libwbclient-sssd package installation does not re-create expected symlink to libwbclient.so.0

[Pedro Principeza]

[Environment]
Ubuntu 18.04 amd64
sssd + libwbclient0 + libwblclient-sssd (any version)

[Issue]
The libwbclient-sssd package provides a libwbclient.so.0.14.0 library which enables winbind queries (i.e. wbinfo) to use sssd as a framework.

However, when libwbclient-sssd package is installed, the symlink to /usr/lib/x86_64-linux-gnu/libwbclient.so.0 is not recreated to point out to the /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0.14.0, thus not enabling such functionality until a manual procedure (re-symlinking) is made by the user.

I have inspected both ealier (xenial) and latest (eoan) packages, and none of them contain postinst/postuninstall scripts that would create/remove the expected symlinks, respectively.

It is unclear as of now it if *is* expected that the symlinks should be recreated by the user or else. There have been discussions [1] about this in the past, but they were closed with inconclusive comments. This bug is being opened to either have the packages' postinst/postuninstall scripts create/remove that symlink, or either to document the need of proceeding with such operation manually.

[Impact]
The use of features included in libwbclient-sssd's library are not usable until the symlink for libwbclient.so.0 is manually created.

[Reproducer]
Install sssd + winbind + dependencies.

Check the symlink of /usr/lib/x86_64-linux-gnu/libwbclient.so.0 points out to the libwbclient.so.0.14 library:

$ ll /usr/lib/x86_64-linux-gnu/libwbclient.so.0
lrwxrwxrwx 1 root root 19 May 23 12:06 /usr/lib/x86_64-linux-gnu/libwbclient.so.0 -> libwbclient.so.0.14

Install libwbclient-sssd.

Check the symlink of /usr/lib/x86_64-linux-gnu/libwbclient.so.0 still points out to the libwbclient.so.0.14 library:

$ ll /usr/lib/x86_64-linux-gnu/libwbclient.so.0
lrwxrwxrwx 1 root root 19 May 23 12:06 /usr/lib/x86_64-linux-gnu/libwbclient.so.0 -> libwbclient.so.0.14

[Workaround]
Using update-alternatives (either with --config or --install, pointing out to the /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0.14.0 library, enables the use of wbinfo + sssd.

Let me know if further information is needed to proceed.

--
Thank you!

[1] https://pagure.io/SSSD/sssd/issue/2845

[Eric Desrochers (slashd)]

# apt-file search libwbclient.so.0
libwbclient-sssd: /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0
libwbclient-sssd: /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0.14.0
libwbclient0: /usr/lib/x86_64-linux-gnu/libwbclient.so.0
libwbclient0: /usr/lib/x86_64-linux-gnu/libwbclient.so.0.14

# readlink /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0
libwbclient.so.0.14.0

# readlink /usr/lib/x86_64-linux-gnu/libwbclient.so.0
libwbclient.so.0.14

# md5sum /usr/lib/x86_64-linux-gnu/libwbclient.so.0.14
aa515cd2c0416debd2786a9052dcdb26 /usr/lib/x86_64-linux-gnu/libwbclient.so.0.14

# md5sum /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0.14.0
28e38d3b43b10bd2f90b5406bfc9f3ff /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0.14.0

It shouldn't be a big deal "in theory", but I suspect in this case they are compiled differently as they come from 2 different src packages, and that must be the reason why one need to be re-symlink'ed.

# src package: samba
Package: libwbclient0

# src package: sssd
Package: libwbclient-sssd

I'll investigate further and see what can be done.

[Timo Aaltonen (tjaalton)]

on Fedora, the libwbclient symlinks are handled by the samba package, the details available on the specfile:

https://src.fedoraproject.org/rpms/samba/blob/master/f/samba.spec

[Steve Langasek (vorlon)]

This is not a problem of the samba package; libwbclient built from the samba source includes the correct symlink for the soname. The issue is that libwbclient-sssd wants to divert libwbclient.so.0 for its own purposes and does not do so correctly.

[Timo Aaltonen (tjaalton)]

hmm right they're using alternatives, either because rpm doesn't support diversions or something else.. anyway, they're also checking for the version of the lib and failing the (sssd) build if it doesn't match what's expected. Wonder if the wbclient api is stable and only adding new stuff or if sssd should keep up with (and samba not break) the api..

[Andreas Hasenack (ahasenack)]

I'm a bit wary of mixing sssd and samba/winbind together like this. But sounds like alternatives would be an option?

[Dan Hill (hillpd)]

Dug into this a bit further.

Fedora packages both samba [0] and sssd [1] with scripts that use the update-alternatives '--install' action. The sssd wbclient library gets configured with a lower priority (5) compared to samba's (10). This gives samba's library preference when both packages are installed.

This solution provides a consistent install configuration regardless of package ordering.
It also properly registers both package libraries as alternatives. The update-alternatives '--remove' action will only revert symlinks to installed alternatives. If an unregistered symlink exists prior to an '--install' action, it gets clobbered by the first '--install' action and can not be recovered.

We could consider adopting a similar model, but it worth noting that fedora is packaging two different wbclient versions. With this commit [2] samba updated the wbclient interface to minor version 15. The upstream sssd wbclient library has not yet followed suit [3].

Their linking is setup as follows:
/usr/lib64/libwbclient.so.0.14 -> /etc/alternatives/libwbclient.so.0.14-64
/usr/lib64/libwbclient.so.0.15 -> /etc/alternatives/libwbclient.so.0.15-64

With the generic names pointing to:
/etc/alternatives/libwbclient.so.0.14-64 -> /usr/lib64/sssd/modules/libwbclient.so.0.14
/etc/alternatives/libwbclient.so.0.15-64 -> /usr/lib64/samba/wbclient/libwbclient.so.0.15

In bionic, the sssd and samba wbclient interface versions are identical (0.14), although implemented differently. There is a version mismatch present in eoan and focal.
ubuntu@bionic-sssd:~$ apt-file search libwbclient.so.0
libwbclient-sssd: /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0
libwbclient-sssd: /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0.14.0
libwbclient0: /usr/lib/x86_64-linux-gnu/libwbclient.so.0
libwbclient0: /usr/lib/x86_64-linux-gnu/libwbclient.so.0.14

ubuntu@eoan-sssd:~$ apt-file search libwbclient.so.0
libwbclient-sssd: /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0
libwbclient-sssd: /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0.14.0
libwbclient0: /usr/lib/x86_64-linux-gnu/libwbclient.so.0
libwbclient0: /usr/lib/x86_64-linux-gnu/libwbclient.so.0.15

ubuntu@focal-sssd:~$ apt-file search libwbclient.so.0
libwbclient-sssd: /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0
libwbclient-sssd: /usr/lib/x86_64-linux-gnu/sssd/modules/libwbclient.so.0.14.0
libwbclient0: /usr/lib/x86_64-linux-gnu/libwbclient.so.0
libwbclient0: /usr/lib/x86_64-linux-gnu/libwbclient.so.0.15

[0] https://src.fedoraproject.org/rpms/sssd/blob/master/f/sssd.spec#_1062
[1] https://src.fedoraproject.org/rpms/samba/blob/master/f/samba.spec#_1151
[2] https://github.com/samba-team/samba/commit/1834513ebe394f4e5111665a21df652e59b3b0b6#diff-0ac0c581f17b5fa5e558397e97fb574d
[3] https://pagure.io/SSSD/sssd/blob/master/f/src/sss_client/libwbclient/wbclient_sssd.h#_81

[Dan Hill (hillpd)]

Alternatives is an option, but would require updating both samba and libwbclient-sssd packaging to cleanly manage the registered wbclient library versions and their associated priorities.

For eoan and focal the sssd libwbclient version mismatch needs to be addressed. Either sssd should be updated to match the 0.15 interface, or the libwbclient.so.0 library links should be split out to include both major + minor version.

The latter is certainly not appealing. Mixing library sources that implement the same interface is already problematic. Managing multiple versions adds unnecessary complexity.

[Dan Hill (hillpd)]

A recent sssd issue was opened re: libwbclient API version 15 [0].

Upstream sssd plan to deprecate the alternative winbind client library, which is why they haven't implemented the 0.15 interface. The sssd library version hasn't maintained feature parity for some years [1]. Upstream recommends using idmap_sss as a winbind plug-in instead, which is available in the sssd-common package [2].

[0] https://pagure.io/SSSD/sssd/issue/4158
[1] https://<email address hidden>/message/BY3FRMUHXNV3OMGYL5WDYCIIPIR3UJSB/
[2] https://manpages.ubuntu.com/manpages/eoan/man8/idmap_sss.8.html

[Dan Hill (hillpd)]

Marking this invalid. Upstream sssd is deprecating the libwbclient libraray and does not recommend its usage.