Description of problem: I may be using this utility wrong, and I know that the documentation isn't ready for this tool yet, but whenever I try to add one group to the member of another group, group-add-member reports "entry not found" Version-Release number of selected component (if applicable): ipa-server-2.0-2.20090505.el5ipa How reproducible: always Steps to Reproduce: 1. create group1 2. create group2 3. add group1 as a member of group2 Actual results: ipa group-add-member --groups=group1 group2 ipa: ERROR: entry not found Expected results: Additional info: I've also tried: ipa group-add-member --groups=group2 cn=group1,cn=groups,cn=accounts,dc=dsdev,dc=sjc,dc=redhat,dc=com and: ipa group-add-member --groups=cn=group1,cn=groups,cn=accounts,dc=dsdev,dc=sjc,dc=redhat,dc=com group2
I can't duplicate this. Can you re-run the group-add-member with the first (simpler) format then attach the last 100 lines of so of /var/log/httpd/error_log to the bug?
[root@iparhel5-vma ~]# ipa group-add-member --groups=group1 group2 ipa: ERROR: entry not found I know it's not 100 lines, but this what gets generated in the error_log. /var/log/httpd/error_log: ipa: INFO: Created connection context.ldap ipa: DEBUG: raw: group_add_member(u'group2', groups=(u'group1',)) ipa: INFO: group_add_member(u'group2', groups=(u'group1',)) ipa: INFO: Destroyed connection context.ldap ipa: INFO: response: NotFound: entry not found
The plot thickens... Ok, need some LDAP logs then. Can you do this: ipa group-show group1 ipa group-show group2 ipa group-add-member --groups=group1 group2 And attach the LDAP access log for that period?
The problem ended up being that I had a QA daemon that was running and removing group2. That's why the command was reporting "entry not found" when I would try to add group1 to group2.