Issue #8990: ipa group-mod should fail properly with --posix and --external options - freeipa

freeipa

#8990 ipa group-mod should fail properly with --posix and --external options

Closed: fixed Jun 2, 2023 by rcritten. Opened Sep 13, 2021 by twoerner.

Issue

ipa group-mod is not failing properly if --posix and --external are given.

Steps to Reproduce

ipa group-add testgroup --nonposix
ipa group-mod testgroup --posix --external

Actual behavior

ipa: ERROR: attribute "gidNumber" not allowed
It is good that this is failing, bit the error message is bad.

Expected behavior

An error that posix can not be used together with external.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.9.6-2.fc34.x86_64
freeipa-client-4.9.6-2.fc34.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-2.0.5-1.fc34.x86_64
pki-ca-10.10.6-1.fc34.noarch
krb5-server-1.19.1-3.fc34.x86_64

Additional info:

Having posix and external as mutually exclusive would also solve this:
$ ipa group-add testgroup
$ ipa group-mod testgroup --posix --external
ipa: ERROR: This is already a posix group

twoerner commented Sep 13, 2021

This combination does also not make a lot of sense:
$ ipa group-add testgroup --nonposix --external

Metadata Update from @rcritten:
- Issue assigned to rcritten

May 24, 2023

rcritten commented May 24, 2023

I agree that $ ipa group-add testgroup --nonposix --external doesn't make sense since --nonposix is implied but it doesn't hurt anything. Returning an error wouldn't be helpful to the user because the end result is still a nonposix group (the option is basically ignored). I feel like it would be a gotcha.

rcritten commented May 24, 2023

PR https://github.com/freeipa/freeipa/pull/6855

frenaud commented May 31, 2023

master: