<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">Le 22 juil. 2015 à 17:09, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" class="">abokovoy@redhat.com</a>> a écrit :</div><br class="Apple-interchange-newline"><div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">On Wed, 22 Jul 2015, Alexandre Ellert wrote:</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""><blockquote type="cite" class="">Le 20 juil. 2015 à 17:17, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" class="">abokovoy@redhat.com</a>> a écrit :<br class=""><br class="">On Mon, 20 Jul 2015, Alexandre Ellert wrote:<br class=""><blockquote type="cite" class=""><br class=""><blockquote type="cite" class="">Can you please show output from<br class="">fgrep -r 'dc' /etc/dirsrv/slapd-INSTANCE/schema<br class=""></blockquote><br class=""># fgrep -r 'dc' /etc/dirsrv/slapd-NUMEEZY-FR/schema<br class=""></blockquote><br class="">This is original 'dc' definition:<br class=""><blockquote type="cite" class="">/etc/dirsrv/slapd-NUMEEZY-FR/schema/00core.ldif:attributeTypes: (<br class="">0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' )<br class=""></blockquote><br class="">This is the offending one:<br class=""><blockquote type="cite" class="">/etc/dirsrv/slapd-NUMEEZY-FR/schema/99user.ldif:attributeTypes: (<br class="">0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) D<br class=""></blockquote><br class=""><blockquote type="cite" class="">In 00core.ldif, I have :<br class="">attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' )<br class="">EQUALITY caseIgnoreIA5Match<br class="">SUBSTR caseIgnoreIA5SubstringsMatch<br class="">SYNTAX 1.3.6.1.4.1.1466.115.121.1.26<br class="">SINGLE-VALUE<br class="">X-ORIGIN 'RFC 4519'<br class="">X-DEPRECATED 'domaincomponent' )<br class=""></blockquote>If you look into 99user.ldif, you'll see the wrong definition there.<br class=""><br class="">99user.ldif accumulates definitions coming from replication or updates.<br class="">You can check other IPA masters, do they have 'dc' attribute defined in<br class="">a wrong way?<br class=""></blockquote><br class="">I have a second IPA master and here is the occurence of ‘ domaincomponent' in /etc/dirsrv/slapd-NUMEEZY-FR/schema :<br class="">In 00core.ldif :<br class="">attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' )<br class="">EQUALITY caseIgnoreIA5Match<br class="">SUBSTR caseIgnoreIA5SubstringsMatch<br class="">SYNTAX 1.3.6.1.4.1.1466.115.121.1.26<br class="">SINGLE-VALUE<br class="">X-ORIGIN 'RFC 4519'<br class="">X-DEPRECATED 'domaincomponent’ )<br class="">In 99user.ldif :<br class="">attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) D<br class="">ESC 'Standard LDAP attribute type' EQUALITY caseIgnoreIA5Match SUBSTR caseIgn<br class="">oreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORI<br class="">GIN ( 'RFC 2247' 'user defined' ) )<br class=""><br class="">This two definition are exactly the same on both IPA masters.<br class=""><br class="">I don’t understand what is wrong in 99user.ldif ? How can I correct with the good definition ?<br class=""></blockquote><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">The correct definition is in the 00core.ldif. The one in 99user.ldif is</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">wrong.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">I think you can remove it from 99user.ldif on both servers but you need</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">to shut down dirsrv instances on both to do that.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">--<span class="Apple-converted-space"> </span></span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">/ Alexander Bokovoy</span></div></blockquote><br class=""></div><div>I shut down IPA on both servers (ipactl stop) and removed this section in 99user.ldif :</div><div>> attributeTypes: ( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domaincomponent' ) D<br class="">> ESC 'Standard LDAP attribute type' EQUALITY caseIgnoreIA5Match SUBSTR caseIgn<br class="">> oreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORI<br class="">> GIN ( 'RFC 2247' 'user defined' ) )</div><div><br class=""></div><div>But still have the same behavior (pki-tomcatd don’t start, same errors in logs). Do you have another idea ?</div><div><br class=""></div><div>Thanks for your support</div><br class=""></body></html>