Red Hat Bugzilla – Bug 703869
Managed Entry Configuration Not Setup when installing replica server
Last modified: 2015-01-04 18:48:33 EST
Description of problem: Master config: # ldapsearch -x -D "cn=directory manager" -w MySecret -b "cn=Managed Entries,cn=plugins,cn=config"# extended LDIF # # LDAPv3 # base <cn=Managed Entries,cn=plugins,cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # Managed Entries, plugins, config dn: cn=Managed Entries,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject objectClass: nsContainer cn: Managed Entries nsslapd-pluginPath: libmanagedentries-plugin nsslapd-pluginInitfunc: mep_init nsslapd-pluginType: preoperation nsslapd-pluginEnabled: on nsslapd-plugin-depends-on-type: database nsslapd-pluginId: Managed Entries nsslapd-pluginVersion: 1.2.8.2 nsslapd-pluginVendor: 389 Project nsslapd-pluginDescription: Managed Entries plugin # NGP Definition, Managed Entries, plugins, config dn: cn=NGP Definition,cn=Managed Entries,cn=plugins,cn=config objectClass: extensibleObject objectClass: top cn: HGP Definition cn: NGP Definition originscope: cn=hostgroups,cn=accounts,dc=testrelm originfilter: objectclass=ipahostgroup managedbase: cn=ng,cn=alt,dc=testrelm managedtemplate: cn=NGP HGP Template,cn=etc,dc=testrelm # UPG Definition, Managed Entries, plugins, config dn: cn=UPG Definition,cn=Managed Entries,cn=plugins,cn=config objectClass: extensibleObject objectClass: top cn: UPG Definition originscope: cn=users,cn=accounts,dc=testrelm originfilter: objectclass=posixAccount managedbase: cn=groups,cn=accounts,dc=testrelm managedtemplate: cn=UPG Template,cn=etc,dc=testrelm # search result search: 2 result: 0 Success # numResponses: 4 # numEntries: 3 Replica config: #ldapsearch -x -D "cn=directory manager" -w Secret123 -b "cn=Managed Entries,cn=plugins,cn=config" # extended LDIF # # LDAPv3 # base <cn=Managed Entries,cn=plugins,cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # Managed Entries, plugins, config dn: cn=Managed Entries,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject objectClass: nsContainer cn: Managed Entries nsslapd-pluginPath: libmanagedentries-plugin nsslapd-pluginInitfunc: mep_init nsslapd-pluginType: preoperation nsslapd-pluginEnabled: on nsslapd-plugin-depends-on-type: database nsslapd-pluginId: Managed Entries nsslapd-pluginVersion: 1.2.8.2 nsslapd-pluginVendor: 389 Project nsslapd-pluginDescription: Managed Entries plugin # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Version-Release number of selected component (if applicable): ipa-server-2.0.0-23.el6.x86_64 How reproducible: Steps to Reproduce: 1. install master - search configuration 2. install slave - search configuration 3. Actual results: configuration is not added Expected results: configuration to be added on installation Additional info: There is a manual workaround. You can manually add the configuration using ldapmodify after replica install, but will need to restart the services with ipactl restart.
https://fedorahosted.org/freeipa/ticket/1222
Pushed a one-liner typo fix from JR as well: master: 5a4f77ac1433ca1a0c9327dc90af58e3f225151d ipa-2-0: 58a970f25d929e7686c696d7c4ca1d5d34c341b5 and my bigger patch: master: 201ffc07bdb9e45ebb155a36b3b8ca77e7f9719c ipa-2-0: 8bd26a81be7c717c8928ba04fdf3ec8e3e1d09c2
verified: config on replica: # Managed Entries, plugins, config dn: cn=Managed Entries,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject objectClass: nsContainer cn: Managed Entries nsslapd-pluginPath: libmanagedentries-plugin nsslapd-pluginInitfunc: mep_init nsslapd-pluginType: preoperation nsslapd-pluginEnabled: on nsslapd-plugin-depends-on-type: database nsslapd-pluginId: Managed Entries nsslapd-pluginVersion: 1.2.9.11 nsslapd-pluginVendor: 389 Project nsslapd-pluginDescription: Managed Entries plugin # NGP Definition, Managed Entries, plugins, config dn: cn=NGP Definition,cn=Managed Entries,cn=plugins,cn=config cn: NGP Definition objectClass: extensibleObject objectClass: top managedbase: cn=ng,cn=alt,dc=testrelm originfilter: objectclass=ipahostgroup originscope: cn=hostgroups,cn=accounts,dc=testrelm managedtemplate: cn=NGP HGP Template,cn=etc,dc=testrelm # UPG Definition, Managed Entries, plugins, config dn: cn=UPG Definition,cn=Managed Entries,cn=plugins,cn=config cn: UPG Definition objectClass: extensibleObject objectClass: top managedbase: cn=groups,cn=accounts,dc=testrelm originfilter: (&(objectclass=posixAccount)(!(description=__no_upg__))) originscope: cn=users,cn=accounts,dc=testrelm managedtemplate: cn=UPG Template,cn=etc,dc=testrelm Version: ipa-server-2.1.1-3.el6.x86_64
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Cause: IPA replication installations were missing configuration for managed entries. Consequence: User-private groups and netgroups were not created for host groups if they were created on the replica. Fix: Add configuration for managed entries when creating a replica. Result: Creating users and host groups perform the same when creating on any IPA server.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1533.html