Red Hat Bugzilla – Bug 1044154
multi master replication allows schema violation
Last modified: 2015-03-05 04:31:45 EST
This bug is created as a clone of upstream ticket: https://fedorahosted.org/389/ticket/601 If an attribute is required by the schema any attempt to delete all values will fail without replication or on a single master. But if the attribute has two values it is possible to simultaneously delete one value on one master and the other value on the other master - the individual operation is allowed as one value remains. After the two masters have replayed their changes to each other bot values have disappeared.
$ rpm -qa | grep 389 389-ds-base-1.3.3.1-9.el7.x86_64 389-ds-base-debuginfo-1.3.3.1-9.el7.x86_64 389-ds-base-libs-1.3.3.1-9.el7.x86_64 I can reproduce the problem. I set up MMR (M1 - 1189, M2 - 1289) [1] Add test entry $ ldapmodify -D "cn=Directory Manager" -w Secret123 -H ldap://localhost:1189 -a << EOF dn: cn=user,ou=People,dc=example,dc=com objectClass: inetUser objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson cn: user sn: user-M1 sn: user-M2 EOF adding new entry "cn=user,ou=People,dc=example,dc=com" [2] Check that it was synchronized $ ldapsearch -h rhel7ds.brq.redhat.com -p 1189 -D "cn=Directory Manager" -w "Secret123" -b "dc=example,dc=com" "(cn=user)" sn -LLL dn: cn=user,ou=People,dc=example,dc=com sn: user-M1 sn: user-M2 $ ldapsearch -h rhel7ds.brq.redhat.com -p 1289 -D "cn=Directory Manager" -w "Secret123" -b "dc=example,dc=com" "(cn=user)" sn -LLL dn: cn=user,ou=People,dc=example,dc=com sn: user-M1 sn: user-M2 [3] Stop M2 $ sudo systemctl stop dirsrv@M2 [4] Delete sn on M1 $ ldapmodify -D "cn=Directory Manager" -w Secret123 -H ldap://localhost:1189 << EOF dn: cn=user,ou=People,dc=example,dc=com changetype: modify delete: sn sn: user-M1 EOF modifying entry "cn=user,ou=People,dc=example,dc=com" $ ldapsearch -h rhel7ds.brq.redhat.com -p 1189 -D "cn=Directory Manager" -w "Secret123" -b "dc=example,dc=com" "(cn=user)" sn -LLL dn: cn=user,ou=People,dc=example,dc=com cn: user sn: user-M2 [5] Stop M1 and start M2 $ sudo systemctl stop dirsrv@M1 $ sudo systemctl start dirsrv@M2 [6] Delete sn on M2 $ ldapmodify -D "cn=Directory Manager" -w Secret123 -H ldap://localhost:1289 << EOF dn: cn=user,ou=People,dc=example,dc=com changetype: modify delete: sn sn: user-M2 EOF modifying entry "cn=user,ou=People,dc=example,dc=com" $ ldapsearch -h rhel7ds.brq.redhat.com -p 1289 -D "cn=Directory Manager" -w "Secret123" -b "dc=example,dc=com" "(cn=user)" sn -LLL dn: cn=user,ou=People,dc=example,dc=com sn: user-M1 [7] Restart both M1 and M2 $ sudo systemctl restart dirsrv.target [8] sn attribute was removed on both M1 and M2, though it violates the schema $ ldapsearch -h rhel7ds.brq.redhat.com -p 1189 -D "cn=Directory Manager" -w "Secret123" -b "dc=example,dc=com" "(cn=user)" -LLL dn: cn=user,ou=People,dc=example,dc=com objectClass: inetUser objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson cn: user $ ldapsearch -h rhel7ds.brq.redhat.com -p 1289 -D "cn=Directory Manager" -w "Secret123" -b "dc=example,dc=com" "(cn=user)" -LLL dn: cn=user,ou=People,dc=example,dc=com objectClass: inetUser objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson cn: user In the errors log: [11/Dec/2014:00:07:42 +0100] - Entry "cn=user,ou=People,dc=example,dc=com" missing attribute "sn" required by object class "person"
The situation cannot be prevented. The fix consists of detecting this situation and log an error and add a replication conflict attribute: nsds5ReplConflict So the fix works as expected
Sorry, it wasn't obvious from the description :( $ ldapsearch -D "cn=Directory Manager" -w Secret123 -h localhost -p 1189 -b "dc=example,dc=com" "nsds5ReplConflict=*" \* nsds5ReplConflict -LLL dn: cn=user,ou=People,dc=example,dc=com objectClass: inetUser objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson cn: user nsds5ReplConflict: Schema violation nsds5ReplConflict attribute was added on both masters. Marking as VERIFIED.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0416.html