Snapd users API on ubuntu classic

jocado · September 20, 2023, 1:29pm

Hi,

Does anyone know if modifying users on Ubuntu Classic is not support or not ?

It seems not from the initial attempt, as I got the following response:

405 Client Error: Method Not Allowed for url: http://snapd/v2/users

Just looking for confirmation, and/or any reasoning.

Thanks!

Cheers, Just

jamesh · September 20, 2023, 1:37pm

The denial is coming from this code:

github.com

snapcore/snapd/blob/c67974c6952799cddbf7671129bf05b354b3464c/daemon/api_users.go#L203-L211


// this might need to become a function, if having user admin becomes a config option
var hasUserAdmin = !release.OnClassic
const noUserAdmin = "system user administration via snapd is not allowed on this system"
func postUsers(c *Command, r *http.Request, user *auth.UserState) Response {
	if !hasUserAdmin {
		return MethodNotAllowed(noUserAdmin)
	}

Snapd only manages user accounts on Ubuntu Core systems. Elsewhere, it’s assumed to be controlled by the host system.

jocado · September 20, 2023, 2:55pm

That’s a shame, but thanks for confirming @jamesh

We have a snap that manages users on our UC systems, using assertions and the snapd API, and it would be nice if it just worked on Classic as well.

Cheers, Just

jamesh · September 21, 2023, 1:46am

On Ubuntu Core, we know exactly how user accounts are managed.

On a classic system, it could be any number of ways due to PAM and NSS. In some configurations, there might not be any way to locally create new user accounts (e.g. if they’re all being managed in a remote LDAP directory that you don’t have administrative access to). So in addition to it being out of scope on classic, there’s enough edge cases to make it hard to implement reliably.

If you’re just working with desktop distributions with default user management, they have accounts-daemon available, which you should be able to access via the accounts-control interface. This is the same API that the users panel in gnome-control-center uses.

jocado · September 21, 2023, 7:35am

I agree, there is more to consider.

However, on a host which is managed and all configuration is known and deliberate, it could/should still be a choice, just like any of the other account configuration options you mention. It could be off by default, and enabled by some snapd system config.

I appreciate there are other ways from a snap, but it still means maintaining multiple separate approaches.

Cheers, Just