Re: FreeIPA Community Portal - install errors - "No module named ipalib"

[Joseph Flynn]

Yes, thank you Alexander.

Yes I performed the enrollment (if running the client install the same as
'enrolling'?)

To make it easier to read, I have the executed steps and the error
formatted for easy reading in
http://agileiomo.blogspot.com/2018/05/errors-i-am-seeing-with-installing.htm...

On Sat, May 12, 2018 at 3:26 AM, Alexander Bokovoy 
wrote:
> On pe, 11 touko 2018, Henery Hawk via FreeIPA-users wrote:
> > Trying to follow the install instructions for the portal at
> > http://freeipa-community-portal.readthedocs.io/en/latest/
> > deploy.html#installation.
> > Using Fedora Server 28.
> >
> > Any thoughts?
> >
> > When creating the stage user via script I get the following error:
> >
> > [*] sudo ./create-portal-user
> >     Traceback (most recent call last):
> >       File "./create-portal-user", line 27, in <module>
> >         from ipalib import api
> >     ImportError: No module named ipalib
>
> Do you have this machine enrolled to IPA itself?
>
> The first thing you are asked to do before installation of the portal
> app is to enroll themachine to IPA:
>
> Before continuing into the installation, the server should be enrolled
> as a FreeIPA client of the FreeIPA domain it belongs to. Running:
>
> ipa-client-install
> with your favorite options will do.
> > I try to manually install ipalib which brings me to another error:
> >
> > [*] sudo pip install ipalib
> >     .
> >     .
> >     .
> >    In distributed package, building from C files...
> >    Traceback (most recent call last):
> >      File "<string>", line 1, in <module>
> >      File "/tmp/pip-install-qQYKRY/gssapi/setup.py", line 109, in
> >
> > <module>
> >        raise Exception("Could not find main GSSAPI shared library.
> > Please "
> >    Exception: Could not find main GSSAPI shared library.  Please try
> > setting GSSAPI_MAIN_LIB yourself or setting ENABLE_SUPPORT_DETECTION to
> > 'false'
> >
> > Command "python setup.py egg_info" failed with error code 1 in
> > /tmp/pip-install-qQYKRY/gssapi/
> > _______________________________________________
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > rahosted.org

FreeIPA Community Portal - install errors - "No module named ipalib"

[Alexander Bokovoy]

On la, 12 touko 2018, Joseph Flynn wrote:
> Yes, thank you Alexander.
>
> Yes I performed the enrollment (if running the client install the same as
> 'enrolling'?)

Thing is, 'from ipalib import api' assumes ipalib Python module is
installed. That module is a strict requirement of freeipa-client package
in Fedora (I have development version installed but that doesn't change
with what I package in Fedora):

# rpm -qf /usr/lib/python3.6/site-packages/ipalib
python3-ipalib-4.6.90.pre1.dev201804271410+gitdcde5a791-0.fc28.noarch
# rpm -q --whatrequires python3-ipalib
python3-ipaclient-4.6.90.pre1.dev201804271410+gitdcde5a791-0.fc28.noarch
freeipa-python-compat-4.6.90.pre1.dev201804271410+gitdcde5a791-0.fc28.noarch
# rpm -q --whatrequires python3-ipaclient
python3-ipa-desktop-profile-client-0.0.6-5.fc28.noarch
python3-ipaserver-4.6.90.pre1.dev201804271410+gitdcde5a791-0.fc28.noarch
freeipa-client-4.6.90.pre1.dev201804271410+gitdcde5a791-0.fc28.x86_64
python3-ipatests-4.6.90.pre1.dev201804271410+gitdcde5a791-0.fc28.noarch

So, freeipa-client package requires ipalib Python package and there is
no way you'd get an error unless you are using a different python
version.

That one (using python 2 in create-portal-user) is a likely your issue:
Fedora 28 has Python 3 by default and only Python 3 versions of IPA
libraries are installed.

You can install python2-ipaclient manually, this should bring python 2
versions of IPA libraries and make freeipa community portal code happy.
> To make it easier to read, I have the executed steps and the error
> formatted for easy reading in
> http://agileiomo.blogspot.com/2018/05/errors-i-am-seeing-with-installing.htm...
>
> On Sat, May 12, 2018 at 3:26 AM, Alexander Bokovoy 
> wrote:
> > On pe, 11 touko 2018, Henery Hawk via FreeIPA-users wrote:
> > > Trying to follow the install instructions for the portal at
> > > http://freeipa-community-portal.readthedocs.io/en/latest/
> > > deploy.html#installation.
> > > Using Fedora Server 28.
> > >
> > > Any thoughts?
> > >
> > > When creating the stage user via script I get the following error:
> > >
> > > [*] sudo ./create-portal-user
> > >     Traceback (most recent call last):
> > >       File "./create-portal-user", line 27, in <module>
> > >         from ipalib import api
> > >     ImportError: No module named ipalib
> >
> > Do you have this machine enrolled to IPA itself?
> >
> > The first thing you are asked to do before installation of the portal
> > app is to enroll themachine to IPA:
> >
> > Before continuing into the installation, the server should be enrolled
> > as a FreeIPA client of the FreeIPA domain it belongs to. Running:
> >
> > ipa-client-install
> > with your favorite options will do.
> > > I try to manually install ipalib which brings me to another error:
> > >
> > > [*] sudo pip install ipalib
> > >     .
> > >     .
> > >     .
> > >    In distributed package, building from C files...
> > >    Traceback (most recent call last):
> > >      File "<string>", line 1, in <module>
> > >      File "/tmp/pip-install-qQYKRY/gssapi/setup.py", line 109, in
> > >
> > > <module>
> > >        raise Exception("Could not find main GSSAPI shared library.
> > > Please "
> > >    Exception: Could not find main GSSAPI shared library.  Please try
> > > setting GSSAPI_MAIN_LIB yourself or setting ENABLE_SUPPORT_DETECTION to
> > > 'false'
> > >
> > > Command "python setup.py egg_info" failed with error code 1 in
> > > /tmp/pip-install-qQYKRY/gssapi/
> > > _______________________________________________
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> > > rahosted.org

FreeIPA Community Portal - install errors - "No module named ipalib"

[Joseph Flynn]

Loading the python2 ipa packages got through the first error.

The script seems to be setting some permissions and creating some users but
then there are some keytab failures.

I'm just a beginner at this so I need to learn more about how ipa handles
these matters.  I see the portal user Self Service in the user table vi the
web UI.

I already kinit admin prior to this and get:

[ me@portal ~ ]$ create-portal-user
Created privilege 'Portal management privilege'
    Added permission 'System: Add Stage User' to privilege
    Added permission 'System: Read Stage User' to privilege
    Added permission 'System: Change User password' to privilege
    Cannot add permission 'System: Read User Standard Attributes' to
privilege
ipa: WARNING:     Cannot add permission 'System: Read User Standard
Attributes' to privilege
    Cannot add permission 'System: Read User Addressbook Attributes' to
privilege
ipa: WARNING:     Cannot add permission 'System: Read User Addressbook
Attributes' to privilege
Created role 'Portal management'
Added privilege 'Portal management privilege' to role 'Portal management'
Created user 'portal'
Added role 'Portal management' to user 'portal'
Retrieving keytab...
    ipa-getkeytab -s prime.ipa.kkgpitt.org -p [e-mail] -k
/etc/ipa/portal.keytab
Failed to add key to the keytab
Traceback (most recent call last):
  File "/home/me/.local/bin/create-portal-user", line 207, in <module>
    main()
  File "/home/me/.local/bin/create-portal-user", line 197, in main
    create_keytab(args.username, args.keytab, args.keytab_owner)
  File "/home/me/.local/bin/create-portal-user", line 180, in create_keytab
    subprocess.check_call(cmd)
  File "/usr/lib64/python2.7/subprocess.py", line 190, in check_call
    raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['ipa-getkeytab', '-s', u'
prime.ipa.kkgpitt.org', '-p', u'[e-mail]', '-k',
'/etc/ipa/portal.keytab']' returned non-zero exit status 11

I tried to manually execute the command

[me@portal ~]$ ipa-getkeytab  -s prime.ipa.kkgpitt.org -p
[e-mail] -k /etc/ipa/portal.keytab
Failed to add key to the keytab

I tried to manually change the password and try again which yielded a
slightly different error.
[me@portal ~]$ ipa-getkeytab  -s prime.ipa.kkgpitt.org -p <new pw> -k
/etc/ipa/portal.keytab
Failed to parse result: PrincipalName not found.

Retrying with pre-4.0 keytab retrieval method...
Failed to parse result: PrincipalName not found.

Failed to get keytab!
Failed to get keytab

On Sat, May 12, 2018 at 2:28 PM, Alexander Bokovoy 
wrote:
> On la, 12 touko 2018, Joseph Flynn wrote:
> > Yes, thank you Alexander.
> >
> > Yes I performed the enrollment (if running the client install the same as
> > 'enrolling'?)
>
> Thing is, 'from ipalib import api' assumes ipalib Python module is
> installed. That module is a strict requirement of freeipa-client package
> in Fedora (I have development version installed but that doesn't change
> with what I package in Fedora):
>
> # rpm -qf /usr/lib/python3.6/site-packages/ipalib
> python3-ipalib-4.6.90.pre1.dev201804271410+gitdcde5a791-0.fc28.noarch
> # rpm -q --whatrequires python3-ipalib
> python3-ipaclient-4.6.90.pre1.dev201804271410+gitdcde5a791-0.fc28.noarch
> freeipa-python-compat-4.6.90.pre1.dev201804271410+gitdcde5a7
> 91-0.fc28.noarch
> # rpm -q --whatrequires python3-ipaclient
> python3-ipa-desktop-profile-client-0.0.6-5.fc28.noarch
> python3-ipaserver-4.6.90.pre1.dev201804271410+gitdcde5a791-0.fc28.noarch
> freeipa-client-4.6.90.pre1.dev201804271410+gitdcde5a791-0.fc28.x86_64
> python3-ipatests-4.6.90.pre1.dev201804271410+gitdcde5a791-0.fc28.noarch
>
> So, freeipa-client package requires ipalib Python package and there is
> no way you'd get an error unless you are using a different python
> version.
>
> That one (using python 2 in create-portal-user) is a likely your issue:
> Fedora 28 has Python 3 by default and only Python 3 versions of IPA
> libraries are installed.
> You can install python2-ipaclient manually, this should bring python 2
> versions of IPA libraries and make freeipa community portal code happy.
> > To make it easier to read, I have the executed steps and the error
> > formatted for easy reading in
> > http://agileiomo.blogspot.com/2018/05/errors-i-am-seeing-wit
> > h-installing.html
> >
> > On Sat, May 12, 2018 at 3:26 AM, Alexander Bokovoy 
> > wrote:
> >
> > On pe, 11 touko 2018, Henery Hawk via FreeIPA-users wrote:
> > > Trying to follow the install instructions for the portal at
> > > > http://freeipa-community-portal.readthedocs.io/en/latest/
> > > > deploy.html#installation.
> > > > Using Fedora Server 28.
> > > >
> > > > Any thoughts?
> > > >
> > > > When creating the stage user via script I get the following error:
> > > >
> > > > [*] sudo ./create-portal-user
> > > >     Traceback (most recent call last):
> > > >       File "./create-portal-user", line 27, in <module>
> > > >         from ipalib import api
> > > >     ImportError: No module named ipalib
> > > >
> > > > Do you have this machine enrolled to IPA itself?
> > >
> > > The first thing you are asked to do before installation of the portal
> > > app is to enroll themachine to IPA:
> > >
> > > Before continuing into the installation, the server should be enrolled
> > > as a FreeIPA client of the FreeIPA domain it belongs to. Running:
> > >
> > > ipa-client-install
> > > with your favorite options will do.
> > >
> > > I try to manually install ipalib which brings me to another error:
> > > > [*] sudo pip install ipalib
> > > >     .
> > > >     .
> > > >     .
> > > >    In distributed package, building from C files...
> > > >    Traceback (most recent call last):
> > > >      File "<string>", line 1, in <module>
> > > >      File "/tmp/pip-install-qQYKRY/gssapi/setup.py", line 109, in
> > > >
> > > > <module>
> > > >        raise Exception("Could not find main GSSAPI shared library.
> > > > Please "
> > > >    Exception: Could not find main GSSAPI shared library.  Please try
> > > > setting GSSAPI_MAIN_LIB yourself or setting ENABLE_SUPPORT_DETECTION to
> > > > 'false'
> > > >
> > > > Command "python setup.py egg_info" failed with error code 1 in
> > > > /tmp/pip-install-qQYKRY/gssapi/
> > > > _______________________________________________
> > > > FreeIPA-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to [e-mail]
> > > > rahosted.org
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland

FreeIPA Community Portal - install errors - "No module named ipalib"

[Alexander Bokovoy]

On la, 12 touko 2018, Joseph Flynn via FreeIPA-users wrote:
> Loading the python2 ipa packages got through the first error.
>
> The script seems to be setting some permissions and creating some users but
> then there are some keytab failures.
>
> I'm just a beginner at this so I need to learn more about how ipa handles
> these matters.  I see the portal user Self Service in the user table vi the
> web UI.
>
> I already kinit admin prior to this and get:
>
> [ me@portal ~ ]$ create-portal-user
> Created privilege 'Portal management privilege'
>    Added permission 'System: Add Stage User' to privilege
>    Added permission 'System: Read Stage User' to privilege
>    Added permission 'System: Change User password' to privilege
>    Cannot add permission 'System: Read User Standard Attributes' to
> privilege
> ipa: WARNING:     Cannot add permission 'System: Read User Standard
> Attributes' to privilege
>    Cannot add permission 'System: Read User Addressbook Attributes' to
> privilege
> ipa: WARNING:     Cannot add permission 'System: Read User Addressbook
> Attributes' to privilege
> Created role 'Portal management'
> Added privilege 'Portal management privilege' to role 'Portal management'
> Created user 'portal'
> Added role 'Portal management' to user 'portal'
> Retrieving keytab...
>    ipa-getkeytab -s prime.ipa.kkgpitt.org -p [e-mail] -k
> /etc/ipa/portal.keytab
> Failed to add key to the keytab
> Traceback (most recent call last):
>  File "/home/me/.local/bin/create-portal-user", line 207, in <module>
>    main()
>  File "/home/me/.local/bin/create-portal-user", line 197, in main
>    create_keytab(args.username, args.keytab, args.keytab_owner)
>  File "/home/me/.local/bin/create-portal-user", line 180, in create_keytab
>    subprocess.check_call(cmd)
>  File "/usr/lib64/python2.7/subprocess.py", line 190, in check_call
>    raise CalledProcessError(retcode, cmd)
> subprocess.CalledProcessError: Command '['ipa-getkeytab', '-s', u'
> prime.ipa.kkgpitt.org', '-p', u'[e-mail]', '-k',
> '/etc/ipa/portal.keytab']' returned non-zero exit status 11

I'd guess that a failure is due to admin not being able to retrieve a
keytab for the user 'portal'.

I'm not sure about the state of the portal app. Probably worth filling a
ticket against it on github.