Bug 1511019 - ipa-restore broken with python2
Summary: ipa-restore broken with python2
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: ipa-qe
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-11-08 14:30 UTC by Petr Vobornik
Modified: 2018-04-10 16:49 UTC (History)
8 users (show)

Fixed In Version: ipa-4.5.4-7.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-04-10 16:48:21 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0918 None None None 2018-04-10 16:49:12 UTC

Description Petr Vobornik 2017-11-08 14:30:48 UTC
Cloned from upstream: https://pagure.io/freeipa/issue/7231

The following scenario is failing on the master branch:
1. ipa-backup
2. ipa-server-install --uninstall -U
3. python2 /usr/sbin/ipa-restore /path/to/full/backup/

with the following output:

    Directory Manager (existing master) password: 
    
    Preparing restore from /var/lib/ipa/backup/ipa-full-2017-10-31-19-21-23 on server.ipadomain.com
    Performing FULL restore from FULL backup
    Restoring data will overwrite existing live data. Continue to restore? [no]: yes
    Each master will individually need to be re-initialized or
    re-created from this one. The replication agreements on
    masters running IPA 3.1 or earlier will need to be manually
    re-enabled. See the man page for details.
    Disabling all replication.
    Unable to get connection, skipping disabling agreements: directory server instance is not running/configured
    Stopping IPA services
    Configuring certmonger to stop tracking system certificates for CA
    [Errno 2] No such file or directory: u'/etc/dirsrv/slapd-IPADOMAIN-COM/dse.ldif'
    The ipa-restore command failed. See /var/log/iparestore.log for more information

The log contains the following stack:

    2017-10-31T18:23:07Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
    2017-10-31T18:23:07Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 174, in execute
        return_value = self.run()
      File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_restore.py", line 389, in run
        self.cert_restore_prepare()
      File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_restore.py", line 838, in cert_restore_prepare
        installutils.realm_to_serverid(api.env.realm))
      File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1111, in stop_tracking_certificates
        nickname = self.get_server_cert_nickname(serverid)
      File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1091, in get_server_cert_nickname
        with open(config_file, "r") as in_file:
    
    2017-10-31T18:23:07Z DEBUG The ipa-restore command failed, exception: IOError: [Errno 2] No such file or directory: u'/etc/dirsrv/slapd-IPADOMAIN-COM/dse.ldif'
    2017-10-31T18:23:07Z ERROR [Errno 2] No such file or directory: u'/etc/dirsrv/slapd-IPADOMAIN-COM/dse.ldif'
    2017-10-31T18:23:07Z ERROR The ipa-restore command failed. See /var/log/iparestore.log for more information

When ipa-restore is run with python3, the issue does not happen.

Investigation:
when `ipa-restore` is run after `ipa-server-install --uninstall`, the directory /etc/dirsrv/slapd-DOMAIN-COM does not exist. The `ipa-restore` tool wants to stop tracking LDAP server certificate, and needs to find the certificate name using the method get_server_cert_nickname which depends on the content of dse.ldif.
As the file does not exist, an IOError exception is raised.
In python3, IOError is a subclass of OSError but not in python2. The code catches OSError but not IOError exception, hence the different behavior in python2 or python3:

    def cert_restore_prepare(self):
        cainstance.CAInstance().stop_tracking_certificates()
        httpinstance.HTTPInstance().stop_tracking_certificates()
        try:
            dsinstance.DsInstance().stop_tracking_certificates(
                installutils.realm_to_serverid(api.env.realm))
        except OSError:
            # When IPA is not installed, DS NSS DB does not exist
            pass

Comment 2 Petr Vobornik 2017-11-08 14:31:01 UTC
Upstream ticket:
https://pagure.io/freeipa/issue/7231

Comment 3 Florence Blanc-Renaud 2017-11-13 10:29:57 UTC
Fixed upstream
master:
https://pagure.io/freeipa/c/f4a208311aa6618336e1ba6ae277243c727ec1fc

Comment 4 Florence Blanc-Renaud 2017-11-13 10:30:44 UTC
Fixed upstream
ipa-4-6:
https://pagure.io/freeipa/c/71c54ef03cabd598ff1c0032529793dbbcd59a9e

Comment 5 Florence Blanc-Renaud 2017-11-13 10:31:08 UTC
Fixed upstream
ipa-4-5:
https://pagure.io/freeipa/c/229c84e9e6bf5db259e7768fc4da38d016b17069

Comment 7 Mohammad Rizwan 2018-01-10 13:17:13 UTC
version:
ipa-server-4.5.4-7.el7.x86_64

Steps:

1. Install ipa master
2. $ ipa-backup
3. $ ipa-server-install --uninstall -U
4. $ python2 /usr/sbin/ipa-restore /path/to/full/backup/

Actual result:

[root@master ~]# ipa-backup 
Preparing backup on master.testrelm.test
Stopping IPA services
Backing up ipaca in TESTRELM-TEST to LDIF
Backing up userRoot in TESTRELM-TEST to LDIF
Backing up TESTRELM-TEST
Backing up files
Backed up to /var/lib/ipa/backup/ipa-full-2018-01-10-08-04-34
Starting IPA service
The ipa-backup command was successful
[root@master ~]# 
[root@master ~]# ipa-server-install -U --uninstall
Updating DNS system records
ipa         : ERROR    unable to resolve host name master.testrelm.test. to IP address, ipa-ca DNS record will be incomplete
-----------------------------------------
Deleted IPA server "master.testrelm.test"
-----------------------------------------
Shutting down all IPA services
Unconfiguring ntpd
Configuring certmonger to stop tracking system certificates for KRA
Configuring certmonger to stop tracking system certificates for CA
Unconfiguring CA
Unconfiguring named
Unconfiguring ipa-dnskeysyncd
Unconfiguring web server
Unconfiguring krb5kdc
Unconfiguring kadmin
Unconfiguring directory server
Unconfiguring ipa-custodia
Unconfiguring ipa-otpd
Removing IPA client configuration
Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
Unconfiguring the NIS domain.
nscd daemon is not installed, skip configuration
nslcd daemon is not installed, skip configuration
Systemwide CA database updated.
Client uninstall complete.
The ipa-client-install command was successful
[root@master ~]# 
[root@master ~]# python2  /usr/sbin/ipa-restore  /var/lib/ipa/backup/ipa-full-2018-01-10-08-04-34
Directory Manager (existing master) password: 

Preparing restore from /var/lib/ipa/backup/ipa-full-2018-01-10-08-04-34 on master.testrelm.test
Performing FULL restore from FULL backup
Restoring data will overwrite existing live data. Continue to restore? [no]: yes
Each master will individually need to be re-initialized or
re-created from this one. The replication agreements on
masters running IPA 3.1 or earlier will need to be manually
re-enabled. See the man page for details.
Disabling all replication.
Unable to get connection, skipping disabling agreements: directory server instance is not running/configured
Stopping IPA services
Configuring certmonger to stop tracking system certificates for CA
Restoring files
Systemwide CA database updated.
Restoring from userRoot in TESTRELM-TEST
Restoring from ipaca in TESTRELM-TEST
Restarting GSS-proxy
Starting IPA services
Restarting SSSD
The ipa-restore command was successful

[root@master ~]# tail -1 /var/log/iparestore.log 
2018-01-10T13:10:08Z INFO The ipa-restore command was successful
[root@master ~]#

ipa-restore succeed with python2. Thus based on above observation marking bug as verified.

Comment 10 errata-xmlrpc 2018-04-10 16:48:21 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0918


Note You need to log in before you can comment on or make changes to this bug.