freeipa

#7255 baseidoverride.get_dn() does not default to a default ID view when resolving user IDs
Closed: fixed by rcritten. Opened by abbra.

Closed: fixed
Reopen Issue

In order to be able to add User ID Overrides as members of IPA groups, their objects should be discoverable by LDAPModMember.get_member_dns(). This method calls 'ldap_obj.get_dn(name)', e.g. passing only a single argument.

This breaks baseidoverride.get_dn() which expects at least '(view, name)' as a key and also options with fallback_to_ldap attribute set to either True or False.

baseidoverride.get_dn() implementation needs to be fixed to assume default trust view in case keys contain a single element. It also needs to survive lack of options (default to False).

A fix is something like this:

diff --git a/ipaserver/plugins/idviews.py b/ipaserver/plugins/idviews.py
index a68b03915..7d0bff3c8 100644
--- a/ipaserver/plugins/idviews.py
+++ b/ipaserver/plugins/idviews.py
@@ -715,8 +715,12 @@ class baseidoverride(LDAPObject):
                 self.backend,
                 self.override_object,
                 keys[-1],
-                fallback_to_ldap=options['fallback_to_ldap']
+                fallback_to_ldap=options.get('fallback_to_ldap', False)
             )
+            if (len(keys[:-1]) == 0 and
+                    self.override_object is 'user' and
+                    anchor.startswith(SID_ANCHOR_PREFIX)):
+                keys = (DEFAULT_TRUST_VIEW_NAME, ) + keys
         keys = keys[:-1] + (anchor, )
         return super(baseidoverride, self).get_dn(*keys, **options)
Edited by abbra

Metadata Update from @frenaud:
- Issue set to the milestone: FreeIPA 4.6

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.6.2 (was: FreeIPA 4.6)

Metadata Update from @tdudlak:
- Issue set to the milestone: FreeIPA 4.6.3 (was: FreeIPA 4.6.2)

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.6.4 (was: FreeIPA 4.6.3)

FreeIPA 4.6.3 has been released, moving to FreeIPA 4.6.4 milestone

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.6.5 (was: FreeIPA 4.6.4)

master:

  • 676774d3fb8a0921afd678d5b0bbe30bcb082420 kdb: handle enterprise principal lookup in AS_REQ
  • 28389fe8af3fb2f36e18864668fb167aa8daca99 Add design page for managing IPA resources as a user from a trusted Active Directory forest
  • ecc0a96d161717960058e22eecad43754de06f11 support using trust-related operations in the server console
  • 973e0c04e460c99f601b0292ff9c64dd0882432e idviews: handle unqualified ID override lookups from Web UI
  • bee4204039dac9cd858e823b839183ba2cdbd216 Support adding user ID overrides as group and role members
  • 306304bb7fb35c88d987e8460aacad6cad0ae888 tests: account for ID overrides as members of groups and roles
  • 0ba64b1ac3fa1709c09b30754138946ddc9c2839 Web UI: allow users from trusted Active Directory forest manage IPA
  • 9248d23ae8e8573b6877851c1d1b31878a7bd1d4 ipatests: test that adding Active Directory user to a role makes it an administrator

ipa-4-8:

  • 6abade3f8daed8dfa024936114209d19319c4f12 kdb: handle enterprise principal lookup in AS_REQ
  • afe9191f99e034bcf52475b57996d81609de6837 support using trust-related operations in the server console
  • 2ffb4fd18fceb509773951ce4f02aa0c5e2f851a idviews: handle unqualified ID override lookups from Web UI
  • 8cce2bb31ab96f6ce6edba95f54575576f2b1a40 Support adding user ID overrides as group and role members
  • 5e8df37e4cca155bf58aa4e61b9fa3f28eddd526 tests: account for ID overrides as members of groups and roles
  • 99e613e478f7925d0f470a04d4de5a2f93385b7a Web UI: allow users from trusted Active Directory forest manage IPA
  • 6b0f8f3617378da41ead8640e194e5b9415a38b1 ipatests: test that adding Active Directory user to a role makes it an administrator

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.