freeipa

#7578 IPA server upgrade should remove stale kdcinfo_* generated by SSSD
Closed: fixed by okozlov. Opened by abbra.

Closed: fixed
Reopen Issue

When upgrading from pre-4.5 version, we try to fix sssd.conf to not have _srv_ in ipa_server option. IPA master should only talk to the services on the same host.

However, a stale kdcinfo_* file could still be present in /var/lib/sss/pubconf/ and it has to be removed during upgrade.

So the fix is just rm -f /var/lib/sss/pubconf/kdcinfo_*?

By the way, is kdcinfo_* the correct suffix? My Fedora 28 system has /var/lib/sss/pubconf/kdcinfo.REALM.EXAMPLE (note the . instead of a _). Is the _ used by pre-4.5 versions?

Easy fix:

for filename in glob.glob("/var/lib/sss/pubconf/kdcinfo_*"):
    logger.debug("Removing stale KDC info file %s", filename)
    os.unlink(filename)

Metadata Update from @cheimes:
- Issue set to the milestone: FreeIPA 4.5.5
- Issue tagged with: easyfix

Metadata Update from @frenaud:
- Issue priority set to: important
- Issue set to the milestone: FreeIPA 4.6.5 (was: FreeIPA 4.5.5)

There are two families of files to remove: kdcinfo.* and kpasswdinfo.*: 

$ git grep -e '\(KDC\|KPASSWD\)INFO_TMPL'
src/krb5_plugin/sssd_krb5_locator_plugin.c:/* The following override of KDCINFO_TMPL and KPASSWDINFO_TMPL is not very
src/krb5_plugin/sssd_krb5_locator_plugin.c:#ifdef KDCINFO_TMPL
src/krb5_plugin/sssd_krb5_locator_plugin.c:#undef KDCINFO_TMPL
src/krb5_plugin/sssd_krb5_locator_plugin.c:#define KDCINFO_TMPL TEST_PUBCONF_PATH"/kdcinfo.%s"
src/krb5_plugin/sssd_krb5_locator_plugin.c:#ifdef KPASSWDINFO_TMPL
src/krb5_plugin/sssd_krb5_locator_plugin.c:#undef KPASSWDINFO_TMPL
src/krb5_plugin/sssd_krb5_locator_plugin.c:#define KPASSWDINFO_TMPL TEST_PUBCONF_PATH"/kpasswdinfo.%s"
src/krb5_plugin/sssd_krb5_locator_plugin.c:            name_tmpl = KDCINFO_TMPL;
src/krb5_plugin/sssd_krb5_locator_plugin.c:            name_tmpl = KPASSWDINFO_TMPL;
src/providers/krb5/krb5_common.c:        name_tmpl = KDCINFO_TMPL;
src/providers/krb5/krb5_common.c:        name_tmpl = KPASSWDINFO_TMPL;
src/providers/krb5/krb5_common.c:    file = talloc_asprintf(mem_ctx, KDCINFO_TMPL, realm);
src/providers/krb5/krb5_common.c:    file = talloc_asprintf(mem_ctx, KPASSWDINFO_TMPL, realm);
src/providers/krb5/krb5_common.h:#define KDCINFO_TMPL PUBCONF_PATH"/kdcinfo.%s"
src/providers/krb5/krb5_common.h:#define KPASSWDINFO_TMPL PUBCONF_PATH"/kpasswdinfo.%s"

Metadata Update from @okozlov:
- Issue assigned to okozlov

master:

  • 0e5a8fbb9bb9713d1466563f82803f410143ed20 Remove stale kdc requests info files when upgrading IPA server

ipa-4-6:

  • ddf3395579d72a3e7114e5cdc4af736682779773 Remove stale kdc requests info files when upgrading IPA server

Fixed. Added cleanup_kdcinfo function, it removes stale files from /var/lib/sss/pubconf directory by patterns kdcinfo.* and kpasswdinfo.*. The function is called inside sssd_update function.

ipa-4-7:

  • f2eb92a7c01e16936a68ff7c91de67e83424f8be Remove stale kdc requests info files when upgrading IPA server

Metadata Update from @okozlov:
- Custom field affects_doc adjusted to on
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

easyfix

None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.