freeipa

#9867 IPA Modrdn plugin performs duplicate replication changes
Closed: fixed by frenaud. Opened by vectinx.

Closed: fixed
Reopen Issue

Issue

I noticed that the ipa-modrdn plugin doesn’t check whether the operation it’s handling might be a replicated one. This results in duplicated operations on each replica — for example, during a preserved user deletion.

Here’s an example of a changelog showing the duplicated modification:

dbid: 68ff12c5000000040000
        encrypted: no
        replgen: 1761546944 Mon Oct 27 09:35:44 2025
        csn: 68ff12c5000000040000
        uniqueid: 0e027f01-b2fd11f0-8ba28524-a890a7ee
        dn: uid=u2,cn=users,cn=accounts,dc=test,dc=loc
        operation: modrdn
        newrdn: uid=u2
        deleteoldrdn: -1
        newsuperior: cn=deleted users,cn=accounts,cn=provisioning,dc=test,dc=loc
dbid: 68ff12c5000100040000
        encrypted: no
        replgen: 1761546944 Mon Oct 27 09:35:44 2025
        csn: 68ff12c5000100040000
        uniqueid: afcf6e34-a66511f0-8d8e8524-a890a7ee
        dn: cn=ipausers,cn=groups,cn=accounts,dc=test,dc=loc
        operation: modify
                member: uid=u2,cn=users,cn=accounts,dc=test,dc=loc
                modifiersname: cn=referential integrity postoperation,cn=plugins,cn=config
                modifytimestamp: 20251027063544Z
                entryusn: 46156
dbid: 68ff12c5000200040000
        encrypted: no
        replgen: 1761546944 Mon Oct 27 09:35:44 2025
        csn: 68ff12c5000200040000
        uniqueid: 9d0f9702-b2fd11f0-8ba28524-a890a7ee
        dn: cn=u2,cn=groups,cn=accounts,dc=test,dc=loc
        operation: delete
dbid: 68ff12c5000300040000
        encrypted: no
        replgen: 1761546944 Mon Oct 27 09:35:44 2025
        csn: 68ff12c5000300040000
        uniqueid: 0e027f01-b2fd11f0-8ba28524-a890a7ee
        dn: uid=u2,cn=deleted users,cn=accounts,cn=provisioning,dc=test,dc=loc
        operation: modify
                objectclass: mepOriginEntry
                modifiersname: cn=Managed Entries,cn=plugins,cn=config
                modifytimestamp: 20251027063544Z
                entryusn: 46160
dbid: 68ff12c5000400040000
        encrypted: no
        replgen: 1761546944 Mon Oct 27 09:35:44 2025
        csn: 68ff12c5000400040000
        uniqueid: 0e027f01-b2fd11f0-8ba28524-a890a7ee
        dn: uid=u2,cn=deleted users,cn=accounts,cn=provisioning,dc=test,dc=loc
        operation: modify
                modifiersname: cn=MemberOf Plugin,cn=plugins,cn=config
                modifytimestamp: 20251027063544Z
                entryusn: 46161
dbid: 68ff12c5000500040000
        encrypted: no
        replgen: 1761546944 Mon Oct 27 09:35:44 2025
        csn: 68ff12c5000500040000
        uniqueid: 0e027f01-b2fd11f0-8ba28524-a890a7ee
        dn: uid=u2,cn=deleted users,cn=accounts,cn=provisioning,dc=test,dc=loc
        operation: modify
                krbCanonicalName: u2@TEST.LOC
                modifiersname: cn=IPA MODRDN,cn=plugins,cn=config
                modifytimestamp: 20251027063544Z
                entryusn: 46162
dbid: 68ff12c5000600040000
        encrypted: no
        replgen: 1761546944 Mon Oct 27 09:35:44 2025
        csn: 68ff12c5000600040000
        uniqueid: 0e027f01-b2fd11f0-8ba28524-a890a7ee
        dn: uid=u2,cn=deleted users,cn=accounts,cn=provisioning,dc=test,dc=loc
        operation: modify
                krbPrincipalName: u2@TEST.LOC
                modifiersname: cn=IPA MODRDN,cn=plugins,cn=config
                modifytimestamp: 20251027063544Z
                entryusn: 46163
dbid: 68ff12c5000900030000
        encrypted: no
        replgen: 1761546945 Mon Oct 27 09:35:45 2025
        csn: 68ff12c5000900030000
        uniqueid: 0e027f01-b2fd11f0-8ba28524-a890a7ee
        dn: uid=u2,cn=deleted users,cn=accounts,cn=provisioning,dc=test,dc=loc
        operation: modify
                krbCanonicalName: u2@TEST.LOC
                modifiersName: cn=IPA MODRDN,cn=plugins,cn=config
                modifyTimestamp: 20251027063544Z
dbid: 68ff12c5000a00030000
        encrypted: no
        replgen: 1761546945 Mon Oct 27 09:35:45 2025
        csn: 68ff12c5000a00030000
        uniqueid: 0e027f01-b2fd11f0-8ba28524-a890a7ee
        dn: uid=u2,cn=deleted users,cn=accounts,cn=provisioning,dc=test,dc=loc
        operation: modify
                krbPrincipalName: u2@TEST.LOC
                modifiersName: cn=IPA MODRDN,cn=plugins,cn=config
                modifyTimestamp: 20251027063544Z

Steps to Reproduce

  1. Install two FreeIPA servers and configure replication between them.
  2. Add a user on one server:
    bash ipa user-add test --first test --last test
  3. Delete the previously created user with --preserve option:
    bash ipa user-del test --preserve
  4. Check the replication changelog:
    bash dbscan -f /var/lib/dirsrv/slapd-TEST-LOC/db/userRoot/replication_changelog.db

Actual behavior

The replication change log shows that Modrdn plugin is performing a record modification on each replica (as in the example log above)

Expected behavior

The plugin should work on one server, and the change should simply replicate to the rest.

Version/Release/Distribution

Tested on AlmaLinux 9:
ipa-server-4.12.2-14.0.1.el9_6.5.x86_64
ipa-client-4.12.2-14.0.1.el9_6.5.x86_64
389-ds-base-2.6.1-11.el9_6.x86_64

Additional info:

Problem is relevant for any version, since the check described in the ticket was never implemented in the Modrdn plugin.

Metadata Update from @abbra:
- Issue assigned to vectinx

Related PR:
https://github.com/freeipa/freeipa/pull/7991

master:

  • a4a218b4ebe490a1d55132e5a19202ca675d393a slapi-plugins: Add replication checking to the Modrdn plugin

ipa-4-12:

  • ac15a8b305e7736c3c158e28b0ecdbd0c231d8af slapi-plugins: Add replication checking to the Modrdn plugin

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.