Open riton opened 3 years ago
Files identified in the description: None
If these files are inaccurate, please update the component name
section of the description or use the !component
bot command.
My current tests shows that a very naive:
if 'result' in resp:
result = resp.get('result')
if 'failed' in result:
self._fail("part of the request has failed", str(result.get('failed')))
in module_utils/ipa.py is enough to catch such errors.
I don't really know if this is enough since I'm still trying to find a good documentation of the FreeIPA API that documents the failed
attribute in the different API versions. This document seems like a good start and references the failed
field.
SUMMARY
I'm trying to add a new usergroup member to an
ipa_sudorule
using GSSAPI auth. This is working fine.The problem occured when I've tried to add a usergroup
usergroup_that_does_NOT_exist
to my my sudo rule. This is expected to fail, since usergroupusergroup_that_does_NOT_exist
does not exist on the FreeIPA server.Problem is that the current version of the
community.general.ipa_sudorule
does not catch this error, since the FreeIPA HTTP response code is200
, despite of the error.FreeIPA API response contains a
failed
element that contains details of the error.Example of such a (truncated) response:
Note: The problem is the same if the user has insufficient privileges. The error goes unnoticed.
ISSUE TYPE
COMPONENT NAME
community.general.ipa_sudorule
, but I think that the problem resides in IPAClient._post_json error detection logic.ANSIBLE VERSION
CONFIGURATION
OS / ENVIRONMENT
FreeIPA Server
STEPS TO REPRODUCE
EXPECTED RESULTS
Task execution should fail.
ACTUAL RESULTS
No error is detected if:
I guess that this bug is present in other modules since it may involve the error detection logic of the FreeIPA API.