freeipa

#6614 ipa group-add-member --external asks interactively for missing members/groups
Closed: Invalid Opened by mbabinsk.

Closed: Invalid
Reopen Issue

FreeIPA version: freeipa-server-4.4.3-1.fc25.x86_64

When manipulating membership of external groups group-add command seems to skip --external option when deciding whether to prompt for users/groups to add to the group. This causes a minor UX inconvenience as you have to go through interactive prompt even if you do not want to add any other members.

Steps to reproduce:

1.) install IPA server and establish trust with AD forest

2.) create a group allowing external users as members

# ipa group-add --external trust_users

3.) add an AD user to the group

# ipa group-add-member trust_users --external ADREALM\\testuser

Expected outcome:

Command completes successfully without prompting for members

Actual outcome:

The command keeps asking for members/groups but otherwise completes successfully:

# ipa group-add-member trust_users --external ADREALM\\testuser
[member user]: 
[member group]: 
  Group name: trust_users
  External member: S-1-5-21-3607537816-595259299-2709812834-1125
-------------------------
Number of members added 1
-------------------------

This is not a bug as the group can have both external and normal members. Use 'ipa -n' to get rid of the prompts if they aren't needed:

# ipa -n group-add-member my-external-users --external domain\ users@ad2016.test
  Group name: my-external-users
  External member: S-1-5-21-920843393-3978028112-2766342605-500, S-1-5-21-920843393-3978028112-2766342605-513
  Member of HBAC rule: access-for-webfarm
-------------------------
Number of members added 1
-------------------------

Metadata Update from @mbabinsk:
- Issue assigned to someone
- Issue set to the milestone: 0.0 NEEDS_TRIAGE

Hi,

Someone has put me onto this issue as it's causing them some confusion.

I think this should be reopened as it is a UX issue.

Adding -n isn't really an option. Because you have satisfied that you are adding a member (regardless of internal or external location of the member), then no prompt is required.

The UX should be:

  • If no members, interactive.
  • If any members are requested (internal or external), do not use interactive mode
  • If both internal and external are added, do not use interactive mode.

These little details may not seem important, but they improve the experience of admins, they make us look professional, and it eases confusion to our consumers,

Thanks!
Metadata
None
None
None
Normal
None
defect
IPA
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.