I think the problem is your double-quoting around the setattr value. Drop that and it works for me.

I'm not entirely sure how that is messing things up in the API but yeah it looks like it isn't seeing the {CRYPT} and encoding the whole thing as a raw password (probably including the {CRYPT}).

So now I put: ipa user-add $username --first=$first --last=$last \ --setattr userpassword='{CRYPT}$password1' --gidnumber=$gid --uid=$uid --gecos="'$gecos'" --homedir=$homedir \ --shell=$shell

But now the debug log has: raw: user_add('jmist', givenname='John', sn='Smith', homedirectory='/home/jsmith', gecos="'John Smith'", loginshell='/bin/tcsh', uidnumber=5278, gidnumber=200, *setattr=*('*userpassword={CRYPT}$password*1',), version='2.239') [Wed Feb 03 12:02:59.129692 2021] [wsgi:error] [pid 182762:tid 183116] [remote x.x.x.x:38886] ipa: DEBUG: user_add('jsmith', givenname='John', sn='Smith', cn='John Smith', displayname='John Smith', initials='JS', homedirectory='/home/jsmith', gecos="'John Smith'", loginshell='/bin/tcsh', krbprincipalname=(ipapython.kerberos.Principal('jsmith@MYDOMAIN.EDU'),), random=False, uidnumber=5278, gidnumber=200,* setattr=('userpassword={CRYPT}$password1',)*, noprivate=False, all=False, raw=False, version='2.239', no_members=False)

So how do I format the --setattr userpassword without quotes?

On Wed, Feb 3, 2021 at 12:18 PM Jochen Kellner jochen@jochen.org wrote:

Robert Kudyba via FreeIPA-users freeipa-users@lists.fedorahosted.org writes:

...

So now I put: ipa user-add $username --first=$first --last=$last \ --setattr userpassword='{CRYPT}$password1' --gidnumber=$gid

Try: --setattr "userpassword={CRYPT}$password1" --gidnumber=$gid

Nice, that worked as well as: --setattr userpassword="{CRYPT}$password1" --gidnumber=$gid

Now any idea why the original '$gecos' inserts the actual string $gecos into FreeIPA/LDAP?

Logs also spit out this warning after every user is added: Failed to set perms (3140) on file (/run/ipa/ccaches/admin@OURDOMAIN.EDU)!, referer: https://oudomain.edu/ipa/xml

...

Now any idea why the original '$gecos' inserts the actual string $gecos into FreeIPA/LDAP?

It's a shell issue, single quotes prevents any argument expansion, use double quotes.

Sure but using just double quotes $gecos is still added to the FreeIPA record. I can at least import it with "'$gecos'" but the script then imports the single quotes as a part of the record.

We also noticed if a NIS user has a middle initial the script errors with: ipa: ERROR: command 'user_add' takes at most 1 argument

So is there some escape character or something that works around this that isn't documented? I don't see anything with ip help user-add

Logs also spit out this warning after every user is added:

Failed to set perms (3140) on file (/run/ipa/ccaches/admin@OURDOMAIN.EDU )!,

I added a comment to issue 7032 https://pagure.io/freeipa/issue/7032#comment-713784 not sure if this is still a "won't fix" issue?

On Thu, Feb 4, 2021 at 11:47 AM Rob Crittenden rcritten@redhat.com wrote:

Robert Kudyba wrote:

...

> Now any idea why the original  '$gecos' inserts the actual string
$gecos
> into FreeIPA/LDAP?

It's a shell issue, single quotes prevents any argument expansion,

use

...

double quotes.

Sure but using just double quotes $gecos is still added to the FreeIPA record. I can at least import it with "'$gecos'" but the script then imports the single quotes as a part of the record.

I assume you tried "$gecos"?

Yes and I found a fix. All that is needed is to surround the echo command with double quotes at the top of the script where username is set: username="$(echo $line | cut -f1 -d:)"

We also noticed if a NIS user has a middle initial the script errors with:

...

ipa: ERROR: command 'user_add' takes at most 1 argument

There should be a way to file a doc bug within the docs themselves.

Indeed perhaps to add comments, but then those are never spam-proof.

The script was never meant to be bullet-proof. It was provided for

guidance purposes. There are *lots* of corner cases with names.

Understood but it's a great launching point. I can share what my colleague added with a couple awks to handle names in NIS that have middle initial, "last name, first name" and other permutations:

# Change Last, First to First Last. (Fill in dummy for empty gecos.) if [ -z "$gecos" ]; then firstlast='First Last' else firstlast=$(echo $gecos | sed -e 's/(.*), (.*$)/\2 \1/') fi

# Extract First and Last into separate variables first=$(echo $firstlast | awk '/^(\w|[-'''])+ \w. / { print $1, $2; } \ /^(\w|[-'''])+ (\w|[-'''])+( |$)/ { print $1; }' ) #echo this dollar 1 $1 this is dollar 2 $2 last=$(echo $firstlast | awk 'BEGIN {ORS=" ";} \ /^(\w|[-'''])+ \w. / { for (i=3; i<=NF; i++) print $i; } \ /^(\w|[-'''])+ (\w|[-'''])+( |$)/ { for (i=2; i<=NF; i++) print $i; }' \ | sed 's/ *$//' )

...

> Logs also spit out this warning after every user is added:

> Failed to set perms (3140) on file
(/run/ipa/ccaches/admin@OURDOMAIN.EDU <mailto:admin@OURDOMAIN.EDU

)!,

I added a comment to issue 7032

https://urldefense.proofpoint.com/v2/url?u=https-3A__pagure.io_freeipa_issue... not sure if

...

this is still a "won't fix" issue?

It's not won't fix, it's just extremely low in priority since it doesn't affect operation.

Thanks for acknowledging. Hope I added some value to future users that might find this thread.