On la, 28 touko 2022, Leo O via FreeIPA-users wrote:
I had a running docker container with "rocky-8-4.9.6",
created one user
with the web ui and used the (maybe broken) docker image
"rocky-8-pfb-4.9.8" mentioned in my issue above. According to logs, the
container logic did start with an upgrade but then failed at "[6/9]:
updating schema [error] DuplicateEntry: Type or value exists"
Uploaded a bit more of the "/data/var/log/ipaupgrade.log" on pastebin:
https://pastebin.com/vBjLFtj6
Some strange lines I spotted, especially as hbac is nothing I bring in
via the plugin. It's a plugin coming with FreeIPA. What does this mean,
is this plugin broken or just a false error message? But it is also
saying to all my plugins -> not valid: "
2022-05-28T19:48:22Z DEBUG importing plugin module ipaserver.plugins.hbac
2022-05-28T19:48:22Z DEBUG ipaserver.plugins.hbac is not a valid plugin module
...
2022-05-28T19:48:22Z DEBUG importing plugin module ipaserver.plugins.mailalias
2022-05-28T19:48:22Z DEBUG ipaserver.plugins.mailalias is not a valid plugin module
2022-05-28T19:48:22Z DEBUG importing plugin module ipaserver.plugins.mailenabled
2022-05-28T19:48:22Z DEBUG ipaserver.plugins.mailenabled is not a valid plugin module
...
"
Ignore these. This typically is issued when a plugin module is imported
but does not have registry calls. ipaserver.plugins.hbac is a stub to
allow
ipa help hbac
to show up in the help topics output.
It is done so that hbacrule, hbacsvc, and hbacsvcgroup shown under the
same HBAC topic.
I guess your plugin does not introduce any additional IPA commands that
get registered in IPA objects/commands registries. This means a warning
is issued like that but it is harmless.
Another interesting part is here, as this error message does not make
any sense to me. I checked on a clean "rocky-8-4.9.6" with ldapsearch
for attributes and couldn't find anything with has the name
"mailForwardingAddress" or the OID "1.3.6.1.4.1.29426.1.10.10".
"
ldap.TYPE_OR_VALUE_EXISTS: {'msgtype': 103, 'msgid': 17, 'result':
20,
'desc': 'Type or value exists', 'ctrls': [], 'info':
'attribute type
mailForwardingAddress: Does not match the OID
"1.3.6.1.4.1.29426.1.10.10". Another attribute type is already using
the name or OID.'} ...
2022-05-28T19:48:30Z DEBUG [error] DuplicateEntry: Type or value exists
"
This is a problem with your LDAP schema. It conflicts with a default
schema provided by 389-ds LDAP server -- besides the schema extensions
IPA provides, we rely on the default schema in 389-ds.
389-ds has default 50ns-mail.ldif schema that already provides
mailForwardingAddress (and many other) attribute. Your definition of
mailForwardingAddress conflicts with the default definition, hence the
issue.
I'd recommend you to look into schema defaults that 389-ds already
provides and reuse them. Your plugin should ideally package only the
difference on top of 389-ds+IPA. If you have conflicting type
definitions which really do conflict by their properties, a better
approach would be to create your own schema and ask IANA to issue your
own OID subtree which then can be used to allocate OIDs for your own
schema.
I don't think in this case it is required though. Check
/usr/share/dirsrv/schema -- all schema files from there are
automatically loaded by the 389-ds LDAP server and don't need to be
repeated as instance-specific schema.
It is typical that LDAP schemas may have conflicting definitions either
on attribute/class names or on used OIDs. Many of the attributes might
have common names and application developers didn't look into
coordinating their activities.
The schema in question comes from '97 as a part of Hans Lachman's draft
for what did not become an RFC for intranet mail routing:
https://datatracker.ietf.org/doc/draft-lachman-ldap-mail-routing/
The draft was issued, went through several rounds of editions but did
not get accepted formally. Nevertheless, its schema is packaged by
default by LDAP servers derived from Netscape Communications' LDAP
server code. 389-ds is the opensourced version of the Netscape's LDAP
server code.
Any suggestions, is this maybe the "broken" image or anything else
inside FreeIPA, I just found a kind of a similar issue here:
https://pagure.io/freeipa/issue/5972
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland