The update to 0.70.0 is breaking the compat tree for ou=sudoers,$SUFFIX.
Reproducer: install ipa server: ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --auto-forwarders -a Secret123 -p Secret123 -U
ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --auto-forwarders -a Secret123 -p Secret123 -U
configure a sudorule: echo Secret123 | kinit admin; ipa sudorule-add defaults ; ipa sudorule-add-option defaults --sudooption '!authenticate'
echo Secret123 | kinit admin; ipa sudorule-add defaults ; ipa sudorule-add-option defaults --sudooption '!authenticate'
perform a ldapsearch: ldapsearch -D cn=directory\ manager -w Secret123 -b ou=sudoers,dc=ipa,dc=test
ldapsearch -D cn=directory\ manager -w Secret123 -b ou=sudoers,dc=ipa,dc=test
No entry is found.
Same issue seen in https://issues.redhat.com/browse/RHEL-56042
Do you see entries for cn=users and cn=groups or they disappeared as well?
There is nothing in ou=sudoers that differentiates it from the other compat tree entries in FreeIPA configuration, so the behavior should be the same. I wonder if there is something else different.
None of the compat tree definitions get loaded. It looks like a priming thread never gets run at all, so no configuration gets processed.
Yes, this is the problem: priming thread is scheduled but never gets to execute. I tried to do a refresh task and see the following in the logs:
[27/Aug/2024:02:45:11.570998360 -0400] - INFO - schema-compat-plugin - backend_shr_refresh_thread - Refresh task already running or initial priming not completed yet
this happens because we don't have yet state->ready_to_server set to 1:
state->ready_to_server
/* Check if refresh is not already running or will start soon */ if (td->state->ready_to_serve == 0) { slapi_task_log_notice(task, "Refresh task already running or initial priming not completed yet."); slapi_task_log_status(task, "Refresh task already running or initial priming not completed yet."); slapi_log_error(SLAPI_LOG_INFO, td->plugin_log_id, "backend_shr_refresh_thread - Refresh task already running or initial priming not completed yet\n"); goto done; }
state->ready_to_serve should be set to 1 at the end of backend_shr_data_initialize_thread_cb() but we never get there.
state->ready_to_serve
backend_shr_data_initialize_thread_cb()
We don't even get to schedule running backend_shr_data_initialize_thread() which should create the thread:
backend_shr_data_initialize_thread()
/* Schedule running a callback that will create a thread * but make sure it is called a first thing when event loop is created */ slapi_eq_once_rel(backend_shr_data_initialize_thread, cbdata, slapi_current_rel_time_t() + PR_SecondsToInterval(PLUGIN_SCAN_DELAY));
where PLUGIN_SCAN_DELAY is 5 seconds. I tried to just add PLUGIN_SCAN_DELAY instead of converting that value to the interval and it started working.
PLUGIN_SCAN_DELAY
So the problem is not related to NIS removal, it is due to cd54ff98adaf58886140d88deecf081208bc5993 which moved to use slapi_eq_once_rel()
slapi_eq_once_rel()
Commit 6f325b03 fixes this issue