freeipa

#9197 [Tracker] nightly failure in ipa-replica-install: [error] ACIError: Insufficient access
Closed: worksforme by frenaud. Opened by amore.

Closed: worksforme
Reopen Issue

Issue

FreeIPA nightly tests fail trying to setup the replication. See for instance this test report with the following logs.

Package Version and Platform:

Platform: Fedora 36
Package and version:389-ds-base-2.1.3-1.fc36.x86_64
The full package list is available here.

Steps to Reproduce

  1. install ipa-server
  2. install client and promote to replica on replica1 and replica2
  3. On master run ipa-replica-manage del replica2.ipa.test --force
  4. On replica2 run ipa-server-install --uninstall -U --ignore-topology-disconnect --ignore-last-of-role
  5. On replica2 install client
  6. On replica2 install replica again.

Actual behavior

[26/42]: restarting directory server
DEBUG ipatests.pytest_ipa.integration.host.Host.replica2.cmd198:transport.py:557 [27/42]: creating DS keytab
DEBUG ipatests.pytest_ipa.integration.host.Host.replica2.cmd198:transport.py:557 [error] ACIError: Insufficient access:
DEBUG ipatests.pytest_ipa.integration.host.Host.replica2.cmd198:transport.py:557 Insufficient access:
DEBUG ipatests.pytest_ipa.integration.host.Host.replica2.cmd198:transport.py:557 The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
DEBUG ipatests.pytest_ipa.integration.host.Host.replica2.cmd198:transport.py:557 Your system may be partly configured.
DEBUG ipatests.pytest_ipa.integration.host.Host.replica2.cmd198:transport.py:557 Run /usr/sbin/ipa-server-install --uninstall to clean up.

Expected behavior

Replica installation should succeed.

Failure observed in testing_master_testing_selinux ,
Report

Metadata Update from @amore:
- Issue tagged with: test-failure, tests

The installation fails when the command is trying to add the entry krbprincipalname=ldap/replica2.ipa.test@IPA.TEST,cn=services,cn=accounts,dc=ipa,dc=test on the master (from master access log):

[06/Jul/2022:19:05:33.816461481 +0000] conn=300 op=13 ADD dn="krbprincipalname=ldap/replica2.ipa.test@IPA.TEST,cn=services,cn=accounts,dc=ipa,dc=test"
[06/Jul/2022:19:05:34.238021208 +0000] conn=300 op=13 RESULT err=50 tag=105 nentries=0 wtime=0.004910682 optime=0.421567626 etime=0.426473854

This connection was bound with fqdn=replica2.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test:

[06/Jul/2022:19:05:03.971976314 +0000] conn=300 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI
[06/Jul/2022:19:05:03.974872296 +0000] conn=300 op=2 RESULT err=0 tag=97 nentries=0 wtime=0.000087080 optime=0.002899505 etime=0.002984121 dn="fqdn=replica2.ipa.test,cn=computers,cn=accounts,dc=ipa,dc=test"

The following ACI is set on cn=services,cn=accounts,dc=ipa,dc=test that should allow the op:

aci: (target = "ldap:///krbprincipalname=*/($dn)@IPA.TEST,cn=services,cn=accounts,dc=ipa,dc=test")(targetfilter = "(objectClass=ipaService)")(version 3.0;acl "Hosts can add own services"; allow(add) userdn="ldap:///fqdn=($dn),cn=computers,cn=accounts,dc=ipa,dc=test";)

The error log on the master shows the following issue:

[06/Jul/2022:19:05:34.236431632 +0000] - ERR - find_entry_internal_dn - Retry count exceeded (cn=services,cn=accounts,dc=ipa,dc=test)
[06/Jul/2022:19:05:34.239816172 +0000] - DEBUG - _csngen_adjust_local_time - gen state before 62c5dcdf0003:1657134302:1:0
[06/Jul/2022:19:05:34.240789362 +0000] - DEBUG - _csngen_adjust_local_time - gen state after 62c5dcfe0000:1657134334:0:0
[06/Jul/2022:19:05:34.241888917 +0000] - DEBUG - NSMMReplicationPlugin - ruv_add_csn_inprogress - Successfully inserted csn 62c5dcfe000000040000 into pending list
[06/Jul/2022:19:05:34.247499723 +0000] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 128]: Missing target entry.
[06/Jul/2022:19:05:34.248446458 +0000] - DEBUG - NSMMReplicationPlugin - process postop - conn=300 op=13 csn=62c5dcfe000000040000 canceling operation csn

Companion issue on 389-ds side: https://github.com/389ds/389-ds-base/issues/5362

Metadata Update from @frenaud:
- Issue tagged with: tracker

Closing this ticket as the issue didn't happen any more in the last months.
Probably fixed with the patch for high contention in find_entry_internal_dn on mixed load #5262

Metadata Update from @frenaud:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)
Metadata
None

test-failure tests tracker

None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.