Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1643623

Summary:	`ipa migrate-ds` fails to migrate user and group data from directory server to IDM.
Product:	Red Hat Enterprise Linux 8	Reporter:	Gaurav Swami <gswami>
Component:	ipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED WONTFIX	QA Contact:	ipa-qe <ipa-qe>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.0	CC:	frenaud, ftrivino, pasik, pcech, pvoborni, rcritten, tscherf
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-30 07:27:23 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Gaurav Swami 2018-10-26 19:05:03 UTC

Description of problem:

Customer trying to migrate user and groups from Sun directory server to IDM server.

User contains value for manager attribute as "" or "No Application", this is causing the migration to fail completely, rather than failing just for that one entry.



Version-Release number of selected component (if applicable):

ipa-server-4.5.4-10.el7_5.4.4.x86_64

How reproducible:

Steps to Reproduce:

1. Add user in Directory server with attribute Manager with value "" or "No application"
 
2. Try to migrate data from Directory server to IDM.


Actual results:

----
# ipa migrate-ds --bind-dn="cn=Directory Manager" --user-container=ou=People --group-container=ou=Group --group-objectclass=posixgroup --user-objectclass=posixAccount --user-ignore-attribute={Manager} --with-compat  ldap://chands1mm.example.com --continue
Password: 
ipa: ERROR: an internal error has occurred
----


Expected results:

Users and groups should be migrated to IDM without any issues.


Additional info:

ipa migrate-ds command fails even if we ignore attribute manager.

In /var/log/httpd/error_log, we can see below logs,

----------
[Thu Oct 25 14:51:50.623924 2018] [:error] [pid 18622] ipa: DEBUG: raw: migrate_ds(u'ldap://chands1mm.example.com', u'********', binddn=u'cn=Directory Manager', usercontainer=u'ou=People', groupcontainer=u'ou=Group', userobjectclass=(u'posixAccount',), groupobjectclass=(u'posixgroup',), userignoreattribute=(u'krbPrincipalName', u'krbextradata', u'krblastfailedauth', u'krblastpwdchange', u'krblastsuccessfulauth', u'krbloginfailedcount', u'krbpasswordexpiration', u'krbticketflags', u'krbpwdpolicyreference', u'mepManagedEntry', u'Manager'), continue=True, compat=True, version=u'2.228')
[Thu Oct 25 14:51:50.624658 2018] [:error] [pid 18622] ipa: DEBUG: migrate_ds(u'ldap://chands1mm.example.com', u'********', binddn=ipapython.dn.DN('cn=Directory Manager'), usercontainer=ipapython.dn.DN('ou=People'), groupcontainer=ipapython.dn.DN('ou=Group'), userobjectclass=(u'posixAccount',), groupobjectclass=(u'posixgroup',), userignoreobjectclass=None, userignoreattribute=(u'krbPrincipalName', u'krbextradata', u'krblastfailedauth', u'krblastpwdchange', u'krblastsuccessfulauth', u'krbloginfailedcount', u'krbpasswordexpiration', u'krbticketflags', u'krbpwdpolicyreference', u'mepManagedEntry', u'Manager'), groupignoreobjectclass=None, groupignoreattribute=None, groupoverwritegid=False, schema=u'RFC2307bis', continue=True, compat=True, use_def_group=True, scope=u'onelevel', version=u'2.228', exclude_groups=None, exclude_users=None)
[Thu Oct 25 14:51:50.631415 2018] [:error] [pid 18622] ipa: DEBUG: Created connection context.ldap2_140127263649552
[Thu Oct 25 14:51:59.396992 2018] [:error] [pid 18622] ipa: ERROR: unable to convert the attribute u'manager' value 'No Application' to type <class 'ipapython.dn.DN'>
[Thu Oct 25 14:51:59.397559 2018] [:error] [pid 18622] ipa: ERROR: non-public: ValueError: unable to convert the attribute u'manager' value 'No Application' to type <class 'ipapython.dn.DN'> in LDAP entry 'uid=adtim,cn=users,cn=accounts,dc=bwh,dc=harvard,dc=edu'
[Thu Oct 25 14:51:59.397585 2018] [:error] [pid 18622] Traceback (most recent call last):
[Thu Oct 25 14:51:59.397592 2018] [:error] [pid 18622]   File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 367, in wsgi_execute
[Thu Oct 25 14:51:59.397598 2018] [:error] [pid 18622]     result = command(*args, **options)
[Thu Oct 25 14:51:59.397603 2018] [:error] [pid 18622]   File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 447, in __call__
[Thu Oct 25 14:51:59.397628 2018] [:error] [pid 18622]     return self.__do_call(*args, **options)
[Thu Oct 25 14:51:59.397638 2018] [:error] [pid 18622]   File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 475, in __do_call
[Thu Oct 25 14:51:59.397770 2018] [:error] [pid 18622]     ret = self.run(*args, **options)
[Thu Oct 25 14:51:59.397860 2018] [:error] [pid 18622]   File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 797, in run
[Thu Oct 25 14:51:59.397939 2018] [:error] [pid 18622]     return self.execute(*args, **options)
[Thu Oct 25 14:51:59.398011 2018] [:error] [pid 18622]   File "/usr/lib/python2.7/site-packages/ipaserver/plugins/migration.py", line 930, in execute
[Thu Oct 25 14:51:59.398045 2018] [:error] [pid 18622]     ldap, config, ds_ldap, ds_base_dn, options
[Thu Oct 25 14:51:59.398124 2018] [:error] [pid 18622]   File "/usr/lib/python2.7/site-packages/ipaserver/plugins/migration.py", line 831, in migrate
[Thu Oct 25 14:51:59.398226 2018] [:error] [pid 18622]     **blacklists
[Thu Oct 25 14:51:59.398300 2018] [:error] [pid 18622]   File "/usr/lib/python2.7/site-packages/ipaserver/plugins/migration.py", line 236, in _pre_migrate_user
[Thu Oct 25 14:51:59.398372 2018] [:error] [pid 18622]     entry_attrs.pop(attr, None)
[Thu Oct 25 14:51:59.398378 2018] [:error] [pid 18622]   File "/usr/lib64/python2.7/_abcoll.py", line 497, in pop
[Thu Oct 25 14:51:59.398383 2018] [:error] [pid 18622]     value = self[key]
[Thu Oct 25 14:51:59.398388 2018] [:error] [pid 18622]   File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 442, in __getitem__
[Thu Oct 25 14:51:59.398396 2018] [:error] [pid 18622]     return self._get_nice(name)
[Thu Oct 25 14:51:59.398498 2018] [:error] [pid 18622]   File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 417, in _get_nice
[Thu Oct 25 14:51:59.398628 2018] [:error] [pid 18622]     self._sync_attr(name)
[Thu Oct 25 14:51:59.398671 2018] [:error] [pid 18622]   File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 309, in _sync_attr
[Thu Oct 25 14:51:59.398744 2018] [:error] [pid 18622]     error=e, dn=self._dn))
[Thu Oct 25 14:51:59.398777 2018] [:error] [pid 18622] ValueError: unable to convert the attribute u'manager' value 'No Application' to type <class 'ipapython.dn.DN'> in LDAP entry 'uid=adtim,cn=users,cn=accounts,dc=bwh,dc=harvard,dc=edu'
[Thu Oct 25 14:51:59.399109 2018] [:error] [pid 18622] ipa: INFO: [jsonserver_session] admin.EDU: migrate_ds/1(u'ldap://chands1mm.example.com', u'********', binddn=u'cn=Directory Manager', usercontainer=u'ou=People', groupcontainer=u'ou=Group', userobjectclass=(u'posixAccount',), groupobjectclass=(u'posixgroup',), userignoreattribute=(u'krbPrincipalName', u'krbextradata', u'krblastfailedauth', u'krblastpwdchange', u'krblastsuccessfulauth', u'krbloginfailedcount', u'krbpasswordexpiration', u'krbticketflags', u'krbpwdpolicyreference', u'mepManagedEntry', u'Manager'), continue=True, compat=True, version=u'2.228'): InternalError
[Thu Oct 25 14:51:59.400115 2018] [:error] [pid 18622] ipa: DEBUG: Destroyed connection context.ldap2_140127273215440
[Thu Oct 25 14:51:59.400350 2018] [:error] [pid 18622] ipa: DEBUG: Destroyed connection context.ldap2_140127263649552
----------


Ldapsearch output of user 


----------------
# ldapsearch -x  -h chands1mm.example.com -b ou=People,dc=example,dc=com "(uid=adtim)"
# extended LDIF
#
# LDAPv3
# base <ou=People,dc=example,dc=com> with scope subtree
# filter: (uid=adtim)
# requesting: ALL
#

# adtim, People, channing.harvard.edu
dn: uid=adtim,ou=People,dc=example,dc=com
mailMessageStore: /dev/null
loginShell: /bin/false
manager: No Application
mailRoutingAddress: adtim.com
sambaKickoffTime: 2147483647
sambaLogoffTime: 2147483647
sambaLogonTime: 0
sambaPwdLastSet: 1010179124
sambaPwdMustChange: 2147483647
sambaPwdCanChange: 0
sambaAcctFlags: [U+]
sambaSID: S-1-0-0-1048
uid: adtim
cn: adtim
telephoneNumber: 111-2222
givenName: Tim
sn: Little
mail: adtim
objectClass: mailRecipient
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
objectClass: sambaSamAccount
uidNumber: 1048
gidNumber: 110
homeDirectory: /udd/adtim
gecos: Tim Little 525-2271

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

----------------

Comment 2 Florence Blanc-Renaud 2018-11-05 13:30:29 UTC

In the IdM schema, the attribute manager is defined with a DN syntax:

attributetypes: ( 0.9.2342.19200300.100.1.10 NAME 'manager'  EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN ( 'RFC 4524' 'user defined' ) )

The migrated entry is not conforming to the schema definition, hence the error. But the migration plugin should better handle this type of issue (especially as the attribute is provided in the --user-ignore-attribute option).

Comment 3 Florence Blanc-Renaud 2018-11-05 15:04:32 UTC

Upstream ticket:
https://pagure.io/freeipa/issue/7749

Comment 4 Florence Blanc-Renaud 2019-06-19 07:41:14 UTC

RHEL-7.7 is already near the end of a Development Phase and development is being wrapped up. I am bulk-moving to RHEL 8 the Bugs which were already triaged, but to which we did not commit (without devel_ack) and we cannot keep them even as a stretch goal for RHEL-7.7.

If you believe this particular bug should be reconsidered for 7.7, please let us know.

Comment 10 RHEL Program Management 2022-05-30 07:27:23 UTC

After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.