Support of freeipa-server for s390x

[bugproxy]

freeipa fails to configure on s390x. (Configuration being handled by the freeipa-server-install script) This script has two failure points. The first is below:

https://bugs.launchpad.net/ubuntu/+source/freeipa/+bug/1600634 describes a known bug but it was only resolved for x86_64.

In the falling scenario the install log will have entries like the following:

2018-04-10T18:53:01Z DEBUG nsslapd-pluginenabled:
2018-04-10T18:53:01Z DEBUG on
2018-04-10T18:53:01Z DEBUG nsslapd-pluginpath:
2018-04-10T18:53:01Z DEBUG /usr/lib/x86_64-linux-gnu/dirsrv/plugins/schemacompat-plugin.so
2018-04-10T18:53:01Z DEBUG nsslapd-pluginversion:
2018-04-10T18:53:01Z DEBUG 0.8

Obviously on s390x /usr/lib/x86_64-linux-gnu/dirsrv/plugins/schemacompat-plugin.so will never be found.

Now if I create a symbolic link with the above name that is linked to the same location but with s390x where x86_64 is located, the install will proceed past this failing location.

The second failure point in the freeipa-server-install script is near the end, after the script has completed the freeipa-server-install and where it attempts to install the freeipa-client. The client install appears to fail because of a problem with certificates related to the server install.

2018-04-17T12:14:59Z ERROR Cannot connect to the server due to generic error: Insufficient access: SASL(-4): no mechanism available: No worthy mechs found (Unknown authentication method)

The above appears to be related to an issue with the key database

# certutil -L
certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.

# ipa cert-show 1
ipa: ERROR: cannot connect to 'https://fipas1.pdl.pok.ibm.com/ipa/json': (SEC_ERROR_LEGACY_DATABASE) The certificate/key database is in an old, unsupported format.

# ipa user-add
First name: Richard
>>> First name: Leading and trailing spaces are not allowed
First name: Richard
Last name: Young
User login [ryoung]: ryoung1
ipa: ERROR: cannot connect to 'https://fipas1.pdl.pok.ibm.com/ipa/json': (SEC_ERROR_LEGACY_DATABASE) The certificate/key database is in an old, unsupported format.

[Timo Aaltonen (tjaalton)]

which version is this? bionic-proposed has a newer version that should not trip on the certdb issues

[Frank Heimes (fheimes)]

Because of the "targetmilestone-inin1604" tag (that's synch-ed over by 'bugproxy') this problem seem to occur on Xenial.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-04-17 10:55 EDT-------
Changed target milestone to 18.04

------- Comment From <email address hidden> 2018-04-17 10:59 EDT-------
I had tried first, freeipa with bionic beta2/final, however new s390x freeipa server binary was found

root@lbskvm3:~# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu Bionic Beaver (development branch)
Release: 18.04
Codename: bionic

root@lbskvm3:~# uname -a
Linux lbskvm3 4.15.0-13-generic #14-Ubuntu SMP Sat Mar 17 13:42:52 UTC 2018 s390x s390x s390x GNU/Linux

root@lbskvm3:~# apt-cache search freeipa
libipa-hbac-dev - FreeIPA HBAC Evaluator library -- development files
libipa-hbac0 - FreeIPA HBAC Evaluator library
libnss-sss - Nss library for the System Security Services Daemon
libpam-sss - Pam module for the System Security Services Daemon
python3-sss - Python3 module for the System Security Services Daemon
sssd - System Security Services Daemon -- metapackage
sssd-common - System Security Services Daemon -- common files
sssd-tools - System Security Services Daemon -- tools
python-libipa-hbac - Python bindings for the FreeIPA HBAC Evaluator library
python-sss - Python module for the System Security Services Daemon
python3-libipa-hbac - Python3 bindings for the FreeIPA HBAC Evaluator library
root@lbskvm3:~#

[Timo Aaltonen (tjaalton)]

Yeah, need to enable bionic-proposed for that.

[Steve Langasek (vorlon)]

Currently, there is no version of freeipa in the bionic release pocket because it was previously unreleasable. The version in bionic-proposed may make it into release, in which case it appears this is fixed for all architectures; or it may not, in which case there are no further bugs to be fixed.

[Timo Aaltonen (tjaalton)]

actually, that SASL issue is likely due to 389-ds-base hardcoding the saslpath for x86 and arm.. Here's a version of it for bionic which adds support for s390x (and ppc64el), if you're able to test:

https://launchpad.net/~canonical-x/+archive/ubuntu/x-staging

yes, it's a silly ppa but one that has builders for all archs :)

grepping for sasl2 gives the right path in libslapd.so.0.1.0 at least..

[Launchpad Janitor (janitor)]

This bug was fixed in the package 389-ds-base - 1.3.7.10-1ubuntu1

---------------
389-ds-base (1.3.7.10-1ubuntu1) bionic; urgency=medium

  * fix-saslpath.diff: Updated to support ppc64el and s390x. (LP:
    #1764744)

 -- Timo Aaltonen <email address hidden> Tue, 17 Apr 2018 20:45:32 +0300

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-04-26 10:35 EDT-------
The package is still failing to configure

root@fipas1:~# ipa-server-install --allow-zone-overlap

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the FreeIPA Server.

This includes:
* Configure a stand-alone CA (dogtag) for certificate management
* Configure the NTP client (chronyd)
* Create and configure an instance of Directory Server
* Create and configure a Kerberos Key Distribution Center (KDC)
* Configure Apache (httpd)
* Configure the KDC to enable PKINIT

To accept the default shown in brackets, press the Enter key.

WARNING: conflicting time&date synchronization service 'ntp' will be disabled
in favor of chronyd

Do you want to configure integrated DNS (BIND)? [no]: yes

Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: master.example.com.

Server host name [fipas1.rgy.net]:

Warning: skipping DNS resolution of host fipas1.rgy.net
The domain name has been determined based on the host name.

Please confirm the domain name [rgy.net]:

The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.

Please provide a realm name [RGY.NET]:
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.

Directory Manager password:
Password (confirm):

The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.

IPA admin password:
Password (confirm):

Checking DNS domain rgy.net., please wait ...
Do you want to configure DNS forwarders? [yes]: no
No DNS forwarders configured
Do you want to search for missing reverse zones? [yes]: no

The IPA Master Server will be configured with:
Hostname: fipas1.rgy.net
IP address(es): 192.168.122.50
Domain name: rgy.net
Realm name: RGY.NET

The CA will be configured with:
Subject DN: CN=Certificate Authority,O=RGY.NET
Subject base: O=RGY.NET
Chaining: self-signed

BIND DNS server will be configured to serve IPA domain with:
Forwarders: No forwarders
Forward policy: only
Reverse zone(s): No reverse zone

Continue to configure the system with these values? [no]: yes

The following operations may take some minutes to complete.
Please wait until the prompt is returned.

Synchronizing time
Using default chrony configuration.
Time synchronization was successful.
Configuring directory server (dirsrv). Estimated time: 30 seconds
[1/44]: creating directory server instance
[2/44]: enabling ldapi
[3/44]: configure autobind for root
[4/44]: stopping directory server
[5/44]: updating configuration in dse.ldif
[6/44]: starting directory server
[error] ACIError: Insufficient access: SASL(-4): no mechanism available: No worthy mechs...

[Frank Heimes (fheimes)]

Please could you attach the logs like the /var/log/syslog as well as the ipa install log:
/var/log/ipaserver-install.log
and in case available any other ipa related logs, too - means: /var/log/ipa*

And also share how the content of the folder: ls -la /etc/ipa/

Thx

[bugproxy (bugproxy)]

------- Comment on attachment From <email address hidden> 2018-05-02 09:49 EDT-------

Requested logs attached in TAR

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-05-07 07:35 EDT-------
IBM bugzilla status closed; Fix Released, Follow-on problem tracked via https://bugzilla.linux.ibm.com/show_bug.cgi?id=167506
https://bugs.launchpad.net/ubuntu/+source/freeipa/+bug/1764744