Red Hat Bugzilla – Bug 1159816
ignoring user attributes in migrate-ds does not work if uppercase characters are returned by ldap
Last modified: 2015-03-05 05:14:19 EST
+++ This bug was initially created as a clone of Bug #1150040 +++ Description of problem: I tried to migrate a openldap based directory to FreeIPA, while removing several objectclasses. --user-ignore-attribute didn't work. The Problem seems to be, that the LDAPEntry Object entry_attry in migration.py isn't lowercased while the blacklist is force to lower case by the script. the problem can be resolved by replacing if attr in attr_blacklist: with: if attr.lower() in attr_blacklist: Version-Release number of selected component (if applicable): 4.0.3 on Fedora 20 How reproducible: use migrate-ds with --user-ignore-attribute Steps to Reproduce: 1. 2. 3. Actual results: error: Failed user: xxx: attribute "shadowLastChange" not allowed xxx: attribute "shadowLastChange" not allowed Expected results: user is migrated Additional info: --- Additional comment from Martin Kosek on 2014-10-07 06:59:28 EDT --- Thanks for the bug report! I will clone it to upstream Trac. The change looks OK, would you consider sending it in form of a patch to freeipa-devel list? This way, your contribute could be recognized in FreeIPA git repository! http://www.freeipa.org/page/Contribute/Code --- Additional comment from Martin Kosek on 2014-10-07 06:59:57 EDT --- Upstream ticket: https://fedorahosted.org/freeipa/ticket/4620
Fixed upstream master: https://fedorahosted.org/freeipa/changeset/35dad9684b22819a2c848e7ebb78cfbc438a30e6 ipa-4-1: https://fedorahosted.org/freeipa/changeset/8ab85f161513b376c95094ccfe2b60202fe41baa
How to verify this?
As noted in the description, you would need to setup Directory Server which returns attributes with mixed case (like OpenLDAP) and try to run migrate-ds and blacklist some mixed-case attribute. Jan, do you know about an easier change with 389 DS how to reproduce this issue?
Maybe install IPA A, look for mixed-case attribute names in "ipa user-find --all --raw" output, run migrate-ds on IPA B from IPA A and blacklist some of the mixed-case attributes. Or you can add some custom user schema to IPA A and set a mixed-case attribute on a user before migrating.
Created attachment 979619 [details] steps with console output Verified. [root@vm-idm-004 ~]# rpm -q ipa-server ipa-server-4.1.0-13.el7.x86_64 [root@vm-idm-004 ~]# Please find the attached verification steps along with console output.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0442.html