Description of problem:

Not able to edit the employeenumber,email,departnumber attributes as a user
which is added to the role having the "User Administrators" privilege.

Getting the error like below :

ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the
'employeeNumber' attribute of entry
'uid=ipauser,cn=users,cn=accounts,dc=redhat,dc=com'.


Steps to Reproduce :

1. Create an user in IPA with the kerberos principal of admin.

  # kinit admin

  # ipa user-add abhinayreddy --password

2. Create a new role in IPA.

   # ipa role-add usermodifier

3. Add "User Administrators" privilege to the new role created.

   # ipa role-add-privilege --privileges="User Administrators" usermodifier

4. Add new user created as a member of the role.

   # ipa role-add-member --users=abhinayreddy usermodifier

5. Get the kerberos principal for the user "abhinayreddy".

   # kinit abhinayreddy

6. Try to modify the employeenumber or email or departnumber of the user
"ipauser"

   # ipa user-mod --employeenumber=123 ipauser

   # ipa user-mod --departnumbernumber=12345 ipauser

   # ipa user-mod --email=rd@redhat.com ipauser


Actual results:

Getting below error -

ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the
'employeeNumber' attribute of entry
'uid=ipauser,cn=users,cn=accounts,dc=redhat,dc=com'.

ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the
'departmentNumber' attribute of entry
'uid=ipauser,cn=users,cn=accounts,dc=redhat,dc=com'.

ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the 'mail'
attribute of entry 'uid=ipauser,cn=users,cn=accounts,dc=redhat,dc=com'.



Expected results:

User "abhinayreddy" should be able to modify the employeenumber,email and
departnumber attributes of the user "ipauser".


# ipa user-mod --employeenumber=123 ipauser
----------------------------
Modified user "ipauser"
----------------------------
  User login: ipauser
  First name: ipa
  Last name: user
  Home directory: /home/ipauser
  Login shell: /bin/sh
  Email address: ipauser@gsslab.pnq.redhat.com
  UID: 659600018
  GID: 659600018
  Account disabled: False
  Employee Number: 123
  Password: True
  Member of groups: ipausers
  Roles: usermodifier
  Kerberos keys available: True


# ipa user-mod --departnumber=122 ipauser
----------------------------
Modified user "ipauser"
----------------------------
  User login: ipauser
  First name: ipa
  Last name: user
  Home directory: /home/ipauser
  Login shell: /bin/sh
  Email address: ipauser@gsslab.pnq.redhat.com
  UID: 659600018
  GID: 659600018
  Account disabled: False
  Department Number: 122
  Password: True
  Member of groups: ipausers
  Roles: usermodifier
  Kerberos keys available: True


# ipa user-mod --email=ipauser@redhat.com ipauser
----------------------------
Modified user "ipauser"
----------------------------
  User login: ipauser
  First name: ipa
  Last name: user
  Home directory: /home/ipauser
  Login shell: /bin/sh
  Email address: ipauser@gsslab.pnq.redhat.com
  UID: 659600018
  GID: 659600018
  Account disabled: False
  Password: True
  Member of groups: ipausers
  Roles: usermodifier
  Kerberos keys available: True


Additional info:

May be this is helpful :

I can see that there are no write permission defined for these attributes in
permissions of Modify Users.


# System: Modify Users, permissions, pbac, gsslab.pnq.redhat.com
dn: cn=System: Modify Users,cn=permissions,cn=pbac,dc=gsslab,dc=pnq,dc=redhat,
 dc=com
ipaPermTargetFilter: (objectclass=posixaccount)
ipaPermRight: write
ipaPermBindRuleType: permission
ipaPermissionType: V2
ipaPermissionType: MANAGED
ipaPermissionType: SYSTEM
cn: System: Modify Users
objectClass: ipapermission
objectClass: top
objectClass: groupofnames
objectClass: ipapermissionv2
member: cn=User Administrators,cn=privileges,cn=pbac,dc=gsslab,dc=pnq,dc=redha
 t,dc=com
member: cn=Modify Users and Reset passwords,cn=privileges,cn=pbac,dc=gsslab,dc
 =pnq,dc=redhat,dc=com
ipaPermDefaultAttr: telephonenumber
ipaPermDefaultAttr: cn
ipaPermDefaultAttr: labeleduri
ipaPermDefaultAttr: manager
ipaPermDefaultAttr: street
ipaPermDefaultAttr: displayname
ipaPermDefaultAttr: homephone
ipaPermDefaultAttr: title
ipaPermDefaultAttr: facsimiletelephonenumber
ipaPermDefaultAttr: loginshell
ipaPermDefaultAttr: employeetype
ipaPermDefaultAttr: description
ipaPermDefaultAttr: businesscategory
ipaPermDefaultAttr: preferredlanguage
ipaPermDefaultAttr: roomnumber
ipaPermDefaultAttr: mepmanagedentry
ipaPermDefaultAttr: carlicense
ipaPermDefaultAttr: postalcode
ipaPermDefaultAttr: givenname
ipaPermDefaultAttr: pager
ipaPermDefaultAttr: seealso
ipaPermDefaultAttr: objectclass
ipaPermDefaultAttr: inetuserhttpurl
ipaPermDefaultAttr: l
ipaPermDefaultAttr: st
ipaPermDefaultAttr: mobile
ipaPermDefaultAttr: gecos
ipaPermDefaultAttr: sn
ipaPermDefaultAttr: ou
ipaPermDefaultAttr: secretary
ipaPermDefaultAttr: userclass
ipaPermDefaultAttr: initials
ipaPermLocation: cn=users,cn=accounts,dc=redhat,dc=com