Red Hat Bugzilla – Bug 1456769
ipaAnchorUUID index incorrectly configured and then not indexed
Last modified: 2017-08-01 05:51:24 EDT
This bug is created as a clone of upstream ticket: https://pagure.io/freeipa/issue/6975 Detection of the bug: configuration invalid and indexed search fails check that the index configuration of ipaAnchorUUID is invalid ldapsearch -LLL -h localhost -p 389 -D "cn=directory manager" -w xxxxx -b "cn=ipaAnchorUUID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config dn: cn=ipaAnchorUUID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config cn: ipaOriginalUid <<< buggy value cn: ipaAnchorUUID nsIndexType: eq nsIndexType: pres nsSystemIndex: false objectClass: top objectClass: nsIndex Verify it is not working --> **'notes=U'** ldapsearch -LLL -h localhost -p 389 -D "cn=directory manager" -w xxxxx -b "<suffix>" "(ipaAnchorUUID=*)" dn [24/May/2017:16:31:53.392012887 +0200] conn=27 op=1 SRCH base="<suffix>" scope=2 filter="(ipaAnchorUUID=*)" attrs="distinguishedName" [24/May/2017:16:31:53.430503561 +0200] conn=27 op=1 RESULT err=0 tag=101 nentries=0 etime=0 notes=U Workaround is to fix the config and reindex fix the configuration ldapmodify -h localhost -p 389 -D "cn=directory manager" -w xxxxx dn: cn=ipaAnchorUUID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config changetype: modify delete: cn cn: ipaOriginalUid ldapsearch -LLL -h localhost -p 389 -D "cn=directory manager" -w xxxxx -b "cn=ipaAnchorUUID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config dn: cn=ipaAnchorUUID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config cn: ipaAnchorUUID nsIndexType: eq nsIndexType: pres nsSystemIndex: false objectClass: top objectClass: nsIndex reindex ipaAnchorUUID ipactl stop db2index -Z TEST-COM -n userRoot -s "<suffix>" -t ipaAnchorUUID ipactl start Check workaround worked ldapsearch -LLL -h localhost -p 389 -D "cn=directory manager" -w xxxxx -b "<suffix>" "(ipaAnchorUUID=*)" dn [24/May/2017:16:41:08.779602212 +0200] conn=26 op=1 SRCH base="<suffix>" scope=2 filter="(ipaAnchorUUID=*)" attrs="distinguishedName" [24/May/2017:16:41:08.785696976 +0200] conn=26 op=1 RESULT err=0 tag=101 nentries=0 etime=0
Fixed upstream master: https://pagure.io/freeipa/c/49ce395b90ea64eda3f9362b05936a3e4d43234a ipa-4-5: https://pagure.io/freeipa/c/8410823e1811ac9e004cc79556334abd429d480d
Can we have steps for verification for this bug?
Use ldapsearch ldapsearch -LLL -h localhost -p 389 -D "cn=directory manager" -w Secret123 "(ipaAnchorUUID=*)" and check /var/log/dirsrv/slapd-*/access log. There shouldn't be "notes=U" in log entry of that search
or you can check ldapsearch -LLL -h localhost -p 389 -D "cn=directory manager" -w Secret123 -b "cn=ipaAnchorUUID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config if contains exactly dn: cn=ipaAnchorUUID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config cn: ipaAnchorUUID nsIndexType: eq nsIndexType: pres nsSystemIndex: false objectClass: top objectClass: nsIndex
Created attachment 1286304 [details] console logs
Verified using steps provided in comment #6 and #7. version: ipa-server-4.5.0-16.el7.x86_64 console logs are attached.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2304