Bug 1016042 - Re-initializing a winsync connection exits with "Can't contact LDAP server"
Re-initializing a winsync connection exits with "Can't contact LDAP server"
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa (Show other bugs)
6.5
Unspecified Unspecified
medium Severity unspecified
: rc
: ---
Assigned To: Martin Kosek
Namita Soman
:
Depends On:
Blocks: 1061410
  Show dependency treegraph
 
Reported: 2013-10-07 07:39 EDT by Steeve Goveas
Modified: 2015-02-14 09:13 EST (History)
4 users (show)

See Also:
Fixed In Version: ipa-3.0.0-38.el6
Doc Type: Known Issue
Doc Text:
The ipa-replica-manage tool contains a bug in the re-initialize command causing the MemberOf task to fail with an error under certain circumstances. When the ipa-replica-manage re-initialize command is run for a Windows Synchronization (WinSync) replication agreement, it succeeds in the re-initialization part, but fails during execution of the MemberOf task which is run after the re-initialization part. The following error is returned: Update succeeded Can't contact LDAP server However, the error is harmless as running the MemberOf task is not required in this case.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-10-14 03:32:17 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
logs generated while re-initializing (251.28 KB, text/plain)
2013-10-07 07:39 EDT, Steeve Goveas
no flags Details

  None (edit)
Description Steeve Goveas 2013-10-07 07:39:58 EDT
Created attachment 808777 [details]
logs generated while re-initializing

Description of problem:
Re-initializing a winsync connection exits with an error "Can't contact LDAP server".

Version-Release number of selected component (if applicable):
ipa-server-3.0.0-37.el6.x86_64
389-ds-base-1.2.11.15-25.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1. Setup AD and IPA servers
2. Create winsync agreement between the 2
3. Add a new user in AD
4. Re-initialize the winsync connection with AD

Actual results:
Command exits with error "Can't contact LDAP server"

Expected results:
Command should complete successfully without error

Additional info:
Attached logs generated while re-initializing

[root@dhcp207-25 ~]# ipa-replica-manage re-initialize --from squab.adrelm.com ; ps -ef | grep ns-slapd
Update in progress
Update in progress
....
Update succeeded
Can't contact LDAP server
root      5883  5804  0 12:12 pts/0    00:00:00 grep ns-slapd
pkisrv   26694     1  0 Oct03 ?        00:01:01 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-PKI-IPA -i /var/run/dirsrv/slapd-PKI-IPA.pid -w /var/run/dirsrv/slapd-PKI-IPA.startpid
dirsrv   26763     1  0 Oct03 ?        00:01:10 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-TESTRELM-COM -i /var/run/dirsrv/slapd-TESTRELM-COM.pid -w /var/run/dirsrv/slapd-TESTRELM-COM.startpid
Comment 2 Martin Kosek 2013-10-07 09:21:24 EDT
Rich, does "ipa-replica-manage re-initialize" run towards a winsync agreement make sense? I am thinking that only "ipa-replica-manage force-sync" makes sense to be done with winsync.

Steeve, this may be related (duplicate) to Bug 994980. I am not sure that re-initalize operation being run with AD makes sense. If customer just wants to force synchronization with AD and thus synchronize the new user, they can just run "force-sync" operation and avoid this error. I.e.:

# ipa-replica-manage force-sync --from squab.adrelm.com

Would that command work for the customer?
Comment 3 Steeve Goveas 2013-10-07 10:46:57 EDT
(In reply to Martin Kosek from comment #2)
> Rich, does "ipa-replica-manage re-initialize" run towards a winsync
> agreement make sense? I am thinking that only "ipa-replica-manage
> force-sync" makes sense to be done with winsync.
> 
> Steeve, this may be related (duplicate) to Bug 994980. I am not sure that
> re-initalize operation being run with AD makes sense. If customer just wants
> to force synchronization with AD and thus synchronize the new user, they can
> just run "force-sync" operation and avoid this error. I.e.:
> 
> # ipa-replica-manage force-sync --from squab.adrelm.com
> 
> Would that command work for the customer?

I agree with your point that force-sync option would work.

But, this issue is simply that the re-initialize option worked in 6.4 without throwing an error.
Comment 4 Martin Kosek 2013-10-07 10:55:11 EDT
If the force-sync fully solves the customer use case (please confirm), then I do not consider the re-initialize error as blocking for RHEL-6.x and I would propose to have it fixed in scope of RHEL-7.0 as proposed in Bug 994980 (i.e. close this one as duplicate). Would you agree?
Comment 5 Rich Megginson 2013-10-07 10:59:46 EDT
(In reply to Martin Kosek from comment #2)
> Rich, does "ipa-replica-manage re-initialize" run towards a winsync
> agreement make sense? I am thinking that only "ipa-replica-manage
> force-sync" makes sense to be done with winsync.

Both "re-initialize" and "force-sync" have the same meaning in both regular replication agreements and in winsync agreements.

> 
> Steeve, this may be related (duplicate) to Bug 994980. I am not sure that
> re-initalize operation being run with AD makes sense. If customer just wants
> to force synchronization with AD and thus synchronize the new user, they can
> just run "force-sync" operation and avoid this error. I.e.:
> 
> # ipa-replica-manage force-sync --from squab.adrelm.com
> 
> Would that command work for the customer?
Comment 6 Martin Kosek 2013-10-08 03:10:11 EDT
How so? With traditional replication agreements, re-initialize sets nsds5BeginReplicaRefresh in the replication agreement and drops the contents of the replicated tree and initializes it from a remote replica.

force-sync just tackles with nsDS5ReplicaUpdateSchedule to force standard synchronization.

I just do not know what is the difference in these 2 operations with winsync agreements...
Comment 7 Rich Megginson 2013-10-08 09:39:56 EDT
(In reply to Martin Kosek from comment #6)
> How so? With traditional replication agreements, re-initialize sets
> nsds5BeginReplicaRefresh in the replication agreement and drops the contents
> of the replicated tree and initializes it from a remote replica.

That's the only difference.  Doing a winsync re-initialize doesn't destroy the current contents of the IPA database.  Instead, it reads every entry from AD to see if it needs to add that entry to IPA, then reads every entry from IPA to see if it needs to add that entry to AD (or not - I think IPA winsync doesn't add users to AD).

> 
> force-sync just tackles with nsDS5ReplicaUpdateSchedule to force standard
> synchronization.

With winsync, force-sync causes any changes pending to send to AD to be sent immediately, and causes the AD DirSync search to happen immediately, to look for any pending changes in AD to update in IPA.

> 
> I just do not know what is the difference in these 2 operations with winsync
> agreements...
Comment 8 Martin Kosek 2013-10-08 09:59:42 EDT
Ok, thanks for info. This reads to me as "having both re-initialize and force-sync actions for FreeIPA winsync replicas makes sense, keep them both available and working".
Comment 9 Martin Kosek 2013-10-08 10:13:36 EDT
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/3854
Comment 10 Steeve Goveas 2013-10-09 03:38:49 EDT
From the above comments this seems to be a blocker for 6.5
Comment 12 Martin Kosek 2013-10-09 04:22:18 EDT
Regression? I do not share this opinion. This particular routine is untouched in RHEL-6.5, RHEL-6.4 and even RHEL-6.3. Did you run a test with RHEL-6.4? IMO it will give you the same error as well.
Comment 13 Steeve Goveas 2013-10-09 04:38:29 EDT
I checked the archived tests for 6.4. You are right, the same error is seen there as well. Removing regression keyword.
Comment 14 Martin Kosek 2013-10-09 05:46:06 EDT
I tested the winsync re-initialize method and it works OK, the only issue is with the memberOf task that is being run afterwards - it is unsuccessful due to a bug and fails with this error message. But the memberOf task is not needed for this operation anyway, so it benign and IMO not a blocker for 6.5.
Comment 16 Martin Kosek 2013-10-11 04:11:59 EDT
Fixed upstream:

master:
dfa135e6069f9cb7f158d4540b530b137887932f Winsync re-initialize should not run memberOf fixup task
524a1a856739dd695e701ac33b67c8e758ac42c4 Use consistent realm name in cainstance and dsinstance

ipa-3-3:
233d07d030500be4a593c22fef9cd841b7e7a12d Winsync re-initialize should not run memberOf fixup task
b73adb72a410fc5669eee25e3670dd7abeeeeb6f Use consistent realm name in cainstance and dsinstance
Comment 20 Scott Poore 2014-07-24 16:07:18 EDT
Verified.

Version ::

ipa-server-3.0.0-42.el6.x86_64

Results ::

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: ipa_winsync_bz994980: Using option re-initialize bz994980 bz1016042
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 15:34:48 ] ::  https://bugzilla.redhat.com/show_bug.cgi?id=994980
:: [ 15:34:48 ] ::  https://bugzilla.redhat.com/show_bug.cgi?id=1016042
:: [   PASS   ] :: Creating error log ldif file (Expected 0, got 0)
modifying entry "cn=config"

:: [   PASS   ] :: Setting the error log level (Expected 0, got 0)
:: [   PASS   ] :: aduser2 does not exist in IPA (Expected 2, got 2)
ipa: ERROR: aduser2: user not found
:: [   PASS   ] :: Sleeping 60 seconds to make sure previous sync is done (Expected 0, got 0)
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should contain 'ipa: ERROR: aduser2: user not found' 
:: [   PASS   ] :: Generate ldif file to add user aduser2 (Expected 0, got 0)
adding new entry "CN=aduser2 ads,CN=Users,DC=adrelm,DC=com"

:: [   PASS   ] :: Adding aduser2 in AD to test re-initialize option (Expected 0, got 0)
:: [   PASS   ] :: Wait for last sync interval 35 seconds (Expected 0, got 0)
:: [   PASS   ] :: User not synced (Expected 2, got 2)
ipa: ERROR: aduser2: user not found
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should contain 'ipa: ERROR: aduser2: user not found' 
:: [ 15:36:30 ] ::  Using re-initiatize option of ipa-replica-manage
:: [ 15:36:30 ] ::  ipa-replica-manage re-initialize --from squab.adrelm.com
:: [   PASS   ] :: Using re-initialize option (Expected 0, got 0)
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update succeeded
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should contain 'Update in progress' 
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should contain 'Update succeeded' 
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should not contain 'Can't contact LDAP server' 
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should not contain 'unexpected error: [Errno -2] Name or service not known' 

MARK-LWD-LOOP -- 2014-07-24 15:38:06 --
:: [   PASS   ] :: aduser2 added in AD, synced to IPA with reinitialize option (Expected 0, got 0)
  User login: aduser2
  First name: aduser2
  Last name: ads
  Home directory: /home/aduser2
  Login shell: /bin/sh
  UID: 1091800010
  GID: 1091800010
  Account disabled: False
  Password: True
  Kerberos keys available: True
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should contain 'Account disabled: False' 
:: [   PASS   ] :: Running 'grep "Running Dirsync" /var/log/dirsrv/slapd-TESTRELM-TEST/errors | tail -n2 > /tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out 2>&1' (Expected 0, got 0)
[24/Jul/2014:15:28:30 -0400] NSMMReplicationPlugin - Running Dirsync 
[24/Jul/2014:15:33:29 -0400] NSMMReplicationPlugin - Running Dirsync
Comment 21 errata-xmlrpc 2014-10-14 03:32:17 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1383.html

Note You need to log in before you can comment on or make changes to this bug.