dweller dweller via FreeIPA-users wrote:
Hi, Rob.
> What does happen will depend on what version of IPA/389-ds-base you have
Using these at the moment. If you share some insight I would be greatful.
[root@ipa ~]# rpm -qa | grep -E 'ipa-server|389-ds'
389-ds-base-1.4.3.28-6.module_el8.6.0+1102+fe5d910f.x86_64
ipa-server-4.9.10-6.module_el8.7.0+1209+42bcbcde.x86_64
Ok, seems new enough to include the changes. IIRC it was something about
not running full automember on mods.
We do not recommend mixing releases together though. It looks like you
have a mix of 8.6 and 8.7 packages. Mixing is not tested. In most cases
it's fine but in others...
> memberof can also be an expensive operation
Can you elaborate more on this?
Whenever a membership is changed the whole memberof may be recalculated,
particularly when there is nesting.
We may need to engage someone from the 389-ds team for the automember
hangup. They'll probably want you to get a pstack. You can learn how on
their troubleshooting page.
rob