Bug 1135516

Summary: freeipa-client needs python-backports-ssl_match_hostname
Product: [Fedora] Fedora Reporter: Marius Vollmer <mvollmer>
Component: freeipaAssignee: Rob Crittenden <rcritten>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 21CC: abokovoy, awilliam, mkosek, pviktori, pvoborni, rcritten, robatino, ssorce, stefw
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: AcceptedBlocker
Fixed In Version: freeipa-4.0.2-1.fc21 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-09-11 02:43:59 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1043119, 1139380    

Description Marius Vollmer 2014-08-29 13:56:02 UTC
Running ipa-client-install (via realmd) leads to this backtrace:

Traceback (most recent call last):
  File "/usr/sbin/ipa-client-install", line 2848, in <module>
    sys.exit(main())
  File "/usr/sbin/ipa-client-install", line 2829, in main
    rval = install(options, env, fstore, statestore)
  File "/usr/sbin/ipa-client-install", line 2528, in install
    api.finalize()
  File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 708, in finalize
    self.__do_if_not_done('load_plugins')
  File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 482, in __do_if_not_done
    getattr(self, name)()
  File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 645, in load_plugins
    self.import_plugins('ipalib')
  File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 689, in import_plugins
    __import__(fullname)
  File "/usr/lib/python2.7/site-packages/ipalib/plugins/otptoken.py", line 28, in <module>
    from backports.ssl_match_hostname import match_hostname
ImportError: No module named backports.ssl_match_hostname
 ! Running ipa-client-install failed

Comment 1 Petr Viktorin (pviktori) 2014-08-29 14:05:16 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/4515

Comment 2 Martin Kosek 2014-09-01 08:43:33 UTC
== Workaround ==

We are solving this report upstream, but note that to workaround it before official fix, please install "python-backports-ssl_match_hostname" before running ipa-client-install.

Comment 5 Fedora Update System 2014-09-08 08:14:46 UTC
freeipa-4.0.2-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/freeipa-4.0.2-1.fc21

Comment 6 Fedora Update System 2014-09-08 16:09:47 UTC
Package freeipa-4.0.2-1.fc21:
* should fix your issue,
* was pushed to the Fedora 21 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing freeipa-4.0.2-1.fc21'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-10298/freeipa-4.0.2-1.fc21
then log in and leave karma (feedback).

Comment 7 Adam Williamson 2014-09-10 04:20:28 UTC
transferring proposed blocker status from https://bugzilla.redhat.com/show_bug.cgi?id=1139917#c0 . I've verified the fix for this.

Comment 8 Adam Williamson 2014-09-10 04:20:40 UTC
*** Bug 1139917 has been marked as a duplicate of this bug. ***

Comment 9 Marius Vollmer 2014-09-10 06:29:37 UTC
(In reply to Fedora Update System from comment #6)
> Package freeipa-4.0.2-1.fc21:
> * should fix your issue,

It does, thanks!

Comment 10 Adam Williamson 2014-09-10 16:24:40 UTC
Discussed at 2014-09-10 blocker review meeting: http://meetbot.fedoraproject.org/fedora-blocker-review/2014-09-10/f21-blocker-review.2014-09-10-16.07.log.txt . Accepted as a blocker per https://fedoraproject.org/wiki/Fedora_21_Alpha_Release_Criteria#Remote_authentication , "It must be possible to join the system to a FreeIPA or Active Directory domain at install time and post-install, and the system must respect the identity, authentication and access control configuration provided by the domain."

Comment 11 Fedora Update System 2014-09-11 02:43:59 UTC
freeipa-4.0.2-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.