Bug 1346735

The fixes are upstream already.

The reproduce the issue create an IPA domain with trust a an AD domain and set 'default_domain_suffix = ad.domain' on the IPA server so the users and groups from the AD domain can be lookup up with the short name.

After restarting the IPA directory server the compat tree cn=compat,dc=ipa,dc=domain is not available anymore and there will be 'schema-compat-plugin - waiting for SSSD to become online... ' in the directory servers logs file.

With the patch the compat tree becomes available again and the repeated log message is gone (it might still show up once during startup).

This bug was fixed in 7.3 as part of the bug 1292148 which was a rebase to newer version. Since 7.2 errata was shipped as bug 1350309, we can close this bug.

Moving to MODIFIED based on the comment 7.

Verified on RHEL73 using 

ipa-server-4.4.0-12.el7.x86_64
sssd-1.14.0-42.el7.x86_64
389-ds-base-1.3.5.10-11.el7.x86_64

[root@master samba]# ipa trust-find
---------------
1 trust matched
---------------
Realm name: pne.qe
Domain NetBIOS name: PNE
Domain Security Identifier: S-1-5-21-3912719521-1967590360-1136226524
Trust type: Active Directory domain
UPN suffixes: qa.org
---------------------------
Number of entries returned 1
     
     
[root@master samba]# grep default_domain_suffix /etc/sssd/sssd.conf
default_domain_suffix = pne.qe
     
service sssd stop; rm -frv /var/lib/sss/{db,mc}/* ; service sssd start

User from AD is resolved with short name     
[root@master samba]# id user1
uid=558001494(user1) gid=558001494(user1) groups=558001494(user1),558000513(domain users),558001493(group1)

Group on AD is listed     
[root@master samba]# getent group sales
sales:x:11000:

[root@master ~]# ipactl restart
 
Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting named Service
Restarting ipa_memcached Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting ntpd Service
Restarting smb Service
Restarting winbind Service
Restarting ipa-otpd Service
Restarting ipa-dnskeysyncd Service
Starting pki-tomcatd Service
ipa: INFO: The ipactl command was successful
     
Directory server error logs
   
[20/Sep/2016:15:54:43.588551496 +051800] schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup!
[20/Sep/2016:15:54:44.287396578 +051800] schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds!
[20/Sep/2016:15:54:49.242886432 +051800] schema-compat-plugin - warning: no entries set up under ou=sudoers,dc=test-relm,dc=test
[20/Sep/2016:15:54:49.270217996 +051800] schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=test-relm,dc=test
[20/Sep/2016:15:54:49.335281757 +051800] schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=test-relm,dc=test
[20/Sep/2016:15:54:49.387085858 +051800] schema-compat-plugin - Finished plugin initialization.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2471.html