Hide Forgot
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/2417 There is a test in roles to verify that escaping commas works as expected. It is failing, as demonstrated by: {{{ $ ipa role-add-privilege --privileges="u,r stuff" test Role name: test Description: test Failed members: privilege: u: privilege not found privilege: r stuff: privilege not found ---------------------------- Number of privileges added 0 ---------------------------- }}}
Fixed upstream: master: dddebe23507749486fb09d219f0da4f483ba4e79 ipa-2-2: 3738a611a678e6c23be38dacbad8955299cbe5bb Note for testing: The correct command is: ipa role-add-privilege --privileges='"u,r stuff"' test The double quotes are for the CSV parser. Single quotes are needed so the shell doesn't interpret the double ones.
Verified using ipa-server-2.2.0-8.el6.x86_64 # ipa role-add-privilege --privileges='"u, r stuff"' test Role name: test Description: test Privileges: u, r stuff ---------------------------- Number of privileges added 1 ---------------------------- Also verified in UI.
1. Adding 2 comma separated privileges [root@wheeljack ~]# ipa role-add-privilege --privileges="u,r stuff" test Role name: test Description: Test Role Privileges: u, r stuff ---------------------------- Number of privileges added 2 ---------------------------- [root@wheeljack ~]# ipa role-remove-privilege --privileges="u,r stuff" test Role name: test Description: Test Role ------------------------------ Number of privileges removed 2 ------------------------------ 2. Adding a privilege having comma as part of the privilege name [root@wheeljack ~]# ipa privilege-add 'u,r stuff' Description: privilege with comma --------------------------- Added privilege "u,r stuff" --------------------------- Privilege name: u,r stuff Description: privilege with comma [root@wheeljack ~]# ipa role-add-privilege --privileges='"u,r stuff"' test Role name: test Description: Test Role Privileges: u,r stuff ---------------------------- Number of privileges added 1 ---------------------------- Both above cases work as expected. Verified in version ipa-server-2.2.0-8.el6.x86_64
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Cause: Comma separated values (CSV) were splitted both in CLI part of IPA processing and the server part too. Consequence: Potential comma escaping was not recognized on the server because the escaping already got lost in client CSV processing. This lead to issues with values with comma included. Fix: CSV processing is done only in client interface. IPA server RPC interfaces (both XML-RPC and JSON-RPC) no longer process CSV values, it now expects either a scalar value or a list of scalar values. Comma escaping is replaced with quoting. Result: User can now pass quoted values with embedded commas to IPA CLI interface to avoid CSV split and thus properly pass the value with a comma to IPA server processing.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0819.html