Bug 1562044

Summary: authconfig --savebackup no longer takes a path
Product: [Fedora] Fedora Reporter: Christian Heimes <cheimes>
Component: authselectAssignee: Pavel Březina <pbrezina>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 28CC: cheimes, jlieskov, pbrezina, tmraz
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: authselect-0.4-1.fc28 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-04-10 22:58:34 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Christian Heimes 2018-03-29 12:32:24 UTC
Description of problem:
ipa-backup uses the authconfig from authselect-compat to backup the current configuration. It calls "authconfig --savebackup /var/lib/ipa/auth_backup". In Fedora 28, the invocation is failing with "authconfig: error: unrecognized arguments: /var/lib/ipa/auth_backup". The --savebackup argument no longer takes a path.

Version-Release number of selected component (if applicable):
authselect-compat-0.3.2-1.fc28.x86_64

How reproducible:
always

Steps to Reproduce:
1. /usr/sbin/authconfig --savebackup /var/lib/ipa/auth_backup'

Actual results:
authconfig: error: unrecognized arguments: /var/lib/ipa/auth_backup


Expected results:
authconfig creates a backup at /var/lib/ipa/auth_backup

Additional info:
The bug breaks ipa-backup, see upstream bug https://pagure.io/freeipa/issue/7478 . We are currently in the process of moving to authselect. However the PR is blocked by other issues.

Comment 1 Christian Heimes 2018-03-29 14:50:11 UTC
I just noticed that savebackup isn't supported at all:

# authconfig --savebackup
Running authconfig compatibility tool.

IMPORTANT: authconfig is replaced by authselect, please update your scripts.
See Fedora 28 Change Page: https://fedoraproject.org/wiki/Changes/AuthselectAsDefault
See man authselect-migration(7) to help you with migration to authselect
Warning: These options are not supported anymore and have no effect:
  --savebackup

Error: Please, provide --updateall option.

Comment 2 Christian Heimes 2018-03-29 15:07:17 UTC
I have created https://github.com/freeipa/freeipa/pull/1760 to temporarily disable backup and restore of auth config data.

Comment 3 Pavel Březina 2018-04-03 11:53:00 UTC
I fixed --savebackup and --restorebackup so it takes a path and does not broken execution [1].

I also have a patch ready, that will make authconfig exit with 0 instead of 1 if you provide or --restorebackup --restorelastbackup so it will not fail script execution [2].

The purpose of compat utility is to make authentication work if it is used in kickstart/installation scripts. It is not desirable to implement all authconfig features and backup/restore was one of the feature that did not go in because it should not be needed when installing the system.

Authselect itself will not do any modifications to non-authselect system unless --force parameter and once it is used, administrator is not supposed to modify the configuration manually. So backup/restore is not strictly needed here.

Since you will switch to authselect and thus not relying on authconfig backup anymore, will [2] be enough to fix this issue and enable testing or do you require to actually implement backup and restore support?

[1] https://github.com/pbrezina/authselect/commit/c57d22bcb377000c04269d691cd752e8eaa956e9
[2] https://github.com/pbrezina/authselect/commit/a0a10c4cf9551080c820325953ea93a849b54122

Comment 4 Christian Heimes 2018-04-06 08:41:21 UTC
I added a workaround to FreeIPA master and disabled authconfig save/restore backup feature temporarily. FreeIPA development is no longer blocked by the issue. We'll move to authselect soon, too. The PR is still under development.

Your patch [1] is a good idea. Patch [2] is no longer required for FreeIPA development. I don't like it, too. The compat authconfig command should fail with a proper error code.

Comment 5 Fedora Update System 2018-04-09 10:50:54 UTC
authselect-0.4-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-d5f37ac141

Comment 6 Fedora Update System 2018-04-09 21:55:53 UTC
authselect-0.4-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-d5f37ac141

Comment 7 Fedora Update System 2018-04-10 22:58:34 UTC
authselect-0.4-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.