The crash is happening in the ipa kdb code. Changing components.

The ld connection is NULL, hence the failure.

Did this fail in a particular context? e.g. under load, a specific Kerberos request?

Alexander thinks this may be upstream issue https://pagure.io/freeipa/issue/9251 . We lost traction with an upstream user who had a reproducing system.

Hi Rob,

(In reply to Rob Crittenden from comment #1)
> The crash is happening in the ipa kdb code. Changing components.
> 
> The ld connection is NULL, hence the failure.
> 
> Did this fail in a particular context? e.g. under load, a specific Kerberos
> request?

Customer mentioned that this typically happens when the LDAP server is under load
( addition / deletion of new hosts triggering multiple and replicated changes ).

Regards,
Têko.

This crash is due to the is_master_host() function[1], which is called in ipadb_fill_info3()[2] as part of the process to populate the PAC.

is_master_host() searches for a master host entry using ipadb_simple_search()[3], and interprets an error as the absence of master entry, and the absence of error as a the presence of a master entry. Hence, a connection error would be misinterpreted.

The crash occurs because in case ipadb_simple_search() faces a connection issue during the query, it will try to reset the connection to run the query again. But if it fails to reset the connection, it returns with an error code right away, leaving the LDAP context uninitialized. But, as mentioned above, is_master_host() won't handle this as an actual error. So the process in ipadb_fill_info3() will continue until the ldap_get_entry_controls() call, where the process crashes because of the uninitialized LDAP context.

[1] https://github.com/freeipa/freeipa/blob/release-4-9-12/daemons/ipa-kdb/ipa_kdb_mspac.c#L404
[2] https://github.com/freeipa/freeipa/blob/release-4-9-12/daemons/ipa-kdb/ipa_kdb_mspac.c#L695-L697
[3] https://github.com/freeipa/freeipa/blob/release-4-9-12/daemons/ipa-kdb/ipa_kdb_common.c#L169

Upstream ticket:
https://pagure.io/freeipa/issue/9422

Upstream pull request:
https://github.com/freeipa/freeipa/pull/6929

Fixed upstream
master:
https://pagure.io/freeipa/c/c84c59c66f1b22ebc671960cae90088a024d2d62

Fixed upstream
ipa-4-10:
https://pagure.io/freeipa/c/fd32e6a3d95f28d2d11d41ee5dabb0d563cb5d51

ipa-4-9:
https://pagure.io/freeipa/c/b5793c854035a122ed4c66f917cc427e5024e46a

*** Bug 2228943 has been marked as a duplicate of this bug. ***

Is thier any way to get a backport hotfix, our IDM servers are running into this issue causing intermittency connection issues for users to their systems. This is blocking upgrades and releases as Automation job and update scripts and playbooks require that stable connectivity.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (idm:client and idm:DL1 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6977

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days