freeipa

#9663 Modify 'group-add-member' command to only consider ID Overrides from 'Default Trust View'
Opened by carlmart. Modified

Open
Close Issue

Request for enhancement

As admin, I want that the 'group-add-member' IPA command would consider only the ID overrides from 'Default Trust View' so that there is no error when I try to add a User ID Override from the CLI to a given group.

Issue

[description of the issue]
There is an internal error when trying to add a User ID Override to a specific User group. This is because the group-add-member <group-id> --idoverrideusers=<uid> command only should work in Default Trusts. But there is no indication or error that describes what it really going on on the backend.

Steps to Reproduce

  1. Create a new user with uid 'bsanderson'
  2. Create a new ID View with name 'my-idview' and override the user mentioned above
ipa idoverrideuser_add my-idview bsanderson
  1. Create a new user group with id 'my-group'
  2. Add the user associated to the ID View
ipa group-add-member my-group --idoverrideusers=bsanderson

Actual behavior

The following error is shown:

ipa: ERROR: an internal error has occurred

Expected behavior

The command should add user as User ID Override to a given user group whenever is possible (based on the DS/IPA requirements). Otherwise, display an error message describing what has failed and how to troubleshoot the error (ideally).

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

From code review: group_add_member class is built on top of LDAPAddMember class which inherits from LDAPModMember and calls into get_member_dns() to collect LDAP DNs of the objects to be considered as members. LDAPModMember.get_member_dns() implements generic metadata reflection for any member-holding attribute that calls into <object type>.get_dn(object name) to retrieve a DN of the LDAP object represented by object name.

Original get_dn() implementation handle assumes only a single name is provided for the object and then a search is done against the primary key. In case of ID overrides, the structure is a bit more complex as ID overrides are localized within ID views. A code was added to baseidoverride.get_dn() to assume a Default Trust View in case ID view is missing or was passed as an empty string ('').

LDAPModMember.get_member_dns() does indeed pass no ID view reference to baseidoverride.get_dn() and that is interpreted as use of Default Trust View ID View. If an ID override was not found in the Default Trust View, it is considered unknown and will be returned as an error (not found).

So everything is working as designed here. Web UI should only allow to show ID overrides from Default Trust View when choosing ID overrides for adding as a group members.
Edited by abbra
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.