Description of problem: ipa-backup uses the authconfig from authselect-compat to backup the current configuration. It calls "authconfig --savebackup /var/lib/ipa/auth_backup". In Fedora 28, the invocation is failing with "authconfig: error: unrecognized arguments: /var/lib/ipa/auth_backup". The --savebackup argument no longer takes a path. Version-Release number of selected component (if applicable): authselect-compat-0.3.2-1.fc28.x86_64 How reproducible: always Steps to Reproduce: 1. /usr/sbin/authconfig --savebackup /var/lib/ipa/auth_backup' Actual results: authconfig: error: unrecognized arguments: /var/lib/ipa/auth_backup Expected results: authconfig creates a backup at /var/lib/ipa/auth_backup Additional info: The bug breaks ipa-backup, see upstream bug https://pagure.io/freeipa/issue/7478 . We are currently in the process of moving to authselect. However the PR is blocked by other issues.
I just noticed that savebackup isn't supported at all: # authconfig --savebackup Running authconfig compatibility tool. IMPORTANT: authconfig is replaced by authselect, please update your scripts. See Fedora 28 Change Page: https://fedoraproject.org/wiki/Changes/AuthselectAsDefault See man authselect-migration(7) to help you with migration to authselect Warning: These options are not supported anymore and have no effect: --savebackup Error: Please, provide --updateall option.
I have created https://github.com/freeipa/freeipa/pull/1760 to temporarily disable backup and restore of auth config data.
I fixed --savebackup and --restorebackup so it takes a path and does not broken execution [1]. I also have a patch ready, that will make authconfig exit with 0 instead of 1 if you provide or --restorebackup --restorelastbackup so it will not fail script execution [2]. The purpose of compat utility is to make authentication work if it is used in kickstart/installation scripts. It is not desirable to implement all authconfig features and backup/restore was one of the feature that did not go in because it should not be needed when installing the system. Authselect itself will not do any modifications to non-authselect system unless --force parameter and once it is used, administrator is not supposed to modify the configuration manually. So backup/restore is not strictly needed here. Since you will switch to authselect and thus not relying on authconfig backup anymore, will [2] be enough to fix this issue and enable testing or do you require to actually implement backup and restore support? [1] https://github.com/pbrezina/authselect/commit/c57d22bcb377000c04269d691cd752e8eaa956e9 [2] https://github.com/pbrezina/authselect/commit/a0a10c4cf9551080c820325953ea93a849b54122
I added a workaround to FreeIPA master and disabled authconfig save/restore backup feature temporarily. FreeIPA development is no longer blocked by the issue. We'll move to authselect soon, too. The PR is still under development. Your patch [1] is a good idea. Patch [2] is no longer required for FreeIPA development. I don't like it, too. The compat authconfig command should fail with a proper error code.
authselect-0.4-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-d5f37ac141
authselect-0.4-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-d5f37ac141
authselect-0.4-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.