freeipa

#9709 All user groups are not being included during HSM token validation
Closed: fixed by rcritten. Opened by rcritten.

Closed: fixed
Reopen Issue

Cloned from https://issues.redhat.com/browse/RHEL-69635

What were you trying to do that didn't work?

During ipa-server-install validation is done to ensure that the token is visible and that the token PIN works. This is to catch errors early.

This test is done as pkiuser:pkiuser

The problem is if pkiuser is a member of other groups that are necessary to access the HSM then this validation will fail (but installation would be ok).
What is the impact of this issue to you?

It causes server and/or replica installation failure

https://github.com/freeipa/freeipa/pull/7615

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-69635

master:

  • 65ed1aa1ff093de5dc49c5e7e2ee7cf0f71b225a Allow looking up constants.Group by gid in addition to name
  • efadc564eb4ff52375d2c80580f4bc82d5cb11df Pass all pkiuser groups as suplementary when validating an HSM

ipa-4-12:

  • 184589fac4ff36b5583541f40dff91296c33370a Allow looking up constants.Group by gid in addition to name
  • 934d4a291d44a40b5ea006aa1f09afa8e4a985fc Pass all pkiuser groups as suplementary when validating an HSM

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.