A few months ago, using IPA 4.8.7, I imported users and groups from OpenLDAP:

ipa -v migrate-ds --with-compat \
--bind-dn="cn=Manager,dc=example,dc=com" \
--user-container="ou=People,dc=example,dc=com" \
--user-objectclass="posixAccount" \
--group-container="ou=Group,dc=example,dc=com" \
--group-objectclass="posixGroup" \
--group-overwrite-gid \
--schema=RFC2307 \
ldap://openldap-server:389

Now, I've found a problem...

In addition to the expected "member" attribute list on the group dn, I also have a memberUid attribute list.  These memberUid attributes are not created when using IPA to assign users to groups, just during my import.

An imported user:

    dn: cn=wahoo,cn=groups,cn=accounts,dc=example,dc=com
    member: uid=fred,cn=users,cn=accounts,dc=example,dc=com
    memberUid: fred

    dn: cn=wahoo,cn=groups,cn=compat,dc=example,dc=com
    memberUid: fred

So, no harm done yet.  Then I remove fred from the group wahoo.  And I end up with this:

    dn: cn=wahoo,cn=groups,cn=accounts,dc=example,dc=com
    memberUid: fred

    dn: cn=wahoo,cn=groups,cn=compat,dc=example,dc=com
    memberUid: fred

Now, anything pointing to my compat tree, still thinks fred is in the wahoo group.

The solution is removing the memberUids from the cn=groups,cn=accounts,dc=example,dc=com tree, and the compat tree automatically reflects that change.

Question:
Is this a bug or did I do something wrong on the import?


Thanks,
Scott

PS- If someone else runs into this, I hope I saved you time.