Bug 1759290

Since FreeIPA server deployment was fixed in Rawhide (https://bugzilla.redhat.com/show_bug.cgi?id=1747901 was the bug), openQA client tests which involve logging into the web UI always seem to fail. The error displayed is "The password or username you entered is incorrect", but as this is an automated test I'm pretty sure it's not mistyping the password every time.

https://openqa.fedoraproject.org/tests/464194 is one affected test, for e.g. - that was with Fedora-Rawhide-20191007.n.0 . You can get the client logs at https://openqa.fedoraproject.org/tests/464194/file/freeipa_webui-var_log.tar.gz and the server logs at https://openqa.fedoraproject.org/tests/464189/file/role_deploy_domain_controller_check-var_log.tar.gz . The failed attempt to log into the web UI occurs at around 13:22:19 UTC. I do see this in the httpd error logs on the server:

[Mon Oct 07 09:22:19.519389 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: DEBUG: WSGI wsgi_dispatch.__call__:
[Mon Oct 07 09:22:19.519559 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: DEBUG: WSGI login_password.__call__:
[Mon Oct 07 09:22:19.520153 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: DEBUG: Obtaining armor in ccache /run/ipa/ccaches/armor_32989
[Mon Oct 07 09:22:19.520307 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: DEBUG: Initializing anonymous ccache
[Mon Oct 07 09:22:19.520509 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: DEBUG: Starting external process
[Mon Oct 07 09:22:19.520595 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: DEBUG: args=['/usr/bin/kinit', '-n', '-c', '/run/ipa/ccaches/armor_32989', '-X', 'X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt', '-X', 'X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem']
[Mon Oct 07 09:22:19.521072 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: DEBUG: Process execution failed
[Mon Oct 07 09:22:19.521207 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: ERROR: Failed to obtain armor cache
[Mon Oct 07 09:22:19.521340 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: DEBUG: Initializing principal admin using password
[Mon Oct 07 09:22:19.521414 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: DEBUG: Using enterprise principal
[Mon Oct 07 09:22:19.521528 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: DEBUG: Starting external process
[Mon Oct 07 09:22:19.521604 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: DEBUG: args=['/usr/bin/kinit', 'admin', '-c', '/run/ipa/ccaches/kinit_32989', '-E']
[Mon Oct 07 09:22:19.521996 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: DEBUG: Process execution failed
[Mon Oct 07 09:22:19.522189 2019] [wsgi:error] [pid 32989:tid 139746234119936] [remote 10.0.2.102:56054] ipa: INFO: 401 Unauthorized: preexec_fn not supported within subinterpreters

That error rang bells for me, and sure enough, this looks similar to:

https://bugs.python.org/issue37951

only now it's 'preexec_fn' we're having trouble with rather than 'fork'. I'll add a comment there.

Proposing as an F32 Beta blocker: "It must be possible to configure a Fedora Server system installed according to the above criteria as a FreeIPA domain controller, using the official deployment tools provided in the distribution FreeIPA packages. Once deployed, the system must handle multiple client enrolments and unenrolments, and client authentication via Kerberos. The web UI must be available and allow at least basic configuration of user accounts and permissions." - https://fedoraproject.org/wiki/Basic_Release_Criteria#FreeIPA_server_requirements