<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 04/29/2015 02:43 PM, Andy Thompson wrote: </div> <blockquote cite="mid:39c3d0fff3104fce847db60727607423@TCCCORPEXCH02.TCC.local" type="cite"> <blockquote type="cite"> <pre wrap="">-----Original Message----- From: Martin Kosek [<a class="moz-txt-link-freetext" href="mailto:mkosek@redhat.com">mailto:mkosek@redhat.com</a>] Sent: Wednesday, April 29, 2015 8:31 AM To: Andy Thompson; <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>; Ludwig Krispenz; Thierry Bordaz Subject: Re: [Freeipa-users] deleting ipa user On 04/29/2015 01:26 PM, Andy Thompson wrote: </pre> <blockquote type="cite"> <pre wrap="">I'm trying to delete an IPA account and I get a generic "operations error" </pre> </blockquote> <pre wrap="">when trying to remove it. It looks like something is messed up with the group object. The user doesn't show up in the ipausers group and there also isn't a group object for the user in question. Here is the error from the attempt. </pre> <blockquote type="cite"> <pre wrap=""> [29/Apr/2015:07:21:32 -0400] referint-plugin - _update_all_per_mod: entry cn=ipausers,cn=groups,cn=accounts,dc=domain,dc=com: deleting "member: uid=<username>,cn=users,cn=accounts,dc=domain,dc=com" </pre> </blockquote> <pre wrap="">failed </pre> <blockquote type="cite"> <pre wrap="">(16) [29/Apr/2015:07:21:32 -0400] referint-plugin - _update_all_per_mod: entry ipaUniqueID=3897c894-e764-11e4-b05b- </pre> </blockquote> <pre wrap="">005056a92af3,cn=hbac,dc=domain,dc= </pre> <blockquote type="cite"> <pre wrap="">com: deleting "memberUser: uid=<username>,cn=users,cn=accounts,dc=domain,dc=com" failed (16) [29/Apr/2015:07:21:32 -0400] ldbm_back_delete - conn=0 op=0 Turning a tombstone into a tombstone! "nsuniqueid=7e1a1f87-e82611e4-99f1b343- </pre> </blockquote> <pre wrap="">f0abc1a8,cn=<username>,cn=group </pre> <blockquote type="cite"> <pre wrap="">s,cn=accounts,dc=domain,dc=com"; e: 0x7fcc84226070, cache_state: 0x0, refcnt: 1 [29/Apr/2015:07:21:32 -0400] managed-entries-plugin - mep_del_post_op: failed to delete managed entry (cn=<username>,cn=groups,cn=accounts,dc=domain,dc=com) - error (1) [29/Apr/2015:07:21:32 -0400] ldbm_back_delete - conn=0 op=0 Turning a tombstone into a tombstone! "nsuniqueid=7e1a1f87-e82611e4-99f1b343- </pre> </blockquote> <pre wrap="">f0abc1a8,cn=<username>,cn=group </pre> <blockquote type="cite"> <pre wrap="">s,cn=accounts,dc=domain,dc=com"; e: 0x7fcc84226070, cache_state: 0x0, refcnt: 1 [29/Apr/2015:07:21:32 -0400] managed-entries-plugin - mep_del_post_op: failed to delete managed entry (cn=<username>,cn=groups,cn=accounts,dc=domain,dc=com) - error (1) </pre> </blockquote> <pre wrap=""> This is the first time I see this error. CCing Ludwig or Thierry to advise. Andy, please also include FreeIPA and 389-ds-base packages versions so that Thierry and Ludwig know what to look at. </pre> </blockquote> <pre wrap=""> Here you go ipa-server-4.1.0-18.el7_1.3.x86_64 389-ds-base-1.3.3.1-15.el7_1.x86_64 Thanks much -andy </pre> </blockquote> Hello, I wonder it is not a similar issue I hit <a class="moz-txt-link-freetext" href="https://fedorahosted.org/389/ticket/48165">https://fedorahosted.org/389/ticket/48165</a>. What differs is '_update_all_per_mod' logs but could be a consequence of the same bug. I have a non systematic test case for 48165. Is it happening systematically in your case ? thanks thierry </body> </html>