<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> On 02/21/2013 12:31 PM, Dmitri Pal wrote: <blockquote cite="mid:512659EA.5060808@redhat.com" type="cite"> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> On 02/21/2013 11:44 AM, Erinn Looney-Triggs wrote: <blockquote cite="mid:51264EF0.6070905@gmail.com" type="cite"> <pre wrap="">On 02/21/2013 09:40 AM, Rob Crittenden wrote: </pre> <blockquote type="cite"> <pre wrap="">Erinn Looney-Triggs wrote: </pre> <blockquote type="cite"> <pre wrap="">On 02/21/2013 09:34 AM, Rob Crittenden wrote: </pre> <blockquote type="cite"> <pre wrap="">Erinn Looney-Triggs wrote: </pre> <blockquote type="cite"> <pre wrap="">On 02/21/2013 09:07 AM, Rob Crittenden wrote: </pre> <blockquote type="cite"> <pre wrap="">add:attributeTypes: (2.16.840.1.113730.3.8.11.1 NAME 'ipaExternalMember' DESC 'External Group Member Identifier' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v3' ) add:objectClasses: (2.16.840.1.113730.3.8.12.1 NAME 'ipaExternalGroup' SUP top STRUCTURAL MUST ( cn ) MAY ( ipaExternalMember $$ memberOf $$ description $$ owner) X-ORIGIN 'IPA v3' ) </pre> </blockquote> <pre wrap="">Well that fails as well, though in sort of a self inflicted way: 2013-02-21T16:24:30Z INFO The ipa-ldap-updater command failed, exception: DatabaseError: Server is unwilling to perform: Minimum SSF not met. arguments: base="cn=config,cn=ldbm database,cn=plugins,cn=config", scope=0, filterstr="(objectclass=*)" 2013-02-21T16:24:30Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: DatabaseError: Server is unwilling to perform: Minimum SSF not met. arguments: base="cn=config,cn=ldbm database,cn=plugins,cn=config", scope=0, filterstr="(objectclass=*)" Now this probably comes about because I set: nsslapd-minssf: 56 For security. I can cange that back to the default and probably move past this, but is that a known issue? Is there another way around? </pre> </blockquote> <pre wrap="">As root try the --ldapi flag: # ipa-ldap-updater --ldapi /path/to/scheme.update rob </pre> </blockquote> <pre wrap="">ERROR: LDAPUpdate: syntax error: dn is not defined in the update, data source=schema.update -Erinn </pre> </blockquote> <pre wrap="">Sorry, add this to the top of your update file: dn: cn=schema rob </pre> </blockquote> <pre wrap="">No worries! Thanks for the help, after a restart of IPA the web UI is working again. I reckon this is something that needs to be fixed, does opening a support case and pointing them to that bug help you folks out with this in any way?</pre> </blockquote> This is a know defect. We just did not realize it would have such a bad impact on upgrade. Sorry, the errata is on the way. I would recommend everyone to not upgrade to 6.4 until the errata is shipped. We will notify you as soon as it goes out. Sorry again. </blockquote> We did some research of this issue: 1) The upgrade works fine from 6.3 to 6.4 and the issue does not exhibit itself 2) We have been able to reproduce it with the direct upgrade from 6.2 to 6.4 3) Since the expected upgrade part is 6.2 -> 6.3 -> 6.4 the question comes up whether this fix is actually that urgent. 4) In the presence of the simple workaround we feel that it is not that important to include this fix into the errata that we are working on. Please let us know if you think that there is a problem with the plan above. <blockquote cite="mid:512659EA.5060808@redhat.com" type="cite"> <blockquote cite="mid:51264EF0.6070905@gmail.com" type="cite"> <pre wrap=""> -Erinn </pre> <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Freeipa-users mailing list <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>