1016042 – Re-initializing a winsync connection exits with "Can't contact LDAP server"

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1016042 - Re-initializing a winsync connection exits with "Can't contact LDAP server"

Summary: Re-initializing a winsync connection exits with "Can't contact LDAP server"

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	ipa
Sub Component:
Version:	6.5
Hardware:	Unspecified
OS:	Unspecified
Priority:	medium
Severity:	unspecified
Target Milestone:	rc
Target Release:	---
Assignee:	Martin Kosek
QA Contact:	Namita Soman
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	1061410
TreeView+	depends on / blocked

Reported:	2013-10-07 11:39 UTC by Steeve Goveas
Modified:	2015-02-14 14:13 UTC (History)
CC List:	4 users (show)
Fixed In Version:	ipa-3.0.0-38.el6
Doc Type:	Known Issue
Doc Text:	The ipa-replica-manage tool contains a bug in the re-initialize command causing the MemberOf task to fail with an error under certain circumstances. When the ipa-replica-manage re-initialize command is run for a Windows Synchronization (WinSync) replication agreement, it succeeds in the re-initialization part, but fails during execution of the MemberOf task which is run after the re-initialization part. The following error is returned: Update succeeded Can't contact LDAP server However, the error is harmless as running the MemberOf task is not required in this case.
Clone Of:
Environment:
Last Closed:	2014-10-14 07:32:17 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)
logs generated while re-initializing (251.28 KB, text/plain) 2013-10-07 11:39 UTC, Steeve Goveas	no flags	Details
View All

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2014:1383	0	normal	SHIPPED_LIVE	ipa bug fix and enhancement update	2014-10-14 01:21:36 UTC

Description Steeve Goveas 2013-10-07 11:39:58 UTC

Created attachment 808777 [details]
logs generated while re-initializing

Description of problem:
Re-initializing a winsync connection exits with an error "Can't contact LDAP server".

Version-Release number of selected component (if applicable):
ipa-server-3.0.0-37.el6.x86_64
389-ds-base-1.2.11.15-25.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1. Setup AD and IPA servers
2. Create winsync agreement between the 2
3. Add a new user in AD
4. Re-initialize the winsync connection with AD

Actual results:
Command exits with error "Can't contact LDAP server"

Expected results:
Command should complete successfully without error

Additional info:
Attached logs generated while re-initializing

[root@dhcp207-25 ~]# ipa-replica-manage re-initialize --from squab.adrelm.com ; ps -ef | grep ns-slapd
Update in progress
Update in progress
....
Update succeeded
Can't contact LDAP server
root      5883  5804  0 12:12 pts/0    00:00:00 grep ns-slapd
pkisrv   26694     1  0 Oct03 ?        00:01:01 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-PKI-IPA -i /var/run/dirsrv/slapd-PKI-IPA.pid -w /var/run/dirsrv/slapd-PKI-IPA.startpid
dirsrv   26763     1  0 Oct03 ?        00:01:10 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-TESTRELM-COM -i /var/run/dirsrv/slapd-TESTRELM-COM.pid -w /var/run/dirsrv/slapd-TESTRELM-COM.startpid

Comment 2 Martin Kosek 2013-10-07 13:21:24 UTC

Rich, does "ipa-replica-manage re-initialize" run towards a winsync agreement make sense? I am thinking that only "ipa-replica-manage force-sync" makes sense to be done with winsync.

Steeve, this may be related (duplicate) to Bug 994980. I am not sure that re-initalize operation being run with AD makes sense. If customer just wants to force synchronization with AD and thus synchronize the new user, they can just run "force-sync" operation and avoid this error. I.e.:

# ipa-replica-manage force-sync --from squab.adrelm.com

Would that command work for the customer?

Comment 3 Steeve Goveas 2013-10-07 14:46:57 UTC

(In reply to Martin Kosek from comment #2)
> Rich, does "ipa-replica-manage re-initialize" run towards a winsync
> agreement make sense? I am thinking that only "ipa-replica-manage
> force-sync" makes sense to be done with winsync.
> 
> Steeve, this may be related (duplicate) to Bug 994980. I am not sure that
> re-initalize operation being run with AD makes sense. If customer just wants
> to force synchronization with AD and thus synchronize the new user, they can
> just run "force-sync" operation and avoid this error. I.e.:
> 
> # ipa-replica-manage force-sync --from squab.adrelm.com
> 
> Would that command work for the customer?

I agree with your point that force-sync option would work.

But, this issue is simply that the re-initialize option worked in 6.4 without throwing an error.

Comment 4 Martin Kosek 2013-10-07 14:55:11 UTC

If the force-sync fully solves the customer use case (please confirm), then I do not consider the re-initialize error as blocking for RHEL-6.x and I would propose to have it fixed in scope of RHEL-7.0 as proposed in Bug 994980 (i.e. close this one as duplicate). Would you agree?

Comment 5 Rich Megginson 2013-10-07 14:59:46 UTC

(In reply to Martin Kosek from comment #2)
> Rich, does "ipa-replica-manage re-initialize" run towards a winsync
> agreement make sense? I am thinking that only "ipa-replica-manage
> force-sync" makes sense to be done with winsync.

Both "re-initialize" and "force-sync" have the same meaning in both regular replication agreements and in winsync agreements.

> 
> Steeve, this may be related (duplicate) to Bug 994980. I am not sure that
> re-initalize operation being run with AD makes sense. If customer just wants
> to force synchronization with AD and thus synchronize the new user, they can
> just run "force-sync" operation and avoid this error. I.e.:
> 
> # ipa-replica-manage force-sync --from squab.adrelm.com
> 
> Would that command work for the customer?

Comment 6 Martin Kosek 2013-10-08 07:10:11 UTC

How so? With traditional replication agreements, re-initialize sets nsds5BeginReplicaRefresh in the replication agreement and drops the contents of the replicated tree and initializes it from a remote replica.

force-sync just tackles with nsDS5ReplicaUpdateSchedule to force standard synchronization.

I just do not know what is the difference in these 2 operations with winsync agreements...

Comment 7 Rich Megginson 2013-10-08 13:39:56 UTC

(In reply to Martin Kosek from comment #6)
> How so? With traditional replication agreements, re-initialize sets
> nsds5BeginReplicaRefresh in the replication agreement and drops the contents
> of the replicated tree and initializes it from a remote replica.

That's the only difference.  Doing a winsync re-initialize doesn't destroy the current contents of the IPA database.  Instead, it reads every entry from AD to see if it needs to add that entry to IPA, then reads every entry from IPA to see if it needs to add that entry to AD (or not - I think IPA winsync doesn't add users to AD).

> 
> force-sync just tackles with nsDS5ReplicaUpdateSchedule to force standard
> synchronization.

With winsync, force-sync causes any changes pending to send to AD to be sent immediately, and causes the AD DirSync search to happen immediately, to look for any pending changes in AD to update in IPA.

> 
> I just do not know what is the difference in these 2 operations with winsync
> agreements...

Comment 8 Martin Kosek 2013-10-08 13:59:42 UTC

Ok, thanks for info. This reads to me as "having both re-initialize and force-sync actions for FreeIPA winsync replicas makes sense, keep them both available and working".

Comment 9 Martin Kosek 2013-10-08 14:13:36 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/3854

Comment 10 Steeve Goveas 2013-10-09 07:38:49 UTC

From the above comments this seems to be a blocker for 6.5

Comment 12 Martin Kosek 2013-10-09 08:22:18 UTC

Regression? I do not share this opinion. This particular routine is untouched in RHEL-6.5, RHEL-6.4 and even RHEL-6.3. Did you run a test with RHEL-6.4? IMO it will give you the same error as well.

Comment 13 Steeve Goveas 2013-10-09 08:38:29 UTC

I checked the archived tests for 6.4. You are right, the same error is seen there as well. Removing regression keyword.

Comment 14 Martin Kosek 2013-10-09 09:46:06 UTC

I tested the winsync re-initialize method and it works OK, the only issue is with the memberOf task that is being run afterwards - it is unsuccessful due to a bug and fails with this error message. But the memberOf task is not needed for this operation anyway, so it benign and IMO not a blocker for 6.5.

Comment 16 Martin Kosek 2013-10-11 08:11:59 UTC

Fixed upstream:

master:
dfa135e6069f9cb7f158d4540b530b137887932f Winsync re-initialize should not run memberOf fixup task
524a1a856739dd695e701ac33b67c8e758ac42c4 Use consistent realm name in cainstance and dsinstance

ipa-3-3:
233d07d030500be4a593c22fef9cd841b7e7a12d Winsync re-initialize should not run memberOf fixup task
b73adb72a410fc5669eee25e3670dd7abeeeeb6f Use consistent realm name in cainstance and dsinstance

Comment 20 Scott Poore 2014-07-24 20:07:18 UTC

Verified.

Version ::

ipa-server-3.0.0-42.el6.x86_64

Results ::

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: ipa_winsync_bz994980: Using option re-initialize bz994980 bz1016042
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 15:34:48 ] ::  https://bugzilla.redhat.com/show_bug.cgi?id=994980
:: [ 15:34:48 ] ::  https://bugzilla.redhat.com/show_bug.cgi?id=1016042
:: [   PASS   ] :: Creating error log ldif file (Expected 0, got 0)
modifying entry "cn=config"

:: [   PASS   ] :: Setting the error log level (Expected 0, got 0)
:: [   PASS   ] :: aduser2 does not exist in IPA (Expected 2, got 2)
ipa: ERROR: aduser2: user not found
:: [   PASS   ] :: Sleeping 60 seconds to make sure previous sync is done (Expected 0, got 0)
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should contain 'ipa: ERROR: aduser2: user not found' 
:: [   PASS   ] :: Generate ldif file to add user aduser2 (Expected 0, got 0)
adding new entry "CN=aduser2 ads,CN=Users,DC=adrelm,DC=com"

:: [   PASS   ] :: Adding aduser2 in AD to test re-initialize option (Expected 0, got 0)
:: [   PASS   ] :: Wait for last sync interval 35 seconds (Expected 0, got 0)
:: [   PASS   ] :: User not synced (Expected 2, got 2)
ipa: ERROR: aduser2: user not found
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should contain 'ipa: ERROR: aduser2: user not found' 
:: [ 15:36:30 ] ::  Using re-initiatize option of ipa-replica-manage
:: [ 15:36:30 ] ::  ipa-replica-manage re-initialize --from squab.adrelm.com
:: [   PASS   ] :: Using re-initialize option (Expected 0, got 0)
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update in progress
Update succeeded
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should contain 'Update in progress' 
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should contain 'Update succeeded' 
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should not contain 'Can't contact LDAP server' 
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should not contain 'unexpected error: [Errno -2] Name or service not known' 

MARK-LWD-LOOP -- 2014-07-24 15:38:06 --
:: [   PASS   ] :: aduser2 added in AD, synced to IPA with reinitialize option (Expected 0, got 0)
  User login: aduser2
  First name: aduser2
  Last name: ads
  Home directory: /home/aduser2
  Login shell: /bin/sh
  UID: 1091800010
  GID: 1091800010
  Account disabled: False
  Password: True
  Kerberos keys available: True
:: [   PASS   ] :: File '/tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out' should contain 'Account disabled: False' 
:: [   PASS   ] :: Running 'grep "Running Dirsync" /var/log/dirsrv/slapd-TESTRELM-TEST/errors | tail -n2 > /tmp/tmp.xIT81Dlz4W/tmpout.ipa_winsync_bz994980.out 2>&1' (Expected 0, got 0)
[24/Jul/2014:15:28:30 -0400] NSMMReplicationPlugin - Running Dirsync 
[24/Jul/2014:15:33:29 -0400] NSMMReplicationPlugin - Running Dirsync

Comment 21 errata-xmlrpc 2014-10-14 07:32:17 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1383.html

Note You need to log in before you can comment on or make changes to this bug.