freeipa

#9784 ipa-migrate --migrate-dns fails to update the DNS record
Closed: fixed by mreynolds. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

ipa-migrate exits on error when executed with --migrate-dns

Steps to Reproduce

  1. Install a source ipa server with ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --forwarder 10.11.5.160 -a Secret123 -p Secret123 -U
  2. Create a new zone on the source server with kinit admin; ipa dnszone-add ipatest.test --force
  3. Install a destination server with ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --forwarder 10.11.5.160 -a Secret123 -p Secret123 -U
  4. Migrate from source to destination, including the DNS records with ipa-migrate prod-mode source.ipa.test -D cn=directory\ manager -w Secret123 -B -n

Actual behavior

The command ipa-migrate fails:

# ipa-migrate prod-mode source.ipa.test -D cn=directory\ manager -w Secret123 -B -n
Initializing ...
Connecting to local server ...
IPA to IPA migration starting ...
Migrating schema ...
Migrating configuration ...
Migrating database ... (this may take a while)
Failed to update "idnsname=_kerberos,idnsname=ipa.test.,cn=dns,dc=ipa,dc=test" error: missing attribute "idnsTemplateAttribute" required by object class "idnsTemplateObject"

Expected behavior

Should succeed and create the same zone on the destination server

Version/Release/Distribution

freeipa-server-4.13.0.dev202505121115+git-0.fc42.x86_64

Additional info:

Form the access log:

[13/May/2025:04:16:27.440383832 -0400] conn=32 op=533 MOD dn="idnsname=_kerberos,idnsname=ipa.test.,cn=dns,dc=ipa,dc=test"
[13/May/2025:04:16:27.449717314 -0400] conn=32 op=533 RESULT err=65 tag=103 nentries=0 wtime=0.000035560 optime=0.009334293 etime=0.009368253 - missing attribute "idnsTemplateAttribute" required by object class "idnsTemplateObject"

From the audit log:

dn: idnsname=_kerberos,idnsname=ipa.test.,cn=dns,dc=ipa,dc=test
result: 65
changetype: modify
delete: idnstemplateattribute;cnamerecord
-
add: URIRecord
URIRecord: 0 100 "krb5srv:m:tcp:source.ipa.test."
URIRecord: 0 100 "krb5srv:m:udp:source.ipa.test."
-
replace: modifiersname
modifiersname: cn=Directory Manager
-
replace: modifytimestamp
modifytimestamp: 20250513081627Z
-
replace: entryusn
entryusn: 1718
-

On the source server, the entry is the following:

dn: idnsname=_kerberos,idnsname=ipa.test.,cn=dns,dc=ipa,dc=test
idnsName: _kerberos
objectClass: top
objectClass: idnsrecord
objectClass: idnsTemplateObject
URIRecord: 0 100 "krb5srv:m:tcp:source.ipa.test."
URIRecord: 0 100 "krb5srv:m:udp:source.ipa.test."
tXTRecord: "IPA.TEST"
idnsTemplateAttribute;cnamerecord: _kerberos.\{substitutionvariable_ipalocatio
 n\}._locations

On the destination server:

dn: idnsname=_kerberos,idnsname=ipa.test.,cn=dns,dc=ipa,dc=test
idnsName: _kerberos
objectClass: top
objectClass: idnsrecord
objectClass: idnsTemplateObject
tXTRecord: "IPA.TEST"
URIRecord: 0 100 "krb5srv:m:tcp:dest.ipa.test."
URIRecord: 0 100 "krb5srv:m:udp:dest.ipa.test."
idnsTemplateAttribute;cnamerecord: _kerberos.\{substitutionvariable_ipalocatio
 n\}._locations

From ipa-migrate.log:

2025-05-13T08:16:27Z DEBUG Entry is different and will be updated: 'idnsname=ipa.test.,cn=dns,dc=ipa,dc=test' attribute 'idnsSOAmName' replaced with val 'source.ipa.test.' old value: ['dest.ipa.test.']
2025-05-13T08:16:27Z DEBUG Entry is different and will be updated: 'idnsname=ipa.test.,cn=dns,dc=ipa,dc=test' attribute 'idnsSOAserial' replaced with val '1747123996' old value: ['1747124122']
2025-05-13T08:16:27Z DEBUG Entry is different and will be updated: 'idnsname=ipa.test.,cn=dns,dc=ipa,dc=test' attribute 'nSRecord' add val 'source.ipa.test.' not in ['dest.ipa.test.']
2025-05-13T08:16:27Z DEBUG update_entry modlist [(2, 'idnsSOAserial', [b'1747123996']), (0, 'nSRecord', [b'source.ipa.test.']), (2, 'idnsSOAmName', [b'source.ipa.test.'])]
2025-05-13T08:16:27Z DEBUG Entry is different and will be updated: 'idnsname=_kerberos,idnsname=ipa.test.,cn=dns,dc=ipa,dc=test' attribute 'URIRecord' add val '0 100 "krb5srv:m:tcp:source.ipa.test."' not in ['0 100 "krb5srv:m:tcp:dest.ipa.test."', '0 100 "krb5srv:m:udp:dest.ipa.test."']
2025-05-13T08:16:27Z DEBUG Entry is different and will be updated: 'idnsname=_kerberos,idnsname=ipa.test.,cn=dns,dc=ipa,dc=test' attribute 'URIRecord' add val '0 100 "krb5srv:m:udp:source.ipa.test."' not in ['0 100 "krb5srv:m:tcp:dest.ipa.test."', '0 100 "krb5srv:m:udp:dest.ipa.test."', '0 100 "krb5srv:m:tcp:source.ipa.test."']
2025-05-13T08:16:27Z DEBUG Entry is different and will be updated: 'idnsname=_kerberos,idnsname=ipa.test.,cn=dns,dc=ipa,dc=test' attribute 'idnsTemplateAttribute;cnamerecord' is being removed
2025-05-13T08:16:27Z DEBUG update_entry modlist [(1, 'idnsTemplateAttribute;cnamerecord', None), (0, 'URIRecord', [b'0 100 "krb5srv:m:tcp:source.ipa.test."', b'0 100 "krb5srv:m:udp:source.ipa.test."'])]
2025-05-13T08:16:27Z ERROR Failed to update "idnsname=_kerberos,idnsname=ipa.test.,cn=dns,dc=ipa,dc=test" error: missing attribute "idnsTemplateAttribute" required by object class "idnsTemplateObject"

Metadata Update from @frenaud:
- Issue tagged with: test-failure

Hi @mreynolds
could you have a look at this issue? Thanks

Filed PR: https://github.com/freeipa/freeipa/pull/7852

master:

  • 878b800e879c460038ab0d3f6aff96a89a22961e ipa-migrate - only remove repl state attribute options

Metadata Update from @mreynolds:
- Issue assigned to mreynolds

Metadata Update from @mreynolds:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-12:

  • ceaa1c9a244499534343dc667227e47a923212ee ipa-migrate - only remove repl state attribute options
Metadata

test-failure

None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.