Issue

Bug https://pagure.io/freeipa/issue/7790 and my log analysis of other installations show repeatedly that 389-DS complains about a missing index on ipaconfigstring.

  Unindexed Component #1 (notes=U)
  -  Date/Time:             03/Dec/2018:17:42:08
  -  Connection Number:     289891
  -  Operation Number:      16
  -  Etime:                 0.0000473303
  -  Nentries:              1
  -  IP Address:            172.16.1.81
  -  Search Base:           cn=ops-ovc-ipa-1.ops.example.com,cn=masters,cn=ipa,cn=etc,dc=example,dc=com
  -  Search Scope:          2 (subtree)
  -  Search Filter:         (&(objectclass=ipaconfigobject)(ipaconfigstring=enabledservice)(cn=ca))
  -  Bind DN:               uid=admin,cn=users,cn=accounts,dc=example,dc=com

The ipaConfigString attribute is used in service definition in the cn=masters,cn=ipa,cn=etc,$SUFFIX subtree. It is queried to find active services, servers with a CA, the CA renewal master, and so on. The attribute is not only used during installation and in ipactl, but also in virtually any command that deals with CA, certs, and vault/KRA. Since not every IPA server has to be a CA master, clients and servers use a search with filter (ipaConfigString=enabledService) to locate a CA or KRA server.

Steps to Reproduce

1. install server
2. perform vault or cert operations
3. restart 389-DS or wait until server flushes logs
4. analyse log file with logconf.pl

Actual behavior

logconf shows unindexed filters with ipaconfigstring.

Expected behavior

There should be no unindexed filters.

Version/Release/Distribution

freeipa-server-4.7.2-0

Additional info:

IPA should add an eq and maybe also a pres index on ipaconfigstring

dn: cn=ipaconfigstring,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
objectClass: top
objectClass: nsIndex
cn: ipaconfigstring
nsIndexType: eq
nsIndexType: pres
nsSystemIndex: false