Bug 1723273

Summary:	RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
Product:	Red Hat Enterprise Linux 8	Reporter:	Arya Rajendran <arajendr>
Component:	sssd	Assignee:	Tomas Halman <thalman>
Status:	CLOSED ERRATA	QA Contact:	sssd-qe <sssd-qe>
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	8.2	CC:	atikhono, ftrivino, grajaiya, jhrozek, lmiksik, lslebodn, mupadhye, mzidek, pbrezina, sgoveas, thalman, tscherf
Target Milestone:	rc	Keywords:	FutureFeature, Triaged
Target Release:	8.2
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	sync-to-jira
Fixed In Version:	sssd-2.3.0-7.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-04 02:04:28 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Arya Rajendran 2019-06-24 06:39:57 UTC

1. Proposed title of this feature request

RFE: Add option to specify alternate sssd config file location with "sssctl config-check"

2. What is the nature and description of the request?

To allow sssctl config-check to check alternate sssd config file location.

Eg. sssctl config-check allows checking of in-place sssd config. If we want to test the config before copying into place, it should allow us to provide an external file to check. Eg. sssctl config-check -f /tmp/sssd.conf

This would make it compatible to configuration management/orchestration tools that allow validation checking before changing config.

3. Can you List the business requirements here

This would make it compatible to configuration management/orchestration tools that allow validation checking before changing config.
 

4. How would the you like to achieve this? (List the functional requirements here)

Provide "-f <file location>" flag to command
 
5. Is there already an existing RFE upstream or in Red Hat Bugzilla?

No
 

6. Do you have any specific timeline dependencies and which release would they like to target (i.e. RHEL 7)?

RHEL 7


7. List any affected packages or components.

sssd-tools
 

8. Would you be able to assist in testing this functionality if implemented?

Yes

Comment 5 Tomas Halman 2020-05-06 12:53:20 UTC

Upstream ticket:
https://github.com/SSSD/sssd/issues/5142

Comment 6 Tomas Halman 2020-05-06 13:02:41 UTC

Upstream PR: https://github.com/SSSD/sssd/pull/5143

Comment 7 Pavel Březina 2020-05-21 09:01:06 UTC

Pushed PR: https://github.com/SSSD/sssd/pull/5143

* `master`
    * 61f4aaa56ea876fb75c1366c938818b7799408ab - sssctl: sssctl config-check alternative config file

Comment 12 Madhuri 2020-07-15 15:15:08 UTC

[root@ci-vm-10-0-107-13 ~]# rpm -qa sssd sssd-tools
sssd-tools-2.3.0-4.el8.x86_64
sssd-2.3.0-4.el8.x86_64

Checking the --help
[root@ci-vm-10-0-107-13 ~]# sssctl config-check --help
Usage: sssctl config-check [OPTIONS...]

Command options:
-c, --config=STRING Specify a non-default config file

Help options:
-?, --help Show this help message
--usage Display brief usage message

The description is pretty short to understand.

case 1:
check with default sssd conf

[root@ci-vm-10-0-107-13 ~]# sssctl config-check -c /etc/sssd/sssd.conf
Issues identified by validators: 0

Messages generated during configuration merging: 1
File /etc/sssd/conf.d/01_snippet.conf did not pass access check. Skipping.

Used configuration snippet files: 0

Case 2:
Check with file under conf.d with proper permission and ownership
[root@ci-vm-10-0-107-13 ~]# chmod 600 /etc/sssd/conf.d/01_snippet.conf
[root@ci-vm-10-0-107-13 ~]# sssctl config-check -c /etc/sssd/conf.d/01_snippet.conf
Issues identified by validators: 1
[rule/allowed_domain_options]: Attribute 'use_fully_quailified_name' is not allowed in section 'domain/example1'. Check for typos.

Messages generated during configuration merging: 1
Directory /etc/sssd/conf.d/conf.d does not exist.

Used configuration snippet files: 0

Here 'Message generated during configuration merging' is misleading to incorrect message.

Case 3:
Check file from /tmp directory

[root@ci-vm-10-0-107-13 ~]# sssctl config-check -c /tmp/01_snippet.conf
Issues identified by validators: 1
[rule/allowed_domain_options]: Attribute 'use_fully_quailified_name' is not allowed in section 'domain/example1'. Check for typos.

Messages generated during configuration merging: 1
Directory /tmp/conf.d does not exist.

Used configuration snippet files: 0

Here also error message is not correct.

Comment 13 Pavel Březina 2020-07-20 09:14:10 UTC

Pushed PR: https://github.com/SSSD/sssd/pull/5244

* `master`
    * 72b8e02c77f0b0b7e36663fa3bd3fd6987ea1b80 - sssctl: sssctl config-check alternative snippet dir

Comment 17 Tomas Halman 2020-07-21 15:34:24 UTC

Steps to test

run

    [root@ci-vm-10-0-107-13 ~]# sssctl config-check --help

and check the provided help message


    mkdir /tmp/test
    cp /path/to/sssd.conf /tmp/test/
    sssctl config-check -c /tmp/test/sssd.conf

Expected result:
config check complains about non-existing snippet dir

    mkdir /tmp/test/conf.d
    chmod 700 /tmp/test/conf.d
    sssctl config-check -c /tmp/test/sssd.conf
     
Expected result:
config check runs ok

    sssctl config-check -c /tmp/test/sssd.conf -d /tmp/does/not/exists

Expected result:
config check complains about non-existing snippet dir

    sssctl config-check -c /tmp/test/sssd.conf -d /etc/sssd/conf.d

config check runs ok

Comment 23 Madhuri 2020-08-11 08:06:12 UTC

Verified with :
[root@ci-vm-10-0-105-117 ~]# rpm -qa sssd sssd-tools
sssd-2.3.0-7.el8.x86_64
sssd-tools-2.3.0-7.el8.x86_64

Verification steps:

1) Check the help 

[root@ci-vm-10-0-105-117 ~]# sssctl config-check --help
Usage: sssctl config-check [OPTIONS...]

Command options:
  -c, --config=STRING      Specify a non-default config file
  -s, --snippet=STRING     Specify a non-default snippet dir (The default is to look in the same place where the main config file is
                           located. For example if the config is set to "/my/path/sssd.conf", the snippet dir "/my/path/conf.d" is
                           used)

Help options:
  -?, --help               Show this help message
      --usage              Display brief usage message

2) Case 1:

    mkdir /tmp/test
    cp /path/to/sssd.conf /tmp/test/
    sssctl config-check -c /tmp/test/sssd.conf

Expected result:
config check complains about non-existing snippet dir

[root@ci-vm-10-0-105-117 ~]# mkdir /tmp/test
[root@ci-vm-10-0-105-117 ~]# cp /etc/sssd/sssd.conf /tmp/test/
[root@ci-vm-10-0-105-117 ~]# sssctl config-check -c /tmp/test/sssd.conf
Issues identified by validators: 0

Messages generated during configuration merging: 1
Directory /tmp/test/conf.d does not exist.

Used configuration snippet files: 0
[root@ci-vm-10-0-105-117 ~]#


3) Case 2: 
[root@ci-vm-10-0-105-117 ~]# chmod  777 /tmp/test/sssd.conf 

[root@ci-vm-10-0-105-117 ~]# sssctl config-check -c /tmp/test/sssd.conf
File ownership and permissions check failed. Expected root:root and 0600.

Actual result:
Gives expected error message.

4) Case 3:
Make typo in option name 

[root@ci-vm-10-0-105-117 ~]# sssctl config-check -c /tmp/test/sssd.conf 
Issues identified by validators: 1
[rule/allowed_domain_options]: Attribute 'search_base' is not allowed in section 'domain/example1'. Check for typos.

Messages generated during configuration merging: 1
Directory /tmp/test/conf.d does not exist.

Used configuration snippet files: 0

Actual result:
Gave expected result.

5) Case 4:

mkdir /tmp/test/conf.d
chmod 700 /tmp/test/conf.d
sssctl config-check -c /tmp/test/sssd.conf

[root@ci-vm-10-0-105-117 ~]# sssctl config-check -c /tmp/test/sssd.conf 
Issues identified by validators: 1
[rule/allowed_domain_options]: Attribute 'search_base' is not allowed in section 'domain/example1'. Check for typos.

Messages generated during configuration merging: 1
Directory /tmp/test/conf.d does not exist.

Used configuration snippet files: 0


Actual result:
Config check runs okay, not giving any error message related to config merging
and gives expected error message from /tmp/test/sssd.conf

6) Case 5:

[root@ci-vm-10-0-105-117 ~]# sssctl config-check -c /tmp/test/sssd.conf -s /tmp/does/not/exists
Issues identified by validators: 0

Messages generated during configuration merging: 1
Directory /tmp/does/not/exists does not exist.

Used configuration snippet files: 0

Actual result:
config check complains about non existing snippet directory.

7) Case 6: 

[root@ci-vm-10-0-105-117 ~]# sssctl config-check -c /tmp/test/sssd.conf -s /etc/sssd/conf.d/
Issues identified by validators: 1
[rule/allowed_domain_options]: Attribute '`_fully_quailified_name' is not allowed in section 'domain/example1'. Check for typos.

Messages generated during configuration merging: 0

Used configuration snippet files: 1
/etc/sssd/conf.d/01_snippet.conf

[root@ci-vm-10-0-105-117 ~]# cat /etc/sssd/conf.d/01_snippet.conf 
[domain/example1]
`_fully_quailified_name = False


Actual result:
config check runs okay, gives expected typo error in validators section.


We dont have '-d' as a option but have '-s' option.
Thus marking the bug as verified.

Comment 26 errata-xmlrpc 2020-11-04 02:04:28 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4569