Bug 1999992
| Summary: | ipa migrate-ds command fails to warn when compat plugin is enabled | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Sudhir Menon <sumenon> | |
| Component: | ipa | Assignee: | Florence Blanc-Renaud <frenaud> | |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 8.5 | CC: | frenaud, lmiksik, rcritten, ssidhaye, tscherf, twoerner | |
| Target Milestone: | rc | Keywords: | Regression | |
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | idm-client-8050020210913151510.de73ecb2 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 2002285 2004165 (view as bug list) | Environment: | ||
| Last Closed: | 2021-11-09 18:29:52 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 2002285, 2004165 | |||
|
Description
Sudhir Menon
2021-09-01 07:12:11 UTC
The migrate-ds plugin is doing an internal ldapsearch in order to find if the compat plugin is enabled, equivalent to ldapsearch -Y GSSAPI -b cn=compat,$SUFFIX -s base "(objectClass=*)" * aci This search does not return any entry, and the plugin considers that the compat tree is not enabled. This looks similar to https://bugzilla.redhat.com/show_bug.cgi?id=1958909 except that 1958909 was fixed for base searches below cn=compat,$SUFFIX (for instance -b cn=admins,cn=groups,cn=compat,$SUFFIX). It seems that the fix was not sufficient: # ldapsearch -LLL -o ldif-wrap=no -D cn=directory\ manager -w Secret123 -b cn=compat,dc=ipa,dc=test -s base "(objectClass=*)" No such object (32) Matched DN: dc=ipa,dc=test # rpm -qa ipa-server slapi-nis ipa-server-4.9.6-4.module+el8.5.0+11912+1b4496cf.x86_64 slapi-nis-0.56.6-3.module+el8.5.0+11645+9d3a3007.x86_64 On IPA side, we can check if compat plugin is enabled by reading the entry cn=Schema Compatibility,cn=plugins,cn=config: if the attribute "nsslapd-pluginEnabled" is set to on, then the plugin is enabled. Opened https://bugzilla.redhat.com/show_bug.cgi?id=2000060 to track the base search on cn=compat,$SUFFIX issue. We can either wait for a fix of 2000060, or modify migrate-ds code with a workaround (search -b cn=users,cn=compat,$SUFFIX -s base instead of search -b cn=compat,$SUFFIX -s base for instance). Note that my previous suggestion (reading the entry cn=Schema Compatibility,cn=plugins,cn=config) would not work as this entry is protected by ACIs and only directory manager could read its content. Since migrate-ds is run with a kerberos ticket (usually admin), the entry would not be returned and migrate-ds would wrongly assume that the compat plugin is not enabled. Upstream ticket: https://pagure.io/freeipa/issue/8984 Fixed upstream master: https://pagure.io/freeipa/c/2ba3028b968f8d3c27980c9921c0c08b29d024e9 Fixed upstream ipa-4-9: https://pagure.io/freeipa/c/3c4f9e7347965ff9a887147df34e720224ffa7cc Removing "depends on" as a workaround has been implemented in the fix for this BZ. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (ipa bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:4230 |