Bug 1996662
| Summary: | Deleted user accounts with --preserved parameter is listed on groups on 'ldapsearch' | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Aleksandr Sharov <asharov> |
| Component: | 389-ds-base | Assignee: | LDAP Maintainers <ldap-maint> |
| Status: | CLOSED INSUFFICIENT_DATA | QA Contact: | RHDS QE <ds-qe-bugs> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.9 | CC: | dcamilof, ldap-maint, rcritten, tscherf |
| Target Milestone: | rc | Flags: | asharov:
needinfo?
dcamilof: needinfo? pm-rhel: mirror+ |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-10-26 15:01:53 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Aleksandr Sharov
2021-08-23 12:31:35 UTC
Hi, I was not able to reproduce the behavior described in this BZ. $ rpm -qa ipa-server 389-ds-base 389-ds-base-1.3.10.2-12.el7_9.x86_64 ipa-server-4.6.8-5.el7_9.5.x86_64 Scenario: - create 2 users u1 and u2 -------------------------- $ ipa user-add u1 --first u1 --last u1 $ ipa user-add u2 --first u2 --last u2 - create a posix group g1, create a nonposix group nonposix1 ------------------------------------------------------------ $ ipa group-add nonposix1 $ ipa group-add nonposix1 --nonposix - add u1 and u2 to both groups ------------------------------ $ ipa group-add-member g1 --users u1 --users u2 $ ipa group-add-member nonposix1 --users u1 --users u2 - check the group membership: both groups contain u1 and u2 ----------------------------------------------------------- $ ldapsearch -LLL -o ldif-wrap=no -D cn=directory\ manager -w Secret123 -b cn=g1,cn=groups,cn=accounts,dc=ipa,dc=test dn: cn=g1,cn=groups,cn=accounts,dc=ipa,dc=test objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject objectClass: posixgroup cn: g1 ipaUniqueID: e5d6f240-040f-11ec-8109-fa163ef9aedd gidNumber: 593600010 member: uid=u1,cn=users,cn=accounts,dc=ipa,dc=test member: uid=u2,cn=users,cn=accounts,dc=ipa,dc=test $ ldapsearch -LLL -o ldif-wrap=no -D cn=directory\ manager -w Secret123 -b cn=nonposix1,cn=groups,cn=accounts,dc=ipa,dc=test dn: cn=nonposix1,cn=groups,cn=accounts,dc=ipa,dc=test objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject cn: nonposix1 ipaUniqueID: f1fde858-040f-11ec-b8ae-fa163ef9aedd member: uid=u1,cn=users,cn=accounts,dc=ipa,dc=test member: uid=u2,cn=users,cn=accounts,dc=ipa,dc=test - delete u1 (not preserved), delete u2 (preserved) -------------------------------------------------- $ ipa user-del u1 $ ipa user-del u2 --preserve - check the group membership: both groups are now empty ------------------------------------------------------- $ ldapsearch -LLL -o ldif-wrap=no -D cn=directory\ manager -w Secret123 -b cn=g1,cn=groups,cn=accounts,dc=ipa,dc=test dn: cn=g1,cn=groups,cn=accounts,dc=ipa,dc=test objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject objectClass: posixgroup cn: g1 ipaUniqueID: e5d6f240-040f-11ec-8109-fa163ef9aedd gidNumber: 593600010 $ ldapsearch -LLL -o ldif-wrap=no -D cn=directory\ manager -w Secret123 -b cn=nonposix1,cn=groups,cn=accounts,dc=ipa,dc=test dn: cn=nonposix1,cn=groups,cn=accounts,dc=ipa,dc=test objectClass: top objectClass: groupofnames objectClass: nestedgroup objectClass: ipausergroup objectClass: ipaobject cn: nonposix1 ipaUniqueID: f1fde858-040f-11ec-b8ae-fa163ef9aedd In order to progress further, can you check if there are any automember rules defined on the group? # ipa automember-find --type hostgroup # ipa automember-find --type group With automember groups I wasn't able to reproduce the issue either but I would like to make sure we can eliminate this possible path of investigation. I would also check if there are replication conflicts or replication issues. According to the sos report shared in the case, I can see a few errors in slapd error log: [09/Aug/2021:08:17:11.566795995 -0400] - ERR - managed-entries-plugin - mep_mod_post_op - Unable to find config for origin entry "uid=XXXX,cn=deleted users,cn=accounts,cn=provisioning,dc=OBFUSCATED". [09/Aug/2021:08:21:30.689795892 -0400] - ERR - managed-entries-plugin - mep_mod_post_op - Unable to find config for origin entry "uid=XXXX,cn=deleted users,cn=accounts,cn=provisioning,dc=OBFUSCATED". [09/Aug/2021:08:23:52.935071195 -0400] - ERR - managed-entries-plugin - mep_mod_post_op - Unable to find config for origin entry "uid=XXXX,cn=deleted users,cn=accounts,cn=provisioning,dc=OBFUSCATED". and they correspond to the preserved users that display the issue. Moving the issue to 389-ds component, the team has better knowledge of how the plugins should be triggered on this ipa user-del --preserve operation. |