Bug 1803165

Summary:	Compatibility Schema difference in functionality for systems following RHEL 7.5 -> 7.6 upgrade path as opposed to new RHEL 7.6 systems
Product:	Red Hat Enterprise Linux 8	Reporter:	Alexander Bokovoy <abokovoy>
Component:	ipa	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED ERRATA	QA Contact:	ipa-qe <ipa-qe>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.2	CC:	ksiddiqu, myusuf, pasik, pcech, rcritten, tscherf
Target Milestone:	rc
Target Release:	8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-04-28 15:44:54 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alexander Bokovoy 2020-02-14 15:30:17 UTC

This bug was initially created as a copy of Bug #1801791

I am copying this bug because:

There are two parts here.

- ipaExternalGroup is only handled for trust to AD configurations. The compat tree configuration for that is only set up when you run ipa-adtrust-install --enable-compat on the specific master (turning the master into a trust controller). When you have no external group members configured for some external groups (this is a concept in IPA, 'ipa group-add --external' and 'ipa group-add-member --external'), and these groups aren't included into some POSIX groups, you should not see any of AD groups pulled in.

- Second part is actual addition of the 'objectclass: ipaExternalGroup' into the entries under cn=groups,cn=compat,$BASEDN. This happens after /usr/share/ipa/updates/50-externalmembers.update file is automatically imported on IPA upgrade. The file content is:

$ cat install/updates/50-externalmembers.update
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
addifexist: schema-compat-entry-attribute: ipaexternalmember=%deref_r("member","ipaexternalmember")
addifexist: schema-compat-entry-attribute: objectclass=ipaexternalgroup

The upgrade should happen during replica deployment as one of last steps before enabling optional services. You can see that in the replica installation log with 'Applying LDAP updates'. But I think there might be an ordering discrepancy because the base compat tree configuration is in install/updates/80-schema_compat.update so it is ran after 50-externalmembers.update. And since at that point cn=groups,cn=Schema ... does not exist yet, it is not applied.

Comment 1 Alexander Bokovoy 2020-02-14 15:30:49 UTC

Fixed upstream
master:
https://pagure.io/freeipa/c/ff547a2777d63609faba42101e9802f5e988fa00

ipa-4-8:
https://pagure.io/freeipa/c/14dbf04148c6284b176eca34aa70df4bef09b857

ipa-4-7:
https://pagure.io/freeipa/c/9db61a51f4cfcaae5e51d10c9ce2ed751cce4c49

ipa-4-6:
https://pagure.io/freeipa/c/a5a201fc008b19841f98bb70d44ede7d04ef1126

Comment 5 Mohammad Rizwan 2020-03-05 11:53:12 UTC

version:
ipa-server-4.8.4-6.module+el8.2.0+5773+68ace8c5.x86_64
ipa-server-trust-ad-4.8.4-6.module+el8.2.0+5773+68ace8c5.x86_64

~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fresh system with AD trust:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
[root@master ~]# ldapsearch -xLLL -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=groups,cn=Schema Compatibility,cn=plugins,cn=config" schema-compat-entry-attribute
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
schema-compat-entry-attribute: objectclass=posixGroup
schema-compat-entry-attribute: gidNumber=%{gidNumber}
schema-compat-entry-attribute: memberUid=%{memberUid}
schema-compat-entry-attribute: memberUid=%deref_r("member","uid")
schema-compat-entry-attribute: %ifeq("ipauniqueid","%{ipauniqueid}","objectcla
 ss=ipaOverrideTarget","")
schema-compat-entry-attribute: %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchor
 uuid=:IPA:testrealm.test:%{ipauniqueid}","")
schema-compat-entry-attribute: ipaanchoruuid=%{ipaanchoruuid}
schema-compat-entry-attribute: %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objec
 tclass=ipaOverrideTarget","")
schema-compat-entry-attribute: ipaexternalmember=%deref_r("member","ipaexterna                         <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 lmember")
schema-compat-entry-attribute: objectclass=ipaexternalgroup

[root@master ~]# 
[root@master ~]# ldapsearch -xLLL -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=groups,cn=Schema Compatibility,cn=plugins,cn=config" schema-compat-lookup-nsswitch
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config

[root@master ~]# ipa-adtrust-install -a Secret123 -U  --enable-compat

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will setup components needed to establish trust to AD domains for
[..]


[root@master ~]# ldapsearch -xLLL -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=groups,cn=Schema Compatibility,cn=plugins,cn=config" schema-compat-lookup-nsswitch
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
schema-compat-lookup-nsswitch: group


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
rhel8.1 System with AD then upgrade to rhel8.2:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[root@master ~]# ldapsearch -xLLL -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=groups,cn=Schema Compatibility,cn=plugins,cn=config" schema-compat-entry-attribute
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
schema-compat-entry-attribute: objectclass=posixGroup
schema-compat-entry-attribute: gidNumber=%{gidNumber}
schema-compat-entry-attribute: memberUid=%{memberUid}
schema-compat-entry-attribute: memberUid=%deref_r("member","uid")
schema-compat-entry-attribute: %ifeq("ipauniqueid","%{ipauniqueid}","objectcla
 ss=ipaOverrideTarget","")
schema-compat-entry-attribute: %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchor
 uuid=:IPA:testrealm.test:%{ipauniqueid}","")
schema-compat-entry-attribute: ipaanchoruuid=%{ipaanchoruuid}
schema-compat-entry-attribute: %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objec
 tclass=ipaOverrideTarget","")
schema-compat-entry-attribute: ipaexternalmember=%deref_r("member","ipaexterna                             <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 lmember")
schema-compat-entry-attribute: objectclass=ipaexternalgroup

[root@master ~]# 
[root@master ~]# 
[root@master ~]# ldapsearch -xLLL -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=groups,cn=Schema Compatibility,cn=plugins,cn=config" schema-compat-lookup-nsswitch
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config

[root@master ~]# ipa-adtrust-install -a Secret123 --enable-compat  -U

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will setup components needed to establish trust to AD domains for
the IPA Server.

[..]

[root@master ~]# ldapsearch -xLLL -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=groups,cn=Schema Compatibility,cn=plugins,cn=config" schema-compat-lookup-nsswitch
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
schema-compat-lookup-nsswitch: group


~~~~~~~~~~~~~~~~~~~~~~~~
Fresh rhel8.2 system without AD:
~~~~~~~~~~~~~~~~~~~~~~~~

[root@master ~]# ldapsearch -xLLL -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=groups,cn=Schema Compatibility,cn=plugins,cn=config" schema-compat-lookup-nsswitch
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config

[root@master ~]# 
[root@master ~]# 
[root@master ~]# ldapsearch -xLLL -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=groups,cn=Schema Compatibility,cn=plugins,cn=config" schema-compat-entry-attribute
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
schema-compat-entry-attribute: objectclass=posixGroup
schema-compat-entry-attribute: gidNumber=%{gidNumber}
schema-compat-entry-attribute: memberUid=%{memberUid}
schema-compat-entry-attribute: memberUid=%deref_r("member","uid")
schema-compat-entry-attribute: %ifeq("ipauniqueid","%{ipauniqueid}","objectcla
 ss=ipaOverrideTarget","")
schema-compat-entry-attribute: %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchor
 uuid=:IPA:testrelm.test:%{ipauniqueid}","")
schema-compat-entry-attribute: ipaanchoruuid=%{ipaanchoruuid}
schema-compat-entry-attribute: %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objec
 tclass=ipaOverrideTarget","")
schema-compat-entry-attribute: ipaexternalmember=%deref_r("member","ipaexterna                          <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 lmember")
schema-compat-entry-attribute: objectclass=ipaexternalgroup

Comment 6 Mohammad Rizwan 2020-03-05 13:20:13 UTC

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fresh rhel8.1 system then upgrade to rhel8.2:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

old version rhel8.1:
ipa-server-4.8.0-13.module+el8.1.0+4923+c6efe041.x86_64

[root@master ~]# ldapsearch -xLLL -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=groups,cn=Schema Compatibility,cn=plugins,cn=config" schema-compat-entry-attribute
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
schema-compat-entry-attribute: objectclass=posixGroup
schema-compat-entry-attribute: gidNumber=%{gidNumber}
schema-compat-entry-attribute: memberUid=%{memberUid}
schema-compat-entry-attribute: memberUid=%deref_r("member","uid")
schema-compat-entry-attribute: %ifeq("ipauniqueid","%{ipauniqueid}","objectcla
 ss=ipaOverrideTarget","")
schema-compat-entry-attribute: %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchor
 uuid=:IPA:ipadomain.tes:%{ipauniqueid}","")
schema-compat-entry-attribute: ipaanchoruuid=%{ipaanchoruuid}
schema-compat-entry-attribute: %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objec
 tclass=ipaOverrideTarget","")


After upgrade version:
ipa-server-4.8.4-6.module+el8.2.0+5773+68ace8c5.x86_64

[root@master ~]# ldapsearch -xLLL -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=groups,cn=Schema Compatibility,cn=plugins,cn=config" schema-compat-entry-attribute
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
schema-compat-entry-attribute: objectclass=posixGroup
schema-compat-entry-attribute: gidNumber=%{gidNumber}
schema-compat-entry-attribute: memberUid=%{memberUid}
schema-compat-entry-attribute: memberUid=%deref_r("member","uid")
schema-compat-entry-attribute: %ifeq("ipauniqueid","%{ipauniqueid}","objectcla
 ss=ipaOverrideTarget","")
schema-compat-entry-attribute: %ifeq("ipauniqueid","%{ipauniqueid}","ipaanchor
 uuid=:IPA:ipadomain.tes:%{ipauniqueid}","")
schema-compat-entry-attribute: ipaanchoruuid=%{ipaanchoruuid}
schema-compat-entry-attribute: %ifeq("ipaanchoruuid","%{ipaanchoruuid}","objec
 tclass=ipaOverrideTarget","")
schema-compat-entry-attribute: ipaexternalmember=%deref_r("member","ipaexterna                       <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 lmember")
schema-compat-entry-attribute: objectclass=ipaexternalgroup



The entry cn=groups,cn=Schema Compatibility,cn=plugins,cn=config properly contains the attribute schema-compat-entry-attribute: ipaexternalmember= . Hence marking the bug as verified.

Comment 8 errata-xmlrpc 2020-04-28 15:44:54 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:1640