freeipa

#7562 Regression: authselect 0.4-3 breaks FreeIPA sudo rules
Closed: fixed Opened by abbra.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Fedora): Bug 1582111

While FreeIPA does not explicitly run authselect for initial configuration on the client, we ran authconfig in older versions (before 4.6.90.pre2) and thus created configurations that authselect considered 'valid'. However, these configurations will be migrated to 'no sudo' by default with authselect 0.4-3.fc28 or later. As result, we need to:
- change IPA server upgrade code to include 'with-sudo' or 'authselect enable-feature with-sudo'
- enable IPA client to run the same in case it was originally configured before 4.6.90.pre2 and sudo wasn't disabled.

Description of problem: I was testing a FreeIPA update
(https://bodhi.fedoraproject.org/updates/FEDORA-2018-93dfeefc68) which pulls in
a newer authselect (0.4-3). This breaks FreeIPA centrally managed sudo rules.
Turns out this isn't the fault of freeipa, but just upgrading authselect from
the previous version 0.4-1 to 0.4-3 already breaks it
Version-Release number of selected component (if applicable):
0.4-3.fc28
How reproducible: Always
Steps to Reproduce:
1. Enroll into a FreeIPA domain
2. Add a sudo rule for the "admin" user:
   ipa sudorule-add --hostcat=all --cmdcat=all All && ipa sudorule-add-user
--groups=admins All
3. Log in as that user and try to run `sudo whoami`
Actual results:
$ sudo whoami
[sudo] password for admin:
admin is not in the sudoers file.  This incident will be reported.
Expected results:
sudo succeeds (like it does with the previous authselect)
Additional info:
 * This is broken for both qualified (admin@cockpit.lan) or unqualified (admin)
user names.
 * This was detected by Cockpit's integration tests when trying to refresh the
Fedora 28 image (https://github.com/cockpit-project/cockpit/pull/9224)

Metadata Update from @abbra:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1582111

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1582111, https://bugzilla.redhat.com/show_bug.cgi?id=1577615 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1582111)

Issue linked to Bugzilla: Bug 1577615

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/2035

Metadata Update from @cheimes:
- Issue set to the milestone: FreeIPA 4.7

master:

  • eda831dba1e09e7f4660c64756343538042b48e0 Installer: configure authselect with-sudo

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.