[Freeipa-users] deleting ipa user

[Andy Thompson]

> -----Original Message-----
> From: Martin Kosek [mailto:mkosek at redhat.com]
> Sent: Wednesday, April 29, 2015 8:31 AM
> To: Andy Thompson; freeipa-users at redhat.com; Ludwig Krispenz; Thierry
> Bordaz
> Subject: Re: [Freeipa-users] deleting ipa user
> 
> On 04/29/2015 01:26 PM, Andy Thompson wrote:
> > I'm trying to delete an IPA account and I get a generic "operations error"
> when trying to remove it.  It looks like something is messed up with the
> group object.  The user doesn't show up in the ipausers group and there also
> isn't a group object for the user in question.  Here is the error from the
> attempt.
> >
> > [29/Apr/2015:07:21:32 -0400] referint-plugin - _update_all_per_mod:
> > entry cn=ipausers,cn=groups,cn=accounts,dc=domain,dc=com: deleting
> > "member: uid=<username>,cn=users,cn=accounts,dc=domain,dc=com"
> failed
> > (16)
> > [29/Apr/2015:07:21:32 -0400] referint-plugin - _update_all_per_mod:
> > entry
> > ipaUniqueID=3897c894-e764-11e4-b05b-
> 005056a92af3,cn=hbac,dc=domain,dc=
> > com: deleting "memberUser:
> > uid=<username>,cn=users,cn=accounts,dc=domain,dc=com" failed (16)
> > [29/Apr/2015:07:21:32 -0400] ldbm_back_delete - conn=0 op=0 Turning a
> > tombstone into a tombstone!
> > "nsuniqueid=7e1a1f87-e82611e4-99f1b343-
> f0abc1a8,cn=<username>,cn=group
> > s,cn=accounts,dc=domain,dc=com"; e: 0x7fcc84226070, cache_state: 0x0,
> > refcnt: 1
> > [29/Apr/2015:07:21:32 -0400] managed-entries-plugin - mep_del_post_op:
> > failed to delete managed entry
> > (cn=<username>,cn=groups,cn=accounts,dc=domain,dc=com) - error (1)
> > [29/Apr/2015:07:21:32 -0400] ldbm_back_delete - conn=0 op=0 Turning a
> > tombstone into a tombstone!
> > "nsuniqueid=7e1a1f87-e82611e4-99f1b343-
> f0abc1a8,cn=<username>,cn=group
> > s,cn=accounts,dc=domain,dc=com"; e: 0x7fcc84226070, cache_state: 0x0,
> > refcnt: 1
> > [29/Apr/2015:07:21:32 -0400] managed-entries-plugin - mep_del_post_op:
> > failed to delete managed entry
> > (cn=<username>,cn=groups,cn=accounts,dc=domain,dc=com) - error (1)
> 
> This is the first time I see this error. CCing Ludwig or Thierry to advise.
> 
> Andy, please also include FreeIPA and 389-ds-base packages versions so that
> Thierry and Ludwig know what to look at.
> 

Here you go

ipa-server-4.1.0-18.el7_1.3.x86_64
389-ds-base-1.3.3.1-15.el7_1.x86_64

Thanks much

-andy