Bug 1373420 - sss_override fails to export
Summary: sss_override fails to export
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.3
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Michal Zidek
QA Contact: Steeve Goveas
Marc Muehlfeld
Depends On:
TreeView+ depends on / blocked
Reported: 2016-09-06 08:57 UTC by Marc Muehlfeld
Modified: 2020-05-02 18:29 UTC (History)
8 users (show)

Fixed In Version: sssd-1.14.0-41.el7
Doc Type: Bug Fix
Doc Text:
Show, find, and export operations in the "sss_override" utility now work correctly Red Hat Enterprise Linux 7.3 introduced local overrides to the System Security Services Daemon (SSSD). Due to a regression, "sss_override" commands failed if an override was created without the "-n" option. The bug has been fixed and now "sss_override" works correctly.
Clone Of:
Last Closed: 2016-11-04 07:21:15 UTC
Target Upstream Version:

Attachments (Terms of Use)
debug log (13.27 KB, text/plain)
2016-09-06 08:57 UTC, Marc Muehlfeld
no flags Details

System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 4212 0 None None None 2020-05-02 18:29:13 UTC
Red Hat Product Errata RHEA-2016:2476 0 normal SHIPPED_LIVE sssd bug fix and enhancement update 2016-11-03 14:08:11 UTC

Description Marc Muehlfeld 2016-09-06 08:57:07 UTC
Created attachment 1198131 [details]
debug log

Description of problem:
sss_override user-export fails

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Set up an LDAP provider
2. Create an user override:
3. Restart sssd
4. Try to export the user overrides

Actual results:
# sss_override user-export /var/lib/sss/backup/sssd_user_overrides.bak

# echo $?

# ls -la /var/lib/sss/backup/sssd_user_overrides.bak
-rw-r--r--. 1 root root 0  6. Sep 09:04 /var/lib/sss/backup/sssd_user_overrides.bak

Expected results:
sss_override should not fail to export.

Additional information:
It would be great, if sss_override user-export tells the user when it fails. I only discovered this bug, because I wanted to remove the SSSD cache. Otherwise I had not seen that it generates just an empty file and fails. The "sssctrl cache-remove" command validates the result of the backup:
# sssctl cache-remove 
SSSD must not be running. Stop SSSD now? (yes/no) [yes] 
Creating backup of local data...
SSSD backup of local data already exist, override? (yes/no) [no] yes
Error while executing external command
Unable to export group overrides
Unable to create backup of local data, can not remove the cache.

Comment 1 Pavel Březina 2016-09-06 09:06:22 UTC
It seems to be related to timestamp cache or fully qualified name changes.

Comment 3 Michal Zidek 2016-09-07 15:40:59 UTC
Upstream ticket:

Comment 4 Michal Zidek 2016-09-07 16:19:39 UTC
The override fails to export if the name attribute is not overriden. For example if someone only overrides shell for the user or GID for the group.

I do not think this is a regression.

Comment 9 Pavel Březina 2016-09-09 09:54:22 UTC
Works in 1.13, this is a regression.

Comment 11 Jakub Hrozek 2016-09-11 20:55:33 UTC
Upstream ticket:

Comment 12 Jakub Hrozek 2016-09-11 20:56:56 UTC
(In reply to Jakub Hrozek from comment #11)
> Upstream ticket:
> https://fedorahosted.org/sssd/ticket/3179

For some reason, the previous clone didn't update the devel Whiteboard, so our internal tool didn't see the BZ as cloned..

Comment 13 Lukas Slebodnik 2016-09-13 11:54:16 UTC
* 1c72723cde8bea0d390b928c7cd29e48e7a7deab
* 07e7683f5a86991feaa764e2055116554ada1b93

Comment 16 Dan Lavu 2016-09-19 20:09:13 UTC
Verified against sssd-client-1.14.0-42.el7.x86_64

[root@dell-per230-02 db]# id Administrator@sssdad.com
uid=498200500(administrator@sssdad.com) gid=498200513(domain users@sssdad.com) groups=498200513(domain users@sssdad.com),498200519(enterprise admins@sssdad.com),498200512(domain admins@sssdad.com),498200520(group policy creator owners@sssdad.com),498200518(schema admins@sssdad.com),498246372(parent_group-474@sssdad.com),498200572(denied rodc password replication group@sssdad.com)

[root@dell-per230-02 db]# sss_override user-add -n admin Administrator@sssdad.com
SSSD needs to be restarted for the changes to take effect.

[root@dell-per230-02 db]# service sssd restart
Redirecting to /bin/systemctl restart  sssd.service

[root@dell-per230-02 db]# id admin@sssdad.com
uid=498200500(admin@sssdad.com) gid=498200513(domain users@sssdad.com) groups=498200513(domain users@sssdad.com),498200520(group policy creator owners@sssdad.com),498200519(enterprise admins@sssdad.com),498200512(domain admins@sssdad.com),498200518(schema admins@sssdad.com),498200572(denied rodc password replication group@sssdad.com),498246372(parent_group-474@sssdad.com)

[root@dell-per230-02 db]# sss_override user-export export.txt

[root@dell-per230-02 db]# cat export.txt 

Comment 20 errata-xmlrpc 2016-11-04 07:21:15 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.