freeipa

#1320 Comma separated values for --externaluser option in sudorule-mod are accepted as a single value
Closed: Fixed Opened by mkosek.

Closed: Fixed
Reopen Issue

Comma separated values for --externaluser option in sudorule-mod are accepted as a single value.

Steps to Reproduce:
1. # ipa sudorule-add-user rule1 --users=sudorule1,sudorule2
  Rule name: rule1
  Enabled: TRUE
  External User: sudorule1, sudorule2
-------------------------
Number of members added 2
-------------------------
2. # ipa sudorule-find rule1 --all --raw
  dn:
ipauniqueid=7eed5c88-964f-11e0-bc9a-525400deab7b,cn=sudorules,cn=sudo,dc=lab,dc=eng,dc=pnq,dc=redhat,dc=com
  cn: rule1
  ipaenabledflag: TRUE
  externaluser: sudorule2
  externaluser: sudorule1
  ipauniqueid: 7eed5c88-964f-11e0-bc9a-525400deab7b
  objectclass: ipaassociation
  objectclass: ipasudorule
----------------------------
Number of entries returned 1
----------------------------
3. # ipa sudorule-mod rule1 --externaluser=sudorule3,sudorule4
  Rule name: rule1
  Enabled: TRUE
  External User: sudorule3,sudorule4

https://bugzilla.redhat.com/show_bug.cgi?id=713069

This ticket is related to:
https://bugzilla.redhat.com/show_bug.cgi?id=711667 (#1307)

Reassigning to jdennis as he has a very similar ticket (#1307)

master: d8c479731e6f985f4c4be1e1e4fee858e9eae901

Metadata Update from @mkosek:
- Issue assigned to rcritten
- Issue set to the milestone: FreeIPA 2.1 - 2011/07

master:

  • afcb06006c46073838ca196ac6d235854c91b854 Add design document for using AD users/groups in SUDO rules
  • 172e4b977048af7cdb244b52aec08a024749962e baseldap: refactor validator support in add_external_pre_callback
  • 5fae809d921c58b6450d4d10f46b9013e1e31da1 baseldap: when adding external objects, differentiate between them and failures
  • 0ffdfc70f26e6f863c69c2ff03219e96dd5fd618 idviews: add extended validator for users from trusted domains
  • a37db297f036390c6b75eca77fa88422df4f51a0 sudorule-add-user: allow to reference users and groups from trusted domains directly
  • 349322e3fb6da88a964d53e6f157743b29e40d30 sudorule runAs: allow to add users and groups from trusted domains directly
  • 09e06e05641be5e71d5a1a6a273cb0c3c0c4531b ipatests: fix test_sudorule_plugin's wrong argument use
  • 642b81e99f6f267c2c24a47816a2f9ae7464a858 test_trust: add tests for using AD users and groups in SUDO rules
  • c91a1a078aea9996d30854ede1ce266f74a6176f ipatests: when talking to AD DCs, use FQDN credentials
  • 08d720982876926ba555b94fdde6c84469b20868 baseldap: allow rejecting unknown objects instead of adding to an external attr

ipa-4-9:

  • 16b30cbe5e4f1fd8965ed27ba2ca9b4b7b295e9c Add design document for using AD users/groups in SUDO rules
  • 132d7fb0ed21e2e7cc69366e2141ae69e7864afb baseldap: refactor validator support in add_external_pre_callback
  • ffc2edf61efccbcbd4294fbc8a8613decea299a3 baseldap: when adding external objects, differentiate between them and failures
  • a3563d1c35fbe9e6e96199ead211ec3b4ff1d2d2 idviews: add extended validator for users from trusted domains
  • 054a068f4705cd715789ceda75fa709404d5f884 sudorule-add-user: allow to reference users and groups from trusted domains directly
  • 78043bfb5e2a3b1fc0fae6d55ba605ba469ce5ae sudorule runAs: allow to add users and groups from trusted domains directly
  • f4d3c91e7f80659268e006dffa5f064b29b45c98 ipatests: fix test_sudorule_plugin's wrong argument use
  • a7c56fde7727bfad3f885cf50e21182cdc46024e test_trust: add tests for using AD users and groups in SUDO rules
  • 64b70be65698b12927795a7a8b79ef7aada010b8 ipatests: when talking to AD DCs, use FQDN credentials
  • 51ca38772f41d3a26a4253a732338d09a69f9647 baseldap: allow rejecting unknown objects instead of adding to an external attr
Metadata
None
None
None
Normal
defect
Command plugins
1
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.