Bug 182515 - Dual winsync paths results in LDAP ADD collision on AD
Summary: Dual winsync paths results in LDAP ADD collision on AD
Alias: None
Product: 389
Classification: Retired
Component: Replication - General   
(Show other bugs)
Version: 1.0
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Rich Megginson
QA Contact: Ben Levenson
Depends On:
Blocks: 512820 690316
TreeView+ depends on / blocked
Reported: 2006-02-22 22:48 UTC by Ulf Weltman
Modified: 2015-11-19 23:08 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2015-11-19 23:08:41 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

Description Ulf Weltman 2006-02-22 22:48:40 UTC
Description of problem:
In a configuration with two DS in MMR (M1 and M2) and two AD in the same domain
(AD1 and AD2), if we configure M1 to sync with AD1 and M2 to sync with AD2, we
have a ring configuration with good availability.  Changes will be available
everywhere even if a server crashes.

However, replication between AD1 and AD2 seems to always lag behind slightly. 
If user uid=fbar,o=abc is added to M1, then uid=fbar,o=abc will be added right
away to M2.  Then M1 and M2 will both sync the user (with DN morphed into CN=foo
bar,o=abc) to their respective AD sync partners.

Here comes the problem.  Sometimes, not always, the sync from M1 to AD1 and the
sync from M2 to AD2 both succeed because of the lag between AD1 and AD2.  This
results in an update collision.  In both AD1 and AD2 we end up with CN=foo
bar,o=abc, and another entry called CN=foo
bar\0ACNF:8ba01336-6466-4495-85c4-54d4bd24549f,o=abc.  And then, because adding
users is a 3 step process (add user, mod password, mod activation flag) the
former is left inactive, while the latter is activated.  I'm not sure which of
them gets the password!

And it doesn't stop there.  Then next time DS calls dirsync on ADS, another cn
will added to uid=fbar,o=abc on M1 and M2 containing

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.Configure MMR between replicas M1 and M2
2.Configure two AD domain controllers in a single domain, AD1 and AD2
3.Configure sync between M1 and AD1 and M2 and AD2
4.Add some NT users to M1.  Some, but not all, will collide on AD1 and AD2.
Actual results:

Expected results:

Additional info:

Comment 1 Rich Megginson 2009-01-14 17:53:20 UTC
latering to 8.2

Comment 2 Martin Kosek 2012-01-04 13:49:53 UTC
Upstream ticket:

Comment 4 Noriko Hosoi 2015-11-19 23:08:41 UTC
Closing this bug since we moved to the ticket system:

Note You need to log in before you can comment on or make changes to this bug.