Bug 1296106 - Modifying user for Kerberos Principal Expiration causes internal server error
Modifying user for Kerberos Principal Expiration causes internal server error
Status: ASSIGNED
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa (Show other bugs)
7.3
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: IPA Maintainers
Namita Soman
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-01-06 05:47 EST by Abhijeet Kasurde
Modified: 2017-04-06 12:40 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
internal_server_error.png (104.75 KB, image/png)
2016-01-06 05:47 EST, Abhijeet Kasurde
no flags Details

  None (edit)
Description Abhijeet Kasurde 2016-01-06 05:47:07 EST
Created attachment 1112088 [details]
internal_server_error.png

Description of problem:
When user tries to modify Kerberos Principal Expiration value with date which is previous to year 1900 causes internal server error. This is due to bug in Python 2.7 - https://bugs.python.org/issue1777412 

# ipa user-mod --principal-expiration=11001212000000Z f 
ipa: ERROR: non-public: ValueError: year=1100 is before 1900; the datetime strftime() methods require year >= 1900
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 129, in execute
    result = self.Command[_name](*args, **options)
  File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 443, in __call__
    ret = self.run(*args, **options)
  File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 761, in run
    return self.forward(*args, **options)
  File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 782, in forward
    return self.Backend.rpcclient.forward(self.name, *args, **kw)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 888, in forward
    return self._call_command(command, params)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 865, in _call_command
    return command(*params)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1016, in _call
    return self.__request(name, args)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 975, in __request
    payload = json_encode_binary(payload, version)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 284, in json_encode_binary
    new_dict[k] = json_encode_binary(v, version)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 287, in json_encode_binary
    new_list = [json_encode_binary(v, version) for v in val]
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 284, in json_encode_binary
    new_dict[k] = json_encode_binary(v, version)
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 297, in json_encode_binary
    return {'__datetime__': val.strftime(LDAP_GENERALIZED_TIME_FORMAT)}
ValueError: year=1100 is before 1900; the datetime strftime() methods require year >= 1900
ipa: ERROR: an internal error has occurred


On Web UI, user gets error. Please see attachment.

Version-Release number of selected component (if applicable):
ipa-server-4.2.0-15.el7_2.3.x86_64

How reproducible:
100%

Steps to Reproduce:
1. install ipa-server and configure
2. add user in IPA server
3. try to modify Kerberos Principal expiration date using command line or web ui

Actual results:
User get trace back like mentioned above in stdout (cmd line) or error_log (web ui)


Expected results:
Either user is notified that date is before 1900 year 

or

Change Kerberos Principal Expiration Date as per user input

Additional info:
We can fix this either adding constant like 

LDAP_STRING_TIME_FORMAT = '{0.year:4d}{0.month:02d}{0.day:02d}{0.hour:02d}{0.minute:02d}{0.second:02d}Z'

and formatting datetime values like 

import datetime
d = datetime.datetime(1900, 10, 10, 10, 10, 10)
LDAP_STRING_TIME_FORMAT.format(d)
Comment 1 Abhijeet Kasurde 2016-01-06 05:49:00 EST
In Python 3.* and onward the bug https://bugs.python.org/issue1777412 is fixed.
Comment 3 Petr Vobornik 2016-01-06 08:36:52 EST
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5579
Comment 4 Rob Crittenden 2016-01-06 08:56:12 EST
What is the use case for setting the password expiration date < 1900?
Comment 5 Abhijeet Kasurde 2016-01-06 23:57:11 EST
There is no valid use case as such because it is very rare that customer will enter a date < 1900. But for sanity purpose, I was writing testcases around Kerberos Principal Expiration Date. One of the usecase is a valid date but previous to 1900.
Comment 6 Petr Vobornik 2017-04-06 12:40:29 EDT
IdM team doesn't have capacity to fix this bug for RHEL 7.4. Moving to next RHEL version. Fixing the bug there will depend on capacity of FreeIPA upstream. Without sufficient  justification there is a chance that it will be moved again later.

Note You need to log in before you can comment on or make changes to this bug.