freeipa

#9284 "ipa netgroup-show" displays hostgroup as netgroup
Opened by twoerner. Modified

Open
Close Issue

Issue

The ipa netgroup-show command is displaying hostgroups as netgroups, ipa netgroup-find is not. Also hostgroup-show and hostgroup-find are not displaying netgroups.

Steps to Reproduce

  1. Create hostgroup
  2. Use ipa netgroup-show for the hostgroup

Actual behavior

ipa hostgroup-show is not showing netgroups.
ipa netgroup-show is showing hostgroups.
ipa netgroup-find is not showing hostgroups.

Expected behavior

ipa netgroup-show should not show hostgroups.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

freeipa-server-4.9.9-1.fc36.x86_64
freeipa-client-4.9.9-1.fc36.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-2.1.1-2.fc36.x86_64
package pki-ca is not installed
krb5-server-1.19.2-6.fc36.x86_64

Additional info:

[root@ipaserver ~]# ipa hostgroup-add testhostgroup
-------------------------------
Added hostgroup "testhostgroup"
-------------------------------
  Host-group: testhostgroup
[root@ipaserver ~]# ipa netgroup-add testnetgroup
-----------------------------
Added netgroup "testnetgroup"
-----------------------------
  Netgroup name: testnetgroup
  NIS domain name: fc36.local
  IPA unique ID: 2cc8d824-6bf4-11ed-940e-525400c151ce
[root@ipaserver ~]# ipa hostgroup-show testnetgroup
ipa: ERROR: testnetgroup: host group not found
[root@ipaserver ~]# ipa hostgroup-find testnetgroup
--------------------
0 hostgroups matched
--------------------
----------------------------
Number of entries returned 0
----------------------------
[root@ipaserver ~]# ipa netgroup-show testhostgroup
  Netgroup name: testhostgroup
  Description: ipaNetgroup testhostgroup
  NIS domain name: fc36.local
  Member Hostgroup: testhostgroup
[root@ipaserver ~]# ipa netgroup-find testhostgroup
-------------------
0 netgroups matched
-------------------
----------------------------
Number of entries returned 0
----------------------------

Metadata Update from @ftrivino:
- Issue assigned to ftrivino

This is working as designed.

Creating a hostgroup creates a managed netgroup, similar to a user-private group.

It is visible as a netgroup if you want to see it (via show) but by default managed groups are excluded from find. If you want to find managed netgroup entries add the --managed option to netgroup-find.

@rcritten this behavior is not consistent.

[root@server ~]# ipa netgroup-find --managed
-------------------
0 netgroups matched
-------------------
----------------------------
Number of entries returned 0
----------------------------
[root@server ~]# ipa hostgroup-find
-------------------
1 hostgroup matched
-------------------
  Host-group: ipaservers
  Description: IPA server hosts
----------------------------
Number of entries returned 1
----------------------------
[root@server ~]# ipa netgroup-add ipaservers
ipa: ERROR: hostgroup with name "ipaservers" already exists. Hostgroups and netgroups share a common namespace

But once I add a hostgroup:

[root@server ~]# ipa hostgroup-add testgroup
---------------------------
Added hostgroup "testgroup"
---------------------------
  Host-group: testgroup
[root@server ~]# ipa netgroup-find --all --managed
------------------
1 netgroup matched
------------------
  dn: cn=testgroup,cn=ng,cn=alt,dc=fed,dc=ipa,dc=test
  Netgroup name: testgroup
  Description: ipaNetgroup testgroup
  NIS domain name: fed.ipa.test
  IPA unique ID: 7047b75a-a1a0-11ed-8017-525400980830
  Member Hostgroup: testgroup
  mepmanagedby: cn=testgroup,cn=hostgroups,cn=accounts,dc=fed,dc=ipa,dc=test
  objectclass: ipanisnetgroup, ipaobject, mepManagedEntry, ipaAssociation, top
----------------------------
Number of entries returned 1
----------------------------

Does the default ipaservers hostgroup have a special meaning?

Yes, ipaservers is special. It is a "protected" group so can't be removed, modified, etc. It doesn't have a netgroup equivalent because it is created at server via the bootstrap LDIF.
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.