freeipa

#8630 Do not resolve user/group UID/GID in the service constructors
Closed: fixed by abbra. Opened by abbra.

Closed: fixed
Reopen Issue

Service constructors are called even when the service itself is not configured. A common pattern in FreeIPA code is to instantiate a service and check whether it is configured, then perform uninstall of the service configuration. This fails if the service constructor does depend on the artifacts only present if other (relevant to the service) packages were installed.

A common pattern is:

  svc = SVCClass(..)
  if svc.is_configured(): 
      svc.uninstall()

Most of DNS-related service classes do resolution of UID/GIDs for ODS and NAMED in their constructors which breaks uninstallation of a DNS-less FreeIPA deployment because neither 'bind' nor 'opendnssec' packages are not installed and user and group they provide are not available in the system:

  File "/usr/lib/python3.6/site-packages/ipaserver/install/server/install.py", line 1184, in uninstall
    dns.uninstall()
  File "/usr/lib/python3.6/site-packages/ipaserver/install/dns.py", line 405, in uninstall
    ods = opendnssecinstance.OpenDNSSECInstance(fstore)
  File "/usr/lib/python3.6/site-packages/ipaserver/install/opendnssecinstance.py", line 70, in __init__
    self.named_gid = constants.NAMED_GROUP.gid
  File "/usr/lib/python3.6/site-packages/ipaplatform/base/constants.py", line 96, in gid
    return self.entity.gr_gid
  File "/usr/lib/python3.6/site-packages/ipaplatform/base/constants.py", line 89, in entity
    raise ValueError(f"group '{self!s}' not found") from None
2020-12-21T18:03:50Z DEBUG The ipa-server-install command failed, exception: ValueError: group 'named' not found
2020-12-21T18:03:50Z ERROR group 'named' not found

Metadata Update from @abbra:
- Issue assigned to abbra

Metadata Update from @abbra:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1909876

PR: https://github.com/freeipa/freeipa/pull/5376

master:

  • 8e16a1d169ddd6b6c1fee8f666ba7660b6d8ed6e opendnssecinstance: use late binding for UID/GID resolution
  • b6a645338c447f8081c3e3501b7bfeb56178ca1d dnskeysyncinstance: use late binding for UID/GID resolution
  • 4c4f16fc9cd08385fda90452669484ab647c47eb odsexporterinstance: use late binding for UID/GID resolution

ipa-4-9:

  • eb42b1097a89c5e863bd4fd1714d5ce84a47b718 opendnssecinstance: use late binding for UID/GID resolution
  • eae9f0d80c8fe67fdd44a9c772ce2c4234b35ba0 dnskeysyncinstance: use late binding for UID/GID resolution
  • eca22818c911646a111d2257213ee22737e2555f odsexporterinstance: use late binding for UID/GID resolution

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 69d480003bc6a7c75280c3c1a5e30cd252edcaec ipatests: Test if server setup without dns uninstall properly
  • 74b4d7e4df3b5406bc62ed1663318430e1739d1c ipatests: Add test_uninstall.py to nightly definitions

master:

  • f621d607bb7852b2aaac4626ede029bf11951319 Revert "ipatests: Test if server setup without dns uninstall properly"
  • 776d575c0607ad5c390b2199a07f0261e0a0cb8f Revert "ipatests: Add test_uninstall.py to nightly definitions"
  • 3a584803da697b80d49590223be632a7451e1b7e ipatests: Test if server setup without dns uninstall properly

ipa-4-9:

  • 85674f16a18a6d4917dcf56330dc122902b53475 ipatests: Test if server setup without dns uninstall properly
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.