Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
Using ipa privilege-remove-permission to remove permissions from the privileges provided - throws an error that it is not a member of the privilege. But doing the same on privileges added by user is successful.
1> Remove the permission "add hbac rule" from privilege "HBAC Administrator"
# ipa privilege-remove-permission --permissions="add hbac rule" "HBAC Administrator"
Privilege name: HBAC Administrator
Description: HBAC Administrator
Permissions: add hbac rule, delete hbac rule, modify hbac rule, manage hbac rule membership, add hbac services, delete hbac services, add hbac service groups, delete hbac service groups, manage hbac service group membership
Granting privilege to roles: IT Security Specialist
Failed members:
permission: add hbac rule: This entry is not a member
-------------------------------
Number of permissions removed 0
-------------------------------
2> The error indicates this permission is not available for privilege, so then attempt to add the permission to privilege "HBAC Administrator"
# ipa privilege-add-permission --permissions="add hbac rule" "HBAC Administrator"
Privilege name: HBAC Administrator
Description: HBAC Administrator
Permissions: add hbac rule, delete hbac rule, modify hbac rule, manage hbac rule membership, add hbac services, delete hbac services, add hbac service groups, delete hbac service groups, manage hbac service group membership
Granting privilege to roles: IT Security Specialist
Failed members:
permission: add hbac rule: Type or value exists:
-----------------------------
Number of permissions added 0
-----------------------------
This is the behaviour with all the privileges provided by IPA. But for a privilege added by user, to which a permission is added, this is not the case:
1> Add a privilege
# ipa privilege-add "Test" --desc="Test"
----------------------
Added privilege "Test"
----------------------
Privilege name: Test
Description: Test
2> Add a permission to this privilege
# ipa privilege-add-permission --permissions="add hbac rule" "Test"
Privilege name: Test
Description: Test
Permissions: add hbac rule
-----------------------------
Number of permissions added 1
-----------------------------
3> Remove this permission for this privilege
# ipa privilege-remove-permission --permissions="add hbac rule" "Test"
Privilege name: Test
Description: Test
-------------------------------
Number of permissions removed 1
-------------------------------
Version-Release number of selected component (if applicable):
ipa-server-2.2.0-102.20120222T1126zgit64dd82f.el6.x86_64
How reproducible:
always
Steps to Reproduce:
1. Remove a permission from a IPA provided privilege (see more detailed steps above)
Actual results:
Throws an error - This entry is not a member
Expected results:
Be able to remove the permission from the privilege
Additional info:
Description of problem: Using ipa privilege-remove-permission to remove permissions from the privileges provided - throws an error that it is not a member of the privilege. But doing the same on privileges added by user is successful. 1> Remove the permission "add hbac rule" from privilege "HBAC Administrator" # ipa privilege-remove-permission --permissions="add hbac rule" "HBAC Administrator" Privilege name: HBAC Administrator Description: HBAC Administrator Permissions: add hbac rule, delete hbac rule, modify hbac rule, manage hbac rule membership, add hbac services, delete hbac services, add hbac service groups, delete hbac service groups, manage hbac service group membership Granting privilege to roles: IT Security Specialist Failed members: permission: add hbac rule: This entry is not a member ------------------------------- Number of permissions removed 0 ------------------------------- 2> The error indicates this permission is not available for privilege, so then attempt to add the permission to privilege "HBAC Administrator" # ipa privilege-add-permission --permissions="add hbac rule" "HBAC Administrator" Privilege name: HBAC Administrator Description: HBAC Administrator Permissions: add hbac rule, delete hbac rule, modify hbac rule, manage hbac rule membership, add hbac services, delete hbac services, add hbac service groups, delete hbac service groups, manage hbac service group membership Granting privilege to roles: IT Security Specialist Failed members: permission: add hbac rule: Type or value exists: ----------------------------- Number of permissions added 0 ----------------------------- This is the behaviour with all the privileges provided by IPA. But for a privilege added by user, to which a permission is added, this is not the case: 1> Add a privilege # ipa privilege-add "Test" --desc="Test" ---------------------- Added privilege "Test" ---------------------- Privilege name: Test Description: Test 2> Add a permission to this privilege # ipa privilege-add-permission --permissions="add hbac rule" "Test" Privilege name: Test Description: Test Permissions: add hbac rule ----------------------------- Number of permissions added 1 ----------------------------- 3> Remove this permission for this privilege # ipa privilege-remove-permission --permissions="add hbac rule" "Test" Privilege name: Test Description: Test ------------------------------- Number of permissions removed 1 ------------------------------- Version-Release number of selected component (if applicable): ipa-server-2.2.0-102.20120222T1126zgit64dd82f.el6.x86_64 How reproducible: always Steps to Reproduce: 1. Remove a permission from a IPA provided privilege (see more detailed steps above) Actual results: Throws an error - This entry is not a member Expected results: Be able to remove the permission from the privilege Additional info: