Bug 1262315
| Summary: | Unable to establish winsync replication | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Steeve Goveas <sgoveas> |
| Component: | ipa | Assignee: | Tomas Babej <tbabej> |
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.2 | CC: | ksiddiqu, mkosek, pvoborni, rcritten, sumenon, tbabej, tlavigne |
| Target Milestone: | rc | Keywords: | Regression, TestBlocker |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.2.0-11.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-19 12:06:32 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
This is a valid regression. It is caused by the following DS change: https://bugzilla.redhat.com/show_bug.cgi?id=1250177 (a nice explanation can be found in https://bugzilla.redhat.com/show_bug.cgi?id=1258624). We will need to fix this in IPA. As a note, in DS 1.3.4 there's a following feature which may simplify handling similiar cases of this problem: https://fedorahosted.org/389/ticket/48267 patch was posted upstream for review Fixed upstream ipa-4-2: https://fedorahosted.org/freeipa/changeset/ffb676511054e72b05b25a8f339a15da5b40eb2f master: https://fedorahosted.org/freeipa/changeset/73c82d00736ae032465b7e50a2ea51ad753c8093 Upstream ticket: https://fedorahosted.org/freeipa/ticket/5308 Verified on RHEL7.2 with winsync done to Windows2012R2 AD. ipa-server-trust-ad-4.2.0-11.el7.x86_64 ipa-server-4.2.0-11.el7.x86_64 sssd-1.13.0-26.el7.x86_64 Observations:- 1. 'ipa-replica-manage' command doesn't fail as mentioned in the original comment. [root@ipa01 log]# ipa-replica-manage connect --winsync --passsync=***** --cacert=/etc/dirsrv/slapd-LABS01-TEST/ADCert.cer win01.test.in --binddn="cn=Administrator,cn=Users,dc=test,dc=in" --bindpw ***** -v -p ***** Added CA certificate /etc/dirsrv/slapd-LABS01-TEST/ADCert.cer to certificate database for ipa01.labs01.test ipa: INFO: AD Suffix is: DC=test,DC=in The user for the Windows PassSync service is uid=passsync,cn=sysaccounts,cn=etc,dc=labs01,dc=test Adding Windows PassSync system account ipa: INFO: Added new sync agreement, waiting for it to become ready . . . ipa: INFO: Replication Update in progress: FALSE: status: 0 Replica acquired successfully: Incremental update started: start: 0: end: 0 ipa: INFO: Agreement is ready, starting replication . . . Starting replication, please wait until this has completed. Update succeeded Connected 'ipa01.labs01.test' to 'win01.test.in' 2. Some of the ipa-replica-manage commands also ran fine. [root@ipa01 ~]# ipa-replica-manage list Directory Manager password: win01.test.in: winsync ipa01.labs01.test: master [root@ipa01 ~]# ipa-replica-manage list-ruv Directory Manager password: ipa01.labs01.test:389: 3 [root@ipa01 ~]# ipa-replica-manage dnarange-show Directory Manager password: ipa01.labs01.test: 1115400015-1115599999 3. Also dirsrv error log file doesn't display any errors as mentioned in the original comment. [21/Sep/2015:20:09:48 +051800] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=labs01,dc=test--no CoS Templates found, which should be added before the CoS Definition. [21/Sep/2015:20:09:48 +051800] - slapd started. Listening on All Interfaces port 389 for LDAP requests [21/Sep/2015:20:09:48 +051800] - Listening on All Interfaces port 636 for LDAPS requests [21/Sep/2015:20:09:48 +051800] - Listening on /var/run/slapd-LABS01-TEST.socket for LDAPI requests [21/Sep/2015:20:09:49 +051800] - Entry "cn=meTowin01.test.in,cn=replica,cn=dc\3Dlabs01\2Cdc\3Dtest,cn=mapping tree,cn=config" -- attribute "nsDS5ReplicatedAttributeListTotal" not allowed [21/Sep/2015:20:09:49 +051800] NSMMReplicationPlugin - windows sync - agmt="cn=meTowin01.test.in" (win01:389): Replica has no update vector. It has never been initialized. [21/Sep/2015:20:09:49 +051800] NSMMReplicationPlugin - windows sync - agmt="cn=meTowin01.test.in" (win01:389): Replica has no update vector. It has never been initialized. [21/Sep/2015:20:09:51 +051800] NSMMReplicationPlugin - windows sync - Beginning total update of replica "agmt="cn=meTowin01.test.in" (win01:389)". [21/Sep/2015:20:09:52 +051800] - Entry "uid=Guest,cn=users,cn=accounts,dc=labs01,dc=test" missing attribute "sn" required by object class "person" [21/Sep/2015:20:09:52 +051800] - Entry "uid=krbtgt,cn=users,cn=accounts,dc=labs01,dc=test" missing attribute "sn" required by object class "person" [21/Sep/2015:20:09:52 +051800] - Entry "uid=PNE02$,cn=users,cn=accounts,dc=labs01,dc=test" missing attribute "sn" required by object class "person" [21/Sep/2015:20:09:52 +051800] - Entry "uid=monuser2,cn=users,cn=accounts,dc=labs01,dc=test" missing attribute "sn" required by object class "person" [21/Sep/2015:20:09:52 +051800] - Entry "uid=LABS$,cn=users,cn=accounts,dc=labs01,dc=test" missing attribute "sn" required by object class "person" [21/Sep/2015:20:09:52 +051800] - Entry "uid=rhel6user,cn=users,cn=accounts,dc=labs01,dc=test" missing attribute "sn" required by object class "person" [21/Sep/2015:20:09:52 +051800] - Entry "uid=RHEL6$,cn=users,cn=accounts,dc=labs01,dc=test" missing attribute "sn" required by object class "person" [21/Sep/2015:20:09:52 +051800] - Entry "uid=Administrator,cn=users,cn=accounts,dc=labs01,dc=test" missing attribute "sn" required by object class "person" [21/Sep/2015:20:09:52 +051800] - Entry "uid=LABS01$,cn=users,cn=accounts,dc=labs01,dc=test" missing attribute "sn" required by object class "person" [21/Sep/2015:20:09:52 +051800] - Entry "uid=user1,cn=users,cn=accounts,dc=labs01,dc=test" missing attribute "sn" required by object class "person" [21/Sep/2015:20:09:52 +051800] NSMMReplicationPlugin - windows sync - Finished total update of replica "agmt="cn=meTowin01.test.in" (win01:389)". Sent 0 entries. Note: If the lastname is not specified for the AD user, the sync won't happen and dirsrv error log file will display the below message and the user's wont be listed in the IPA UI Console under Identity --> Active Users Tab "uid=user1,cn=users,cn=accounts,dc=labs01,dc=test" missing attribute "sn" required by object class "person". User created in AD is shown in the IPA-server using the below command once the WinSync agreement is done completely without any errors. [root@ipa01 ipa]# ipa user-show User login: user2 User login: user2 First name: user2 Last name: test Home directory: /home/user2 Login shell: /bin/sh UID: 1892400010 GID: 1892400010 Account disabled: False Password: False Kerberos keys available: False Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2362.html |
Description of problem: Winsync replication fails with error unexpected error: {'desc': 'Object class violation'} Version-Release number of selected component (if applicable): # rpm -q ipa-server ipa-server-4.2.0-9.el7.x86_64 How reproducible: Always Steps to Reproduce: 1. Setup winync replication 2. 3. Actual results: :: [ BEGIN ] :: Creating Winsync Agreement with valid cert :: actually running 'ipa-replica-manage connect --winsync --passsync=password --cacert=/tmp/tmp.GqgBmxLgKR/ADcert.cer squab.adrelm.com --binddn "CN=Administrator,CN=Users,DC=adrelm,DC=com" --bindpw Secret123 -v -p Secret123 > /tmp/tmp.GqgBmxLgKR/tmpout.ipa_winsync_0003.out 2>&1' :: [ FAIL ] :: Creating Winsync Agreement with valid cert (Expected 0, got 1) ipa: INFO: AD Suffix is: DC=adrelm,DC=com Added CA certificate /tmp/tmp.GqgBmxLgKR/ADcert.cer to certificate database for vm-idm-008.syncwin.test The user for the Windows PassSync service is uid=passsync,cn=sysaccounts,cn=etc,dc=syncwin,dc=test Adding Windows PassSync system account unexpected error: {'desc': 'Object class violation'} [root@vm-idm-008 sgoveas]# tail -100 /var/log/dirsrv/slapd-SYNCWIN-TEST/errors [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA: enabled [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA: enabled [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA: enabled [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA: enabled [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_RSA_WITH_AES_256_CBC_SHA: enabled [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA: enabled [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_RSA_WITH_AES_128_CBC_SHA: enabled [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_RSA_WITH_CAMELLIA_128_CBC_SHA: enabled [11/Sep/2015:16:07:30 +051800] - SSL alert: TLS_RSA_WITH_SEED_CBC_SHA: enabled [11/Sep/2015:16:07:30 +051800] SSL Initialization - Configured SSL version range: min: TLS1.0, max: TLS1.2 [11/Sep/2015:16:07:30 +051800] - 389-Directory/1.3.4.0 B2015.247.1833 starting up [11/Sep/2015:16:07:30 +051800] schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=syncwin,dc=test [11/Sep/2015:16:07:30 +051800] schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=syncwin,dc=test [11/Sep/2015:16:07:30 +051800] schema-compat-plugin - warning: no entries set up under ou=sudoers,dc=syncwin,dc=test [11/Sep/2015:16:07:30 +051800] NSACLPlugin - The ACL target cn=groups,cn=compat,dc=syncwin,dc=test does not exist [11/Sep/2015:16:07:30 +051800] NSACLPlugin - The ACL target cn=computers,cn=compat,dc=syncwin,dc=test does not exist [11/Sep/2015:16:07:30 +051800] NSACLPlugin - The ACL target cn=ng,cn=compat,dc=syncwin,dc=test does not exist [11/Sep/2015:16:07:30 +051800] NSACLPlugin - The ACL target ou=sudoers,dc=syncwin,dc=test does not exist [11/Sep/2015:16:07:30 +051800] NSACLPlugin - The ACL target cn=users,cn=compat,dc=syncwin,dc=test does not exist [11/Sep/2015:16:07:30 +051800] NSACLPlugin - The ACL target cn=ad,cn=etc,dc=syncwin,dc=test does not exist [11/Sep/2015:16:07:30 +051800] NSACLPlugin - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=syncwin,dc=test does not exist [11/Sep/2015:16:07:30 +051800] NSACLPlugin - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=syncwin,dc=test does not exist [11/Sep/2015:16:07:30 +051800] NSACLPlugin - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [11/Sep/2015:16:07:30 +051800] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=syncwin,dc=test--no CoS Templates found, which should be added before the CoS Definition. [11/Sep/2015:16:07:30 +051800] - slapd started. Listening on All Interfaces port 389 for LDAP requests [11/Sep/2015:16:07:30 +051800] - Listening on All Interfaces port 636 for LDAPS requests [11/Sep/2015:16:07:30 +051800] - Listening on /var/run/slapd-SYNCWIN-TEST.socket for LDAPI requests [11/Sep/2015:16:44:19 +051800] - slapd shutting down - signaling operation threads - op stack size 2 max work q size 1 max work q stack size 1 [11/Sep/2015:16:44:19 +051800] - slapd shutting down - waiting for 27 threads to terminate [11/Sep/2015:16:44:19 +051800] - slapd shutting down - closing down internal subsystems and plugins [11/Sep/2015:16:44:20 +051800] - Waiting for 4 database threads to stop [11/Sep/2015:16:44:21 +051800] - All database threads now stopped [11/Sep/2015:16:44:21 +051800] - slapd shutting down - freed 1 work q stack objects - freed 4 op stack objects [11/Sep/2015:16:44:21 +051800] - slapd stopped. [11/Sep/2015:16:44:22 +051800] - SSL alert: Configured NSS Ciphers [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_RSA_WITH_AES_256_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_DSS_WITH_AES_256_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_DSS_WITH_AES_128_GCM_SHA256: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_RSA_WITH_AES_128_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_DSS_WITH_AES_128_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_RSA_WITH_AES_256_GCM_SHA384: enabled [11/Sep/2015:16:44:22 +051800] - SSL alert: TLS_RSA_WITH_AES_256_CBC_SHA: enabled [11/Sep/2015:16:44:23 +051800] - SSL alert: TLS_RSA_WITH_AES_256_CBC_SHA256: enabled [11/Sep/2015:16:44:23 +051800] - SSL alert: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA: enabled [11/Sep/2015:16:44:23 +051800] - SSL alert: TLS_RSA_WITH_AES_128_GCM_SHA256: enabled [11/Sep/2015:16:44:23 +051800] - SSL alert: TLS_RSA_WITH_AES_128_CBC_SHA: enabled [11/Sep/2015:16:44:23 +051800] - SSL alert: TLS_RSA_WITH_AES_128_CBC_SHA256: enabled [11/Sep/2015:16:44:23 +051800] - SSL alert: TLS_RSA_WITH_CAMELLIA_128_CBC_SHA: enabled [11/Sep/2015:16:44:23 +051800] - SSL alert: TLS_RSA_WITH_SEED_CBC_SHA: enabled [11/Sep/2015:16:44:23 +051800] SSL Initialization - Configured SSL version range: min: TLS1.0, max: TLS1.2 [11/Sep/2015:16:44:23 +051800] - 389-Directory/1.3.4.0 B2015.247.1833 starting up [11/Sep/2015:16:44:23 +051800] schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=syncwin,dc=test [11/Sep/2015:16:44:23 +051800] schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=syncwin,dc=test [11/Sep/2015:16:44:23 +051800] schema-compat-plugin - warning: no entries set up under ou=sudoers,dc=syncwin,dc=test [11/Sep/2015:16:44:23 +051800] NSACLPlugin - The ACL target cn=groups,cn=compat,dc=syncwin,dc=test does not exist [11/Sep/2015:16:44:23 +051800] NSACLPlugin - The ACL target cn=computers,cn=compat,dc=syncwin,dc=test does not exist [11/Sep/2015:16:44:23 +051800] NSACLPlugin - The ACL target cn=ng,cn=compat,dc=syncwin,dc=test does not exist [11/Sep/2015:16:44:23 +051800] NSACLPlugin - The ACL target ou=sudoers,dc=syncwin,dc=test does not exist [11/Sep/2015:16:44:23 +051800] NSACLPlugin - The ACL target cn=users,cn=compat,dc=syncwin,dc=test does not exist [11/Sep/2015:16:44:23 +051800] NSACLPlugin - The ACL target cn=ad,cn=etc,dc=syncwin,dc=test does not exist [11/Sep/2015:16:44:23 +051800] NSACLPlugin - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=syncwin,dc=test does not exist [11/Sep/2015:16:44:23 +051800] NSACLPlugin - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=syncwin,dc=test does not exist [11/Sep/2015:16:44:23 +051800] NSACLPlugin - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [11/Sep/2015:16:44:23 +051800] - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=syncwin,dc=test--no CoS Templates found, which should be added before the CoS Definition. [11/Sep/2015:16:44:23 +051800] - slapd started. Listening on All Interfaces port 389 for LDAP requests [11/Sep/2015:16:44:23 +051800] - Listening on All Interfaces port 636 for LDAPS requests [11/Sep/2015:16:44:23 +051800] - Listening on /var/run/slapd-SYNCWIN-TEST.socket for LDAPI requests [11/Sep/2015:16:44:24 +051800] - Entry "uid=passsync,cn=sysaccounts,cn=etc,dc=syncwin,dc=test" -- attribute "memberOf" not allowed [11/Sep/2015:16:44:24 +051800] memberof-plugin - memberof_postop_modify: failed to replace values in dn (cn=PassSync Service,cn=privileges,cn=pbac,dc=syncwin,dc=test). Error (65) Expected results: Winsync replication is establised Additional info: