Bug 1493145

Summary:	ipa-replica-install might fail because of an already existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
Product:	Red Hat Enterprise Linux 7	Reporter:	Thorsten Scherf <tscherf>
Component:	ipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED ERRATA	QA Contact:	ipa-qe <ipa-qe>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	7.4	CC:	fbarreto, ksiddiqu, msauton, myusuf, pasik, pvoborni, rcritten, slaznick, tscherf
Target Milestone:	rc	Keywords:	ZStream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ipa-4.5.4-4.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1506913 (view as bug list)		Environment:
Last Closed:	2018-04-10 16:46:13 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1506913

Description Thorsten Scherf 2017-09-19 13:21:20 UTC

Description of problem:

We have seen cases where ipa-replica-install is failing with this error:

"""
 [31/40]: enabling S4U2Proxy delegation
ipa         : CRITICAL Failed to load replica-s4u2proxy.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpVKeXNx -H ldapi://%2Fvar%2Frun%2Fslapd-EXAMPLE-COM.socket -Y EXTERNAL' returned non-zero exit status 20
  [error] CalledProcessError: Command '/usr/bin/ldapmodify -v -f /tmp/tmpVKeXNx -H ldapi://%2Fvar%2Frun%2Fslapd-EXAMPLE-COM.socket -Y EXTERNAL' returned non-zero exit status 20
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
"""

The error occurs in __setup_s4u2proxy() when replica-s4u2proxy.ldif is applied. In the DS log we can see that one of the two entries already exists which then results in a failure:

[19/Sep/2017:08:24:09.269050086 -0400] conn=11 fd=68 slot=68 connection from local to /var/run/slapd-EXAMPLE-COM.socket
[19/Sep/2017:08:24:09.269396910 -0400] conn=11 AUTOBIND dn="cn=Directory Manager"
[19/Sep/2017:08:24:09.269402696 -0400] conn=11 op=0 BIND dn="cn=Directory Manager" method=sasl version=3 mech=EXTERNAL
[19/Sep/2017:08:24:09.269427850 -0400] conn=11 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=Directory Manager"
[19/Sep/2017:08:24:09.269593705 -0400] conn=11 op=1 MOD dn="cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=example,dc=com"
[19/Sep/2017:08:24:09.270433469 -0400] conn=11 op=1 RESULT err=20 tag=103 nentries=0 etime=0 csn=39e7b123001d00fd0000
[19/Sep/2017:08:24:09.281553093 -0400] conn=11 op=2 UNBIND

The DS installer should not apply the ldif in case those entries are already stored in the LDAP tree.
  

Version-Release number of selected component (if applicable):
ipa-server-4.5.0-21.el7_4.1.2.x86_64

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 2 fbarreto 2017-09-29 20:00:54 UTC

Upstream ticket: https://pagure.io/freeipa/issue/7174

Comment 4 fbarreto 2017-10-25 16:31:12 UTC

Fixed upstream
master:
https://pagure.io/freeipa/c/23a0453c4d33271376b2156f2e2b484e8b9708c9

Comment 5 Standa Laznicka 2017-10-27 06:15:58 UTC

Fixed upstream

ipa-4-6:
https://pagure.io/freeipa/c/b3dfc13f36de365b78bfbf6ac0fda2549d134739

ipa-4-5:
https://pagure.io/freeipa/c/55b7f588d0eced7e4b7840d808138eb798347d77

Comment 8 Mohammad Rizwan 2017-11-20 10:51:57 UTC

verified.

version:
ipa-server-4.5.4-4.el7.x86_64

Steps:

1. Added the entry for replica in directory server on master.

[root@master ~]# cat a.ldif 
dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=testrelm,dc=test
changetype: modify
add: memberPrincipal
memberPrincipal: HTTP/replica.testrelm.test

dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=testrelm,dc=test
changetype: modify
add: memberPrincipal
memberPrincipal: ldap/replica.testrelm.test


[root@master ~]# ldapmodify -h master.testrelm.test -p 389 -D "cn=directory manager" -w Secret123 -f a.ldif 
modifying entry "cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=testrelm,dc=test"

modifying entry "cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=testrelm,dc=test"

[root@master ~]#

2. Install replica


Expected result:
replica should install

Actual result:

Replica installed successfully.

Comment 12 errata-xmlrpc 2018-04-10 16:46:13 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0918