Bug 1493145 - ipa-replica-install might fail because of an already existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
Summary: ipa-replica-install might fail because of an already existing entry cn=ipa-ht...
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.4
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: ipa-qe
Depends On:
Blocks: 1506913
TreeView+ depends on / blocked
Reported: 2017-09-19 13:21 UTC by Thorsten Scherf
Modified: 2020-12-14 10:07 UTC (History)
9 users (show)

Fixed In Version: ipa-4.5.4-4.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1506913 (view as bug list)
Last Closed: 2018-04-10 16:46:13 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0918 0 None None None 2018-04-10 16:47:24 UTC

Description Thorsten Scherf 2017-09-19 13:21:20 UTC
Description of problem:

We have seen cases where ipa-replica-install is failing with this error:

 [31/40]: enabling S4U2Proxy delegation
ipa         : CRITICAL Failed to load replica-s4u2proxy.ldif: Command '/usr/bin/ldapmodify -v -f /tmp/tmpVKeXNx -H ldapi://%2Fvar%2Frun%2Fslapd-EXAMPLE-COM.socket -Y EXTERNAL' returned non-zero exit status 20
  [error] CalledProcessError: Command '/usr/bin/ldapmodify -v -f /tmp/tmpVKeXNx -H ldapi://%2Fvar%2Frun%2Fslapd-EXAMPLE-COM.socket -Y EXTERNAL' returned non-zero exit status 20
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

The error occurs in __setup_s4u2proxy() when replica-s4u2proxy.ldif is applied. In the DS log we can see that one of the two entries already exists which then results in a failure:

[19/Sep/2017:08:24:09.269050086 -0400] conn=11 fd=68 slot=68 connection from local to /var/run/slapd-EXAMPLE-COM.socket
[19/Sep/2017:08:24:09.269396910 -0400] conn=11 AUTOBIND dn="cn=Directory Manager"
[19/Sep/2017:08:24:09.269402696 -0400] conn=11 op=0 BIND dn="cn=Directory Manager" method=sasl version=3 mech=EXTERNAL
[19/Sep/2017:08:24:09.269427850 -0400] conn=11 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=Directory Manager"
[19/Sep/2017:08:24:09.269593705 -0400] conn=11 op=1 MOD dn="cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=example,dc=com"
[19/Sep/2017:08:24:09.270433469 -0400] conn=11 op=1 RESULT err=20 tag=103 nentries=0 etime=0 csn=39e7b123001d00fd0000
[19/Sep/2017:08:24:09.281553093 -0400] conn=11 op=2 UNBIND

The DS installer should not apply the ldif in case those entries are already stored in the LDAP tree.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:

Actual results:

Expected results:

Additional info:

Comment 2 fbarreto 2017-09-29 20:00:54 UTC
Upstream ticket: https://pagure.io/freeipa/issue/7174

Comment 4 fbarreto 2017-10-25 16:31:12 UTC
Fixed upstream

Comment 8 Mohammad Rizwan 2017-11-20 10:51:57 UTC



1. Added the entry for replica in directory server on master.

[root@master ~]# cat a.ldif 
dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=testrelm,dc=test
changetype: modify
add: memberPrincipal
memberPrincipal: HTTP/replica.testrelm.test@TESTRELM.TEST

dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=testrelm,dc=test
changetype: modify
add: memberPrincipal
memberPrincipal: ldap/replica.testrelm.test@TESTRELM.TEST

[root@master ~]# ldapmodify -h master.testrelm.test -p 389 -D "cn=directory manager" -w Secret123 -f a.ldif 
modifying entry "cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=testrelm,dc=test"

modifying entry "cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=testrelm,dc=test"

[root@master ~]#

2. Install replica

Expected result:
replica should install

Actual result:

Replica installed successfully.

Comment 12 errata-xmlrpc 2018-04-10 16:46:13 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.