The crash is happening in the ipa kdb code. Changing components. The ld connection is NULL, hence the failure. Did this fail in a particular context? e.g. under load, a specific Kerberos request?
Alexander thinks this may be upstream issue https://pagure.io/freeipa/issue/9251 . We lost traction with an upstream user who had a reproducing system.
Hi Rob, (In reply to Rob Crittenden from comment #1) > The crash is happening in the ipa kdb code. Changing components. > > The ld connection is NULL, hence the failure. > > Did this fail in a particular context? e.g. under load, a specific Kerberos > request? Customer mentioned that this typically happens when the LDAP server is under load ( addition / deletion of new hosts triggering multiple and replicated changes ). Regards, Têko.
This crash is due to the is_master_host() function[1], which is called in ipadb_fill_info3()[2] as part of the process to populate the PAC. is_master_host() searches for a master host entry using ipadb_simple_search()[3], and interprets an error as the absence of master entry, and the absence of error as a the presence of a master entry. Hence, a connection error would be misinterpreted. The crash occurs because in case ipadb_simple_search() faces a connection issue during the query, it will try to reset the connection to run the query again. But if it fails to reset the connection, it returns with an error code right away, leaving the LDAP context uninitialized. But, as mentioned above, is_master_host() won't handle this as an actual error. So the process in ipadb_fill_info3() will continue until the ldap_get_entry_controls() call, where the process crashes because of the uninitialized LDAP context. [1] https://github.com/freeipa/freeipa/blob/release-4-9-12/daemons/ipa-kdb/ipa_kdb_mspac.c#L404 [2] https://github.com/freeipa/freeipa/blob/release-4-9-12/daemons/ipa-kdb/ipa_kdb_mspac.c#L695-L697 [3] https://github.com/freeipa/freeipa/blob/release-4-9-12/daemons/ipa-kdb/ipa_kdb_common.c#L169
Upstream ticket: https://pagure.io/freeipa/issue/9422
Upstream pull request: https://github.com/freeipa/freeipa/pull/6929
Fixed upstream master: https://pagure.io/freeipa/c/c84c59c66f1b22ebc671960cae90088a024d2d62
Fixed upstream ipa-4-10: https://pagure.io/freeipa/c/fd32e6a3d95f28d2d11d41ee5dabb0d563cb5d51 ipa-4-9: https://pagure.io/freeipa/c/b5793c854035a122ed4c66f917cc427e5024e46a
*** Bug 2228943 has been marked as a duplicate of this bug. ***
Is thier any way to get a backport hotfix, our IDM servers are running into this issue causing intermittency connection issues for users to their systems. This is blocking upgrades and releases as Automation job and update scripts and playbooks require that stable connectivity.