freeipa

#7570 Create a system permission for access to radius proxy entries
Closed: fixed Opened by frenaud.

Closed: fixed
Reopen Issue

Request for enhancement

As non-admin with privileges allowing to create/modify users and groups, I want to create a user and specify its radius server with ipa user-add|mod ... --radius=

Actual behavior

The command fails looking for the radius server because of ACI issues.

$ ipa user-add nonadmin --first nonadmin --last nonadmin --password
$ ipa role-add-member 'User Administrator' --users=nonadmin
$ ipa radiusproxy-add --desc "My Radius Proxy" --server radius.example.com myradius
$ kinit nonadmin
$ ipa user-add test --first test --last test --radius-username test --radius myradius
ipa: ERROR: no matching entry found

Expected behavior

FreeIPA should define permissions, privileges and roles so that the admin can easily allow another user to define the radius server used by a user.

Metadata Update from @frenaud:
- Issue set to the milestone: FreeIPA 4.6.5

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/2530

master:

  • 19cd9603876845ea068b7fd0778e2f0d5ac4fc70 ipa user-add: add optional objectclass for radius-username
  • 1c2c2ee6f815babc0ac59040e03e3075d7319e59 tests: add xmlrpc test for ipa user-add --radius-username
  • 5d603fce5d87a39c0a12bbed880a286b00128f34 radiusproxy: add permission for reading radius proxy servers
  • da4c12c3e6ac978afc1a365c3aed87eae5832a96 ipatests: add integration test for "Read radius servers" perm

ipa-4-6:

  • d5eabd538642cded497424374bcc32c502a16116 ipa user-add: add optional objectclass for radius-username
  • d6043c7f0450db3b4a36f636acef46f3efe73f50 tests: add xmlrpc test for ipa user-add --radius-username
  • 3f56ae4322de42530c42b043a3254947569c4a29 radiusproxy: add permission for reading radius proxy servers
  • 97133bbf04002e9748357b7ab4c9d8a5eb48e768 ipatests: add integration test for "Read radius servers" perm

ipa-4-7:

  • 79b7f07cf571b4268de91dedd3bcaa899f0aa3fb ipa user-add: add optional objectclass for radius-username
  • 10ccc3bab0b32dc5eaffb91aa280b9a826ba532b tests: add xmlrpc test for ipa user-add --radius-username
  • 22be7b4deaded601ac3a273116e26eb468a360ce radiusproxy: add permission for reading radius proxy servers
  • 918dbdfee7a8ffd5264ea780a4a4c02099db9186 ipatests: add integration test for "Read radius servers" perm

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
https://github.com/freeipa/freeipa/pull/2530
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.