Bug 1450007 - Long DN string for LDAP authentication provider in ansible hosts file causes incorrect master-config.yaml to be created
Summary: Long DN string for LDAP authentication provider in ansible hosts file causes ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 3.5.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 3.5.z
Assignee: Tim Bielawa
QA Contact: Gan Huang
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-05-11 11:16 UTC by Javier Ramirez
Modified: 2017-08-01 14:46 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: YAML Library wrapping long lines Consequence: LDAP config parameters are parsed incorrectly Fix: Configure YAML library dumper with longer line length Result: LDAP config parameters are written without line wraps and can be parsed correctly
Clone Of:
Environment:
Last Closed: 2017-07-27 18:02:01 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github https://github.com/openshift openshift-ansible issues 3912 0 None None None 2017-05-11 11:16:35 UTC
Red Hat Product Errata RHBA-2017:1810 0 normal SHIPPED_LIVE OpenShift Container Platform atomic-openshift-utils bug fix and enhancement 2017-07-27 21:58:37 UTC

Description Javier Ramirez 2017-05-11 11:16:35 UTC
Description of problem:
	

What problem/issue/behavior are you having trouble with?  What do you expect to see?

We are using the LDAPPasswordIdentityProvider, and have a rather long DN string for the url parameter when setting the  openshift_master_identity_providers config in our ansible hosts file.  This causes a line feed to be inserted into the master-config.yaml resulting in a broken login provider.

Investigating we found an upstream issue[1] that describes the same problem and seems to addresses it. The file in that fix is in a different place with OCP 3.3 but adding the "width=float("inf")" to the command has helped get passed the issue. Is there any update on when the fix will be available in product.

[1]https://github.com/openshift/openshift-ansible/issues/3912

Comment 1 Scott Dodson 2017-06-09 04:51:49 UTC
Just needs a backport of https://github.com/openshift/openshift-ansible/pull/3914 to 3.5

Comment 2 Tim Bielawa 2017-06-13 14:54:20 UTC
Working on backport in https://github.com/openshift/openshift-ansible/pull/4424

Comment 6 Gan Huang 2017-07-07 09:46:53 UTC
Verified with openshift-ansible-3.5.95-1.git.0.a2b30e3.el7.noarch

Inventory host file:
openshift_master_identity_providers=[{'name': 'LDAP_auth', 'login': 'true', 'challenge': 'true', 'kind': 'LDAPPasswordIdentityProvider', 'attributes': {'id': ['dn'], 'email': ['mail'], 'name': ['uid'], 'preferredUsername': ['uid']}, 'bindDN': '', 'bindPassword': '', 'ca': '', 'insecure': 'true', 'url': 'ldap://10.66.xx.xx:389/DC=blah,DC=foo,DC=bar?uid??(memberof=CN=UserGroupForPaaS,OU=Groups,OU=Unit With Spaces For Some Reason,OU=Also With - In Case,DC=blah,DC=foo,DC=bar)'}]

Installation succeed

Comment 7 Gan Huang 2017-07-07 09:50:11 UTC
Correct last comment, verified with openshift-ansible-3.5.94-1

Comment 9 errata-xmlrpc 2017-07-27 18:02:01 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1810


Note You need to log in before you can comment on or make changes to this bug.