<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span><br></span></div><div>Hi all,</div><div><br></div><div> Not sure whether it is bug or a feature, but when I evaluate the IPA net groups, the 'external host' feature brings me some unexpected results. I'll listed them below -- I am running IPA 2.1.3-9 on Redhat 6.2.</div><div><br></div><div> 1, when I added a host into IPA netgroup in command line mode, 'ipa netgroup-add-member <netgroup> --hosts=<client>'. When the host is not yet installed/configured into an IPA client, it shows in 'external host' category, in the output of 'ipa netgroup-find <netgroup>' command.</div><div> </div><div> The 'external host' doesn't show up in the Web interface for IPA net group. But it does show up when run 'ipa net group-find', or even 'getent <netgroup>' by sssd.</div><div><br></div><div>2, After the 'external host' is configured into an IPA client -- 'ipa user-find <client> proves it' -- it is still reported as 'external host' by command 'ipa netgroup-find', and still not show up in web interface neither. Could this is a bug?</div><div><br></div><div>3, because of #2 above, when this machine is reconfigured, and removed with 'ipa user-del <client>', it is show up in the containing netgroups and nested netgroups, and has to be removed manually. :(</div><div><br></div><div>4, This could be a real bug: You can add an 'external host' with either a host's bare name, or FQDN name. Then after the machine is installed, and you would like to remove it from 'external host' category with command 'ipa user-del <client>', it will remove the FQDN name entry only! and leave the bare name there forever, until you delete the whole containing netgroup!</div><div><br></div><div><div>[root@ipaclient02 ~]# ipa netgroup-find external-ng</div><div>-------------------</div><div>1 netgroups matched</div><div>-------------------</div><div> Netgroup name: external-ng</div><div> Description: netgroup for external hosts</div><div> NIS domain name: example.com</div><div> Member of netgroups: nest-external-ng</div><div> External host: dnsmaster.example.com, ipaclient02, ipaclient02.mac.example.com</div><div><br></div><div>----------------------------</div><div>Number of entries returned 1</div><div>----------------------------</div><div><br></div><div>[root@ipaclient02 ~]# getent netgroup external-ng</div><div>external-ng (dnsmaster.example.com, -, example.com) (ipaclient02.mac.example.com, -, example.com)</div><div><br></div><div>[root@ipaclient02 ~]# ipa netgroup-remove-member external-ng --hosts=ipaclient02</div><div> Netgroup name: external-ng</div><div> Description: netgroup for external hosts</div><div> NIS domain name: example.com</div><div> Member of netgroups: nest-external-ng</div><div> External host: dnsmaster.example.com, ipaclient02</div><div>---------------------------</div><div>Number of members removed 1</div><div>---------------------------</div><div><br></div><div>[root@ipaclient02 ~]# ipa netgroup-remove-member external-ng --hosts=ipaclient02</div><div> Netgroup name: external-ng</div><div> Description: netgroup for external hosts</div><div> NIS domain name: example.com</div><div> Member of netgroups: nest-external-ng</div><div> External host: dnsmaster.example.com, ipaclient02</div><div> Failed hosts/hostgroups: </div><div> member host: ipaclient02.example.com: This entry is not a member</div><div>---------------------------</div><div>Number of members removed 0</div><div>---------------------------</div><div>[root@ipaclient02 ~]# </div><div><br></div><div>--Gelen</div></div><div><br></div><div><br></div><div><br></div><div> </div> </div></body></html>