FreeIPA Realm Update Issue on Re-Build

Dmkaz · February 12, 2020, 9:14pm

Afternoon all,

Recently, I updated and rebuilt our Foreman infrastructure, going from 1.21.0-RC4 on Ubuntu to 1.24.2 on CentOS 7.

We utilize the FreeIPA Realm plugin for Smart-Proxy and is where my present issue lies.

Previously, on 1.21.0, after a host was successfully built, initiating a ‘Build’ from the GUI would trigger a realm_update query to wipe the existing keytab from FreeIPA and re-issue the OTP.

Currently, on 1.24.2, the initial build functions correctly, but initiating a re-build does not cause a realm_update. The only work-around is to fully delete the host in Foreman and create new.

Is this some functionality that has changed to anyone’s knowledge or indeed a bug?

Thanks!

lzap · February 13, 2020, 2:50pm

Not many changes, however the most recent patch changed priority from 50 to 1 so the step should be executed earlier. Could be a bug, try to lower the priority:

Dmkaz · February 13, 2020, 3:21pm

Appreciate the suggestion, lzap. Unfortunately that didn’t appear to solve the issue.

Could you point me in the direction as to what function is triggered when the ‘Build’ button is pressed within the gui?

It’s almost appearing that since the realm/hostname is not changing between builds (as it’s simply a re-build of an existing host) the realm_update function is not being called. I’m not seeing any evidence in logs pointing to a failure to update the realm on re-build either.

lzap · February 13, 2020, 3:35pm

If you investigate the file I sent you, that’s what’s being actually called. In the “queue” method, there might be something missing so it does not get queued. Enable debug mode to see which actions are in the queue.

Dmkaz · February 13, 2020, 6:25pm

Few things:
I enabled debug-level logging on foreman and confirmed that the realm task is not getting queued on host re-build.

Also, digging through some of the code, I saw that there is a method in /app/models/host/managed.rb that sets: set_realm :rebuild => true. However, outside of logging, :rebuild isn’t defined in realm.rb

github.com

theforeman/foreman/blob/bd99c356ccb9c3f4432ca9ead71d430f4197f585/app/models/host/managed.rb#L336


def import_facts(facts, source_proxy = nil)
  # Facts come from 'existing' attributes/infrastructure. We skip triggering
  # the orchestration of this infrastructure when we create a host this way.
  skip_orchestration! if SETTINGS[:unattended] && !SETTINGS[:enable_orchestration_on_fact_import]
  super
ensure
  enable_orchestration! if SETTINGS[:unattended] && !SETTINGS[:enable_orchestration_on_fact_import]
end


# Request a new OTP for a host
def handle_realm
  return true unless realm?


  # If no OTP is set, then this is probably a rebuild
  if self.otp.blank?
    logger.info "Setting realm for host #{name}"
    set_realm :rebuild => true
    self.save!
  else
    true
  end

lzap · February 14, 2020, 7:35am

The “rebuild” flag is passed into the API and processed in smart-proxy:

github.com

theforeman/smart-proxy/blob/develop/modules/realm_freeipa/provider.rb#L73




def create realm, hostname, params
  check_realm realm


  # Send params to FreeIPA, may want to send more than one in the future
  setattr = params.has_key?('userclass') ? ["userclass=#{params['userclass']}"] : []


  host = find(hostname)
  if host.nil?
    result = do_host_create(hostname, setattr)
  elsif params[:rebuild] == "true"
    result = do_host_rebuild(hostname, setattr, host["result"]["has_keytab"])
  else
    result = do_host_modify(hostname, setattr)
  end


  JSON.pretty_generate(result["result"])
rescue => e
  if e.message =~ /no modifications/
    JSON.pretty_generate("message" => "nothing to do")
  else

Share debug logs of the transaction with us, both from foreman and smart proxy. Use request ID to grep relevant lines please.