This is in reference to issue 1137 in freeipa/ansible-freeipa.

Issue

freeipa/ansible-freeipa/roles/ipaclient/module_utils/ansible_ipa_client.py sets the options.unattended value to True here.

But when ansible-freeipa/roles/ipaclient/library/ipaclient_setup_nss.py makes the call tasks.modify_nsswitch_pam_stack(**the_options) which calls def modify_nsswitch_pam_stack() in freeipa/ipaplatform/debian/tasks.py, the ipautil.run command in that function does not pass the "unattended"/non-interactive state of the session to the Debian OS utilities such as pam-auth-update.

This results in situations where ansible-freeipa will hang waiting for an interactive prompt to be confirmed even though it has set the options to be unattended.

Steps to Reproduce

1. Modify one of the files /etc/pam.d/common-{auth,account,password,session} so that it is modified outside of pam-auth-update
2. Run freeipa/ansible-freeipa Ansible script and install an IPA Client on an Ubuntu 20.04 or newer, and also on Debian 12 or newer system.

Actual behavior

When the options.unattended flag is set, calls to pam-auth-update (or any Debian system functions) through ipautil.run will call "whiptail" and prompt for some confirmation because PAM files were locally modified.

Expected behavior

Any instances in which ipautil.run is called on a Debian system, include the environment variable "DEBIAN_FRONTEND=noninteractive" to be set so that native operating system functions and modules that are subsequently called will understand to run in a non-interactive mode.

Additional info:

Please refer to for details: https://github.com/freeipa/ansible-freeipa/issues/1137