freeipa

#9979 Schema Compatibility plugin disabling failed while ipa-server-upgrade command
Closed: fixed by frenaud. Opened by expram.

Closed: fixed
Reopen Issue

Request for enhancement

ipa-server-upgrade command needs to locate the Schema Compatibility plugin DN, so that FreeIPA upgrades complete without any errors.

Issue

the ipa-server-upgrade command fails to disable the Schema Compatibility plugin (cn=Schema Compatibility,cn=plugins,cn=config). Error message: DN: cn=Schema Compatibility,cn=plugins,cn=config does not exist or hasn't been updated

Steps to Reproduce

  1. Start with a working FreeIPA 4.11 installation (ipa-server fully configured)
  2. Perform a sequential package upgrade to freeipa-server-4.13.1-13.fc45.x86_64 (e.g., via dist upgrade in Fedora)
  3. Run ipa-server-upgrade
  4. Observe the upgrade log for errors related to Schema Compatibility plugin

Actual behavior

ipa-server-upgrade shows an error message while disabling the plugin.

Expected behavior

ipa-server-upgrade should successfully locate cn=Schema Compatibility,cn=plugins,cn=config in the 389-DS configuration tree and disable the plugin.

Version/Release/Distribution

freeipa-server-4.13.1-13.fc45.x86_64
freeipa-client-4.13.1-13.fc45.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-3.2.0-15.fc45.x86_64
package pki-ca is not installed
krb5-server-1.22.2-6.fc45.x86_64

Additional info:

I think this issue is related to the case sensitivity of the plugin DN - when the plugin's CN is converted to lowercase(https://github.com/freeipa/freeipa/pull/8360/changes), the problem does not occur, however this may potentially cause a conflict with older versions of 389-DS.

Ldap Search:

root@dlp:/# ldapsearch -LLL -D "cn=Directory Manager" -W -b "cn=Schema Compatibility,cn=plugins,cn=config"
Enter LDAP Password: 
dn: cn=schema compatibility,cn=plugins,cn=config
cn: Schema Compatibility
nsslapd-pluginDescription: Schema Compatibility Plugin
nsslapd-pluginEnabled: on
nsslapd-pluginId: schema-compat-plugin
nsslapd-pluginInitfunc: schema_compat_plugin_init
nsslapd-pluginPath: /usr/lib64/dirsrv/plugins/schemacompat-plugin.so
nsslapd-pluginType: object
nsslapd-pluginVendor: redhat.com
nsslapd-pluginVersion: 0.70.0 (betxn support available and enabled by default)
nsslapd-pluginbetxn: on
nsslapd-pluginprecedence: 40
objectClass: top
objectClass: nsSlapdPlugin
objectClass: extensibleObject

logs around error:

2026-04-27T10:16:17Z DEBUG step duration: dirsrv __save_config 0.09 sec
2026-04-27T10:16:17Z DEBUG   [2/9]: disabling listeners
2026-04-27T10:16:17Z DEBUG step duration: dirsrv __disable_listeners 0.07 sec
2026-04-27T10:16:17Z DEBUG   [3/9]: enabling DS global lock
2026-04-27T10:16:17Z DEBUG step duration: dirsrv __enable_ds_global_write_lock 0.08 sec
2026-04-27T10:16:17Z DEBUG   [4/9]: disabling Schema Compat
2026-04-27T10:16:17Z ERROR DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated
2026-04-27T10:16:17Z DEBUG step duration: dirsrv __disable_schema_compat 0.12 sec
2026-04-27T10:16:17Z DEBUG   [5/9]: starting directory server

The issue is a regression similar to the one handled in this commit: https://pagure.io/freeipa/c/2f3c035e2b8a8ac70b98264d17e84201578f2871

The LDIF parser now builds a results list as a dict with case-insensitive keys. The problem happens when the LDIF parser tries to update the entry (https://pagure.io/freeipa/blob/master/f/ipaserver/install/upgradeinstance.py#_272-278).
Edited by frenaud

master:

  • 57a304dbbff7c61f957ee37ebb1676accea6ac97 upgrade: change ModifyLDIF modification processing logic for proper Schema Compat turn off

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8374
- Issue assigned to expram

ipa-4-12:

  • d15081254dbb965d9544680fec3baf506e1e7e36 upgrade: change ModifyLDIF modification processing logic for proper Schema Compat turn off

ipa-4-13:

  • 0421666a050810983239bf0672393e7354dfcd36 upgrade: change ModifyLDIF modification processing logic for proper Schema Compat turn off

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.