freeipa

#9874 Nightly test failure in test_sudo.py::TestSudo_Functional::test_007_sudorule_offline_caching_option_command
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

The new nightly test test_sudo.py::TestSudo_Functional::test_007_sudorule_offline_caching_option_command is failing. Test scenario:
- add a sudorule allowing testuser1 to run the 'date' command without password on ipa client
- check that 'sudo -u root -n date' works on ipa client
- stop the master
- check that 'sudo -u root -n date' works on ipa client (because the rule is in the cache).

Actual behavior

The test fails because there are additional steps performed after the master is stopped: the method clears the cache on the client (while it should skip that part).

Expected behavior

Test should succeed.

Example of run in https://$ARTIFACTS_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-latest-sssd/master/2025-11-08_15-55/sssd/test_sudo/2/report.html?sort=result where we can see that there are unwanted calls that clear SSSD cache on the client:

INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN ['kinit', 'testuser1']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd696:transport.py:513 RUN ['kinit', 'testuser1']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd696:transport.py:557 Password for testuser1@UFREEIPA.TEST: 
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd696:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN su -c "sudo -u root -n date" testuser1
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd697:transport.py:513 RUN su -c "sudo -u root -n date" testuser1
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd697:transport.py:557 Mon Nov 10 10:00:18 AM UTC 2025
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd697:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN ['date', '+%a']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd698:transport.py:513 RUN ['date', '+%a']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd698:transport.py:557 Mon
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd698:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:415 STAT /bin/systemctl
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd699:transport.py:513 RUN ['ls', '/bin/systemctl']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd699:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN ['systemctl', 'stop', 'sssd']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd700:transport.py:513 RUN ['systemctl', 'stop', 'sssd']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd700:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN find /var/lib/sss/db -name '*.ldb' | xargs rm -fv
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd701:transport.py:513 RUN find /var/lib/sss/db -name '*.ldb' | xargs rm -fv
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd701:transport.py:557 removed '/var/lib/sss/db/config.ldb'
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd701:transport.py:557 removed '/var/lib/sss/db/cache_ufreeipa.test.ldb'
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd701:transport.py:557 removed '/var/lib/sss/db/timestamps_ufreeipa.test.ldb'
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd701:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN ['rm', '-fv', '/var/lib/sss/mc/group']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd702:transport.py:513 RUN ['rm', '-fv', '/var/lib/sss/mc/group']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd702:transport.py:557 removed '/var/lib/sss/mc/group'
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd702:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN ['rm', '-fv', '/var/lib/sss/mc/passwd']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd703:transport.py:513 RUN ['rm', '-fv', '/var/lib/sss/mc/passwd']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd703:transport.py:557 removed '/var/lib/sss/mc/passwd'
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd703:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN ['rm', '-fv', '/var/lib/sss/mc/initgroups']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd704:transport.py:513 RUN ['rm', '-fv', '/var/lib/sss/mc/initgroups']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd704:transport.py:557 removed '/var/lib/sss/mc/initgroups'
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd704:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN ['systemctl', 'start', 'sssd']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd705:transport.py:513 RUN ['systemctl', 'start', 'sssd']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd705:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN ['kinit', 'testuser1']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd706:transport.py:513 RUN ['kinit', 'testuser1']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd706:transport.py:557 Password for testuser1@UFREEIPA.TEST: 
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd706:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN su -c "echo Secret123! | sudo -l -S" testuser1
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd707:transport.py:513 RUN su -c "echo Secret123! | sudo -l -S" testuser1
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd707:transport.py:557 Matching Defaults entries for testuser1 on client:
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd707:transport.py:557     !visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/var/lib/snapd/snap/bin
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd707:transport.py:557 
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd707:transport.py:557 User testuser1 may run the following commands on client:
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd707:transport.py:557     (root) NOPASSWD: /bin/date
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd707:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.master.IPAOpenSSHTransport:transport.py:391 RUN ['/usr/sbin/ipactl', 'stop']
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd425:transport.py:513 RUN ['/usr/sbin/ipactl', 'stop']
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd425:transport.py:557 Stopping ipa-dnskeysyncd Service
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd425:transport.py:557 Stopping ipa-otpd Service
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd425:transport.py:557 Stopping pki-tomcatd Service
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd425:transport.py:557 Stopping ipa-custodia Service
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd425:transport.py:557 Stopping httpd Service
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd425:transport.py:557 Stopping named Service
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd425:transport.py:557 Stopping kadmin Service
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd425:transport.py:557 Stopping krb5kdc Service
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd425:transport.py:557 Stopping Directory Service
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd425:transport.py:557 ipa: INFO: The ipactl command was successful
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd425:transport.py:217 Exit code: 0
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN su -c "sudo -u root -n date" testuser1
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd708:transport.py:513 RUN su -c "sudo -u root -n date" testuser1
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd708:transport.py:557 sudo: PAM account management error: Unknown error -1
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd708:transport.py:557 sudo: a password is required
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd708:transport.py:217 Exit code: 1
INFO     ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:391 RUN ['date', '+%a']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd709:transport.py:513 RUN ['date', '+%a']
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd709:transport.py:557 Mon
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.cmd709:transport.py:217 Exit code: 0

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8014

master:

  • d3909d8601e0bdb6c78dcdf2507e7bf71f656e8f test_sudo: do not clean the cache for offline cache tests

ipa-4-12:

  • 8e9e516299883e5f4f820c3a3c444513b896a36a test_sudo: do not clean the cache for offline cache tests

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

test-failure tests

None
None
None
https://github.com/freeipa/freeipa/pull/8014
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.