#54 After update to 0.70.0 ldapsearch -b ou=sudoers,dc=ipa,dc=test does not return any entry
Closed: Fixed by abbra. Opened by frenaud.

The update to 0.70.0 is breaking the compat tree for ou=sudoers,$SUFFIX.

Reproducer:
install ipa server: ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --auto-forwarders -a Secret123 -p Secret123 -U

configure a sudorule: echo Secret123 | kinit admin; ipa sudorule-add defaults ; ipa sudorule-add-option defaults --sudooption '!authenticate'

perform a ldapsearch: ldapsearch -D cn=directory\ manager -w Secret123 -b ou=sudoers,dc=ipa,dc=test

No entry is found.

Same issue seen in https://issues.redhat.com/browse/RHEL-56042


Do you see entries for cn=users and cn=groups or they disappeared as well?

There is nothing in ou=sudoers that differentiates it from the other compat tree entries in FreeIPA configuration, so the behavior should be the same. I wonder if there is something else different.

None of the compat tree definitions get loaded. It looks like a priming thread never gets run at all, so no configuration gets processed.

Yes, this is the problem: priming thread is scheduled but never gets to execute.
I tried to do a refresh task and see the following in the logs:

[27/Aug/2024:02:45:11.570998360 -0400] - INFO - schema-compat-plugin - backend_shr_refresh_thread - Refresh task already running or initial priming not completed yet

this happens because we don't have yet state->ready_to_server set to 1:

    /* Check if refresh is not already running or will start soon */
    if (td->state->ready_to_serve == 0) {
        slapi_task_log_notice(task, "Refresh task already running or initial priming not completed yet.");
        slapi_task_log_status(task, "Refresh task already running or initial priming not completed yet.");
        slapi_log_error(SLAPI_LOG_INFO, td->plugin_log_id,
                        "backend_shr_refresh_thread - Refresh task already running or initial priming not completed yet\n");
        goto done;
    }

state->ready_to_serve should be set to 1 at the end of backend_shr_data_initialize_thread_cb() but we never get there.

We don't even get to schedule running backend_shr_data_initialize_thread() which should create the thread:

        /* Schedule running a callback that will create a thread
         * but make sure it is called a first thing when event loop is created */
    slapi_eq_once_rel(backend_shr_data_initialize_thread, cbdata,
                      slapi_current_rel_time_t() +
                      PR_SecondsToInterval(PLUGIN_SCAN_DELAY));

where PLUGIN_SCAN_DELAY is 5 seconds. I tried to just add PLUGIN_SCAN_DELAY instead of converting that value to the interval and it started working.

So the problem is not related to NIS removal, it is due to cd54ff98adaf58886140d88deecf081208bc5993 which moved to use slapi_eq_once_rel()

Commit 6f325b03 fixes this issue

Metadata