<div dir="ltr"><div>Hi,<br><br></div><div>In the above log (httpd log) the LDAPEntry contains qmailuser and qmailUser objectClasses, I don't know if this is what is causing the problem.<br></div><div><br></div><div>Another thing, I can't import groups as well, I did add a simple group to my ldap<br>dn: ou=groups,dc=example,dc=com<br>objectClass: organizationalUnit<br>objectClass: top<br>ou: groups<br>structuralObjectClass: organizationalUnit<br><br>dn: cn=vmail,ou=groups,dc=example,dc=com<br>objectClass: top<br>objectClass: posixGroup<br>gidNumber: 5000<br>structuralObjectClass: posixGroup<br>cn: vmail<br><br></div><div>When I launch the migration command I get<br><br>ipa: ERROR: La recherche LDAP group ne renvoie aucun résultat (base de recherche : ou=groups,dc=example,dc=com, classe d'objet : groupofuniquenames, groupofnames)<br></div><div><br></div><div>any idea?<br><br></div>Regards.<br></div><div class="gmail_extra"><br><div class="gmail_quote">2016-01-26 13:42 GMT+01:00 wodel youchi <span dir="ltr"><<a href="mailto:wodel.youchi@gmail.com" target="_blank">wodel.youchi@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Hi again,<br><br></div><div>This is what I get from httpd error_log<br><br>[Tue Jan 26 13:38:02.394757 2016] [:error] [pid 7427] ipa: WARNING: GID number 1000 of migrated user jean.doe does not point to a known group.<br>[Tue Jan 26 13:38:02.397928 2016] [:error] [pid 7427] LDAPEntry(ipapython.dn.DN('uid=jean.doe,cn=users,cn=accounts,dc=example,dc=com'), {u'mailQuotaSize': ['2048000'], u'cn': ['DOE'], u'uid': [u'jean.doe'], u'objectClass': [u'ipaobject', u'organizationalperson', u'qmailuser', u'top', u'ipasshuser', u'inetorgperson', u'person', u'krbticketpolicyaux', u'krbprincipalaux', u'shadowaccount', u'qmailUser', u'inetuser', u'posixaccount'], u'loginShell': ['/bin/bash'], u'uidNumber': ['1001'], u'gidNumber': [u'1000'], u'ipauniqueid': ['autogenerate'], u'krbprincipalname': [<a href="mailto:u%27jean.doe@EXAMPLE.COM" target="_blank">u'jean.doe@EXAMPLE.COM</a>'], u'mailMessageStore': ['/var/vmail/jean.doe'], u'description': ['__no_upg__'], u'displayName': ['Jean Doe'], u'userPassword': ['{SSHA}NIxCImzQDagloyVdMtheC4wDMUImxW85'], u'accountStatus': ['yes'], u'mailAlternateAddress': ['<a href="mailto:root@example.com" target="_blank">root@example.com</a>', '<a href="mailto:postmaster@example.com" target="_blank">postmaster@example.com</a>'], u'sn': ['Jean'], u'homeDirectory': ['/var/vmail/jean.doe'], u'mail': ['<a href="mailto:jean.doe@example.com" target="_blank">jean.doe@example.com</a>'], u'givenName': ['DOE']})<br>[Tue Jan 26 13:38:02.398937 2016] [:error] [pid 7427] ipa: WARNING: GID number 1000 of migrated user jeane.doe does not point to a known group.<br>[Tue Jan 26 13:38:02.399703 2016] [:error] [pid 7427] LDAPEntry(ipapython.dn.DN('uid=jeane.doe,cn=users,cn=accounts,dc=example,dc=com'), {u'mailQuotaSize': ['1024000'], u'cn': ['DOE'], u'uid': [u'jeane.doe'], u'objectClass': [u'ipaobject', u'organizationalperson', u'qmailuser', u'top', u'ipasshuser', u'inetorgperson', u'person', u'krbticketpolicyaux', u'krbprincipalaux', u'shadowaccount', u'qmailUser', u'inetuser', u'posixaccount'], u'loginShell': ['/bin/bash'], u'uidNumber': ['1002'], u'gidNumber': [u'1000'], u'ipauniqueid': ['autogenerate'], u'krbprincipalname': [<a href="mailto:u%27jeane.doe@EXAMPLE.COM" target="_blank">u'jeane.doe@EXAMPLE.COM</a>'], u'mailMessageStore': ['/var/vmail/jeane.doe'], u'description': ['__no_upg__'], u'displayName': ['Jeane Doe'], u'userPassword': ['{SSHA}+fXBt+2vlneTFUDhnEv9YvHS4Zo65LIT'], u'accountStatus': ['yes'], u'sn': ['Jeane'], u'homeDirectory': ['/var/vmail/jeane.doe'], u'mail': ['<a href="mailto:jeane.doe@example.com" target="_blank">jeane.doe@example.com</a>'], u'givenName': ['DOE']})<br></div><div><br></div>Regards.<br></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">2016-01-26 11:22 GMT+01:00 wodel youchi <span dir="ltr"><<a href="mailto:wodel.youchi@gmail.com" target="_blank">wodel.youchi@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div>Thanks I will try and report back.<br><br></div>I am using Centos 7.2x64 with latest updates<br><br></div>and ipa-server-4.2.0-15.el7.centos.3.x86_64<br><br></div>Regards<br></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">2016-01-26 10:53 GMT+01:00 Martin Kosek <span dir="ltr"><<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On 01/26/2016 10:16 AM, wodel youchi wrote:<br> > Hi,<br> ><br> > I am a newbie in freeipa. I am trying to use it with our mail server.<br> <br> </span>Cool! What is your version of the FreeIPA server? It will be important for<br> further investigation.<br> <div><div><br> > Our mail server uses openldap with one external schema : qmail.schema, we<br> > use it especially for mailQuota, mailAlternateAddress,<br> > mailForwardingAddress and AccountStatus.<br> ><br> > I tried to import this schema to freeipa using ipa-ldap-updater.<br> > I am not sure if I succeeded, but when I tried : ipa config-mod<br> > --addattr=ipaGroupObjectClasses=qmailUser it worked and I can see the<br> > objectClass.<br> ><br> ><br> > [root@ipamaster work]# ipa config-show --all<br> > dn: cn=ipaConfig,cn=etc,dc=example,dc=com<br> > Longueur maximale du nom d'utilisateur: 32<br> > Base du répertoire utilisateur: /home<br> > Interprèteur par défaut: /bin/sh<br> > Groupe utilisateur par défaut: ipausers<br> > Domaine par défaut pour les courriels: <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a><br> > Limite de temps d'une recherche: 2<br> > Limite de taille d'une recherche: 100<br> > Champs de recherche utilisateur: uid,givenname,sn,telephonenumber,ou,title<br> > Group search fields: cn,description<br> > Activer le mode migration: TRUE<br> > Base de sujet de certificat: O=<a href="http://EXAMPLE.COM" rel="noreferrer" target="_blank">EXAMPLE.COM</a><br> > Classes d'objets de groupe par défaut: top, ipaobject, groupofnames,<br> > ipausergroup, nestedgroup<br> > Classes d'objets utilisateur par défaut: ipaobject, person, top,<br> > ipasshuser, inetorgperson, organizationalperson,<br> > krbticketpolicyaux,<br> </div></div>> krbprincipalaux, *qmailUser*, inetuser, posixaccount<br> <div><div>> Notification d'expiration de mot de passe (jours): 4<br> > Fonctionnalités du greffon mots de passe: AllowNThash<br> > Ordre de la mappe des utilisateurs SELinux:<br> > guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023<br> > Utilisateur SELinux par défaut: unconfined_u:s0-s0:c0.c1023<br> > Types de PAC par défaut: nfs:NONE, MS-PAC<br> > aci: (targetattr = "cn || createtimestamp || entryusn ||<br> > ipacertificatesubjectbase || ipaconfigstring || ipacustomfields ||<br> > ipadefaultemaildomain || ipadefaultloginshell ||<br> > ipadefaultprimarygroup || ipagroupobjectclasses ||<br> > ipagroupsearchfields || ipahomesrootdir || ipakrbauthzdata ||<br> > ipamaxusernamelength || ipamigrationenabled ||<br> > ipapwdexpadvnotify || ipasearchrecordslimit || ipasearchtimelimit ||<br> > ipaselinuxusermapdefault ||<br> > ipaselinuxusermaporder || ipauserauthtype || ipauserobjectclasses ||<br> > ipausersearchfields || modifytimestamp ||<br> > objectclass")(targetfilter = "(objectclass=ipaguiconfig)")(version<br> > 3.0;acl "permission:System: Read Global<br> > Configuration";allow (compare,read,search) userdn = "ldap:///all";)<br> > cn: ipaConfig<br> > objectclass: ipaConfigObject, nsContainer, top, ipaGuiConfig,<br> > ipaUserAuthTypeClass<br> ><br> > Then I tried to migrate openldap's accounts, but without luck so far<br> > #ipa -v migrate-ds --with-compat --bind-dn "cn=admin,dc=example,dc=com"<br> > --continue ldap://<a href="http://192.168.1.121:389" rel="noreferrer" target="_blank">192.168.1.121:389</a><br> > -----------<br> > migrate-ds:<br> > -----------<br> > Migrated:<br> > Failed user:<br> > jean.doe: Type or value exists:<br> > jeane.doe: Type or value exists:<br> > Failed group:<br> > ----------<br> > No users/groups were migrated from ldap://<a href="http://192.168.1.121:389" rel="noreferrer" target="_blank">192.168.1.121:389</a><br> ><br> ><br> > Here is an entry from openldap<br> > dn: uid=jeane.doe,ou=people,dc=example,dc=com<br> > loginShell: /bin/bash<br> > gidNumber: 1000<br> > objectClass: top<br> > objectClass: qmailUser<br> > objectClass: inetOrgPerson<br> > objectClass: posixAccount<br> > objectClass: person<br> > objectClass: shadowAccount<br> > objectClass: organizationalPerson<br> > mail: <a href="mailto:jeane.doe@example.com" target="_blank">jeane.doe@example.com</a><br> > givenName: DOE<br> > uid: jeane.doe<br> > uidNumber: 1002<br> > displayName: Jeane Doe<br> > homeDirectory: /var/vmail/jeane.doe<br> > accountStatus: yes<br> > mailMessageStore: /var/vmail/jeane.doe<br> > structuralObjectClass: inetOrgPerson<br> > entryUUID: 3e8ee290-166f-1035-94d7-ef8fa27fbe71<br> > creatorsName: cn=admin,dc=example,dc=com<br> > createTimestamp: 20151103120748Z<br> > userPassword:: e1NTSEF9K2ZYQnQrMnZsbmVURlVEaG5FdjlZdkhTNFpvNjVMSVQ=<br> > mailQuotaSize: 1024000<br> > sn: Jeane<br> > cn: DOE<br> > entryCSN: 20160125162455.613052Z#000000#000#000000<br> > modifiersName: cn=admin,dc=example,dc=com<br> > modifyTimestamp: 20160125162455Z<br> ><br> > What does "Type or value exists" means?<br> <br> </div></div>That normally means that you have the same value for LDAP attribute twice or<br> that you are trying to add multiple values for a single valued attribute. I<br> wonder if we could get better logging, like how exactly the entry looks like<br> before it is added to LDAP.<br> <br> But right now, I cannot think about a better way than to updating<br> /usr/lib/python2.7/site-packages/ipalib/plugins/migration.py<br> on the FreeIPA server the following way (new print statement)<br> <br> try:<br> print entry_attrs<br> ldap.add_entry(entry_attrs)<br> except errors.ExecutionError, e:<br> <br> , restarting the httpd service and sending us the /var/log/httpd/error_log<br> after the next migration attempt. Maybe Jan (CCed) knows a better way.<br> <div><div><br> > PS: the qmail.schema presents two other objectClasses, but I didn't add use<br> > them (qldapAdmin, qmailGroup)<br> ><br> > Regards<br> ><br> ><br> ><br> <br> </div></div></blockquote></div><br></div> </div></div></blockquote></div><br></div> </div></div></blockquote></div><br></div>