Hide Forgot
Description of problem: ipa permission-add works if --memberof group entry does not exist. It should fail in this scenario like it does when group entry does not exist. 1> There is no group - xyz # ipa group-find xyz ---------------- 0 groups matched ---------------- ---------------------------- Number of entries returned 0 ---------------------------- 2> Add a permission, and specify memberof to be the above mentioned group: # ipa permission-add ManageHost --permissions="write" --subtree=cn=computers,cn=accounts,dc=testrelm,dc=com --memberof=xyz ----------------------------- Added permission "ManageHost" ----------------------------- Permission name: ManageHost Permissions: write Member of group: xyz Subtree: ldap:///cn=computers,cn=accounts,dc=testrelm,dc=com Version-Release number of selected component (if applicable): ipa-server-2.2.0-101.20120117T0229zgit5febffb.el6.x86_64 How reproducible: always Steps to Reproduce: 1. As mentioned above Actual results: permission is added Expected results: the group should not be allowed to be specified, since it does not exit yet. Additional info: There is bug 783307 for delegation displaying same behaviour
Upstream ticket: https://fedorahosted.org/freeipa/ticket/2305
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/616d543a54833a1fde6b0098d91ac0f4e14f7a57 ipa-2-2: https://fedorahosted.org/freeipa/changeset/93a1a3805369048f87e4328f421e156c8ebac07f
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: No documentation needed.
Verified using ipa-server-2.2.0-11.el6.x86_64 Executing: ipa permission-add ManageHost --permissions="write" --subtree=cn=computers,cn=accounts,dc=testrelm,dc=com --attr=nshostlocation --memberof=nonexistentgroup ipa: ERROR: nonexistentgroup: group not found :: [09:50:19] :: There was an error adding ManageHost
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0819.html