freeipa

#9384 ipn-epn not reporting users with expiring passwords
Closed: fixed by dmgeurts. Opened by dmgeurts.

Closed: fixed
Reopen Issue

Issue

ipn-epn used to work, but no longer does. Only noticed as my password is about to expire and I did not receive any notification about it. Test email works fine.

Steps to Reproduce

  1. Install ipa-epn on FreeIPA server: sudo dnf install freeipa-client-epn
  2. And test with: sudo ipa-epn --dry-run

Actual behavior

user@ipa:~$ sudo ipa-epn --dry-run
[sudo] password for user:
Your password will expire in 6 day(s).
[]
The IPA-EPN command was successful

Expected behavior

I'd expect to see my username returned, instead of [].

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

freeipa-server-4.10.1-1.fc37.x86_64
freeipa-client-4.10.1-1.fc37.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-2.2.7-2.fc37.x86_64
package pki-ca is not installed
krb5-server-1.19.2-13.fc37.x86_64

Additional info:

Tail of /var/log/ipaepn.log:

2023-05-24T14:12:07Z DEBUG Destroyed connection context.rpcclient_140388800977552
2023-05-24T14:12:07Z DEBUG Dropped privileges to user=daemon, group=daemon
2023-05-24T14:12:07Z DEBUG Empty Result.
2023-05-24T14:12:07Z DEBUG 0 entries found
2023-05-24T14:12:07Z DEBUG Empty Result.
2023-05-24T14:12:07Z DEBUG 0 entries found
2023-05-24T14:12:07Z DEBUG Empty Result.
2023-05-24T14:12:07Z DEBUG 0 entries found
2023-05-24T14:12:07Z DEBUG Empty Result.
2023-05-24T14:12:07Z DEBUG 0 entries found
2023-05-24T14:12:07Z DEBUG Empty Result.
2023-05-24T14:12:07Z DEBUG 0 entries found
2023-05-24T14:12:07Z INFO The IPA-EPN command was successful

It warns on a configured set of days as to not spam users. Via epn.conf(5):

  notify_ttls <list of days>
         This  is the list of days before a password expiration when ipa-
         epn should notify a user that their password will soon require a
         reset. If this value is not specified then the default list will
         be used: 28, 14, 7, 3, 1.

Sadly I get no emails at all. But despite that, when using dry-run it should show the users with accounts about to expire, yet none are shown.

Well blow me down, I added a few more days to the list and now I do see a user listed...

The next thing I'm missing I bet is the cronjob...

Metadata Update from @dmgeurts:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.