RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
Summary: RFE: Add option to specify alternate sssd config file location with "sssctl c...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: sssd
Version: 8.2
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: rc
: 8.2
Assignee: Tomas Halman
QA Contact: sssd-qe
URL:
Whiteboard: sync-to-jira
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-06-24 06:39 UTC by Arya Rajendran
Modified: 2023-12-15 16:34 UTC (History)
12 users (show)

Fixed In Version: sssd-2.3.0-7.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-11-04 02:04:28 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 5142 0 None closed RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command. 2020-11-03 22:22:59 UTC
Red Hat Product Errata RHBA-2020:4569 0 None None None 2020-11-04 02:04:48 UTC

Description Arya Rajendran 2019-06-24 06:39:57 UTC 
1. Proposed title of this feature request

RFE: Add option to specify alternate sssd config file location with "sssctl config-check"

2. What is the nature and description of the request?

To allow sssctl config-check to check alternate sssd config file location.

Eg. sssctl config-check allows checking of in-place sssd config. If we want to test the config before copying into place, it should allow us to provide an external file to check. Eg. sssctl config-check -f /tmp/sssd.conf

This would make it compatible to configuration management/orchestration tools that allow validation checking before changing config.

3. Can you List the business requirements here

This would make it compatible to configuration management/orchestration tools that allow validation checking before changing config.
 

4. How would the you like to achieve this? (List the functional requirements here)

Provide "-f <file location>" flag to command
 
5. Is there already an existing RFE upstream or in Red Hat Bugzilla?

No
 

6. Do you have any specific timeline dependencies and which release would they like to target (i.e. RHEL 7)?

RHEL 7


7. List any affected packages or components.

sssd-tools
 

8. Would you be able to assist in testing this functionality if implemented?

Yes
Comment 5 Tomas Halman 2020-05-06 12:53:20 UTC 
Upstream ticket:
https://github.com/SSSD/sssd/issues/5142
Comment 6 Tomas Halman 2020-05-06 13:02:41 UTC 
Upstream PR: https://github.com/SSSD/sssd/pull/5143
Comment 7 Pavel Březina 2020-05-21 09:01:06 UTC 
Pushed PR: https://github.com/SSSD/sssd/pull/5143

* `master`
    * 61f4aaa56ea876fb75c1366c938818b7799408ab - sssctl: sssctl config-check alternative config file
Comment 12 Madhuri 2020-07-15 15:15:08 UTC 
[root@ci-vm-10-0-107-13 ~]# rpm -qa sssd sssd-tools
sssd-tools-2.3.0-4.el8.x86_64
sssd-2.3.0-4.el8.x86_64

Checking the --help
[root@ci-vm-10-0-107-13 ~]# sssctl config-check --help
Usage: sssctl config-check [OPTIONS...]

Command options:
  -c, --config=STRING     Specify a non-default config file

Help options:
  -?, --help              Show this help message
      --usage             Display brief usage message


The description is pretty short to understand.

case 1:
check with default sssd conf

[root@ci-vm-10-0-107-13 ~]# sssctl config-check -c /etc/sssd/sssd.conf 
Issues identified by validators: 0

Messages generated during configuration merging: 1
File /etc/sssd/conf.d/01_snippet.conf did not pass access check. Skipping.

Used configuration snippet files: 0

Case 2:
Check with file under conf.d with proper permission and ownership
[root@ci-vm-10-0-107-13 ~]# chmod 600 /etc/sssd/conf.d/01_snippet.conf 
[root@ci-vm-10-0-107-13 ~]# sssctl config-check -c /etc/sssd/conf.d/01_snippet.conf 
Issues identified by validators: 1
[rule/allowed_domain_options]: Attribute 'use_fully_quailified_name' is not allowed in section 'domain/example1'. Check for typos.

Messages generated during configuration merging: 1
Directory /etc/sssd/conf.d/conf.d does not exist.

Used configuration snippet files: 0

Here 'Message generated during configuration merging' is misleading to incorrect message.

Case 3:
Check file from /tmp directory

[root@ci-vm-10-0-107-13 ~]# sssctl config-check -c /tmp/01_snippet.conf 
Issues identified by validators: 1
[rule/allowed_domain_options]: Attribute 'use_fully_quailified_name' is not allowed in section 'domain/example1'. Check for typos.

Messages generated during configuration merging: 1
Directory /tmp/conf.d does not exist.

Used configuration snippet files: 0

Here also error message is not correct.
Comment 13 Pavel Březina 2020-07-20 09:14:10 UTC 
Pushed PR: https://github.com/SSSD/sssd/pull/5244

* `master`
    * 72b8e02c77f0b0b7e36663fa3bd3fd6987ea1b80 - sssctl: sssctl config-check alternative snippet dir
Comment 17 Tomas Halman 2020-07-21 15:34:24 UTC 
Steps to test

run

    [root@ci-vm-10-0-107-13 ~]# sssctl config-check --help

and check the provided help message


    mkdir /tmp/test
    cp /path/to/sssd.conf /tmp/test/
    sssctl config-check -c /tmp/test/sssd.conf

Expected result:
config check complains about non-existing snippet dir

    mkdir /tmp/test/conf.d
    chmod 700 /tmp/test/conf.d
    sssctl config-check -c /tmp/test/sssd.conf
     
Expected result:
config check runs ok

    sssctl config-check -c /tmp/test/sssd.conf -d /tmp/does/not/exists

Expected result:
config check complains about non-existing snippet dir

    sssctl config-check -c /tmp/test/sssd.conf -d /etc/sssd/conf.d

config check runs ok
Comment 23 Madhuri 2020-08-11 08:06:12 UTC 
Verified with :
[root@ci-vm-10-0-105-117 ~]# rpm -qa sssd sssd-tools
sssd-2.3.0-7.el8.x86_64
sssd-tools-2.3.0-7.el8.x86_64

Verification steps:

1) Check the help 

[root@ci-vm-10-0-105-117 ~]# sssctl config-check --help
Usage: sssctl config-check [OPTIONS...]

Command options:
  -c, --config=STRING      Specify a non-default config file
  -s, --snippet=STRING     Specify a non-default snippet dir (The default is to look in the same place where the main config file is
                           located. For example if the config is set to "/my/path/sssd.conf", the snippet dir "/my/path/conf.d" is
                           used)

Help options:
  -?, --help               Show this help message
      --usage              Display brief usage message

2) Case 1:

    mkdir /tmp/test
    cp /path/to/sssd.conf /tmp/test/
    sssctl config-check -c /tmp/test/sssd.conf

Expected result:
config check complains about non-existing snippet dir

[root@ci-vm-10-0-105-117 ~]# mkdir /tmp/test
[root@ci-vm-10-0-105-117 ~]# cp /etc/sssd/sssd.conf /tmp/test/
[root@ci-vm-10-0-105-117 ~]# sssctl config-check -c /tmp/test/sssd.conf
Issues identified by validators: 0

Messages generated during configuration merging: 1
Directory /tmp/test/conf.d does not exist.

Used configuration snippet files: 0
[root@ci-vm-10-0-105-117 ~]#


3) Case 2: 
[root@ci-vm-10-0-105-117 ~]# chmod  777 /tmp/test/sssd.conf 

[root@ci-vm-10-0-105-117 ~]# sssctl config-check -c /tmp/test/sssd.conf
File ownership and permissions check failed. Expected root:root and 0600.

Actual result:
Gives expected error message.

4) Case 3:
Make typo in option name 

[root@ci-vm-10-0-105-117 ~]# sssctl config-check -c /tmp/test/sssd.conf 
Issues identified by validators: 1
[rule/allowed_domain_options]: Attribute 'search_base' is not allowed in section 'domain/example1'. Check for typos.

Messages generated during configuration merging: 1
Directory /tmp/test/conf.d does not exist.

Used configuration snippet files: 0

Actual result:
Gave expected result.

5) Case 4:

mkdir /tmp/test/conf.d
chmod 700 /tmp/test/conf.d
sssctl config-check -c /tmp/test/sssd.conf

[root@ci-vm-10-0-105-117 ~]# sssctl config-check -c /tmp/test/sssd.conf 
Issues identified by validators: 1
[rule/allowed_domain_options]: Attribute 'search_base' is not allowed in section 'domain/example1'. Check for typos.

Messages generated during configuration merging: 1
Directory /tmp/test/conf.d does not exist.

Used configuration snippet files: 0


Actual result:
Config check runs okay, not giving any error message related to config merging
and gives expected error message from /tmp/test/sssd.conf

6) Case 5:

[root@ci-vm-10-0-105-117 ~]# sssctl config-check -c /tmp/test/sssd.conf -s /tmp/does/not/exists
Issues identified by validators: 0

Messages generated during configuration merging: 1
Directory /tmp/does/not/exists does not exist.

Used configuration snippet files: 0

Actual result:
config check complains about non existing snippet directory.

7) Case 6: 

[root@ci-vm-10-0-105-117 ~]# sssctl config-check -c /tmp/test/sssd.conf -s /etc/sssd/conf.d/
Issues identified by validators: 1
[rule/allowed_domain_options]: Attribute '`_fully_quailified_name' is not allowed in section 'domain/example1'. Check for typos.

Messages generated during configuration merging: 0

Used configuration snippet files: 1
/etc/sssd/conf.d/01_snippet.conf

[root@ci-vm-10-0-105-117 ~]# cat /etc/sssd/conf.d/01_snippet.conf 
[domain/example1]
`_fully_quailified_name = False


Actual result:
config check runs okay, gives expected typo error in validators section.


We dont have '-d' as a option but have '-s' option.
Thus marking the bug as verified.
Comment 26 errata-xmlrpc 2020-11-04 02:04:28 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4569
Note You need to log in before you can comment on or make changes to this bug.