Red Hat Bugzilla – Bug 781208
ipa user-find --manager does not find matches
Last modified: 2013-02-21 04:09:04 EST
Description of problem: Cannot search user list by manager name using user-find --manager. More in Additional Info section. Version-Release number of selected component (if applicable): This test was run on Fedora 16 with latest(?) freeipa rpms. # rpm -qa|grep freeipa freeipa-server-2.1.4-3.fc16.x86_64 freeipa-client-2.1.4-3.fc16.x86_64 freeipa-admintools-2.1.4-3.fc16.x86_64 freeipa-python-2.1.4-3.fc16.x86_64 freeipa-server-selinux-2.1.4-3.fc16.x86_64 How reproducible: always? Steps to Reproduce: 1. ipa user-add --first=first --last=last testmanager 2. ipa user-add --first=first --last=last testuser 3. ipa user-mod testuser --manager=testmanager <should see "Manager: testmanager" in output here> 4. ipa user-find testuser --manager=testmanager Actual results: # ipa user-find testuser --manager=testmanager --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- Expected results: Should return 1 match for testuser. Additional info: I'm not sure if this is intentional or even matters here but, thought I would note also that in my testing the following seems to match all users: ipa user-find --manager="" Full (sanitized) output from failure tests below: # ipa user-add --first=first --last=last testmanager ------------------------ Added user "testmanager" ------------------------ User login: testmanager First name: first Last name: last Full name: first last Display name: first last Initials: fl Home directory: /home/testmanager GECOS field: first last Login shell: /bin/sh Kerberos principal: testmanager@TESTRELM UID: 1798000033 GID: 1798000033 Keytab: False Password: False # ipa user-add --first=first --last=last testuser --------------------- Added user "testuser" --------------------- User login: testuser First name: first Last name: last Full name: first last Display name: first last Initials: fl Home directory: /home/testuser GECOS field: first last Login shell: /bin/sh Kerberos principal: testuser@TESTRELM UID: 1798000034 GID: 1798000034 Keytab: False Password: False # ipa user-mod testuser --manager=testmanager ------------------------ Modified user "testuser" ------------------------ User login: testuser First name: first Last name: last Home directory: /home/testuser Login shell: /bin/sh UID: 1798000034 GID: 1798000034 Manager: testmanager Account disabled: False Keytab: False Password: False Member of groups: ipausers # ipa user-find testuser --manager=testmanager --------------- 0 users matched --------------- ---------------------------- Number of entries returned 0 ----------------------------
Hey Scott: The default user search attributes do not include manager. # ipa config-show Max. username length: 32 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain for new users: testrelm Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title <=============== Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=TESTRELM Password Expiration Notification (days): 4 You could modify this and check that the user is found if the search attributes include manager. # ipa config-mod --usersearch="uid,givenname,sn,telephonenumber,ou,title,manager" Max. username length: 32 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain for new users: testrelm Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title,manager Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=TESTRELM Password Expiration Notification (days): 4
No, the problem is that the data is stored as a DN and we are not converting the manager value into a DN before creating the filter. In this case we do a query like this: (&(objectClass=posixaccount)(manager=testmanager)) We need to convert the incoming manager value into a DN before creating the search filter. As a demonstration, this will work (but is unwieldy): ipa user-find testuser --manager="uid=testmanager,cn=users,cn=accounts,dc=testrelm" When no options are provided to a find then the default search fields are used. When some criteria is provided we use only that.
Got it ... bug :-)
Upstream ticket: https://fedorahosted.org/freeipa/ticket/2264
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/557b2605503738f25d9c89e8b51d1832b24d5636 ipa-3-0: https://fedorahosted.org/freeipa/changeset/cbfe062a5cbe44d346754c5cb2643bbb23b375d7
Verified. Version :: [root@vm1 quickinstall]# rpm -q ipa-server ipa-server-3.0.0-2.el6.x86_64 Manual Test Results :: [root@vm1 quickinstall]# ipa user-add --first=first --last=last testmanager ------------------------ Added user "testmanager" ------------------------ User login: testmanager First name: first Last name: last Full name: first last Display name: first last Initials: fl Home directory: /home/testmanager GECOS field: first last Login shell: /bin/sh Kerberos principal: testmanager@TESTRELM.COM Email address: testmanager@testrelm.com UID: 378000001 GID: 378000001 Password: False Kerberos keys available: False [root@vm1 quickinstall]# ipa user-add --first=first --last=last testuser --------------------- Added user "testuser" --------------------- User login: testuser First name: first Last name: last Full name: first last Display name: first last Initials: fl Home directory: /home/testuser GECOS field: first last Login shell: /bin/sh Kerberos principal: testuser@TESTRELM.COM Email address: testuser@testrelm.com UID: 378000003 GID: 378000003 Password: False Kerberos keys available: False [root@vm1 quickinstall]# ipa user-mod testuser --manager=testmanager ------------------------ Modified user "testuser" ------------------------ User login: testuser First name: first Last name: last Home directory: /home/testuser Login shell: /bin/sh Email address: testuser@testrelm.com UID: 378000003 GID: 378000003 Manager: testmanager Account disabled: False Password: False Member of groups: ipausers Kerberos keys available: False [root@vm1 quickinstall]# ipa user-find testuser --manager=testmanager -------------- 1 user matched -------------- User login: testuser First name: first Last name: last Home directory: /home/testuser Login shell: /bin/sh Email address: testuser@testrelm.com UID: 378000003 GID: 378000003 Manager: testmanager Account disabled: False Password: False Kerberos keys available: False ---------------------------- Number of entries returned 1 ----------------------------
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0528.html