freeipa

#5137 ipa-replica-manage: show an ACI error instead of not found error
Opened by mbasti. Modified

Open
Close Issue

I was kinited as a regular user (I forgot about it).
Then I was getting contradictory results about replicas.
Would be better to show an ACI error instead of not found error. 

[root@vm-218 ~]# ipa-replica-manage list
vm-235.example.com: master
vm-218.example.com: master
[root@vm-218 ~]# ipa-replica-manage list-ruv
No RUV records found.
[root@vm-218 ~]# kdestroy 
[root@vm-218 ~]# kinit admin
Password for admin@EXAMPLE.COM: 
[root@vm-218 ~]# ipa-replica-manage list-ruv
vm-218.example.com:389: 4
vm-235.example.com:389: 7

I don't believe an ACI error is thrown in this case. The bound user simply doesn't have permission to read the entries so nothing is returned.

Perhaps "get effective rights" can/should be used more liberally so an error is returned on this type of read and not 0 entries.

I agree with Rob.

Stretch in 4.3

Not a blocker for 4.3.

Metadata Update from @mbasti:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.5 backlog
Metadata
None
None
None
High
defect
IPA
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.