From b3f06994b7b44a0f9cd0c6bd0302c9db87dc2502 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 15 Jan 2019 17:33:56 +0100
Subject: [PATCH] Fix systemd-user HBAC rule

2ef6e14c5a87724a3b37dd5f0817af48c4411e03 added an invalid HBAC rule that
encoded the service wrongly.

See: https://bugzilla.redhat.com/show_bug.cgi?id=1643928
Fixes: https://pagure.io/freeipa/issue/7831
Signed-off-by: Christian Heimes <cheimes@redhat.com>
---
 install/share/default-hbac.ldif            |  2 +-
 ipatests/test_integration/test_commands.py | 12 +++++++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/install/share/default-hbac.ldif b/install/share/default-hbac.ldif
index 8dd90685c..c89bd3eef 100644
--- a/install/share/default-hbac.ldif
+++ b/install/share/default-hbac.ldif
@@ -21,7 +21,7 @@ cn: allow_systemd-user
 accessruletype: allow
 usercategory: all
 hostcategory: all
-servicecategory: systemd-user
+memberService: cn=systemd-user,cn=hbacservices,cn=hbac,$SUFFIX
 ipaenabledflag: TRUE
 description: Allow pam_systemd to run user@.service to create a system user session
 ipauniqueid: autogenerate
diff --git a/ipatests/test_integration/test_commands.py b/ipatests/test_integration/test_commands.py
index 1fb6450a2..8b2c84fc6 100644
--- a/ipatests/test_integration/test_commands.py
+++ b/ipatests/test_integration/test_commands.py
@@ -500,12 +500,18 @@ class TestIPACommand(IntegrationTest):
         # https://pagure.io/freeipa/issue/7831
         tasks.kinit_admin(self.master)
         # check for presence
-        self.master.run_command(
-            ['ipa', 'hbacrule-show', 'allow_systemd-user']
-        )
         self.master.run_command(
             ['ipa', 'hbacsvc-show', 'systemd-user']
         )
+        result = self.master.run_command(
+            ['ipa', 'hbacrule-show', 'allow_systemd-user', '--all']
+        )
+        lines = set(l.strip() for l in result.stdout_text.split('\n'))
+        assert 'User category: all' in lines
+        assert 'Host category: all' in lines
+        assert 'Enabled: TRUE' in lines
+        assert 'Services: systemd-user' in lines
+        assert 'accessruletype: allow' in lines
 
         # delete both
         self.master.run_command(
-- 
2.20.1