freeipa

#9286 memberManager ACIs aren't allowing group-based manager access due to missing upgrade code
Closed: fixed by frenaud. Opened by abbra.

Closed: fixed
Reopen Issue

New installation includes ACIs that allow both memberManager#USERDN and memberManager#GROUPDN access:

# Allow member managers to modify members of user groups
dn: cn=groups,cn=accounts,$SUFFIX
aci: (targetattr = "member")(targetfilter =
"(objectclass=ipaUserGroup)")(version 3.0; acl "Allow member managers
to modify members of user groups"; allow (write) userattr =
"memberManager#USERDN" or userattr = "memberManager#GROUPDN";)
# Allow member managers to modify members of a host group
dn: cn=hostgroups,cn=accounts,$SUFFIX
aci: (targetattr = "member")(targetfilter =
"(objectclass=ipaHostGroup)")(version 3.0; acl "Allow member managers
to modify members of host groups"; allow (write) userattr =
"memberManager#USERDN" or userattr = "memberManager#GROUPDN";)

However, upgrades don't get the GROUPDN part and thus do not allow group-based member managers.

This was reported as https://bugzilla.redhat.com/show_bug.cgi?id=2056009

Metadata Update from @abbra:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2056009

PR: https://github.com/freeipa/freeipa/pull/6565

Metadata Update from @abbra:
- Issue assigned to abbra

master:

  • e1fd9ebb7380c206c1cac2d7b40f78b4581fddf5 updates: fix memberManager ACI to allow managers from a specified group

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2056009, https://bugzilla.redhat.com/show_bug.cgi?id=2148887 (was: https://bugzilla.redhat.com/show_bug.cgi?id=2056009)

ipa-4-10:

  • 42be04fe4ff317efe599dcbc2637f94ecc6fa220 updates: fix memberManager ACI to allow managers from a specified group

ipa-4-9:

  • 651e28c1fb6b86ad1fbd4ea98644e00b7042499c updates: fix memberManager ACI to allow managers from a specified group

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 4acd9fe9f7f0934ff26bbd6254c036341b1dae52 ipatests: Test MemberManager ACI to allow managers from a specified group after upgrade scenario

ipa-4-10:

  • e1f4f655a65777f5096e65b8e5c3e079f77f6ecc ipatests: Test MemberManager ACI to allow managers from a specified group after upgrade scenario

ipa-4-9:

  • 2fb6f0216e7433e0e6459678863edb2a31c90cde ipatests: Test MemberManager ACI to allow managers from a specified group after upgrade scenario
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.