Based on
https://www.redhat.com/archives/freeipa-users/2014-February/msg00006.html
it might be helpful if the WebUI either listed or at least made a generic note on the page listing HBAC Rules for the object when there is an enabled HBAC rule which matches the user or host due to --usercat=all or --hostcat=all.
Otherwise the existence of allow_all is hidden and admins might think their setup is more safe than it is when they see the list empty but users still can get to the services.
Another user hitting (what seems to be) the very same issue of allow_all not reasonably visible on the WebUI on the same day:
https://www.redhat.com/archives/freeipa-users/2014-February/msg00035.html
Processing leftovers from 4.2 backlog - this ticket was found as suitable for consideration in next big feature release - 4.4.
Metadata Update from @adelton: - Issue assigned to someone - Issue set to the milestone: FreeIPA 4.5 backlog
Metadata Update from @pvomacka: - Issue close_status updated to: None - Issue tagged with: webui
Thank you taking time to submit this request for FreeIPA. Unfortunately this bug was not given priority and the team lacks the capacity to work on it at this time.
Given that we are unable to fulfil this request I am closing the issue as wontfix. To request re-consideration of this decision please reopen this issue and provide additional technical details about its importance to you.
Metadata Update from @rcritten: - Issue close_status updated to: wontfix - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.