<html> <head> <meta content="text/html; charset=ISO-8859-2" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 06/10/2015 02:14 PM, David Kupka wrote: </div> <blockquote cite="mid:55782A17.4070203@redhat.com" type="cite"><a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/5057">https://fedorahosted.org/freeipa/ticket/5057</a> </blockquote> Hello David, The patch looks ok except it removes a permission to update 'uid' from an active user. This permission is required to delete(preserve) an active user. <blockquote><tt>- # Active container</tt><tt> </tt><tt>- #</tt><tt> </tt><tt>- # Stage user administrators need write right on RDN when</tt><tt> </tt><tt>- # the active user is deleted (preserved)</tt><tt> </tt><tt>- 'System: Write Active Users RDN by administrators': {</tt><tt> </tt><tt>- 'ipapermlocation': DN(baseuser.active_container_dn, api.env.basedn),</tt><tt> </tt><tt>- 'ipapermbindruletype': 'permission',</tt><tt> </tt><tt>- 'ipapermtarget': DN('uid=*', baseuser.active_container_dn, api.env.basedn),</tt><tt> </tt><tt>- 'ipapermtargetfilter': {'(objectclass=posixaccount)'},</tt><tt> </tt><tt>- 'ipapermright': {'write'},</tt><tt> </tt><tt>- 'ipapermdefaultattr': {'uid'},</tt><tt> </tt><tt>- 'default_privileges': {'Stage User Administrators'},</tt><tt> </tt><tt>- },</tt><tt> </tt><tt>- #</tt> </blockquote> I prepared a new patch (attached) with that permission and it makes 'user-del --preserve' happy. Now I think the name would rather be something like: 'System: Preserve an active user (user-del --preserve)' I also added back this comment in two permissions 'Note: targetfilter is the target parent container'. This was to say that the targetfilter setting was intentional. If you think it is not the right place, you may remove those comments. Thanks thierry </body> </html>