freeipa

#8516 Nightly test failure (master) in ipa trust-add
Closed: fixed by abbra. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

The nightly testing_master_latest now fails in multiple tests in a call to ipa trust-add. See PR #427:
- fedora-latest/test_idviews: report, logs
- test_ipahealthcheck_adtrust: report, logs
- test_winsyncmigrate: report, logs

The failures are similar, in a call to ipa trust-add:

Command: ipa trust-add --type ad ad.test --range-type ipa-ad-trust --admin Administrator --password repeatedly failed 15 times, exceeding the timeout of 30 seconds.

/var/log/httpd/error_log shows the following:

ipa: ERROR: Helper fetch_domains was called for forest ad.test, return code is 1
ipa: ERROR: Standard output from the helper:
---
ipa: ERROR: Error output from the helper:
Traceback (most recent call last):
  File "/usr/libexec/ipa/oddjob/com.redhat.idm.trust-fetch-domains", line 250, in <module>
    retrieve_keytab(api, ccache_name, oneway_keytab_name, oneway_principal)
  File "/usr/libexec/ipa/oddjob/com.redhat.idm.trust-fetch-domains", line 99, in retrieve_keytab
    constants.SSSD_USER.chown(oneway_keytab_name)
  File "/usr/lib/python3.8/site-packages/ipaplatform/base/constants.py", line 69, in chown
    gid = self.pgid
  File "/usr/lib/python3.8/site-packages/ipaplatform/base/constants.py", line 61, in pgid
    return self.entity.pw_gid
  File "/usr/lib/python3.8/site-packages/ipaplatform/base/constants.py", line 49, in entity
    raise ValueError(f"user '{self!s}' not found") from None
 ValueError: user 'sssd' not found
--
ipa: INFO: [jsonserver_session] admin@IPA.TEST: trust_add/1('ad.test', trust_type='ad', realm_admin='Administrator', realm_passwd='********', range_type='ipa-ad-trust', version='2.239'): ServerCommandError

The regression seems linked to commit 72fb4e6 after which a ValueError is returned instead of a KeyError: see line 49.

Good catch! I propose that either com.redhat.idm.trust-fetch-domain should catch ValueError or User/Group wrappers should raise KeyError instead of ValueError. In my opinion it's easier to change com.redhat.idm.trust-fetch-domain and ValueError more appropriate for missing user/group than KeyError.

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/5150

Sounds good. Could you please submit ValueError patch?

master:

  • 4e30a48d3cde4cab57a711503764bb9dddf2d53b trust-add: Catch correct exception when chown SSSD

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

test-failure tests

None
None
None
https://github.com/freeipa/freeipa/pull/5150
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.