Skip to main content

Hi all,
We use here Redhat 8.10.
Our policy is not to create local users on our linux systems.
Instead all our users are in Active Directory (with linux attributes).
We use Centrify to map the Ad users to the local linux system (https://delinea.com/centrify)

This is why all our centron users are not present in /etc/passwd (centreon, centreon-broker, centreon-engine, centreon-gorgone)
But they do exists and can be used as usual to start process, as owner of files ...etc 
→ All our Centreon Platform is running well with this Centrify configuration ….

BUT we are facing an issue while upgrading :
EX:  during  “dnf upgrade centreon-common.noarch”

The rpm scriplet provided by centreon runs this : 

if getent passwd centreon-broker > /dev/null 2>&1; then
  usermod -a -G centreon-broker centreon
  usermod -a -G centreon centreon-broker
fi

But it fails with : 

Running scriptlet: centreon-common-23.10.11-1.el8.noarch 7/138

usermod: user 'centreon' does not exist

usermod: user 'centreon-broker' does not exist

usermod: user 'centreon' does not exist

usermod: user 'centreon-engine' does not exist

error: %prein(centreon-common-23.10.11-1.el8.noarch) scriptlet failed, exit status 6

This is because ‘usermod’ need real linux local users (present in /etc/password)
So the package is not installed … and other foloowing commands (chown /  chmod) in the scriptlet are not executed at all….

Would it be possible not to exit when these ‘usermod’ are failing ??
This could be possible with the || true option for the usermod commands :

usermod -a -G centreon-broker centreon || true 


Thanks 

Sorry, I'm not very familiar with Centrify.

From what I understand, system users must come from AD and not from the software packaging. How do you manage user creation? Their home page? Their relationship to groups?

If we decide to add new components or remove some, how will you handle this? Similarly, if we change the contents of user groups, how will this work if the upgrade script fails? A the end the solution will no longer work.

Regards


NewDiscussion ongoing