On to, 08 huhti 2021, John Desantis via FreeIPA-users wrote:
Alexander,
Thanks for your reply!
> If you are not using cn=compat tree anywhere, it is probably better to
> disable it.
We do appear to be using it, so this doesn't seem to be an option;
there were entries listed as
cn=groupname,cn=groups,cn=compat,dc=ipa,dc=domain.
Schema compatibility plugin populates them automatically based on the
content of the primary tree. Presence of the entries does not mean you
are using them.
> What helps is to get the same groups looked up locally on IPA
master to
> cache them in SSSD cache. Then on restart of LDAP server and Schema
> Compatibility tree requests, SSSD would serve most of those from cache.
>
> >Has anyone else run into this issue? Can the messages be ignored? Are
> >there any steps to take to resolve the issue?
>
> These can be ignored, mostly. It is something we cannot currently
> address well due to chicken/egg problem at startup of LDAP server.
So, these entries did get logged well after dirsrv had started.
If they can mostly be ignored, when should they not be ignored?
If SSSD cannot recover from offline state. If it does recover, fine.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland