diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py
index d87b9e3c1..e047324d3 100644
--- a/ipapython/ipautil.py
+++ b/ipapython/ipautil.py
@@ -515,14 +515,18 @@ def run(args, stdin=None, raiseonerr=True, nolog=(), env=None,
             for group, gid in zip(suplementary_groups, suplementary_gids):
                 logger.debug('suplementary_group=%s (GID %d)', group, gid)
 
-    def preexec_fn():
-        if runas is not None:
-            os.setgroups(suplementary_gids)
-            os.setregid(pent.pw_gid, pent.pw_gid)
-            os.setreuid(pent.pw_uid, pent.pw_uid)
+    if runas is not None or umask is not None:
+        # preexec function is not supported in WSGI environment
+        def preexec_fn():
+            if runas is not None:
+                os.setgroups(suplementary_gids)
+                os.setregid(pent.pw_gid, pent.pw_gid)
+                os.setreuid(pent.pw_uid, pent.pw_uid)
 
-        if umask:
-            os.umask(umask)
+            if umask is not None:
+                os.umask(umask)
+    else:
+        preexec_fn = None
 
     try:
         # pylint: disable=subprocess-popen-preexec-fn