Hide Forgot
Description of problem: Version-Release number of selected component (if applicable): ipa-server-2.1.3-8.el6.x86_64 How reproducible: Steps to Reproduce: 1. [root@decepticons ~]# ipa privilege-find "User Administrators" ------------------- 1 privilege matched ------------------- Privilege name: User Administrators Description: User Administrators Permissions: add users, change a user password, add user to default group, unlock user accounts, remove users, modify users Granting privilege to roles: User Administrator ---------------------------- Number of entries returned 1 ---------------------------- [root@decepticons ~]# 2. [root@decepticons ~]# ipa privilege-find "Sudo Administrator" ------------------- 1 privilege matched ------------------- Privilege name: Sudo Administrator Description: Sudo Administrator Granting privilege to roles: IT Security Specialist ---------------------------- Number of entries returned 1 ---------------------------- [root@decepticons ~]# 3. Actual results: Sudo Administrator Role exists with no permissions assigned No Sudo permissions Expected results: Default Sudo permissions exist Sudo Administrator Role has the expected permissions assigned Additional info:
This is the same root cause as in Bug 751029. I will target this for 6.3.0. # ipa permission-find sudo --all --------------------- 9 permissions matched --------------------- dn: cn=add sudo command,cn=permissions,cn=pbac,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com Permission name: Add Sudo command Permissions: add Subtree: ldap:///sudocmd=*,cn=sudocmds,cn=sudo,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com Granted to Privilege: Sudo Administrator <<<<<<< objectclass: groupofnames, ipapermission, top dn: cn=add sudo command group,cn=permissions,cn=pbac,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com Permission name: Add Sudo command group Permissions: add Subtree: ldap:///cn=*,cn=sudocmdgroups,cn=sudo,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com Granted to Privilege: Sudo Administrator <<<<<<< objectclass: groupofnames, ipapermission, top ...
Upstream ticket: https://fedorahosted.org/freeipa/ticket/2060
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/373e9d1cf8b6539149e50b02655bdc7e931d7bf6 ipa-2-1: https://fedorahosted.org/freeipa/changeset/6d984172afd16492ec220c3f36b51a6314808fd1
verified: # ipa permission-find sudo --all --------------------- 9 permissions matched --------------------- dn: cn=add sudo command,cn=permissions,cn=pbac,dc=testrelm,dc=com Permission name: Add Sudo command Permissions: add Subtree: ldap:///sudocmd=*,cn=sudocmds,cn=sudo,dc=testrelm,dc=com Granted to Privilege: Sudo Administrator memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com objectclass: groupofnames, ipapermission, top dn: cn=add sudo command group,cn=permissions,cn=pbac,dc=testrelm,dc=com Permission name: Add Sudo command group Permissions: add Subtree: ldap:///cn=*,cn=sudocmdgroups,cn=sudo,dc=testrelm,dc=com Granted to Privilege: Sudo Administrator memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com objectclass: groupofnames, ipapermission, top dn: cn=add sudo rule,cn=permissions,cn=pbac,dc=testrelm,dc=com Permission name: Add Sudo rule Permissions: add Subtree: ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,dc=testrelm,dc=com Granted to Privilege: Sudo Administrator memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com objectclass: groupofnames, ipapermission, top dn: cn=delete sudo command,cn=permissions,cn=pbac,dc=testrelm,dc=com Permission name: Delete Sudo command Permissions: delete Subtree: ldap:///sudocmd=*,cn=sudocmds,cn=sudo,dc=testrelm,dc=com Granted to Privilege: Sudo Administrator memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com objectclass: groupofnames, ipapermission, top dn: cn=delete sudo command group,cn=permissions,cn=pbac,dc=testrelm,dc=com Permission name: Delete Sudo command group Permissions: delete Subtree: ldap:///cn=*,cn=sudocmdgroups,cn=sudo,dc=testrelm,dc=com Granted to Privilege: Sudo Administrator memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com objectclass: groupofnames, ipapermission, top dn: cn=delete sudo rule,cn=permissions,cn=pbac,dc=testrelm,dc=com Permission name: Delete Sudo rule Permissions: delete Subtree: ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,dc=testrelm,dc=com Granted to Privilege: Sudo Administrator memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com objectclass: groupofnames, ipapermission, top dn: cn=manage sudo command group membership,cn=permissions,cn=pbac,dc=testrelm,dc=com Permission name: Manage Sudo command group membership Permissions: write Attributes: member Subtree: ldap:///cn=*,cn=sudocmdgroups,cn=sudo,dc=testrelm,dc=com Granted to Privilege: Sudo Administrator memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com objectclass: groupofnames, ipapermission, top dn: cn=modify sudo command,cn=permissions,cn=pbac,dc=testrelm,dc=com Permission name: Modify Sudo command Permissions: write Attributes: description Subtree: ldap:///sudocmd=*,cn=sudocmds,cn=sudo,dc=testrelm,dc=com Granted to Privilege: Sudo Administrator memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com objectclass: groupofnames, ipapermission, top dn: cn=modify sudo rule,cn=permissions,cn=pbac,dc=testrelm,dc=com Permission name: Modify Sudo rule Permissions: write Attributes: description, ipaenabledflag, usercategory, hostcategory, cmdcategory, ipasudorunasusercategory, ipasudorunasgroupcategory, externaluser, ipasudorunasextuser, ipasudorunasextgroup, memberdenycmd, memberallowcmd, memberuser Subtree: ldap:///ipauniqueid=*,cn=sudorules,cn=sudo,dc=testrelm,dc=com Granted to Privilege: Sudo Administrator memberindirect: cn=sudo administrator,cn=privileges,cn=pbac,dc=testrelm,dc=com, cn=it security specialist,cn=roles,cn=accounts,dc=testrelm,dc=com objectclass: groupofnames, ipapermission, top ---------------------------- Number of entries returned 9 ---------------------------- version: ipa-server-2.2.0-9.el6.x86_64
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: No documentation needed.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0819.html