freeipa

#8443 ipa delegation-add can add permissions and attributes several times
Closed: fixed by rcritten. Opened by twoerner.

Closed: fixed
Reopen Issue

Issue

ipa delegation-add can add same permissions and attributes several times

Steps to Reproduce

  1. ipa group-add managers
  2. ipa group-add employees
  3. ipa delegation-add "basic manager attributes" --permissions=read --permissions=read --permissions=read --attrs=businesscategory --attrs=departmentnumber --attrs=employeetype --attrs=employeenumber --attrs=employeenumber --attrs=employeenumber --attrs=employeenumber --group=managers --membergroup=employees

Actual behavior

Entries in permissions and attributes are not unique:

-------------------------------------------
Added delegation "basic manager attributes"
-------------------------------------------
  Delegation name: basic manager attributes
  Permissions: read, read, read
  Attributes: businesscategory, departmentnumber, employeetype, employeenumber,
              employeenumber, employeenumber, employeenumber
  Member user group: employees
  User group: managers

Expected behavior

Failure

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
ipa-server-4.8.7-7.module+el8.3.0+7376+c83e4fcd.x86_64
ipa-client-4.8.7-7.module+el8.3.0+7376+c83e4fcd.x86_64
389-ds-base-1.4.3.8-4.module+el8.3.0+7193+dfd1e8ad.x86_64
pki-ca-10.9.0-0.7.module+el8.3.0+7364+90640274.noarch
krb5-server-1.18.2-4.el8.x86_64

Additional Information

ipa delegation-mod is behaving differently. It is not possible to make the permissions and attributes items unique after the -add call in the reproducer has been used:

$ ipa delegation-mod "basic manager attributes" --permissions=read --attrs=businesscategory --attrs=departmentnumber --attrs=employeetype --attrs=employeenumber --group=managers --membergroup=employees
ipa: ERROR: no modifications to be performed

Metadata Update from @rcritten:
- Issue assigned to rcritten

I think we just need to convert the values into a set and allow the ACI class to handle sets as iterables.

https://github.com/freeipa/freeipa/pull/5094

Ended up not using a set() because it doesn't guarantee order which makes the xmlrpc tests more difficult than they need to be. We don't need a true set(), just de-duplication, so I added a simple iterator to de-duplicate things.

master:

  • cdf830af189ceac4b0e8606fb3b538d17d90aaf6 De-duplicate ACI attributes and permissions
  • 2656c4687b09f8eb2fe847e5e9901df1dbb3335e Use ACI class set_permissions() method to set permissions
  • 2e4431af7066ce298008973b6caddc170645c98d ipatests: Add test for ACI attribute and permission uniqueness

ipa-4-8:

  • 4e5ba24bcf99daa4764b43093ff6a6dbcde52485 De-duplicate ACI attributes and permissions
  • 939a72f47c4f9ddd55fd703fbe26dad847ab8d1e Use ACI class set_permissions() method to set permissions
  • a572df9616c1da69611ed5a172fd638011ba161f ipatests: Add test for ACI attribute and permission uniqueness

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.