freeipa server upgrade fails trying to switch to authselect

Bug #1793994 reported by William
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
freeipa (Ubuntu)
Fix Released
Undecided
Timo Aaltonen

Bug Description

On upgrading freeipa using the staging ppa, I encountered the following failure:

traceback:

2018-09-03T17:46:05Z INFO [Migrating to authselect profile]
2018-09-03T17:46:05Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state'
2018-09-03T17:46:05Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2018-09-03T17:46:05Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
2018-09-03T17:46:05Z DEBUG Starting external process
2018-09-03T17:46:05Z DEBUG args=[None, 'select', 'sssd', '--force']
2018-09-03T17:46:06Z DEBUG Process execution failed
2018-09-03T17:46:06Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2018-09-03T17:46:06Z DEBUG File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line 178, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_upgrade.py", line 52, in run
    server.upgrade()
  File "/usr/lib/python2.7/dist-packages/ipaserver/install/server/upgrade.py", line 2103, in upgrade
    upgrade_configuration()
  File "/usr/lib/python2.7/dist-packages/ipaserver/install/server/upgrade.py", line 1982, in upgrade_configuration
    migrate_to_authselect()
  File "/usr/lib/python2.7/dist-packages/ipaserver/install/server/upgrade.py", line 1696, in migrate_to_authselect
    tasks.migrate_auth_configuration(statestore)
  File "/usr/lib/python2.7/dist-packages/ipaplatform/redhat/tasks.py", line 238, in migrate_auth_configuration
    ipautil.run(authselect_cmd)
  File "/usr/lib/python2.7/dist-packages/ipapython/ipautil.py", line 518, in run
    preexec_fn=preexec_fn)
  File "/usr/lib/python2.7/subprocess.py", line 394, in __init__
    errread, errwrite)
  File "/usr/lib/python2.7/subprocess.py", line 1047, in _execute_child
    raise child_exception

2018-09-03T17:46:06Z DEBUG The ipa-server-upgrade command failed, exception: AttributeError: 'NoneType' object has no attribute 'rfind'
2018-09-03T17:46:06Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details:
AttributeError: 'NoneType' object has no attribute 'rfind'
2018-09-03T17:46:06Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information

Looking through /usr/lib/python2.7/dist-packages/ipaplatform/debian/tasks.py, I note that debian doesn't use authconfig. Presuming (perhaps wrongly) that authselect is similarly inapplicable, I modified def migrate_to_authselect() in /usr/lib/python2.7/dist-packages/ipaserver/install/server/upgrade.py to just return. With this change, upgrade completed successfully. I'm not sure if this is the correct approach.

Revision history for this message
Timo Aaltonen (tjaalton) wrote :

thanks for the bug and the suggestion, we probably need to do exactly that

Changed in freeipa (Ubuntu):
assignee: nobody → Timo Aaltonen (tjaalton)
status: New → Triaged
Revision history for this message
gianluca (amato) wrote :

I confirm that this works for me, too.

Revision history for this message
Timo Aaltonen (tjaalton) wrote :

would you be able to test this which should be good for upstream:

--- a/ipaplatform/debian/tasks.py
+++ b/ipaplatform/debian/tasks.py
@@ -57,6 +57,10 @@ class DebianTaskNamespace(RedHatTaskNamespace):
         # Debian doesn't use authconfig, nothing to restore
         return True

+ def migrate_auth_configuration(self, statestore):
+ # Debian doesn't have authselect
+ return True
+
     @staticmethod
     def parse_ipa_version(version):
         return BaseTaskNamespace.parse_ipa_version(version)

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package freeipa - 4.7.1-1

---------------
freeipa (4.7.1-1) unstable; urgency=medium

  * New upstream release.
    - fix-replicainstall.diff dropped, not applicable anymore
    - ipa-httpd-pwdreader-force-fqdn.diff dropped, obsolete
    - refresh patches
    - server: drop ipa-replica-prepare
  * dont-migrate-to-authselect.diff We don't have authselect, so just
    return true when trying to migrate to it. (LP: #1793994)
  * control: Move client dependency on chrony to recommends. (Closes:
    #909803)
  * control: Build server on any arch again.
  * tests: Don't fail the tests, just dump the log if something goes
    wrong.

 -- Timo Aaltonen <email address hidden> Tue, 09 Oct 2018 10:30:09 +0300

Changed in freeipa (Ubuntu):
status: Triaged → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers