freeipa

#9433 ipa user-mod --idp-user-id fails with: attribute "ipaIdpSub" not allowed
Closed: fixed by rcritten. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

When creating a user with --idp-user-id or modifying an existing user with --idp-user-id, the operations fails if the user entry does not already contain the ipaipduser objectclass.

Steps to Reproduce

  1. Create a new user with ipa user-add idpuser --first idp --last user --idp-user-id myidpuserid
  2. or
  3. Add a new user, then update the user with ipa user-add idpuser --first idp --last user; ipa user-mod idpuser --idp-user-id myidpuserid

The operation fails with

ipa: ERROR: attribute "ipaIdpSub" not allowed

Actual behavior

(what happens)

Expected behavior

(what do you expect to happen)

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2234480, https://bugzilla.redhat.com/show_bug.cgi?id=2234481

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/6975

master:

  • 0654fb3737febf3d9836cdd2a98352c34c447a6f idp: add the ipaidpuser objectclass when needed

ipa-4-11:

  • f16b6e3e0a1f3dc507c3150c347276255f3b3e72 idp: add the ipaidpuser objectclass when needed

ipa-4-10:

  • 1b69b0ee2578b8e5cad6a47f37f46c509fddee42 idp: add the ipaidpuser objectclass when needed

ipa-4-9:

  • 7e5740f534893487f5a61907ebd6e3677f0beecc idp: add the ipaidpuser objectclass when needed

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to Allow to create user accounts with external IdP reference pre-defined.

Test PR in progress: https://github.com/freeipa/freeipa/pull/7113
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.