>> On 18 Jul 2024, at 22:15, Rob Crittenden <rcritten@redhat.com> wrote:
>>
>> Francis Augusto Medeiros-Logeay wrote:
>>
>>
>>
>> I am a bit lost here. Shouldn’t adding these privileges be enough to
>> create users? And if the user is added to the admin group, shouldn’t
>> users it creates via ldap (not ipa user-add) be modifiable by another
>> admin user?
>
> There isn't enough information to go on. Can you show us more details on
> this Keycloak privilege and permissions and what these unmodifiable
> users look like?
>
> rob
>


Ok, here’s a full report:

I created a user called “biding”. I then created a role so that this user could add other users and could be used on Keycloak for binding and adding users.

I gave it the following default roles:

- User administration
- helpdesk
- Keycloak biding (sorry for the typo)

The last one is like this:

✘ ⚡ root@freeipa  /home/francis  ipa privilege-show
Privilege name: Keycloak admin
 Privilege name: Keycloak admin
 Permissions: System: Add Users, System: Change User password
 Granting privilege to roles: Keycloak biding
⚡ root@freeipa  /home/francis  ipa role-show
Role name: Keycloak biding
 Role name: Keycloak biding
 Member users: biding
 Privileges: User Administrators, Group Administrators, Stage User Administrators, Stage User Provisioning,
             Modify Users and Reset passwords, Modify Group membership, Keycloak admin


I can’t add a user with it on Keyclok. This is what I get on the logs:

{ "date": "[19\/Jul\/2024:14:31:59.636888234 +0200] ", "utc_time": "1721392319.636888234", "event": "AUTHZ_ERROR", "dn": "uid=biding,cn=users,cn=accounts,dc=ipa,dc=med-lo", "bind_method": "SIMPLE", "root_dn": false, "client_ip": "10.10.210.152", "server_ip": "10.10.40.20", "ldap_version": 3, "conn_id": 3722, "op_id": 1, "msg": "target_dn=(uid=testing2,cn=users,cn=accounts,dc=ipa,dc=med-lo)” }

I then added “biding” to the “admins” group.

I could then create users on keycloak with it. This is how a user looks like:

testing, users, accounts, ipa.med-lo
dn: uid=testing,cn=users,cn=accounts,dc=ipa,dc=med-lo
sn: TEst
givenName: Test
mail: testing@med-lo.eu
cn: Test TEst
uid: testing
objectClass: top
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: postfixMailBox
objectClass: ipaobject
ipaUniqueID: b203edc0-45c9-11ef-bb0c-00505695d7f7

But, when searching for this user with my read-only system account, it doesn’t get it:

ldapsearch -b dc=ipa,dc=med-lo -D uid=system,cn=sysaccounts,cn=etc,dc=ipa,dc=med-lo -W uid=testing
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <dc=ipa,dc=med-lo> with scope subtree
# filter: uid=testing
# requesting: ALL
#

# search result
search: 2
result: 0 Success

# numResponses: 1

So I have two problems:

How to give “biding” permission to add and modify users without adding it to the “admins” group, and how to make the users created by it readable like a normal ipa-user?

I hope this makes the issue a bit clearer.

Best,

Francis
--
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue