Running `apt install sssd-tools` causes sssd to be uninstalled

[CH]

I was trying to debug an authentication problem on one of our hosts, and managed to break authentication in a new and interesting way.

I ran `apt install sssd-tools`, and this is what showed up in /var/log/apt/history.log:

```
Start-Date: 2023-03-16 18:11:52
Commandline: apt install sssd-tools
Requested-By: user1005 (1005)
Upgrade: sssd-common:amd64 (2.2.3-3ubuntu0.9, 2.2.3-3ubuntu0.10), sssd-ldap:amd64 (2.2.3-3ubuntu0.9, 2.2.3-3ubuntu0.10), sssd-ad-common:amd64 (2.2.3-3ubuntu0.9, 2.2.3-3ubuntu0.10), python3-sss:amd64 (2.2.3-3ubuntu0.9, 2.2.3-3ubuntu0.10), sssd-krb5-common:amd64 (2.2.3-3ubuntu0.9, 2.2.3-3ubuntu0.10), sssd-ad:amd64 (2.2.3-3ubuntu0.9, 2.2.3-3ubuntu0.10), sssd-tools:amd64 (2.2.3-3ubuntu0.9, 2.2.3-3ubuntu0.10), sssd-krb5:amd64 (2.2.3-3ubuntu0.9, 2.2.3-3ubuntu0.10), sssd-proxy:amd64 (2.2.3-3ubuntu0.9, 2.2.3-3ubuntu0.10), libsss-idmap0:amd64 (2.2.3-3ubuntu0.9, 2.2.3-3ubuntu0.10)
Remove: sssd:amd64 (2.2.3-3ubuntu0.9), freeipa-client:amd64 (4.8.6-1ubuntu2), sssd-ipa:amd64 (2.2.3-3ubuntu0.9)
End-Date: 2023-03-16 18:12:41
```

For reasons I don't understand, apt decided to uninstall `sssd`, `sssd-ipa`, and `freeipa-client`.

1) This is on Ubuntu 20.04.5 LTS.
2) sssd-tools 2.2.3-3ubuntu0.10
3) Expected sssd-tools to be installed
4) sssd, sssd-ipa and freeipa-client were uninstalled, breaking authentication

[Timo Aaltonen (tjaalton)]

You had a pending update for sssd (0.10), and the package dependencies are such that they need to be in sync. Did it not prompt after offering to remove packages? It should.

[CH (pdragon99)]

Here's what appeared on the screen:
```
# apt-get install sssd-tools
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  augeas-lenses certmonger freeipa-common libaugeas0 libcurl3-nss libimagequant0 libipa-hbac0 liblua5.2-0 libnss3-tools librpm8 librpmio8 libwebpdemux2 libwebpmux3 libxmlrpc-core-c3 nss-plugin-pem oddjob oddjob-mkhomedir python3-augeas python3-bs4 python3-cffi python3-html5lib
  python3-ipaclient python3-ipalib python3-ldap python3-libipa-hbac python3-lxml python3-nss python3-olefile python3-pil python3-pycparser python3-qrcode python3-soupsieve python3-usb python3-webencodings python3-yubico rpm-common
Use 'sudo apt autoremove' to remove them.
The following additional packages will be installed:
  libldb2 libsmbclient libsss-idmap0 libtalloc2 libtdb1 libtevent0 libwbclient0 python3-ldb python3-sss python3-talloc samba-libs sssd-ad sssd-ad-common sssd-common sssd-krb5 sssd-krb5-common sssd-ldap sssd-proxy
Suggested packages:
  adcli libsasl2-modules-ldap
Recommended packages:
  sssd
The following packages will be REMOVED:
  freeipa-client sssd sssd-ipa
The following NEW packages will be installed:
  sssd-tools
The following packages will be upgraded:
  libldb2 libsmbclient libsss-idmap0 libtalloc2 libtdb1 libtevent0 libwbclient0 python3-ldb python3-sss python3-talloc samba-libs sssd-ad sssd-ad-common sssd-common sssd-krb5 sssd-krb5-common sssd-ldap sssd-proxy
18 upgraded, 1 newly installed, 3 to remove and 140 not upgraded.
Need to get 7,743 kB of archives.
After this operation, 430 kB disk space will be freed.
Do you want to continue? [Y/n]
```

Reading it now, I can see that it clearly says it's going to remove freeipa-client, sssd and sssd-ipa, but for the life of me I don't understand why it's removing them and not upgrading them to version 0.10 like it did with sssd-ad, sssd-common, etc.

Basically, I trust apt to do the right thing, and really didn't expect the removal of any packages, so I didn't read the output closely.

[Timo Aaltonen (tjaalton)]

So can you still replicate this? What does it do if you then run 'apt install freeipa-client', would it pull extra updates? I wonder if some other update holds sssd-ipa back.

[CH (pdragon99)]

The copied output from above was a replication.
We did `apt install freeipa-client sssd sssd-ipa` and they were installed again.

[Sergio Durigan Junior (sergiodj)]

Hi there,

I'm trying to reproduce this locally, but so far I haven't been able to make much progress. Here's what I did:

1) Download the .deb's for version 2.2.3-3ubuntu0.9 on Focal (from https://launchpad.net/ubuntu/+source/sssd/2.2.3-3ubuntu0.9/+build/24144892).

2) Install sssd from the .deb files mentioned above, but without installing sssd-tools.

3) Invoke "apt install sssd-tools --dry-run".

Here's what I see:

# apt install sssd-tools --dry-run
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
  libfreetype6
Use 'apt autoremove' to remove it.
The following additional packages will be installed:
  libipa-hbac0 libsss-idmap0 python3-sss sssd sssd-ad sssd-ad-common sssd-common sssd-ipa sssd-krb5 sssd-krb5-common sssd-ldap sssd-proxy
Suggested packages:
  adcli libsasl2-modules-ldap
The following NEW packages will be installed:
  sssd-tools
The following packages will be upgraded:
  libipa-hbac0 libsss-idmap0 python3-sss sssd sssd-ad sssd-ad-common sssd-common sssd-ipa sssd-krb5 sssd-krb5-common sssd-ldap sssd-proxy
12 upgraded, 1 newly installed, 0 to remove and 45 not upgraded.
Inst sssd-ad [2.2.3-3ubuntu0.9] (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64]) [sssd:amd64 ]
Inst sssd-ldap [2.2.3-3ubuntu0.9] (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64]) [sssd:amd64 ]
Inst sssd-krb5 [2.2.3-3ubuntu0.9] (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64]) [sssd:amd64 ]
Inst sssd-ipa [2.2.3-3ubuntu0.9] (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64]) [sssd:amd64 ]
Inst sssd-ad-common [2.2.3-3ubuntu0.9] (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64]) [sssd:amd64 ]
Inst sssd-common [2.2.3-3ubuntu0.9] (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64]) [sssd:amd64 sssd-krb5-common:amd64 sssd-proxy:amd64 ]
Inst sssd-krb5-common [2.2.3-3ubuntu0.9] (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64]) [sssd:amd64 sssd-proxy:amd64 ]
Inst sssd [2.2.3-3ubuntu0.9] (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64]) [sssd-proxy:amd64 ]
Inst sssd-proxy [2.2.3-3ubuntu0.9] (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64]) []
Inst python3-sss [2.2.3-3ubuntu0.9] (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64]) []
Inst libsss-idmap0 [2.2.3-3ubuntu0.9] (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64]) []
Inst libipa-hbac0 [2.2.3-3ubuntu0.9] (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64])
Inst sssd-tools (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64])
Conf sssd-ad (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64])
Conf sssd-ldap (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates, Ubuntu:20.04/focal-security [amd64])
Conf sssd-krb5 (2.2.3-3ubuntu0.10 Ubuntu:20.04/focal-updates...

[Launchpad Janitor (janitor)]

[Expired for sssd (Ubuntu) because there has been no activity for 60 days.]