freeipa

#8335 [WebUI] manage IPA resources as a user from a trusted Active Directory domain
Closed: fixed by rcritten. Opened by stsymbal.

Closed: fixed
Reopen Issue

Description of problem:

In Webui showing "IPA Error 3007: RequirmentError" while adding members in "User ID overrides" tab

How reproducible:
100%

Steps to Reproduce:
1. Setup ipa-server
2. Setup AD trust
3. Add Trust Domain, Go to Identity > IPA Server > Trusts > Trusts > Add
4. Create ID override for AD user, Go to Identity > ID View > click "Default Trust View"
5. Click "Add" button on the right-hand side
6. ADD ADuser@addomain in "user to override" field
7. Hit "Add"
8. Add AD user to admin group, Go to Identity > Groups > click "admins"
9. Now Click "User ID overrides" tab (next to "External" tab)
10. Then click "Add" button.

Actual results:
"IPA Error 3007: RequirmentError" Error dialog pops up.

Expected results:
Should pop up ADD dialog.

master:

  • 676774d3fb8a0921afd678d5b0bbe30bcb082420 kdb: handle enterprise principal lookup in AS_REQ
  • 28389fe8af3fb2f36e18864668fb167aa8daca99 Add design page for managing IPA resources as a user from a trusted Active Directory forest
  • ecc0a96d161717960058e22eecad43754de06f11 support using trust-related operations in the server console
  • 973e0c04e460c99f601b0292ff9c64dd0882432e idviews: handle unqualified ID override lookups from Web UI
  • bee4204039dac9cd858e823b839183ba2cdbd216 Support adding user ID overrides as group and role members
  • 306304bb7fb35c88d987e8460aacad6cad0ae888 tests: account for ID overrides as members of groups and roles
  • 0ba64b1ac3fa1709c09b30754138946ddc9c2839 Web UI: allow users from trusted Active Directory forest manage IPA
  • 9248d23ae8e8573b6877851c1d1b31878a7bd1d4 ipatests: test that adding Active Directory user to a role makes it an administrator

ipa-4-8:

  • 6abade3f8daed8dfa024936114209d19319c4f12 kdb: handle enterprise principal lookup in AS_REQ
  • afe9191f99e034bcf52475b57996d81609de6837 support using trust-related operations in the server console
  • 2ffb4fd18fceb509773951ce4f02aa0c5e2f851a idviews: handle unqualified ID override lookups from Web UI
  • 8cce2bb31ab96f6ce6edba95f54575576f2b1a40 Support adding user ID overrides as group and role members
  • 5e8df37e4cca155bf58aa4e61b9fa3f28eddd526 tests: account for ID overrides as members of groups and roles
  • 99e613e478f7925d0f470a04d4de5a2f93385b7a Web UI: allow users from trusted Active Directory forest manage IPA
  • 6b0f8f3617378da41ead8640e194e5b9415a38b1 ipatests: test that adding Active Directory user to a role makes it an administrator

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to It is now possible to manage IPA resources as a user from a trusted Active Directory domain.
- Issue assigned to abbra (was: stsymbal)

Metadata Update from @abbra:
- Custom field changelog adjusted to When users from trusted Active Directory domains have permissions to manage IPA resources, they can do so through a Web UI management console. (was: It is now possible to manage IPA resources as a user from a trusted Active Directory domain.)

master:

  • c2ba333b9681d008d9c528a79dbdd76ce11a3ecd WebUI: Fix "IPA Error 3007: RequirmentError" while adding idoverrideuser association

ipa-4-8:

  • ffe7f7b35907f9adab004ce63ce78f67fbd7aed8 WebUI: Fix "IPA Error 3007: RequirmentError" while adding idoverrideuser association
Metadata

webui

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.