freeipa

#3226 [RFE] ipa sudorule-add-user should accept more types of characters
Closed: fixed by rcritten. Opened by dpal.

Closed: fixed
Reopen Issue

https://bugzilla.redhat.com/show_bug.cgi?id=871208 (Red Hat Enterprise Linux 6)

Description of problem:
ipa sudorule-add-user restricts users names to a limited variety of characters.
At the very least @ and \ should be included to cover username conventions used
for AD trusted users.  When I try now, I see this:
[root@rhel6-1 failure1]#  ipa sudorule-add-user testrule
--users=adtestuser1@adtestdom.com
ipa: ERROR: invalid 'user': may only include letters, numbers, _, -, . and $
In addition Simo mentioned in an email:
We should allow any character in this case.
These are external user/group names, we do not have any control on them.
If I want to add the user ?test@foo^^bar in /etc/passwd then I should be
allowed to use it in a sudo rule
Version-Release number of selected component (if applicable):
ipa-server-3.0.0-106.20121026T1837zgitf14dd98.el6.x86_64
How reproducible:
Always
Steps to Reproduce:
1.  Setup IPA Master
2.  ipa sudorule-add testrule
3.  ipa sudorule-add-user --users=test@domain.com
Actual results:
error listed above
Expected results:
success
Additional info:

After Sumit brought up a good point, I'm modifying this request.

Instead of modifying --users option functionality, I'd like to request a new --external (or similar) option. This will allow a distinction between adding IPA users and External ones coming from other sources like AD.

I'd think we'd keep the option similar to the group-add one used when adding AD groups/users to a group in IPA.

Changing 3.2 priority

Releasing tickets from distant milestones.

IPA already distinguishes between home IPA users and external users, no new option was added. The validation is still strict though:

# ipa sudorule-add-user test --users "external@ad.domain.test"
ipa: ERROR: invalid 'user': may only include letters, numbers, _, -, . and $
# ipa sudorule-add-user test --users "external"
  Rule name: test
  Enabled: TRUE
  Host category: all
  External User: foouser, external
  Sudo Allow Commands: /usr/bin/yum, /bin/mv
-------------------------
Number of members added 1
-------------------------

This looks as a basic use case for SUDO, lets move it to earlier release.

Related discussion with advise: http://www.redhat.com/archives/freeipa-devel/2015-May/msg00499.html

FreeIPA 4.2.1 was released, moving to 4.2.x.

Metadata Update from @dpal:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.5 backlog

Raven grooming:

  • there is already ability to add an external user (in terms of not existing in IPA LDAP) but it is prevented by a validation rule for 'uid' param as described in https://www.redhat.com/archives/freeipa-devel/2015-May/msg00499.html
  • the scope for this bug is to allow not checking the validation when 'uid' param is used within sudo commands.

Metadata Update from @abbra:
- Issue close_status updated to: None
- Issue set to the milestone: None (was: FreeIPA 4.5 backlog)

PR: https://github.com/freeipa/freeipa/pull/4792

Metadata Update from @abbra:
- Issue assigned to abbra (was: someone)
- Issue set to the milestone: FreeIPA 4.9
- Issue tagged with: trust

master:

  • afcb06006c46073838ca196ac6d235854c91b854 Add design document for using AD users/groups in SUDO rules
  • 172e4b977048af7cdb244b52aec08a024749962e baseldap: refactor validator support in add_external_pre_callback
  • 5fae809d921c58b6450d4d10f46b9013e1e31da1 baseldap: when adding external objects, differentiate between them and failures
  • 0ffdfc70f26e6f863c69c2ff03219e96dd5fd618 idviews: add extended validator for users from trusted domains
  • a37db297f036390c6b75eca77fa88422df4f51a0 sudorule-add-user: allow to reference users and groups from trusted domains directly
  • 349322e3fb6da88a964d53e6f157743b29e40d30 sudorule runAs: allow to add users and groups from trusted domains directly
  • 09e06e05641be5e71d5a1a6a273cb0c3c0c4531b ipatests: fix test_sudorule_plugin's wrong argument use
  • 642b81e99f6f267c2c24a47816a2f9ae7464a858 test_trust: add tests for using AD users and groups in SUDO rules
  • c91a1a078aea9996d30854ede1ce266f74a6176f ipatests: when talking to AD DCs, use FQDN credentials
  • 08d720982876926ba555b94fdde6c84469b20868 baseldap: allow rejecting unknown objects instead of adding to an external attr

ipa-4-9:

  • 16b30cbe5e4f1fd8965ed27ba2ca9b4b7b295e9c Add design document for using AD users/groups in SUDO rules
  • 132d7fb0ed21e2e7cc69366e2141ae69e7864afb baseldap: refactor validator support in add_external_pre_callback
  • ffc2edf61efccbcbd4294fbc8a8613decea299a3 baseldap: when adding external objects, differentiate between them and failures
  • a3563d1c35fbe9e6e96199ead211ec3b4ff1d2d2 idviews: add extended validator for users from trusted domains
  • 054a068f4705cd715789ceda75fa709404d5f884 sudorule-add-user: allow to reference users and groups from trusted domains directly
  • 78043bfb5e2a3b1fc0fae6d55ba605ba469ce5ae sudorule runAs: allow to add users and groups from trusted domains directly
  • f4d3c91e7f80659268e006dffa5f064b29b45c98 ipatests: fix test_sudorule_plugin's wrong argument use
  • a7c56fde7727bfad3f885cf50e21182cdc46024e test_trust: add tests for using AD users and groups in SUDO rules
  • 64b70be65698b12927795a7a8b79ef7aada010b8 ipatests: when talking to AD DCs, use FQDN credentials
  • 51ca38772f41d3a26a4253a732338d09a69f9647 baseldap: allow rejecting unknown objects instead of adding to an external attr

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

trust

None
None
Normal
enhancement
IPA
None
None
0
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.