749352 – users not in ypcat netgroup output

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 749352 - users not in ypcat netgroup output

Summary: users not in ypcat netgroup output

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	ipa
Sub Component:
Version:	6.2
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	---
Assignee:	Rob Crittenden
QA Contact:	IDM QE LIST
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	752757
TreeView+	depends on / blocked

Reported:	2011-10-26 19:04 UTC by Rob Crittenden
Modified:	2011-12-06 18:43 UTC (History)
CC List:	6 users (show)
Fixed In Version:	ipa-2.1.3-9.el6
Doc Type:	Bug Fix
Doc Text:	Cause: Users would not show in ypcat netgroup triples. Consequence: NIS-based authorization would not work as expected. This would result in denying access where it should be allowed. Fix: A syntax error in the triple rule was fixed. Result: Users are now properly included in netgroup triples.
Clone Of:
Environment:
Last Closed:	2011-12-06 18:43:31 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2011:1533	0	normal	SHIPPED_LIVE	Moderate: ipa security and bug fix update	2011-12-06 01:23:31 UTC

Description Rob Crittenden 2011-10-26 19:04:06 UTC

Description of problem:

Users are not showing in ypcat output but they show in cn=compat.

# ipa netgroup-add --desc=ng1 ng1
# ipa netgroup-add-member --users=admin --hosts=dane ng1

# ypcat -k -h dane -d greyoak.com netgroup
ng1 (dane.greyoak.com,-,greyoak.com)

# ldapsearch -LLL -x -b 'cn=ng,cn=compat,dc=greyoak,dc=com'
dn: cn=ng,cn=compat, dc=greyoak,dc=com
objectClass: extensibleObject
cn: ng

dn: cn=ng1,cn=ng,cn=compat,dc=greyoak,dc=com
objectClass: nisNetgroup
objectClass: top
nisNetgroupTriple: (dane.greyoak.com,admin,greyoak.com)
cn: ng1

Adding additional users to the netgroup don't show either:

# ipa netgroup-add-member --users=ttest ng1
  Netgroup name: ng1
  Description: ng1
  NIS domain name: greyoak.com
  Member User: admin, ttest
  Member Host: dane.greyoak.com
-------------------------
Number of members added 1
-------------------------
# ypcat -k -h dane -d greyoak.com netgroup
ng1 (dane.greyoak.com,-,greyoak.com)

#  ldapsearch -LLL -x -b 'cn=ng,cn=compat,dc=greyoak,dc=com'
dn: cn=ng,cn=compat, dc=greyoak,dc=com
objectClass: extensibleObject
cn: ng

dn: cn=ng1,cn=ng,cn=compat,dc=greyoak,dc=com
objectClass: nisNetgroup
objectClass: top
nisNetgroupTriple: (dane.greyoak.com,admin,greyoak.com)
nisNetgroupTriple: (-,ttest,greyoak.com)
cn: ng1

Version-Release number of selected component (if applicable):

ipa-server-2.1.3-4.el6.i686

Comment 1 Rob Crittenden 2011-10-26 20:47:50 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/2028

Comment 2 Martin Kosek 2011-10-27 07:57:40 UTC

Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/4322370942b92c7778a96b6622be95ec8fa1cfda
ipa-2-1: https://fedorahosted.org/freeipa/changeset/c10db54aeedad18e04a18d664687b147043b6bbd

Comment 3 Rob Crittenden 2011-10-28 17:33:45 UTC

Backported patch to RHEL 6.2

Comment 6 Martin Kosek 2011-10-31 15:40:06 UTC

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Do not document

Comment 7 Rob Crittenden 2011-10-31 16:04:13 UTC

    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1 +1,4 @@
-Do not document+Cause: Users would not show in ypcat netgroup triples.
+Consequence: NIS-based authorization would not work as expected. This would result in denying access where it should be allowed.
+Fix: A syntax error in the triple rule was fixed.
+Result: Users are now properly included in netgroup triples.

Comment 8 Gowrishankar Rajaiyan 2011-11-05 07:29:30 UTC

[root@decepticons yp]# ipa netgroup-add --desc=ng1 ng1
--------------------
Added netgroup "ng1"
--------------------
  Netgroup name: ng1
  Description: ng1
  NIS domain name: lab.eng.pnq.redhat.com
  IPA unique ID: c1aa4cb6-0779-11e1-847a-525400f56e2e
[root@decepticons yp]# 

[root@decepticons yp]# ipa netgroup-add-member --users=admin --hosts=decepticons ng1
  Netgroup name: ng1
  Description: ng1
  NIS domain name: lab.eng.pnq.redhat.com
  Member User: admin
  Member Host: decepticons.lab.eng.pnq.redhat.com
-------------------------
Number of members added 2
-------------------------
[root@decepticons yp]#

[root@decepticons ~]# ypcat -k -h decepticons -d lab.eng.pnq.redhat.com netgroup
ng1 (decepticons.lab.eng.pnq.redhat.com,admin,lab.eng.pnq.redhat.com)'
[root@decepticons ~]# 


[root@decepticons ~]# ipa netgroup-add-member --users=ypuser2 --hosts=decepticons ng2
  Netgroup name: ng2
  Description: ng2
  NIS domain name: lab.eng.pnq.redhat.com
  Member User: ypuser2
  Member Host: decepticons.lab.eng.pnq.redhat.com
-------------------------
Number of members added 2
-------------------------
[root@decepticons ~]# 

[root@decepticons ~]# ipa netgroup-add-member --users=ypuser2 --hosts=decepticons ng1
  Netgroup name: ng1
  Description: ng1
  NIS domain name: lab.eng.pnq.redhat.com
  Member User: admin, ypuser2
  Member Host: decepticons.lab.eng.pnq.redhat.com
  Failed hosts/hostgroups: 
    member host: decepticons.lab.eng.pnq.redhat.com: This entry is already a member
-------------------------
Number of members added 1
-------------------------
[root@decepticons ~]# 

[root@decepticons ~]# ldapsearch -LLL -x -b 'cn=ng,cn=compat,dc=lab,dc=eng,dc=pnq,dc=redhat,dc=com'
dn: cn=ng,cn=compat, dc=lab,dc=eng,dc=pnq,dc=redhat,dc=com
objectClass: extensibleObject
cn: ng

dn: cn=ng2,cn=ng,cn=compat,dc=lab,dc=eng,dc=pnq,dc=redhat,dc=com
objectClass: nisNetgroup
objectClass: top
nisNetgroupTriple: (decepticons.lab.eng.pnq.redhat.com,ypuser2,lab.eng.pnq.red
 hat.com)
cn: ng2

dn: cn=ng1,cn=ng,cn=compat,dc=lab,dc=eng,dc=pnq,dc=redhat,dc=com
objectClass: nisNetgroup
objectClass: top
nisNetgroupTriple: (decepticons.lab.eng.pnq.redhat.com,admin,lab.eng.pnq.redha
 t.com)
nisNetgroupTriple: (-,ypuser2,lab.eng.pnq.redhat.com)
cn: ng1

[root@decepticons ~]# 


[root@decepticons ~]# ypcat -k -h decepticons -d lab.eng.pnq.redhat.com netgroup
ng2 (decepticons.lab.eng.pnq.redhat.com,ypuser2,lab.eng.pnq.redhat.com)'
ng1 (decepticons.lab.eng.pnq.redhat.com,admin,lab.eng.pnq.redhat.com) (-,ypuser2,lab.eng.pnq.redhat.com)'
[root@decepticons ~]# 


[root@decepticons ~]# rpm -qi ipa-server | head
Name        : ipa-server                   Relocations: (not relocatable)
Version     : 2.1.3                             Vendor: Red Hat, Inc.
Release     : 8.el6                         Build Date: Wed 02 Nov 2011 03:21:27 AM IST
Install Date: Thu 03 Nov 2011 10:13:53 AM IST      Build Host: x86-012.build.bos.redhat.com
Group       : System Environment/Base       Source RPM: ipa-2.1.3-8.el6.src.rpm
Size        : 3381421                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://www.freeipa.org/
Summary     : The IPA authentication server
[root@decepticons ~]#

Comment 9 Rob Crittenden 2011-11-07 19:53:26 UTC

If you look very closely at the output there is a trailing single quote at the end of each netgroup line.

Re-opening bug.

Comment 10 Rob Crittenden 2011-11-07 20:09:08 UTC

Updated patch to remove extraneous '.

Comment 11 Gowrishankar Rajaiyan 2011-11-08 12:57:36 UTC

[root@decepticons ~]# ypcat -k -h decepticons -d lab.eng.pnq.redhat.com netgroup
ng1 (decepticons.lab.eng.pnq.redhat.com,admin,lab.eng.pnq.redhat.com)


[root@decepticons ~]# ipa netgroup-add-member ng2 --users=shanks --hosts=decepticons
  Netgroup name: ng2
  Description: ng2
  NIS domain name: lab.eng.pnq.redhat.com
  Member User: shanks
  Member Host: decepticons.lab.eng.pnq.redhat.com
-------------------------
Number of members added 2
-------------------------
[root@decepticons ~]# ypcat -k -h decepticons -d lab.eng.pnq.redhat.com netgroup
ng2 (decepticons.lab.eng.pnq.redhat.com,shanks,lab.eng.pnq.redhat.com)
ng1 (decepticons.lab.eng.pnq.redhat.com,admin,lab.eng.pnq.redhat.com)
[root@decepticons ~]# 


[root@decepticons ~]# ipa netgroup-add ng3 --desc=ng3
--------------------
Added netgroup "ng3"
--------------------
  Netgroup name: ng3
  Description: ng3
  NIS domain name: lab.eng.pnq.redhat.com
  IPA unique ID: 074a54b8-0a00-11e1-a907-525400f56e2e
[root@decepticons ~]# ypcat -k -h decepticons -d lab.eng.pnq.redhat.com netgroup
ng3 
ng2 (decepticons.lab.eng.pnq.redhat.com,shanks,lab.eng.pnq.redhat.com)
ng1 (decepticons.lab.eng.pnq.redhat.com,admin,lab.eng.pnq.redhat.com)
[root@decepticons ~]# 


[root@decepticons ~]# ipa netgroup-add-member --users=shanks --hosts=decepticons ng1
  Netgroup name: ng1
  Description: ng1
  NIS domain name: lab.eng.pnq.redhat.com
  Member User: admin, shanks
  Member Host: decepticons.lab.eng.pnq.redhat.com
  Failed hosts/hostgroups: 
    member host: decepticons.lab.eng.pnq.redhat.com: This entry is already a member
-------------------------
Number of members added 1
-------------------------
[root@decepticons ~]# ypcat -k -h decepticons -d lab.eng.pnq.redhat.com netgroup
ng1 (decepticons.lab.eng.pnq.redhat.com,admin,lab.eng.pnq.redhat.com) (-,shanks,lab.eng.pnq.redhat.com)
ng3 
ng2 (decepticons.lab.eng.pnq.redhat.com,shanks,lab.eng.pnq.redhat.com)
[root@decepticons ~]# 

[root@decepticons ~]# ipa group-add-member biggroup1 
[member user]: biguser1
[member group]: 
  Group name: biggroup1
  Description: bg1
  GID: 896600005
  Member users: biguser1
  Member of groups: biggroup
  Indirect Member of netgroup: ng3
-------------------------
Number of members added 1
-------------------------
[root@decepticons ~]# ypcat -k -h decepticons -d lab.eng.pnq.redhat.com netgroup
ng3 (decepticons.lab.eng.pnq.redhat.com,biguser1,lab.eng.pnq.redhat.com)
ng1 (decepticons.lab.eng.pnq.redhat.com,admin,lab.eng.pnq.redhat.com) (-,shanks,lab.eng.pnq.redhat.com)
ng2 (decepticons.lab.eng.pnq.redhat.com,shanks,lab.eng.pnq.redhat.com)
[root@decepticons ~]# 


Trailing single quote no longer exists.

[root@decepticons ~]# rpm -qi ipa-server | head
Name        : ipa-server                   Relocations: (not relocatable)
Version     : 2.1.3                             Vendor: Red Hat, Inc.
Release     : 9.el6                         Build Date: Tue 08 Nov 2011 01:30:54 AM IST
Install Date: Tue 08 Nov 2011 11:14:36 AM IST      Build Host: x86-001.build.bos.redhat.com
Group       : System Environment/Base       Source RPM: ipa-2.1.3-9.el6.src.rpm
Size        : 3382131                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://www.freeipa.org/
Summary     : The IPA authentication server
[root@decepticons ~]#

Comment 12 errata-xmlrpc 2011-12-06 18:43:31 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1533.html

Note You need to log in before you can comment on or make changes to this bug.