Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1357488 - ipa command stuck forever on higher versioned client with lower versioned server
Summary: ipa command stuck forever on higher versioned client with lower versioned server
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Kaleem
Aneta Šteflová Petrová
URL:
Whiteboard:
Depends On:
Blocks: 1366991
TreeView+ depends on / blocked
 
Reported: 2016-07-18 10:47 UTC by Abhijeet Kasurde
Modified: 2016-11-04 05:58 UTC (History)
6 users (show)

Fixed In Version: ipa-4.4.0-10.el7
Doc Type: Bug Fix
Doc Text:
Running commands on servers with an earlier version of IdM no longer takes unexpectedly long When a user on an Identity Management (IdM) client running IdM version 4.4 executes a command, IdM checks if the server contacted by the client supports the new command schema. Because this information is not cached, the check is performed every time the client contacts the server, which previously prolonged the time required to invoke commands on servers running an earlier version of IdM. If the user executed a new command introduced in IdM 4.4, it sometimes even seemed that the operation would not complete at all, because the server did not recognize the command. This bug has been fixed, and executing IdM commands in the described situation no longer takes unexpectedly long.
Clone Of:
Environment:
Last Closed: 2016-11-04 05:58:34 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2404 normal SHIPPED_LIVE ipa bug fix and enhancement update 2016-11-03 13:56:18 UTC

Description Abhijeet Kasurde 2016-07-18 10:47:46 UTC
Description of problem:
Install IPA Server 4.2 and join client with IPA Client 4.4
If user invoke any unsupported command on client, then it triggers following error message 

# kdestroy -A

# kinit admin
Password for admin@TESTRELM.TEST: 

# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin@TESTRELM.TEST

Valid starting       Expires              Service principal
07/18/2016 16:05:10  07/19/2016 16:05:08  krbtgt/TESTRELM.TEST@TESTRELM.TEST

# ipa -vvv ca-add
ipa: INFO: trying https://dhcp201-172.testrelm.test/ipa/json
ipa: INFO: Forwarding 'schema' to json server 'https://dhcp201-172.testrelm.test/ipa/json'
ipa: INFO: trying https://dhcp201-172.testrelm.test/ipa/json
ipa: INFO: Forwarding 'env' to json server 'https://dhcp201-172.testrelm.test/ipa/json'
<snip>
</snip>
ipa: INFO: operation aborted

# rpm -q ipa-client
ipa-client-4.4.0-2.1.el7.x86_64


File /var/log/httpd/error_log on Server contains

[Mon Jul 18 06:34:01.725121 2016] [:error] [pid 7030] ipa: INFO: [jsonserver_kerb] admin@TESTRELM.TEST: env((u'api_version',), version=u'2.0'): SUCCESS
[Mon Jul 18 06:34:08.872626 2016] [:error] [pid 7023] ipa: INFO: [jsonserver_kerb] admin@TESTRELM.TEST: schema: CommandError
[Mon Jul 18 06:34:08.958584 2016] [:error] [pid 7030] ipa: INFO: [jsonserver_kerb] admin@TESTRELM.TEST: env((u'api_version',), version=u'2.0'): SUCCESS
[Mon Jul 18 06:34:17.307152 2016] [:error] [pid 7023] ipa: INFO: [jsonserver_kerb] admin@TESTRELM.TEST: schema: CommandError
[Mon Jul 18 06:34:17.392404 2016] [:error] [pid 7030] ipa: INFO: [jsonserver_kerb] admin@TESTRELM.TEST: env((u'api_version',), version=u'2.0'): SUCCESS
[Mon Jul 18 06:34:37.415954 2016] [:error] [pid 7023] ipa: INFO: [jsonserver_kerb] admin@TESTRELM.TEST: schema: CommandError
[Mon Jul 18 06:34:37.666269 2016] [:error] [pid 7030] ipa: INFO: [jsonserver_kerb] admin@TESTRELM.TEST: env((u'api_version',), version=u'2.0'): SUCCESS
[Mon Jul 18 06:34:45.663847 2016] [:error] [pid 7023] ipa: INFO: [jsonserver_kerb] admin@TESTRELM.TEST: schema: CommandError
[Mon Jul 18 06:34:45.765081 2016] [:error] [pid 7030] ipa: INFO: [jsonserver_kerb] admin@TESTRELM.TEST: env((u'api_version',), version=u'2.0'): SUCCESS




Version-Release number of selected component (if applicable):
IPA Server = ipa-server-4.2.0-15.el7_2.17.x86_64
IPA Client = ipa-client-4.4.0-2.1.el7.x86_64

How reproducible:
100%

Actual results:
Command goes in infinite loop.

Expected results:
Command should warn about non-availability of feature or command 

ipa: ERROR: unknown command 'ca-add' or something similar

Comment 1 Petr Vobornik 2016-07-18 11:01:53 UTC
root cause sounds similar to https://fedorahosted.org/freeipa/ticket/6089, Honza, do you want to clone this or just link it?

Comment 3 Jan Cholasta 2016-07-19 12:05:16 UTC
Petr, clone please, this is not related to #6089.

Comment 4 Petr Vobornik 2016-07-19 12:25:30 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/6095

Comment 5 Jan Cholasta 2016-08-03 14:40:21 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/6069

Comment 7 Abhijeet Kasurde 2016-08-12 16:50:49 UTC
Following are some observations while using IPA 4.4 client with IPA 4.2 server 

[root@vm-idm-010 ~]# ipa -v commands
ipa: INFO: trying https://vm-idm-003.testrelm.test/ipa/session/json
ipa: INFO: Forwarding 'schema' to json server 'https://vm-idm-003.testrelm.test/ipa/session/json'
ipa: INFO: trying https://vm-idm-003.testrelm.test/ipa/session/json
ipa: INFO: Forwarding 'env' to json server 'https://vm-idm-003.testrelm.test/ipa/session/json'
ipa: INFO: trying https://vm-idm-003.testrelm.test/ipa/session/json
ipa: INFO: trying https://vm-idm-003.testrelm.test/ipa/session/json
ipa: INFO: Forwarding 'schema' to json server 'https://vm-idm-003.testrelm.test/ipa/session/json'
ipa: INFO: trying https://vm-idm-003.testrelm.test/ipa/session/json
ipa: INFO: Forwarding 'env' to json server 'https://vm-idm-003.testrelm.test/ipa/session/json'
ipa: INFO: trying https://vm-idm-003.testrelm.test/ipa/session/json
ipa: INFO: Forwarding 'schema' to json server 'https://vm-idm-003.testrelm.test/ipa/session/json'
ipa: INFO: trying https://vm-idm-003.testrelm.test/ipa/session/json
ipa: INFO: Forwarding 'env' to json server 'https://vm-idm-003.testrelm.test/ipa/session/json'
^Cexception in SSLSocket.auth_certificate_func
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/ipapython/nsslib.py", line 43, in auth_certificate_callback
    def auth_certificate_callback(sock, check_sig, is_server, certdb):
KeyboardInterrupt
ipa: ERROR: cannot connect to 'https://vm-idm-003.testrelm.test/ipa/session/json': (SEC_ERROR_EXTENSION_NOT_FOUND) Certificate extension not found.


[root@vm-idm-010 ~]# ipa -v ca-add/1
ipa: INFO: trying https://vm-idm-003.testrelm.test/ipa/session/json
ipa: INFO: Forwarding 'schema' to json server 'https://vm-idm-003.testrelm.test/ipa/session/json'
ipa: INFO: trying https://vm-idm-003.testrelm.test/ipa/session/json
ipa: INFO: Forwarding 'env' to json server 'https://vm-idm-003.testrelm.test/ipa/session/json'
ipa: INFO: trying https://vm-idm-003.testrelm.test/ipa/session/json
^C
ipa: INFO: operation aborted

Comment 8 Jan Cholasta 2016-08-17 12:14:46 UTC
Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/6e6cbda036559e741ead0ab5ba18b0be0b41621e

Comment 16 Abhijeet Kasurde 2016-09-09 10:19:53 UTC
Verified using IPA version::
ipa-server-4.4.0-10.el7.x86_64

Verification Steps ::

1. Install IPA Server on RHEL 7.2 
2. Install IPA Client on RHEL 7.3 
3. Try IPA 4.4 version command 

[root@beast ~]# ipa ca-add
ipa: ERROR: unknown command 'ca-add'
[root@beast ~]# ipa topologysegment-show
ipa: ERROR: unknown command 'topologysegment-show'
[root@beast ~]# ipa topologysuffix-show
ipa: ERROR: unknown command 'topologysuffix-show'
[root@beast ~]# echo Secret123 |kinit 123
kinit: Client '123@TESTRELM.TEST' not found in Kerberos database while getting initial credentials
[root@beast ~]# echo Secret123 |kinit admin
Password for admin@TESTRELM.TEST: 
[root@beast ~]# ipa ping
-------------------------------------------
IPA server version 4.2.0. API version 2.156
-------------------------------------------
[root@beast ~]# rpm -q ipa-server
ipa-server-4.4.0-10.el7.x86_64

Comment 20 errata-xmlrpc 2016-11-04 05:58:34 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html


Note You need to log in before you can comment on or make changes to this bug.