-
Title
Authselect errors when no previous profile is configured -
Description
On Linux system that use authselect to configure system identity and authentication sources by selecting a specific profile, a configuration error will occur in files like nsswitch.conf when trying to unjoin and the join a system if the Linux host does not have a previously defined authselect profile before Authentication Services was installed. -
Cause
Freshly installed Linux system that use authselect may not have a predefined or minimal policy configured. As a result, when installing Authentication Services software for the first time, the routines to apply the AuthenticationServices authselect profile will correctly apply the profile but will fail to take a backup of the previous profile (because it does not exist).
Later, when you decide to unjoin and rejoin the system, our routines will fail at unjoin to unconfigure (restore the backup) the authselect profiles and the system will be in an invalid state of authselect.
the output will be like this:
Removing authselect configuration ... 2022-04-27 22:49:19 [debug] (24976) _authselect_reset_prev_config: Got previous configuration of 2022-04-27 22:49:19 [debug] (24976) vas_process_wait_for: WEXITSTATUS returned 1 Failed
=====BEGIN /usr/bin/authselect OUTPUT=====
[error] Unable to get profile information [2]: No such file or directory
=====END /usr/bin/authselect OUTPUT=====
Every additional attempt to install/reinstall our software and configure the profiles will faill with a similar error:
-
Resolution
The workaround is:1- Make sure system is unjoined2- Call RHEL authselect with a profile that IS NOT SAS, any profile will do$ sudo authselect select minimal --force3- Do the join, our script will detect a previous authselect profile, perform the profile backup and apply our profile. Then when unjoin, it will restore minimal profile backup and the system will not remain in error. -
Change Request
307955 -
Additional Information
Change Request 307955 created.