Description of problem:

I have not been able to reproduce this issue yet. I think a simple scenario to reproduce it is to update to 7.3 (domain level 1) two nodes at the same time which are temporarily disconnected regarding replication.

What we observe is that one or more conflicts could appear to these entries:

dn: cn=domain,cn=topology,cn=ipa,cn=etc,<suffix>
dn: cn=ca,cn=topology,cn=ipa,cn=etc,<suffix>

like for instance:


dn: cn=domain+nsuniqueid=b3725a7b-a34711e6-b68bc5e1-98fbe70f,cn=topology,cn=ipa,cn=etc,<suffix>
dn: cn=ca+nsuniqueid=b3725abf-a34711e6-b68bc5e1-98fbe70f,cn=topology,cn=ipa,cn=etc,<suffix>
Which could unfortunately happen.

The problem is that afterwards we can find segments created under the conflicts:

dn: cn=<host1>-to-<host2>,cn=domain+nsuniqueid=b3725a7b-a34711e6-b68bc5e1-98fbe70f,cn=topology,cn=ipa,cn=etc,<suffix>

we could eventually rename the entry but we have also segments created under the original entry:

dn: cn=<host3>-to-<host4>,cn=domain,cn=topology,cn=ipa,cn=etc,<suffix>


This bug is reported to get sure that applications check that there's a replication conflict and create the segment always out of that conflict.

This could also be related to bz's:

https://bugzilla.redhat.com/show_bug.cgi?id=747701
[RFE] Make replication plugin put conflicts in a special suffix 

and:

https://bugzilla.redhat.com/show_bug.cgi?id=1213787
 [RFE] it could be nice to have replication conflicts being skipped in client app queries. 

Thanks and regards,

German.



Version-Release number of selected component (if applicable):

ipa-server-4.4.0-12.el7.x86_64

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info: