Red Hat Bugzilla – Bug 837357
Attributelevelrights differs in permission-show and permission-mod for the same permission
Last modified: 2013-08-19 10:22:58 EDT
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/2875 For permission with target group set following attributes level rights were sent in: permission_show command: {{{ "attributelevelrights": { "aci": "rscwo", "attrs": "rscwo", "businesscategory": "rscwo", "cn": "rscwo", "description": "rscwo", "filter": "rscwo", "group": "rscwo", "ipapermissiontype": "rscwo", "member": "rscwo", "memberof": "rscwo", "nsaccountlock": "rscwo", "o": "rscwo", "objectclass": "rscwo", "ou": "rscwo", "owner": "rscwo", "permissions": "rscwo", "seealso": "rscwo", "subtree": "rscwo", "targetgroup": "rscwo", "type": "rscwo" }, }}} permission_mod command: {{{ "attributelevelrights": { "aci": "rscwo", "businesscategory": "rscwo", "cn": "rscwo", "description": "rscwo", "ipapermissiontype": "rscwo", "member": "rscwo", "nsaccountlock": "rscwo", "o": "rscwo", "objectclass": "rscwo", "ou": "rscwo", "owner": "rscwo", "seealso": "rscwo" }, }}} commands executed as admin user. Effect: user can't modify target group after mod in Web UI. He have to refresh the page.
This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux.
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development. This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
Please add steps to reproduce this issue
1) (Optional) Add a new permission # ipa permission-add foo --attrs=cn --type=user --permissions=write 2) Show permission with --all and --rights options to display attributelevelrights attribute: # ipa permission-show foo --all --rights dn: cn=foo,cn=permissions,cn=pbac,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com Permission name: foo Permissions: write Attributes: cn Type: user attributelevelrights: {'member': u'rscwo', 'seealso': u'rscwo', 'ipapermissiontype': u'rscwo', 'cn': u'rscwo', 'businesscategory': u'rscwo', 'objectclass': u'rscwo', 'memberof': u'rscwo', 'aci': u'rscwo', 'subtree': u'rscwo', 'o': u'rscwo', 'filter': u'rscwo', 'attrs': u'rscwo', 'owner': u'rscwo', 'group': u'rscwo', 'ou': u'rscwo', 'targetgroup': u'rscwo', 'type': u'rscwo', 'permissions': u'rscwo', 'nsaccountlock': u'rscwo', 'description': u'rscwo'} objectclass: groupofnames, ipapermission, top Make sure that attributelevelrights also contains levelrights for ACI-related attributes, i.e. memberof, subtree, filter, group, ... 3) Run -mod command with these options and check that the ACI-related permissions are there too (won't be before the fix): # ipa permission-mod foo --attrs=cn,uid --all --rights ------------------------- Modified permission "foo" ------------------------- dn: cn=foo,cn=permissions,cn=pbac,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com Permission name: foo Permissions: write Attributes: cn, uid Type: user attributelevelrights: {'ipapermissiontype': u'rscwo', 'cn': u'rscwo', 'businesscategory': u'rscwo', 'objectclass': u'rscwo', 'aci': u'rscwo', 'o': u'rscwo', 'member': u'rscwo', 'owner': u'rscwo', 'ou': u'rscwo', 'seealso': u'rscwo', 'nsaccountlock': u'rscwo', 'description': u'rscwo'} objectclass: groupofnames, ipapermission, top
Fixed upstream. master: 7e9eb9caad731ef3ecb8e733a4979d375ec5a1b5 ipa-3-0: 0cfca2aec9fbf17ab195ed18d52425e43f150930
Verified using ipa-server-3.0.0-8.el6.x86_64 # ipa permission-add APerm --attrs=cn --type=user --permissions=write ------------------------ Added permission "APerm" ------------------------ Permission name: APerm Permissions: write Attributes: cn Type: user # ipa permission-show APerm --all --rights dn: cn=APerm,cn=permissions,cn=pbac,dc=testrelm,dc=com Permission name: APerm Permissions: write Attributes: cn Type: user attributelevelrights: {'member': u'rscwo', 'seealso': u'rscwo', 'ipapermissiontype': u'rscwo', 'cn': u'rscwo', 'businesscategory': u'rscwo', 'objectclass': u'rscwo', 'memberof': u'rscwo', 'aci': u'rscwo', 'subtree': u'rscwo', 'o': u'rscwo', 'filter': u'rscwo', 'attrs': u'rscwo', 'owner': u'rscwo', 'group': u'rscwo', 'ou': u'rscwo', 'targetgroup': u'rscwo', 'type': u'rscwo', 'permissions': u'rscwo', 'nsaccountlock': u'rscwo', 'description': u'rscwo'} objectclass: groupofnames, ipapermission, top # ipa permission-mod APerm --attrs=cn,uid --all --rights --------------------------- Modified permission "APerm" --------------------------- dn: cn=APerm,cn=permissions,cn=pbac,dc=testrelm,dc=com Permission name: APerm Permissions: write Attributes: cn, uid Type: user attributelevelrights: {'member': u'rscwo', 'seealso': u'rscwo', 'ipapermissiontype': u'rscwo', 'cn': u'rscwo', 'businesscategory': u'rscwo', 'objectclass': u'rscwo', 'memberof': u'rscwo', 'aci': u'rscwo', 'subtree': u'rscwo', 'o': u'rscwo', 'filter': u'rscwo', 'attrs': u'rscwo', 'owner': u'rscwo', 'group': u'rscwo', 'ou': u'rscwo', 'targetgroup': u'rscwo', 'type': u'rscwo', 'permissions': u'rscwo', 'nsaccountlock': u'rscwo', 'description': u'rscwo'} objectclass: groupofnames, ipapermission, top
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0528.html