[SRU] Timeout for listing GPOs is not enough in some cases

[Denison Barbosa]

[Impact]

Adsys has a fixed timeout for listing the GPOs. This can cause issues on slower machines or in cases with many policies to be listed. Adding a configurable timeout prevents the daemon from timing out the listing process during its execution.

[Test Plan]

1. Configure A LOT (this can vary depending on the VM setup) of GPOs in the AD controller;

2. Install adsys on the client, without changing the default settings;

3. Run `adsysctl policy update --all`;

4. With the default timeout, the command should timeout due to not being able to fetch all policies in time;

5. Update adsys configuration file (/etc/adsys.yaml) and increase the gpo_list_timeout;

6. Repeat step 3;

7. With an increased timeout, the command should fetch all policies with no issues;

[Where Problems Could Occur]

If misconfigured by the user, the timeout could be insufficient and AD users would not be allowed to authenticate.

Upstream PR: https://github.com/ubuntu/adsys/pull/1097

[Launchpad Janitor (janitor)]

This bug was fixed in the package adsys - 0.15.2

---------------
adsys (0.15.2) oracular; urgency=medium

  [ Davi Henrique ]
  * Ignore casing when fetching Registry.pol (LP: #2080390)
  * Add configurable timeout for listing GPOs (LP: #2081966)

  [ Felipe Alencastro ]
  * Add support for DCONF usb settings (LP: #2081968)

 -- Denison Barbosa <email address hidden> Wed, 25 Sep 2024 08:06:40 -0400

[Andreas Hasenack (ahasenack)]

Hello Denison, or anyone else affected,

Accepted adsys into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/adsys/0.14.3~24.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Denison, or anyone else affected,

Accepted adsys into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/adsys/0.14.3~22.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Denison Barbosa (justdenis)]

The test plan was executed for Noble (24.04) and I confirm it was successful. The package version used for the tests is the one proposed, as can be seen by the output of apt-cache policy:
adsys:
  Installed: 0.14.3~24.04
  Candidate: 0.14.3~24.04
  Version table:
 *** 0.14.3~24.04 100
        100 http://archive.ubuntu.com/ubuntu noble-proposed/main amd64 Packages

The following steps were executed:

1) Create a fresh VM with Ubuntu 24.04;
2) Join an active directory domain (created for test purposes);
3) Install adsys;
4) Instead of following the original plan of adding a lot of GPOs, it's better to decrease the GPO list timeout and force a failure: this can be done by setting gpo_list_timeout to 0 in /etc/adsys.yaml;
5) Try to update the GPOs applied to the client. It fails due to not having enough time to fetch the required assets;
6) Increase the gpo_list_timeout in /etc/adsys.yaml (the default value for the key is 10);
7) Try to update the GPOs applied to the client. If the configured timeout is enough, adsys successfully fetches the required assets;

After step 7, adsys successfully fetched the required GPOs and its assets and applied to the client.

[Denison Barbosa (justdenis)]

The test plan was executed for Jammy (22.04) and I confirm it was successful. The package version used for the tests is the one proposed, as can be seen by the output of apt-cache policy:
adsys:
  Installed: 0.14.3~22.04
  Candidate: 0.14.3~22.04
  Version table:
 *** 0.14.3~22.04 500
        500 http://archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages

The following steps were executed:

1) Create a fresh VM with Ubuntu 22.04;
2) Join an active directory domain (created for test purposes);
3) Install adsys;
4) Instead of following the original plan of adding a lot of GPOs, it's better to decrease the GPO list timeout and force a failure: this can be done by setting gpo_list_timeout to 0 in /etc/adsys.yaml;
5) Try to update the GPOs applied to the client. It fails due to not having enough time to fetch the required assets;
6) Increase the gpo_list_timeout in /etc/adsys.yaml (the default value for the key is 10);
7) Try to update the GPOs applied to the client. If the configured timeout is enough, adsys successfully fetches the required assets;

After step 7, adsys successfully fetched the required GPOs and its assets and applied to the client.

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for adsys has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package adsys - 0.14.3~24.04

---------------
adsys (0.14.3~24.04) noble; urgency=medium

  [Davi Henrique]
  * Ignore casing when fetching Registry.pol (LP: #2080390)
  * Add configurable timeout for listing GPOs (LP: #2081966)

  [Felipe Alencastro]
  * Add support for DCONF usb settings (LP: #2081968)

 -- Denison Barbosa <email address hidden> Tue, 19 Nov 2024 06:28:25 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package adsys - 0.14.3~22.04

---------------
adsys (0.14.3~22.04) jammy; urgency=medium

  [Davi Henrique]
  * Ignore casing when fetching Registry.pol (LP: #2080390)
  * Add configurable timeout for listing GPOs (LP: #2081966)

  [Felipe Alencastro]
  * Add support for DCONF usb settings (LP: #2081968)

 -- Denison Barbosa <email address hidden> Tue, 19 Nov 2024 06:38:20 -0400