freeipa

#9875 The permission with 'System: Modify System Accounts' fails to modify the description.
Closed: fixed by frenaud. Opened by amore.

Closed: fixed
Reopen Issue

IPA user with the role Security Architect fails to modify a system account's description.
version : freeipa-server-4.13.0.dev202511071453+gitbd8288476-0.fc42.x86_64
Steps to reproduce:
- Add ipauser in role 'Security Architect'
- kdestroy -A ; kinit ipauser
- ipa sysaccount-add test-sysaccount --random
- ipa sysaccount-mod test-sysaccount --desc="Modified by IPA user" 

[root@master1 ~]# ipa role-add-member
Role name: Security Architect
[member user]: anna
[member group]: 
[member host]: 
[member host group]: 
[member service]: 
[member User ID override]: 
[member system account]: 
  Role name: Security Architect
  Description: Security Architect
  Member users: anna
  Privileges: Delegation Administrator, Replication Administrators, System Accounts Administrators, Write IPA Configuration, Password Policy Administrator
-------------------------
Number of members added 1
-------------------------
[root@master1 ~]# kdestroy -A ; echo Secret123 | kinit anna
Password for anna@IPADOMAIN1.TEST: 
[root@master1 ~]# ipa sysaccount-add test-sysaccount-2 --random
----------------------------------------
Added system account "test-sysaccount-2"
----------------------------------------
  Privileged: False
  System account ID: test-sysaccount-2
  Random password: 9Da+<1EQ@qGtchA[Mob,[m
[root@master1 ~]# 
[root@master1 ~]# ipa sysaccount-find test-sysaccount-testing --all
------------------------
1 system account matched
------------------------
  dn: uid=test-sysaccount-testing,cn=sysaccounts,cn=etc,dc=ipadomain1,dc=test
  System account ID: test-sysaccount-testing
  Password: True
  objectclass: account, simplesecurityobject, top
  privileged: False
----------------------------
Number of entries returned 1
----------------------------
[root@master1 ~]# ipa sysaccount-mod test-sysaccount-testing --desc="testingggjytdjytdjytjy"
ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the 'description' attribute of entry 'uid=test-sysaccount-testing,cn=sysaccounts,cn=etc,dc=ipadomain1,dc=test'.

Also observed issue in sysaccount-enable and disable for user with member of Security Architect

[root@master1 ~]# kdestroy -A ; echo Secret123 | kinit admin ; ipa sysaccount-show test-sysact-disable
Password for admin@IPADOMAIN1.TEST: 
  System account ID: test-sysact-disable
  Password: True
[root@master1 ~]# kdestroy -A ; echo Secret123 | kinit anna ; ipa sysaccount-show test-sysact-disable
Password for anna@IPADOMAIN1.TEST: 
  System account ID: test-sysact-disable
  Password: True
[root@master1 ~]# kdestroy -A ; echo Secret123 | kinit anna ; ipa sysaccount-enable "test-sysact-disable"
Password for anna@IPADOMAIN1.TEST: 
ipa: ERROR: This entry is already enabled
[root@master1 ~]# kdestroy -A ; echo Secret123 | kinit anna ; ipa sysaccount-disable "test-sysact-disable"
Password for anna@IPADOMAIN1.TEST: 
ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the 'nsAccountLock' attribute of entry 'uid=test-sysact-disable,cn=sysaccounts,cn=etc,dc=ipadomain1,dc=test'.
[root@master1 ~]# 
[root@master1 ~]# kdestroy -A ; echo Secret123 | kinit admin ; ipa sysaccount-disable "test-sysact-disable"
Password for admin@IPADOMAIN1.TEST: 
---------------------------------------------
Disabled system account "test-sysact-disable"
---------------------------------------------
[root@master1 ~]# kdestroy -A ; echo Secret123 | kinit anna ; ipa sysaccount-enable "test-sysact-disable"
Password for anna@IPADOMAIN1.TEST: 
ipa: ERROR: This entry is already enabled
[root@master1 ~]#

PR: https://github.com/freeipa/freeipa/pull/8017

Metadata Update from @abbra:
- Issue assigned to abbra

master:

  • ec22295fede3f1c71b6111e4d36a7386080cf39e sysaccounts: extend permissions to include description and account lock

ipa-4-12:

  • 5e87614ef408cfa89093bc2186242f1b99c0b251 sysaccounts: extend permissions to include description and account lock

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.