freeipa

#7383 user-add: user creation proceeds when password is wrong
Closed: fixed Opened by ftweedal.

Closed: fixed
Reopen Issue

Issue

When adding user via user-add CLI and setting a password, if the passwords do not match
the user creation continues anyway, and the user is unable to log in. It is necessary
for the administrator to subsequently execute ipa passwd to reset the user's password.

Steps to Reproduce

% ipa user-add bob --first Bob --last Baker --password
Password:  foobar
Enter Password again to verify: barfoo
  ** Passwords do not match! **                     
----------------          
Added user "bob"          
----------------          
  User login: bob         
  First name: Bob         
  Last name: Baker        
  Full name: Bob Baker    
  Display name: Bob Baker 
  Initials: BB            
  Home directory: /home/bob                         
  GECOS: Bob Baker        
  Login shell: /bin/sh    
  Principal name: bob@IPA.LOCAL                     
  Principal alias: bob@IPA.LOCAL                    
  Email address: bob@ipa.local                      
  UID: 1398800004         
  GID: 1398800004         
  Password: False         
  Member of groups: ipausers                        
  Kerberos keys available: False
% kinit bob
kinit: Pre-authentication failed: Invalid argument while getting initial credentials

Expected behavior

User creation should NOT proceed when passwords don't match.
Instead, the password prompt should be repeated.

Version/Release/Distribution

master 9c208ea14db34dbadf5cdb1cdabf887105b7ae19

For me Its not proceeding with user creation.
# ipa --version
VERSION: 4.5.0, API_VERSION: 2.228
# ipa user-add bob --first Bob --last Baker --password
Password: foobar
Enter Password again to verify: barfoo
** Passwords do not match! **
Password:

I'm also unable to duplicate.

It is reproducible with master 9c208ea, probably linked to commit 8cb756a2295d046c22a52fb7a51e7a8c17c7f116

Metadata Update from @pvoborni:
- Issue assigned to pvoborni

Metadata Update from @pvoborni:
- Assignee reset
- Issue tagged with: regression

Metadata Update from @rcritten:
- Issue priority set to: critical
- Issue set to the milestone: FreeIPA 4.6.4

https://github.com/freeipa/freeipa/pull/1622

master:

  • 0aaee0a97f5e26903474da10538e464a9f32dba7 Don't return None on mismatched interactive passwords

ipa-4-6:

  • 57ab38fe2a8aa9d1198b493537932a5d063df3f3 Don't return None on mismatched interactive passwords

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

regression

None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.