freeipa

#5604 IPA upgrade failed due to DS updates failures
Closed: Invalid Opened by tbordaz.

Closed: Invalid
Reopen Issue

Fedora 23
freeipa-server-4.3.90.201601111613GIT48e1706
389-ds-base-1.3.4.6-1.fc23.x86_64

Upgrade of an IPA instance failed. The problem is not systematic

[ipa.ipatests.test_integration.host.Host.vm.cmd11] Upgrading IPA:
[ipa.ipatests.test_integration.host.Host.vm.cmd11]   [1/9]: stopping directory server
[ipa.ipatests.test_integration.host.Host.vm.cmd11]   [2/9]: saving configuration
[ipa.ipatests.test_integration.host.Host.vm.cmd11]   [3/9]: disabling listeners
[ipa.ipatests.test_integration.host.Host.vm.cmd11]   [4/9]: enabling DS global lock
[ipa.ipatests.test_integration.host.Host.vm.cmd11]   [5/9]: starting directory server
[ipa.ipatests.test_integration.host.Host.vm.cmd11]   [6/9]: upgrading server
[ipa.ipatests.test_integration.host.Host.vm.cmd11] ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR    Update failed: Server is unwilling to perform: database is read-only
[ipa.ipatests.test_integration.host.Host.vm.cmd11] ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR    Add failure Server is unwilling to perform: database is read-only
[ipa.ipatests.test_integration.host.Host.vm.cmd11] ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR    Add failure Server is unwilling to perform: database is read-only
[ipa.ipatests.test_integration.host.Host.vm.cmd11] ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR    Add failure Server is unwilling to perform: database is read-only
[ipa.ipatests.test_integration.host.Host.vm.cmd11] ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR    Add failure Server is unwilling to perform: database is read-only
[ipa.ipatests.test_integration.host.Host.vm.cmd11] ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR    Delete failed: Server is unwilling to perform: database is read-only
[ipa.ipatests.test_integration.host.Host.vm.cmd11] ipa         : ERROR    Upgrade failed with no such entry
[ipa.ipatests.test_integration.host.Host.vm.cmd11]   [error] RuntimeError: no such entry
[ipa.ipatests.test_integration.host.Host.vm.cmd11]   [cleanup]: stopping directory server
[ipa.ipatests.test_integration.host.Host.vm.cmd11]   [cleanup]: restoring configuration
[ipa.ipatests.test_integration.host.Host.vm.cmd11] ipa.ipapython.install.cli.install_tool(Server): ERROR    Update failed: no such entry
[ipa.ipatests.test_integration.host.Host.vm.cmd11] ipa.ipapython.install.cli.install_tool(Server): ERROR    The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
[ipa.ipatests.test_integration.host.Host.vm.cmd11] Exit code: 1

The reason of the failure is because of LDAP MOD failure.

During upgrade, it triggers indexing of 'ipaallowedtarget' attribute (eq, sub, pres).

[13/Jan/2016:15:40:38 +0100] - 389-Directory/1.3.4.6 B2016.012.2238 starting up
...
[13/Jan/2016:15:41:37 +0100] - userRoot: Indexing attribute: ipaallowedtarget
[13/Jan/2016:15:41:43 +0100] - userRoot: Finished indexing.
...
[13/Jan/2016:15:42:55 +0100] - slapd stopped.
2016-01-13T14:34:10Z WARNING DNS check for domain dom-055.idm.lab.eng.brq.redhat.com. failed: The DNS operation timed out after 30.0000379086 seconds.
2016-01-13T14:34:10Z DEBUG ipa-server-install was invoked with arguments [] and options: {'no_dns_sshfp': None, 'ignore_topology_disconnect': None, 'verbose': False, 'ip_addresses': None, 'domainlevel': 1, 'mkhomedir': None, 'no_pkinit': None, 'http_cert_files': None, 'no_ntp': None, 'subject': None, 'no_forwarders': None, 'external_ca_type': None, 'ssh_trust_dns': None, 'domain_name': 'dom-055.idm.lab.eng.brq.redhat.com', 'idmax': None, 'http_cert_name': None, 'dirsrv_cert_files': None, 'no_dnssec_validation': None, 'ca_signing_algorithm': None, 'no_reverse': None, 'pkinit_cert_files': None, 'unattended': True, 'auto_reverse': True, 'auto_forwarders': None, 'no_host_dns': None, 'no_sshd': None, 'no_ui_redirect': None, 'dirsrv_config_file': None, 'realm_name': 'DOM-055.IDM.LAB.ENG.BRQ.REDHAT.COM', 'forwarders': [CheckedIPAddress('10.34.47.10')], 'idstart': None, 'external_ca': None, 'pkinit_cert_name': None, 'no_ssh': None, 'external_cert_files': None, 'no_hbac_allow': None, 'dirsrv_cert_name': None, 'ca_cert_files': None, 'zonemgr': None, 'quiet': False, 'setup_dns': True, 'host_name': None, 'log_file': None, 'reverse_zones': None, 'allow_zone_overlap': None, 'uninstall': False}
...
2016-01-13T14:41:32Z DEBUG New entry: cn=ipaallowedtarget,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
2016-01-13T14:41:32Z DEBUG ---------------------------------------------
2016-01-13T14:41:32Z DEBUG Initial value
2016-01-13T14:41:32Z DEBUG dn: cn=ipaallowedtarget,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
2016-01-13T14:41:32Z DEBUG ObjectClass:
2016-01-13T14:41:32Z DEBUG      top
2016-01-13T14:41:32Z DEBUG      nsIndex
2016-01-13T14:41:32Z DEBUG cn:
2016-01-13T14:41:32Z DEBUG      ipaallowedtarget
2016-01-13T14:41:32Z DEBUG nsSystemIndex:
2016-01-13T14:41:32Z DEBUG      false
2016-01-13T14:41:32Z DEBUG only: set nsIndexType to 'eq', current value []
2016-01-13T14:41:32Z DEBUG only: updated value ['eq']
2016-01-13T14:41:32Z DEBUG only: set nsIndexType to 'pres', current value ['eq']
2016-01-13T14:41:32Z DEBUG only: updated value ['eq', 'pres']
2016-01-13T14:41:32Z DEBUG only: set nsIndexType to 'sub', current value ['eq', 'pres']
2016-01-13T14:41:32Z DEBUG only: updated value ['eq', 'pres', 'sub']
2016-01-13T14:41:32Z DEBUG ---------------------------------------------
2016-01-13T14:41:32Z DEBUG Final value after applying updates
2016-01-13T14:41:32Z DEBUG dn: cn=ipaallowedtarget,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
2016-01-13T14:41:32Z DEBUG ObjectClass:
2016-01-13T14:41:32Z DEBUG      top
2016-01-13T14:41:32Z DEBUG      nsIndex
2016-01-13T14:41:32Z DEBUG nsIndexType:
2016-01-13T14:41:32Z DEBUG      eq
2016-01-13T14:41:32Z DEBUG      sub
2016-01-13T14:41:32Z DEBUG      pres
2016-01-13T14:41:32Z DEBUG cn:
2016-01-13T14:41:32Z DEBUG      ipaallowedtarget
2016-01-13T14:41:32Z DEBUG nsSystemIndex:
2016-01-13T14:41:32Z DEBUG      false
2016-01-13T14:41:37Z DEBUG Creating task to index attribute: ipaallowedtarget
2016-01-13T14:41:37Z DEBUG Task id: cn=indextask_ipaallowedtarget_136719888976026470_4100,cn=index,cn=tasks,cn=config
2016-01-13T14:41:43Z DEBUG Indexing finished

The indexing of the task is monitored until it succeeds then the first update on the indexed suffix failed.
A later second update was successful.

Note: access logs rotated so there is only sample of it.

[13/Jan/2016:15:41:43 +0100] conn=3 op=204 MOD dn="dc=dom055,<SUFFIX>"
[13/Jan/2016:15:41:43 +0100] conn=3 op=204 RESULT err=53 tag=103 nentries=0 etime=0
...
[13/Jan/2016:15:41:44 +0100] conn=3 op=250 MOD dn="cn=staged users,cn=accounts,cn=provisioning,<SUFFIX>"
[13/Jan/2016:15:41:44 +0100] conn=3 op=250 RESULT err=0 tag=103 nentries=0 etime=0

The MOD was issued by processing of /usr/share/ipa/updates/20-nss_ldap.update.

016-01-13T14:41:43Z DEBUG Final value after applying updates
2016-01-13T14:41:43Z DEBUG dn: dc=dom-055,<SUFFIX>
2016-01-13T14:41:43Z DEBUG info:
2016-01-13T14:41:43Z DEBUG      IPA V2.0
2016-01-13T14:41:43Z DEBUG objectClass:
2016-01-13T14:41:43Z DEBUG      pilotObject
2016-01-13T14:41:43Z DEBUG      top
2016-01-13T14:41:43Z DEBUG      nisDomainObject
2016-01-13T14:41:43Z DEBUG      domain
2016-01-13T14:41:43Z DEBUG      domainRelatedObject
2016-01-13T14:41:43Z DEBUG aci:
2016-01-13T14:41:43Z DEBUG      (targetattr = "objectclass")(target = "ldap:///cn=retrieve certificate,cn=virtual operations,cn=etc,dc=dom-055,<SUFFIX>" )(version 3.0 ; acl "permission:Retrieve Certificates from the CA" ; allow (write) groupdn = "ldap:///cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=dom-055,<SUFFIX>";)
2016-01-13T14:41:43Z DEBUG      (targetattr = "objectclass")(target = "ldap:///cn=request certificate,cn=virtual operations,cn=etc,dc=dom-055,<SUFFIX>" )(version 3.0 ; acl "permission:Request Certificate" ; allow (write) groupdn = "ldap:///cn=Request Certificate,cn=permissions,cn=pbac,dc=dom-055,<SUFFIX>";)
2016-01-13T14:41:43Z DEBUG      (targetattr = "objectclass")(target = "ldap:///cn=request certificate different host,cn=virtual operations,cn=etc,dc=dom-055,<SUFFIX>" )(version 3.0 ; acl "permission:Request Certificates from a different host" ; allow (write) groupdn = "ldap:///cn=Request Certificates from a different host,cn=permissions,cn=pbac,dc=dom-055,<SUFFIX>";)
2016-01-13T14:41:43Z DEBUG      (targetattr = "objectclass")(target = "ldap:///cn=certificate status,cn=virtual operations,cn=etc,dc=dom-055,<SUFFIX>" )(version 3.0 ; acl "permission:Get Certificates status from the CA" ; allow (write) groupdn = "ldap:///cn=Get Certificates status from the CA,cn=permissions,cn=pbac,dc=dom-055,<SUFFIX>";)
2016-01-13T14:41:43Z DEBUG      (targetattr = "objectclass")(target = "ldap:///cn=revoke certificate,cn=virtual operations,cn=etc,dc=dom-055,<SUFFIX>" )(version 3.0 ; acl "permission:Revoke Certificate"; allow (write) groupdn = "ldap:///cn=Revoke Certificate,cn=permissions,cn=pbac,dc=dom-055,<SUFFIX>";)
2016-01-13T14:41:43Z DEBUG      (targetattr = "objectclass")(target = "ldap:///cn=certificate remove hold,cn=virtual operations,cn=etc,dc=dom-055,<SUFFIX>" )(version 3.0 ; acl "permission:Certificate Remove Hold"; allow (write) groupdn = "ldap:///cn=Certificate Remove Hold,cn=permissions,cn=pbac,dc=dom-055,<SUFFIX>";)
2016-01-13T14:41:43Z DEBUG      (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";)
2016-01-13T14:41:43Z DEBUG      (targetattr = "givenname || sn || cn || displayname || title || initials || loginshell || gecos || homephone || mobile || pager || facsimiletelephonenumber || telephonenumber || street || roomnumber || l || st || postalcode || manager || secretary || description || carlicense || labeleduri || inetuserhttpurl || seealso || employeetype  || businesscategory || ou")(version 3.0;acl "selfservice:User Self service";allow (write) userdn = "ldap:///self";)
2016-01-13T14:41:43Z DEBUG      (targetattr = "ipasshpubkey")(version 3.0;acl "selfservice:Users can manage their own SSH public keys";allow (write) userdn = "ldap:///self";)
2016-01-13T14:41:43Z DEBUG      (targetattr = "usercertificate")(version 3.0;acl "selfservice:Users can manage their own X.509 certificates";allow (write) userdn = "ldap:///self";)
2016-01-13T14:41:43Z DEBUG      (targetfilter = "(objectClass=ipaToken)")(targetattrs = "objectclass || description || managedBy || ipatokenUniqueID || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial || ipatokenOwner")(version 3.0; acl "Users/managers can read basic token info"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)
2016-01-13T14:41:43Z DEBUG      (targetfilter = "(objectClass=ipatokenTOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits || ipatokenTOTPtimeStep")(version 3.0; acl "Users/managers can see TOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)
2016-01-13T14:41:43Z DEBUG      (targetfilter = "(objectClass=ipatokenHOTP)")(targetattrs = "ipatokenOTPalgorithm || ipatokenOTPdigits")(version 3.0; acl "Users/managers can see HOTP details"; allow (read, search, compare) userattr = "ipatokenOwner#USERDN" or userattr = "managedBy#USERDN";)
2016-01-13T14:41:43Z DEBUG      (targetfilter = "(objectClass=ipaToken)")(targetattrs = "description || ipatokenDisabled || ipatokenNotBefore || ipatokenNotAfter || ipatokenVendor || ipatokenModel || ipatokenSerial")(version 3.0; acl "Managers can write basic token info"; allow (write) userattr = "managedBy#USERDN";)
2016-01-13T14:41:43Z DEBUG      (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Managers can delete tokens"; allow (delete) userattr = "managedBy#USERDN";)
2016-01-13T14:41:43Z DEBUG      (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=dom-055,<SUFFIX>")(targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "Users can create self-managed tokens"; allow (add) userattr = "ipatokenOwner#SELFDN" and userattr = "managedBy#SELFDN";)
2016-01-13T14:41:43Z DEBUG      (targetfilter="(objectclass=domain)")(targetattr="objectclass || dc || info || nisDomain || associatedDomain")(version 3.0; acl "Anonymous read access to DIT root"; allow(read, search, compare) userdn = "ldap:///anyone";)
2016-01-13T14:41:43Z DEBUG      (targetfilter="(&(objectclass=nsContainer)(!(objectclass=krbPwdPolicy)))")(target!="ldap:///cn=masters,cn=ipa,cn=etc,dc=dom-055,<SUFFIX>")(targetattr="objectclass || cn")(version 3.0; acl "Anonymous read access to containers"; allow(read, search, compare) userdn = "ldap:///anyone";)
2016-01-13T14:41:43Z DEBUG      (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbPwdHistory || krbLastPwdChange || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || ipaUniqueId || memberOf || enrolledBy || ipaNTHash || ipaProtectedOperation")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=dom-055,<SUFFIX>";)
2016-01-13T14:41:43Z DEBUG      (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=dom-055,<SUFFIX>";)
2016-01-13T14:41:43Z DEBUG      (targetfilter = "(objectClass=krbPwdPolicy)")(targetattr = "krbMaxPwdLife || krbMinPwdLife || krbPwdMinDiffChars || krbPwdMinLength || krbPwdHistoryLength")(version 3.0;acl "Admins can write password policies"; allow (read, search, compare, write) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=dom-055,<SUFFIX>";)
2016-01-13T14:41:43Z DEBUG      (targetattr="ipaUniqueId || memberOf || enrolledBy || krbExtraData || krbPrincipalName || krbCanonicalName || krbPasswordExpiration || krbLastPwdChange || krbLastSuccessfulAuth || krbLastFailedAuth")(version 3.0; acl "Admin read-only attributes"; allow (read, search, compare) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,dc=dom-055,<SUFFIX>";)
2016-01-13T14:41:43Z DEBUG      (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || ipaNTHash")(version 3.0; acl "Admins can write passwords"; allow (add,delete,write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=dom-055,<SUFFIX>";)
2016-01-13T14:41:43Z DEBUG dc:
2016-01-13T14:41:43Z DEBUG      dom-055
2016-01-13T14:41:43Z DEBUG nisDomain:
2016-01-13T14:41:43Z DEBUG      dom-055.idm.lab.eng.brq.redhat.com
2016-01-13T14:41:43Z DEBUG associatedDomain:
2016-01-13T14:41:43Z DEBUG      dom-055.idm.lab.eng.brq.redhat.com
2016-01-13T14:41:43Z DEBUG [(0, u'objectClass', ['nisDomainObject', 'domainRelatedObject']), (2, u'nisDomain', ['dom-055.idm.lab.eng.brq.redhat.com']), (2, u'associatedDomain', ['dom-055.idm.lab.eng.brq.redhat.com'])]
2016-01-13T14:41:43Z DEBUG Updated 1
2016-01-13T14:41:43Z ERROR Update failed: Server is unwilling to perform: database is read-only
2016-01-13T14:41:43Z DEBUG New entry: ou=profile,dc=dom-055,<SUFFIX>

So far the RC of the failure is not clear. It could be

- a bug in DS where the indexing task completed but the backend was not immediately available for update
- an invalid update in 20-nss_ldap.update. but then the problem should be systematic

More logs can be found in a duplicate issue #5789

I have reproduced the same issue with fresh RHEL 7.2.4 (ipa-server-4.2.0-15.el7_2.15.x86_64). I didn't do anything myself, just tried to install IPA and it never completed, crashed in the upgrade code:

ipa-server-install -a Test1234 -p Test1234 --setup-dns --mkhomedir -r TRUST.TEST --forwarder 192.168.X.Z -U
The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.
This includes:
  * Configure a stand-alone CA (dogtag) for certificate management
  * Configure the Network Time Daemon (ntpd)
  * Create and configure an instance of Directory Server
  * Create and configure a Kerberos Key Distribution Center (KDC)
  * Configure Apache (httpd)
  * Configure DNS (bind)
WARNING: conflicting time&date synchronization service 'chronyd' will be disabled
in favor of ntpd
Warning: skipping DNS resolution of host ipa-1.trust.test
The domain name has been determined based on the host name.
Checking DNS forwarders, please wait ...
Using reverse zone(s) X.168.192.in-addr.arpa.
The IPA Master Server will be configured with:
Hostname:       ipa-1.trust.test
IP address(es): 192.168.X.Y
Domain name:    trust.test
Realm name:     TRUST.TEST
BIND DNS server will be configured to serve IPA domain with:
Forwarders:    192.168.X.Z
Reverse zone(s):  X.168.192.in-addr.arpa.
Configuring NTP daemon (ntpd)
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
  [4/4]: starting ntpd
Done configuring NTP daemon (ntpd).
Configuring directory server (dirsrv). Estimated time: 1 minute
  [1/42]: creating directory server user
  [2/42]: creating directory server instance
  [3/42]: adding default schema
  [4/42]: enabling memberof plugin
  [5/42]: enabling winsync plugin
  [6/42]: configuring replication version plugin
  [7/42]: enabling IPA enrollment plugin
  [8/42]: enabling ldapi
  [9/42]: configuring uniqueness plugin
  [10/42]: configuring uuid plugin
  [11/42]: configuring modrdn plugin
  [12/42]: configuring DNS plugin
  [13/42]: enabling entryUSN plugin
  [14/42]: configuring lockout plugin
  [15/42]: creating indices
  [16/42]: enabling referential integrity plugin
  [17/42]: configuring certmap.conf
  [18/42]: configure autobind for root
  [19/42]: configure new location for managed entries
  [20/42]: configure dirsrv ccache
  [21/42]: enable SASL mapping fallback
  [22/42]: restarting directory server
  [23/42]: adding default layout
  [24/42]: adding delegation layout
  [25/42]: creating container for managed entries
  [26/42]: configuring user private groups
  [27/42]: configuring netgroups from hostgroups
  [28/42]: creating default Sudo bind user
  [29/42]: creating default Auto Member layout
  [30/42]: adding range check plugin
  [31/42]: creating default HBAC rule allow_all
  [32/42]: adding entries for topology management
  [33/42]: initializing group membership
  [34/42]: adding master entry
  [35/42]: initializing domain level
  [36/42]: configuring Posix uid/gid generation
  [37/42]: adding replication acis
  [38/42]: enabling compatibility plugin
  [39/42]: activating sidgen plugin
  [40/42]: activating extdom plugin
  [41/42]: tuning directory server
  [42/42]: configuring directory to start on boot
Done configuring directory server (dirsrv).
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds
  [1/28]: creating certificate server user
  [2/28]: configuring certificate server instance
  [3/28]: stopping certificate server instance to update CS.cfg
  [4/28]: backing up CS.cfg
  [5/28]: disabling nonces
  [6/28]: set up CRL publishing
  [7/28]: enable PKIX certificate path discovery and validation
  [8/28]: starting certificate server instance
  [9/28]: creating RA agent certificate database
  [10/28]: importing CA chain to RA certificate database
  [11/28]: fixing RA database permissions
  [12/28]: setting up signing cert profile
  [13/28]: setting audit signing renewal to 2 years
  [14/28]: restarting certificate server
  [15/28]: requesting RA certificate from CA
  [16/28]: issuing RA agent certificate
  [17/28]: adding RA agent as a trusted user
  [18/28]: authorizing RA to modify profiles
  [19/28]: configure certmonger for renewals
  [20/28]: configure certificate renewals
  [21/28]: configure RA certificate renewal
  [22/28]: configure Server-Cert certificate renewal
  [23/28]: Configure HTTP to proxy connections
  [24/28]: restarting certificate server
  [25/28]: migrating certificate profiles to LDAP
  [26/28]: importing IPA certificate profiles
  [27/28]: adding default CA ACL
  [28/28]: updating IPA configuration
Done configuring certificate server (pki-tomcatd).
Configuring directory server (dirsrv). Estimated time: 10 seconds
  [1/3]: configuring ssl for ds instance
  [2/3]: restarting directory server
  [3/3]: adding CA certificate entry
Done configuring directory server (dirsrv).
Configuring Kerberos KDC (krb5kdc). Estimated time: 30 seconds
  [1/10]: adding sasl mappings to the directory
  [2/10]: adding kerberos container to the directory
  [3/10]: configuring KDC
  [4/10]: initialize kerberos container
WARNING: Your system is running out of entropy, you may experience long delays
  [5/10]: adding default ACIs
  [6/10]: creating a keytab for the directory
  [7/10]: creating a keytab for the machine
  [8/10]: adding the password extension to the directory
  [9/10]: starting the KDC
  [10/10]: configuring KDC to start on boot
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
  [1/2]: starting kadmin 
  [2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring ipa_memcached
  [1/2]: starting ipa_memcached 
  [2/2]: configuring ipa_memcached to start on boot
Done configuring ipa_memcached.
Configuring ipa-otpd
  [1/2]: starting ipa-otpd 
  [2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Configuring the web interface (httpd). Estimated time: 1 minute
  [1/19]: setting mod_nss port to 443
  [2/19]: setting mod_nss protocol list to TLSv1.0 - TLSv1.2
  [3/19]: setting mod_nss password file
  [4/19]: enabling mod_nss renegotiate
  [5/19]: adding URL rewriting rules
  [6/19]: configuring httpd
  [7/19]: configure certmonger for renewals
  [8/19]: setting up ssl
  [9/19]: importing CA certificates from LDAP
  [10/19]: setting up browser autoconfig
  [11/19]: publish CA cert
  [12/19]: creating a keytab for httpd
  [13/19]: clean up any existing httpd ccache
  [14/19]: configuring SELinux for httpd
  [15/19]: create KDC proxy user
  [16/19]: create KDC proxy config
  [17/19]: enable KDC proxy
  [18/19]: restarting httpd
  [19/19]: configuring httpd to start on boot
Done configuring the web interface (httpd).
Applying LDAP updates
Upgrading IPA:
  [1/9]: stopping directory server
  [2/9]: saving configuration
  [3/9]: disabling listeners
  [4/9]: enabling DS global lock
  [5/9]: starting directory server
  [6/9]: upgrading server
ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR    Update failed: Server is unwilling to perform: database is read-only
ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR    Add failure Server is unwilling to perform: database is read-only
ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR    Add failure Server is unwilling to perform: database is read-only
ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR    Add failure Server is unwilling to perform: database is read-only
ipa.ipaserver.install.ldapupdate.LDAPUpdate: ERROR    Add failure Server is unwilling to perform: database is read-only
ipa         : ERROR    Upgrade failed with no such entry
  [error] RuntimeError: no such entry
  [cleanup]: stopping directory server
  [cleanup]: restoring configuration
ipa.ipapython.install.cli.install_tool(Server): ERROR    Update failed: no such entry

The failure is around this update:

2016-05-24T18:49:56Z DEBUG Adding ACI u'(targetattr = "attributemap || authenticationmethod || bindtimelimit || cn || createtimestamp || credentiallevel || defaultsearchbase
 || defaultsearchscope || defaultserverlist || dereferencealiases || entryusn || followreferrals || modifytimestamp || objectclass || objectclassmap || ou || preferredserver
list || profilettl || searchtimelimit || serviceauthenticationmethod || servicecredentiallevel || servicesearchdescriptor")(targetfilter = "(|(objectclass=organizationalUnit
)(objectclass=DUAConfigProfile))")(version 3.0;acl "permission:System: Read DUA Profile";allow (compare,read,search) userdn = "ldap:///anyone";)' to ou=profile,dc=trust,dc=test
2016-05-24T18:49:56Z DEBUG Destroyed connection context.ldap2_163322576
2016-05-24T18:49:56Z ERROR Upgrade failed with no such entry

An attempt to run ipa-server-upgrade manually caused an error too, this time because installer didn't complete and the system has no sssd config:

2016-05-24T18:52:21Z DEBUG Saving StateFile to '/var/lib/ipa/sysupgrade/sysupgrade.state'
2016-05-24T18:52:21Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2016-05-24T18:52:21Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 48, in run
    server.upgrade()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1615, in upgrade
    upgrade_configuration()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1557, in upgrade_configuration
    set_sssd_domain_option('ipa_server_mode', 'True')
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1197, in set_sssd_domain_option
    sssdconfig.import_config()
  File "/usr/lib/python2.7/site-packages/SSSDConfig/__init__.py", line 1399, in import_config
    fd = open(configfile, 'r')
2016-05-24T18:52:21Z DEBUG The ipa-server-upgrade command failed, exception: IOError: [Errno 2] No such file or directory: '/etc/sssd/sssd.conf'
2016-05-24T18:52:21Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details:
IOError: [Errno 2] No such file or directory: '/etc/sssd/sssd.conf'

Moving to 4.3.2, it was found as duplicate of #5721, #5789.

This ticket was incorrectly moved, moving to correct milestone and raising priority.

Unrelated to replica promotion BZ

4.3.2 was released, moving to 4.3.3

Martin, Thierry, this is an old issue. Is it still reproducible/ was it seen recently? If not wes should close it.

I tried unsuccessfully to reproduce it (with DS 1.3.4). The problem is quite rare and the reason of failure is unknown.
The problem is likely in 389-ds, that is not accepting updates just after an indexing phase (although it should accept).

Last occurrence was 3 month ago https://fedorahosted.org/freeipa/ticket/5604#comment:6. Note that it is not possible to confirm 100% it is the same problem.

I suggest to close the ticket, as not reproducible and reopen if needed.

Metadata Update from @tbordaz:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.3.3
Metadata
None
None
None
Low
defect
IPA
0
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.