freeipa

#8236 Enforce a check to prevent adding objects from IPA as external members of external groups
Closed: fixed by abbra. Opened by abbra.

Closed: fixed
Reopen Issue

The purpose of external groups in FreeIPA is to be able to reference objects only existing in trusted domains. These members get resolved through SSSD interfaces but there is nothing that prevents SSSD from resolving any IPA user or group if they have security identifiers
associated.

Enforce a check that a SID returned by SSSD does not belong to IPA domain and raise a validation error if this is the case. This would prevent adding IPA users or groups as external members of an external group.

Metadata Update from @abbra:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1809835

PR: https://github.com/freeipa/freeipa/pull/4374

master:

  • 2997a74abcfdb0ad1c0b5356949e557c3b624d3c Prevent adding IPA objects as external members of external groups

ipa-4-8:

  • 127b8d9cf23bf65aa42e6ee9ed8d7f8628bbac19 Prevent adding IPA objects as external members of external groups

ipa-4-7:

  • 5a2f27fe036d61415a128b650d6750e2c2048b4b Prevent adding IPA objects as external members of external groups

ipa-4-6:

  • c14e385141ea05f2709364b6f0fca844578a7652 Prevent adding IPA objects as external members of external groups

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • c1c45df4b25ea2a96a2b5fe59e3d7edf4303c04e ipatests: always skip additional input for group-add-member --external

ipa-4-7:

  • 935c356dace23a60be8a0fba4ac482eeccb95948 ipatests: always skip additional input for group-add-member --external

ipa-4-8:

  • 74f36e7c2f7f6d17b56e06b5f05205edb8a286d7 ipatests: always skip additional input for group-add-member --external

ipa-4-6:

bce5097 ipatests: fix KeyError in test_sssd
7b9cdfb ipatests: fix group-add-member in test_sssd

ipa-4-6:

  • bce50976ca5363e2097171b36a0d9a5df652a988 ipatests: fix KeyError in test_sssd
  • 7b9cdfb2556bd290d5f18b0680a1cf907b4dff0c ipatests: fix group-add-member in test_sssd
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.