freeipa

#9200 [Tracker] nightly failure in idoverrideuser-add
Closed: duplicate by frenaud. Opened by amore.

Closed: duplicate
Reopen Issue

Issue

idoverrideuser-add' is failing with error:
ERROR ipatests.pytest_ipa.integration.host.Host.master.cmd124:host.py:201 stderr: ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry 'ipaanchoruuid=:SID:S-1-5-21-2254720287-924841295-3146287821-1107,cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=test'.

Steps to Reproduce

setup steps are as per https://www.freeipa.org/page/V4/Certs_in_ID_overrides/Test_Plan#Test_case:_Manipulate_certificate_in_ID_override_entry
1. ipa idoverrideuser-add 'Default Trust View' testuser@ad.test

Actual behavior

ERROR ipatests.pytest_ipa.integration.host.Host.master.cmd124:host.py:201 stderr: ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry 'ipaanchoruuid=:SID:S-1-5-21-2254720287-924841295-3146287821-1107,cn=Default Trust View,cn=views,cn=accounts,dc=ipa,dc=test'.

Expected behavior

ipa idoverrideuser-add should succeed.

Version/Release/Distribution

The full package list is available here.
389-ds-base-2.1.3-1.fc36.x86_64
sssd-ipa-2.7.3-1.fc36.x86_64
freeipa-server-4.11.0.dev-0.fc36.x86_64

Metadata Update from @amore:
- Issue tagged with: test-failure, tests

Investigation

The test is failing in a call to ipa idoverrideuser-add. The httpd error log shows the command is executed with the principal cifs/master.ipa.test@IPA.TEST:

[Thu Jul 07 11:10:48.114076 2022] [wsgi:error] [pid 20791:tid 21220] [remote 192.168.122.253:53580] ipa: INFO: [jsonserver_kerb] cifs/master.ipa.test@IPA.TEST: idoverrideuser_add/1('Default Trust View', 'testuser@ad.test', version='2.249'): ACIError

The test scenario is the following:
- kinit admin
- install a trust with ipa trust-add
- clear sssd cache, restart sssd
- various certutil operations
- ipa idoverrideuser-add

The call ipa idoverrideuser-add should be done with admin credentials but is using cifs/master.ipa.test@IPA.TEST instead.
The issue is similar to #9198, let's close this one and track all the test failures in #9198.

Metadata Update from @frenaud:
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)
Metadata
None

test-failure tests

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.