fedora-infrastructure

#11717 IPA refuses password changes
Closed: Fixed with Explanation by abompard. Opened by abompard.

Closed: Fixed with Explanation
Reopen Issue

In a matrix message that I can't find anymore, @kevin notified me that Noggin seems to refuse to change user passwords now.
I've looked at the logs, there are failed attempts indeed, and on IPA's logs it looks like:

[Sat Jan 13 18:01:28.558108 2024] [:warn] [pid 1223708:tid 140162289821440] [client 10.3.163.123:41292] failed to set perms (3140) on file (/run/ipa/ccaches/kevintest2@FEDORAPROJECT.ORG-A0C3vf)!, referer: https://ipa02.iad2.fedoraproject.org/ipa
[Sat Jan 13 18:01:28.566053 2024] [wsgi:error] [pid 1223703:tid 140162568984320] [remote 10.3.163.123:41292] ipa: INFO: [jsonserver_session] kevintest2@FEDORAPROJECT.ORG: ping(version='2.235'): SUCCESS
[Sat Jan 13 18:01:28.569506 2024] [:warn] [pid 1223708:tid 140162509416192] [client 10.3.163.123:41292] failed to set perms (3140) on file (/run/ipa/ccaches/kevintest2@FEDORAPROJECT.ORG-A0C3vf)!, referer: https://ipa02.iad2.fedoraproject.org/ipa
[Sat Jan 13 18:01:28.588126 2024] [wsgi:error] [pid 1223705:tid 140162568984320] [remote 10.3.163.123:41292] ipa: INFO: [jsonserver_session] kevintest2@FEDORAPROJECT.ORG: user_find(None, whoami=True, all=True, raw=False, version='2.235', no_members=True, pkey_only=False): SUCCESS
[Sat Jan 13 18:01:28.590975 2024] [:warn] [pid 1223708:tid 140162323392256] [client 10.3.163.123:41292] failed to set perms (3140) on file (/run/ipa/ccaches/kevintest2@FEDORAPROJECT.ORG-A0C3vf)!, referer: https://ipa02.iad2.fedoraproject.org/ipa
[Sat Jan 13 18:01:28.896807 2024] [wsgi:error] [pid 1223703:tid 140162568984320] [remote 10.3.163.123:41292] ipa: INFO: [jsonserver_session] kevintest2@FEDORAPROJECT.ORG: user_show('kevintest2', rights=False, all=True, raw=False, version='2.235', no_members=False): SUCCESS
[Sat Jan 13 18:01:28.902069 2024] [:warn] [pid 1223708:tid 140162542987008] [client 10.3.163.123:41292] failed to set perms (3140) on file (/run/ipa/ccaches/kevintest2@FEDORAPROJECT.ORG-A0C3vf)!, referer: https://ipa02.iad2.fedoraproject.org/ipa
[Sat Jan 13 18:01:29.040716 2024] [wsgi:error] [pid 1223704:tid 140162568984320] [remote 10.3.163.123:41292] ipa: INFO: [jsonserver_session] kevintest2@FEDORAPROJECT.ORG: otptoken_find(None, ipatokenowner='kevintest2', all=True, raw=False, version='2.235', no_members=True, pkey_only=False): SUCCESS
[Sat Jan 13 18:01:29.045160 2024] [wsgi:error] [pid 1223703:tid 140162568984320] [remote 10.3.163.123:41292] ipa: INFO: WSGI change_password.__call__:
[Sat Jan 13 18:01:29.045223 2024] [wsgi:error] [pid 1223703:tid 140162568984320] [remote 10.3.163.123:41292] ipa: ERROR: Rejecting request with missing Referer
[Sat Jan 13 18:01:29.045254 2024] [wsgi:error] [pid 1223703:tid 140162568984320] [remote 10.3.163.123:41292] ipa: INFO: 400 Bad Request: denied

This is apparently due to a very recent commit that has probably been backported to the rpm.
I'll see how we can adapt our library to include the referer.

Metadata Update from @abompard:
- Issue assigned to abompard

Metadata Update from @abompard:
- Issue private status set to: True

I found a fix and sent it upstream: https://github.com/waldur/python-freeipa/pull/54
I've also included the patch in our OpenShift deployment: https://github.com/fedora-infra/noggin/commit/dd1e2be70919c4f8e1d4ed182a99ef4105045ef1

I've deployed it to staging and prod, it seems to work fine now.

Metadata Update from @abompard:
- Assignee reset
- Issue close_status updated to: Fixed with Explanation
- Issue private status set to: False (was: True)
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.