[Freeipa-users] deleting ipa user

[thierry bordaz]

On 04/29/2015 02:43 PM, Andy Thompson wrote:
>> -----Original Message-----
>> From: Martin Kosek [mailto:mkosek at redhat.com]
>> Sent: Wednesday, April 29, 2015 8:31 AM
>> To: Andy Thompson; freeipa-users at redhat.com; Ludwig Krispenz; Thierry
>> Bordaz
>> Subject: Re: [Freeipa-users] deleting ipa user
>>
>> On 04/29/2015 01:26 PM, Andy Thompson wrote:
>>> I'm trying to delete an IPA account and I get a generic "operations error"
>> when trying to remove it.  It looks like something is messed up with the
>> group object.  The user doesn't show up in the ipausers group and there also
>> isn't a group object for the user in question.  Here is the error from the
>> attempt.
>>> [29/Apr/2015:07:21:32 -0400] referint-plugin - _update_all_per_mod:
>>> entry cn=ipausers,cn=groups,cn=accounts,dc=domain,dc=com: deleting
>>> "member: uid=<username>,cn=users,cn=accounts,dc=domain,dc=com"
>> failed
>>> (16)
>>> [29/Apr/2015:07:21:32 -0400] referint-plugin - _update_all_per_mod:
>>> entry
>>> ipaUniqueID=3897c894-e764-11e4-b05b-
>> 005056a92af3,cn=hbac,dc=domain,dc=
>>> com: deleting "memberUser:
>>> uid=<username>,cn=users,cn=accounts,dc=domain,dc=com" failed (16)
>>> [29/Apr/2015:07:21:32 -0400] ldbm_back_delete - conn=0 op=0 Turning a
>>> tombstone into a tombstone!
>>> "nsuniqueid=7e1a1f87-e82611e4-99f1b343-
>> f0abc1a8,cn=<username>,cn=group
>>> s,cn=accounts,dc=domain,dc=com"; e: 0x7fcc84226070, cache_state: 0x0,
>>> refcnt: 1
>>> [29/Apr/2015:07:21:32 -0400] managed-entries-plugin - mep_del_post_op:
>>> failed to delete managed entry
>>> (cn=<username>,cn=groups,cn=accounts,dc=domain,dc=com) - error (1)
>>> [29/Apr/2015:07:21:32 -0400] ldbm_back_delete - conn=0 op=0 Turning a
>>> tombstone into a tombstone!
>>> "nsuniqueid=7e1a1f87-e82611e4-99f1b343-
>> f0abc1a8,cn=<username>,cn=group
>>> s,cn=accounts,dc=domain,dc=com"; e: 0x7fcc84226070, cache_state: 0x0,
>>> refcnt: 1
>>> [29/Apr/2015:07:21:32 -0400] managed-entries-plugin - mep_del_post_op:
>>> failed to delete managed entry
>>> (cn=<username>,cn=groups,cn=accounts,dc=domain,dc=com) - error (1)
>> This is the first time I see this error. CCing Ludwig or Thierry to advise.
>>
>> Andy, please also include FreeIPA and 389-ds-base packages versions so that
>> Thierry and Ludwig know what to look at.
>>
> Here you go
>
> ipa-server-4.1.0-18.el7_1.3.x86_64
> 389-ds-base-1.3.3.1-15.el7_1.x86_64
>
> Thanks much
>
> -andy
>
>
Hello,

I wonder it is not a similar issue I hit 
https://fedorahosted.org/389/ticket/48165. What differs is 
'_update_all_per_mod' logs but could be a consequence of the same bug.
I have a non systematic test case for 48165.
Is it happening systematically in your case ?

thanks
thierry
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20150429/9831b214/attachment.htm>