<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> On 02/21/2013 11:44 AM, Erinn Looney-Triggs wrote: <blockquote cite="mid:51264EF0.6070905@gmail.com" type="cite"> <pre wrap="">On 02/21/2013 09:40 AM, Rob Crittenden wrote: </pre> <blockquote type="cite"> <pre wrap="">Erinn Looney-Triggs wrote: </pre> <blockquote type="cite"> <pre wrap="">On 02/21/2013 09:34 AM, Rob Crittenden wrote: </pre> <blockquote type="cite"> <pre wrap="">Erinn Looney-Triggs wrote: </pre> <blockquote type="cite"> <pre wrap="">On 02/21/2013 09:07 AM, Rob Crittenden wrote: </pre> <blockquote type="cite"> <pre wrap="">add:attributeTypes: (2.16.840.1.113730.3.8.11.1 NAME 'ipaExternalMember' DESC 'External Group Member Identifier' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v3' ) add:objectClasses: (2.16.840.1.113730.3.8.12.1 NAME 'ipaExternalGroup' SUP top STRUCTURAL MUST ( cn ) MAY ( ipaExternalMember $$ memberOf $$ description $$ owner) X-ORIGIN 'IPA v3' ) </pre> </blockquote> <pre wrap=""> Well that fails as well, though in sort of a self inflicted way: 2013-02-21T16:24:30Z INFO The ipa-ldap-updater command failed, exception: DatabaseError: Server is unwilling to perform: Minimum SSF not met. arguments: base="cn=config,cn=ldbm database,cn=plugins,cn=config", scope=0, filterstr="(objectclass=*)" 2013-02-21T16:24:30Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: DatabaseError: Server is unwilling to perform: Minimum SSF not met. arguments: base="cn=config,cn=ldbm database,cn=plugins,cn=config", scope=0, filterstr="(objectclass=*)" Now this probably comes about because I set: nsslapd-minssf: 56 For security. I can cange that back to the default and probably move past this, but is that a known issue? Is there another way around? </pre> </blockquote> <pre wrap=""> As root try the --ldapi flag: # ipa-ldap-updater --ldapi /path/to/scheme.update rob </pre> </blockquote> <pre wrap=""> ERROR: LDAPUpdate: syntax error: dn is not defined in the update, data source=schema.update -Erinn </pre> </blockquote> <pre wrap=""> Sorry, add this to the top of your update file: dn: cn=schema rob </pre> </blockquote> <pre wrap=""> No worries! Thanks for the help, after a restart of IPA the web UI is working again. I reckon this is something that needs to be fixed, does opening a support case and pointing them to that bug help you folks out with this in any way?</pre> </blockquote> This is a know defect. We just did not realize it would have such a bad impact on upgrade. Sorry, the errata is on the way. I would recommend everyone to not upgrade to 6.4 until the errata is shipped. We will notify you as soon as it goes out. Sorry again. <blockquote cite="mid:51264EF0.6070905@gmail.com" type="cite"> <pre wrap=""> -Erinn </pre> <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>