Debian 12: grommunio-admin-api / uwsg: can't create domain

freeloadermatt · 2023-08-16T15:15:12+00:00

Hi everyone, tried to install community edition on Debian 12 today and the install goes fine but admin-api is not working. The problems is unique to Debian...

eryx

Actually just found out, that I have the same problem, also adding new users or even opening existing ones doesn't work and causes an "InvalidSchemaValue" error.

freeloadermatt

eryx Yes I get the same: if create a domain using the CLI then go back to the GUI to create or edit users, also getting the "InvalidSchemaValue" error from uwsgi

note: problem only on Debian 12, works fine on Debian 11

WalterH

You may use grommunio-admin to create the domain:
grommunio-admin domain create DOMAIN_NAME

freeloadermatt

WalterH Thanks, that did work. Any idea why it doesn't work through the admin GUI?

Any hints on how I can switch on detailed debug for this, to find the root cause of the GUI failure?

eryx

Yes exactly. I guess it has something to do with the Python3 deps being different on Debian12, most likely the openapi-core or openapi-schema-validator libs, but definitely not sure.

stefan_o

Any news on when this will be fixed? I had the same issue (couldn't create a new user). Also users don't seem to be able to change their passwords (not sure if that's related).

WalterH

stefan_o Also users don't seem to be able to change their passwords

Do you use an LDAP source für your users or do you create the users in MySQL?

freeloadermatt

WalterH mysql on my installation. have tried a number of different builds with Debian 12 over last few weeks with three different machine architectures: Intel on synology VMM, Intel on AWS, ARM on AWS. All using mysql as the back-end.
One big difference between Debian 11.7 and 12 is PHP version update from 7.4 to 8.2
Could that be the cause?

stefan_o

WalterH
For me the users are in MySQL. Was able to change a password with phpMyAdmin manually.

WalterH
I cannot find any PHP errors, I cannot find an error in any of the nginx logs related to this

WalterH

freeloadermatt PHP 8.2 can be the issue, but you should see PHP error messages in nginx logs in /var/log/grommunio .

WalterH

stefan_o Was able to change a password with phpMyAdmin manually.

When you try to change password in G-Web, what happens?

stefan_o

WalterH
Error changing password. Please contact the system administrator.
I cannot find any log entry for that. The user also has the permission to change his password

stefan_o

The problem is indeed a known bug in openapi: https://github.com/python-openapi/openapi-core/issues/251
openapi-core is provided by the grommunio repository, but it's a version that is broken/incompatible with Debian 12 . Maybe you could update that package. I'm not sure how I could update openapi-core without breaking something else.
I had a look where grommunio-admin-api uses openapi and found it has a config file where I can just disable openapi:
"openapi": { "validateRequest": False, "validateResponse": False },
After this change the problem is gone. I assume this is somehow used for safety against malicious users/clients?

weini

Can we tag this as "bug" to increase the visibility?

I´m cross linking the posting that I raised for the identical issue:
https://community.grommunio.com/d/1216-fehler-im-admin-ui-beim-offnen-von-benutzern-und-domanen/9

stefan_o

Changing the config did not resolve all issues: users still cannot change their password, syslog shows the openapi error.
I tried to reinstall python3-openapi-core, but it wouldn't work. Turns out, that there also seems to be a packaging error: The latest version in the Debian 12 pool is older than the one I had installed:
dpkg: Warnung: Version 0.13.7-1+7.17 des Paketes python3-openapi-core wird durch ältere Version 0.13.7-1+7.2 ersetzt
I manually downloaded the deb package from the pool and installed it, but it didn't fix the problem.
I'm not sure how other people get it working on Debian 12

weini

stefan_o The latest version in the Debian 12 pool is older than the one I had installed

I think that this is because the 0.13.7-1+7.17 is from the Debian 11 pool. When you switeched from Debian 11 to 12 repository, then apt is now downgrading anything.

weini

I´m running a local package repository cache using aptly and I have this in my archive:

root@:/etc/postfix# apt list -a python3-openapi-core
Auflistung… Fertig
python3-openapi-core/now 0.13.7-1+7.17 all  [Installiert,lokal]
python3-openapi-core/Debian_12 0.13.7-1+7.2 all
python3-openapi-core/Debian_12 0.13.7-1+7.1 all

Doing approx. weekly apt update; apt upgrade resulted in having 0.13.7-1+7.17 on my system.
However, based on the github tracker link provided by @stefan_o, I would expect that the other 2 package versions will not make any difference.

stefan_o

I assume it could be an incompatibility with a later version of another package or Python 3.11

eryx

actually I am not sure in which of the python3-openapi- packages the error is located. Could also be the schema or spec validator!

stefan_o

I tried manually installing all packages from the Debian 12 and also from the Debian 11 repo, no difference.

Can anyone confirm that works on Debian 12 and post his exact versions of the openapi packages?