Hi Thierry, On 6/20/18 6:02 PM, thierry bordaz via FreeIPA-users wrote: > Hi Harald, > > I wonder if error on ipa1 can not be part of the problem > > [20/Jun/2018:12:16:31.885644563 +0200] - ERR - ldbm_back_modrdn - > SLAPI_PLUGIN_BE_TXN_POST_MODRDN_FN plugin returned error but did not set > SLAPI_RESULT_CODE > > The MODRDN failed, that would explain why 'uid=bobs' remained in the index > (and findable via search) > But this does not explain how RDN and entry itself was changed. > > Could you provide the access logs (ipa1) around that time ? >
Sure, see attachment. Hope this helps. Regards Harri
[20/Jun/2018:12:16:26.356458986 +0200] conn=2464249 fd=414 slot=414 connection from 172.19.96.3 to 172.19.96.3 [20/Jun/2018:12:16:26.357829369 +0200] conn=908087 op=1923845 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/[email protected])(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/[email protected])))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:26.358137032 +0200] conn=908087 op=1923845 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.358249074 +0200] conn=908087 op=1923846 SRCH base="cn=ipaConfig,cn=etc,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" [20/Jun/2018:12:16:26.358312855 +0200] conn=908087 op=1923846 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.358646683 +0200] conn=908087 op=1923847 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/[email protected])(krbPrincipalName:caseIgnoreIA5Match:=ldap/[email protected])))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:26.358862079 +0200] conn=908087 op=1923847 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.359061673 +0200] conn=908087 op=1923848 SRCH base="cn=EXAMPLE.DE,cn=kerberos,dc=example,dc=de" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags" [20/Jun/2018:12:16:26.359116353 +0200] conn=908087 op=1923848 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.359258875 +0200] conn=908087 op=1923849 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal))(krbPrincipalName=HTTP/[email protected]))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:26.359444456 +0200] conn=908087 op=1923849 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.359595463 +0200] conn=908087 op=1923850 SRCH base="cn=EXAMPLE.DE,cn=kerberos,dc=example,dc=de" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags" [20/Jun/2018:12:16:26.359640554 +0200] conn=908087 op=1923850 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.359928111 +0200] conn=908087 op=1923851 SRCH base="dc=example,dc=de" scope=2 filter="(&(objectClass=ipaKrb5DelegationACL)(memberPrincipal=HTTP/[email protected]))" attrs="objectClass memberPrincipal" [20/Jun/2018:12:16:26.360105137 +0200] conn=908087 op=1923851 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.360257657 +0200] conn=908087 op=1923852 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal))([email protected]))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:26.360445160 +0200] conn=908087 op=1923852 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.360569067 +0200] conn=908087 op=1923853 SRCH base="cn=EXAMPLE.DE,cn=kerberos,dc=example,dc=de" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags" [20/Jun/2018:12:16:26.360615169 +0200] conn=908087 op=1923853 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.360699619 +0200] conn=908087 op=1923854 SRCH base="uid=admin,cn=users,cn=accounts,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs="objectClass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLogonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" [20/Jun/2018:12:16:26.361367183 +0200] conn=908087 op=1923854 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.362500195 +0200] conn=2464249 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [20/Jun/2018:12:16:26.368240341 +0200] conn=2464249 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=admin,cn=users,cn=accounts,dc=example,dc=de" [20/Jun/2018:12:16:26.369602228 +0200] conn=2464249 op=1 UNBIND [20/Jun/2018:12:16:26.369619841 +0200] conn=2464249 op=1 fd=414 closed - U1 [20/Jun/2018:12:16:26.438676865 +0200] conn=2464250 fd=417 slot=417 connection from 172.19.96.3 to 172.19.96.3 [20/Jun/2018:12:16:26.440061263 +0200] conn=908087 op=1923855 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/[email protected])(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/[email protected])))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:26.440319342 +0200] conn=908087 op=1923855 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.440639152 +0200] conn=908087 op=1923856 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/[email protected])(krbPrincipalName:caseIgnoreIA5Match:=ldap/[email protected])))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:26.440819849 +0200] conn=908087 op=1923856 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.441010049 +0200] conn=908087 op=1923857 SRCH base="cn=EXAMPLE.DE,cn=kerberos,dc=example,dc=de" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags" [20/Jun/2018:12:16:26.441059971 +0200] conn=908087 op=1923857 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.441175974 +0200] conn=908087 op=1923858 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal))(krbPrincipalName=HTTP/[email protected]))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:26.441331352 +0200] conn=908087 op=1923858 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.441651301 +0200] conn=908087 op=1923859 SRCH base="cn=EXAMPLE.DE,cn=kerberos,dc=example,dc=de" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags" [20/Jun/2018:12:16:26.441694874 +0200] conn=908087 op=1923859 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.441818109 +0200] conn=908087 op=1923860 SRCH base="dc=example,dc=de" scope=2 filter="(&(objectClass=ipaKrb5DelegationACL)(memberPrincipal=HTTP/[email protected]))" attrs="objectClass memberPrincipal" [20/Jun/2018:12:16:26.441982021 +0200] conn=908087 op=1923860 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.442091004 +0200] conn=908087 op=1923861 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal))([email protected]))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:26.442279624 +0200] conn=908087 op=1923861 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.442437266 +0200] conn=908087 op=1923862 SRCH base="cn=EXAMPLE.DE,cn=kerberos,dc=example,dc=de" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags" [20/Jun/2018:12:16:26.442482322 +0200] conn=908087 op=1923862 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.442623212 +0200] conn=908087 op=1923863 SRCH base="uid=admin,cn=users,cn=accounts,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs="objectClass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLogonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" [20/Jun/2018:12:16:26.443304181 +0200] conn=908087 op=1923863 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.444420018 +0200] conn=2464250 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [20/Jun/2018:12:16:26.449637703 +0200] conn=2464250 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=admin,cn=users,cn=accounts,dc=example,dc=de" [20/Jun/2018:12:16:26.451161509 +0200] conn=2464250 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs=ALL [20/Jun/2018:12:16:26.451753066 +0200] conn=2464250 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.452751904 +0200] conn=2464250 op=2 SRCH base="uid=bobs,cn=users,cn=accounts,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs="distinguishedName" [20/Jun/2018:12:16:26.452983629 +0200] conn=2464250 op=2 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.453499505 +0200] conn=2464250 op=3 SRCH base="uid=bobs,cn=users,cn=accounts,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs="krbPrincipalName krbCanonicalName" [20/Jun/2018:12:16:26.453742775 +0200] conn=2464250 op=3 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:26.456729268 +0200] conn=2464250 op=4 MODRDN dn="uid=bobs,cn=users,cn=accounts,dc=example,dc=de" newrdn="uid=bobk" newsuperior="(null)" [20/Jun/2018:12:16:28.833898436 +0200] conn=216 op=5499 SRCH base="dc=example,dc=de" scope=2 filter="(&(objectClass=posixAccount)(uid=administrator))" attrs="userPassword cn gidNumber uidNumber loginShell objectClass gecos uid homeDirectory" [20/Jun/2018:12:16:31.719281845 +0200] conn=2464008 op=20 SRCH base="cn=accounts,dc=example,dc=de" scope=2 filter="(&(uid=vgeorgiev)(objectClass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))" attrs="objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn memberOf ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdattribute authorizedService accountexpires useraccountcontrol nsAccountLock host logindisabled loginexpirationtime loginallowedtimemap ipaSshPubKey ipaUserAuthType usercertificate;binary mail" [20/Jun/2018:12:16:31.890728641 +0200] conn=216 op=5499 RESULT err=0 tag=101 nentries=0 etime=3 [20/Jun/2018:12:16:31.890761679 +0200] conn=2464250 op=4 RESULT err=1 tag=109 nentries=0 etime=5 csn=5b2a297c000900040000 [20/Jun/2018:12:16:31.891412040 +0200] conn=2464008 op=20 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:31.892091985 +0200] conn=2464250 op=5 UNBIND [20/Jun/2018:12:16:31.892112732 +0200] conn=2464250 op=5 fd=417 closed - U1 [20/Jun/2018:12:16:31.892791148 +0200] conn=2464008 op=21 SRCH base="cn=ipausers,cn=groups,cn=accounts,dc=example,dc=de" scope=0 filter="(&(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*))" attrs="objectClass posixgroup cn userPassword gidNumber member ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn ipaExternalMember" [20/Jun/2018:12:16:31.893278927 +0200] conn=2464008 op=21 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:31.893973054 +0200] conn=2464008 op=22 SRCH base="cn=projects,cn=groups,cn=accounts,dc=example,dc=de" scope=0 filter="(&(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*))" attrs="objectClass posixgroup cn userPassword gidNumber member ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn ipaExternalMember" [20/Jun/2018:12:16:31.894248601 +0200] conn=2464008 op=22 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:31.894808057 +0200] conn=2464008 op=23 SRCH base="cn=kundenprojekte_nvo,cn=groups,cn=accounts,dc=example,dc=de" scope=0 filter="(&(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*))" attrs="objectClass posixgroup cn userPassword gidNumber member ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn ipaExternalMember" [20/Jun/2018:12:16:31.895015375 +0200] conn=2464008 op=23 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:31.895907539 +0200] conn=2464008 op=24 SRCH base="cn=develop,cn=groups,cn=accounts,dc=example,dc=de" scope=0 filter="(&(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*))" attrs="objectClass posixgroup cn userPassword gidNumber member ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn ipaExternalMember" [20/Jun/2018:12:16:31.896291359 +0200] conn=908087 op=1923864 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal))([email protected]))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:31.896353933 +0200] conn=2464008 op=24 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:31.896438316 +0200] conn=908087 op=1923864 RESULT err=0 tag=101 nentries=0 etime=0 [20/Jun/2018:12:16:31.896871602 +0200] conn=2464008 op=25 SRCH base="cn=confluence-users,cn=groups,cn=accounts,dc=example,dc=de" scope=0 filter="(&(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*))" attrs="objectClass posixgroup cn userPassword gidNumber member ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn ipaExternalMember" [20/Jun/2018:12:16:31.897144916 +0200] conn=2464008 op=25 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:31.897693275 +0200] conn=2464008 op=26 SRCH base="cn=invdev,cn=groups,cn=accounts,dc=example,dc=de" scope=0 filter="(&(|(objectClass=ipaUserGroup)(objectClass=posixGroup))(cn=*))" attrs="objectClass posixgroup cn userPassword gidNumber member ipaUniqueID ipaNTSecurityIdentifier modifyTimestamp entryusn ipaExternalMember" [20/Jun/2018:12:16:31.897951970 +0200] conn=2464008 op=26 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:31.900190551 +0200] conn=2464008 op=27 SRCH base="cn=Default Trust View,cn=views,cn=accounts,dc=example,dc=de" scope=2 filter="(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:IPA:example.de:6d586cb4-ad70-11e5-abe8-0016cc46e69a))" attrs=ALL [20/Jun/2018:12:16:31.900373663 +0200] conn=2464008 op=27 RESULT err=0 tag=101 nentries=0 etime=0 [20/Jun/2018:12:16:33.066966199 +0200] conn=2462274 op=2673 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Jun/2018:12:16:33.068361968 +0200] conn=2462274 op=2673 RESULT err=0 tag=120 nentries=0 etime=0 [20/Jun/2018:12:16:33.071570364 +0200] conn=2462274 op=2674 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Jun/2018:12:16:33.085632650 +0200] conn=2462274 op=2674 RESULT err=0 tag=120 nentries=0 etime=0 [20/Jun/2018:12:16:33.125891282 +0200] conn=2462274 op=2675 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Jun/2018:12:16:33.126314006 +0200] conn=2462274 op=2675 RESULT err=0 tag=120 nentries=0 etime=0 [20/Jun/2018:12:16:33.128191785 +0200] conn=2462274 op=2676 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Jun/2018:12:16:33.131023841 +0200] conn=2462274 op=2676 RESULT err=0 tag=120 nentries=0 etime=0 [20/Jun/2018:12:16:37.003813054 +0200] conn=2463933 op=45 UNBIND [20/Jun/2018:12:16:37.003881833 +0200] conn=2463933 op=45 fd=80 closed - U1 [20/Jun/2018:12:16:38.002019739 +0200] conn=2464251 fd=80 slot=80 connection from 172.19.96.68 to 172.19.96.3 [20/Jun/2018:12:16:38.002662792 +0200] conn=2464251 op=0 BIND dn="" method=128 version=3 [20/Jun/2018:12:16:38.003164531 +0200] conn=2464251 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [20/Jun/2018:12:16:38.003596091 +0200] conn=2464251 op=1 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedSASLMechanisms vendorName vendorVersion objectClass isglobalcatalogready" [20/Jun/2018:12:16:38.010615593 +0200] conn=2464251 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:38.010979678 +0200] conn=2464251 op=2 UNBIND [20/Jun/2018:12:16:38.011022193 +0200] conn=2464251 op=2 fd=80 closed - U1 [20/Jun/2018:12:16:40.036071275 +0200] conn=2462274 op=2677 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Jun/2018:12:16:40.036441224 +0200] conn=2462274 op=2677 RESULT err=0 tag=120 nentries=0 etime=0 [20/Jun/2018:12:16:40.038488929 +0200] conn=2462274 op=2678 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Jun/2018:12:16:40.042708550 +0200] conn=2462274 op=2678 RESULT err=0 tag=120 nentries=0 etime=0 [20/Jun/2018:12:16:40.067336421 +0200] conn=2462274 op=2679 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [20/Jun/2018:12:16:40.067649433 +0200] conn=2462274 op=2679 RESULT err=0 tag=120 nentries=0 etime=0 [20/Jun/2018:12:16:40.069757088 +0200] conn=2462274 op=2680 EXT oid="2.16.840.1.113730.3.5.5" name="replication-multimaster-extop" [20/Jun/2018:12:16:40.076449349 +0200] conn=2462274 op=2680 RESULT err=0 tag=120 nentries=0 etime=0 [20/Jun/2018:12:16:40.624535790 +0200] conn=2464252 fd=80 slot=80 connection from 172.19.96.3 to 172.19.96.3 [20/Jun/2018:12:16:40.625875188 +0200] conn=908083 op=2297321 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/[email protected])(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/[email protected])))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:40.626151847 +0200] conn=908083 op=2297321 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.626298613 +0200] conn=908083 op=2297322 SRCH base="cn=ipaConfig,cn=etc,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs="ipaConfigString ipaKrbAuthzData ipaUserAuthType" [20/Jun/2018:12:16:40.626360396 +0200] conn=908083 op=2297322 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.626672304 +0200] conn=908083 op=2297323 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/[email protected])(krbPrincipalName:caseIgnoreIA5Match:=ldap/[email protected])))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:40.626885414 +0200] conn=908083 op=2297323 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.627045166 +0200] conn=908083 op=2297324 SRCH base="cn=EXAMPLE.DE,cn=kerberos,dc=example,dc=de" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags" [20/Jun/2018:12:16:40.627093712 +0200] conn=908083 op=2297324 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.627224372 +0200] conn=908083 op=2297325 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal))(krbPrincipalName=HTTP/[email protected]))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:40.627389079 +0200] conn=908083 op=2297325 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.627592658 +0200] conn=908083 op=2297326 SRCH base="cn=EXAMPLE.DE,cn=kerberos,dc=example,dc=de" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags" [20/Jun/2018:12:16:40.627635182 +0200] conn=908083 op=2297326 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.627812765 +0200] conn=908083 op=2297327 SRCH base="dc=example,dc=de" scope=2 filter="(&(objectClass=ipaKrb5DelegationACL)(memberPrincipal=HTTP/[email protected]))" attrs="objectClass memberPrincipal" [20/Jun/2018:12:16:40.627998036 +0200] conn=908083 op=2297327 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.628175487 +0200] conn=908083 op=2297328 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal))([email protected]))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:40.628359516 +0200] conn=908083 op=2297328 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.628507845 +0200] conn=908083 op=2297329 SRCH base="cn=EXAMPLE.DE,cn=kerberos,dc=example,dc=de" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags" [20/Jun/2018:12:16:40.628549662 +0200] conn=908083 op=2297329 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.628665873 +0200] conn=908083 op=2297330 SRCH base="uid=admin,cn=users,cn=accounts,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs="objectClass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLogonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" [20/Jun/2018:12:16:40.629326481 +0200] conn=908083 op=2297330 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.630490495 +0200] conn=2464252 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [20/Jun/2018:12:16:40.644571566 +0200] conn=2464252 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=admin,cn=users,cn=accounts,dc=example,dc=de" [20/Jun/2018:12:16:40.645976406 +0200] conn=2464252 op=1 UNBIND [20/Jun/2018:12:16:40.645994144 +0200] conn=2464252 op=1 fd=80 closed - U1 [20/Jun/2018:12:16:40.762076682 +0200] conn=2464253 fd=414 slot=414 connection from 172.19.96.3 to 172.19.96.3 [20/Jun/2018:12:16:40.763349389 +0200] conn=908083 op=2297331 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbtgt/[email protected])(krbPrincipalName:caseIgnoreIA5Match:=krbtgt/[email protected])))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:40.763667265 +0200] conn=908083 op=2297331 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.763966530 +0200] conn=908083 op=2297332 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=ldap/[email protected])(krbPrincipalName:caseIgnoreIA5Match:=ldap/[email protected])))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:40.764151114 +0200] conn=908083 op=2297332 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.764310731 +0200] conn=908083 op=2297333 SRCH base="cn=EXAMPLE.DE,cn=kerberos,dc=example,dc=de" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags" [20/Jun/2018:12:16:40.764362103 +0200] conn=908083 op=2297333 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.764439759 +0200] conn=908083 op=2297334 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal))(krbPrincipalName=HTTP/[email protected]))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:40.764603213 +0200] conn=908083 op=2297334 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.764825901 +0200] conn=908083 op=2297335 SRCH base="cn=EXAMPLE.DE,cn=kerberos,dc=example,dc=de" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags" [20/Jun/2018:12:16:40.764879744 +0200] conn=908083 op=2297335 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.765002482 +0200] conn=908083 op=2297336 SRCH base="dc=example,dc=de" scope=2 filter="(&(objectClass=ipaKrb5DelegationACL)(memberPrincipal=HTTP/[email protected]))" attrs="objectClass memberPrincipal" [20/Jun/2018:12:16:40.765177170 +0200] conn=908083 op=2297336 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.765351814 +0200] conn=908083 op=2297337 SRCH base="dc=example,dc=de" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal))([email protected]))" attrs="krbPrincipalName krbCanonicalName krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbPrincipalAuthInd krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [20/Jun/2018:12:16:40.765518851 +0200] conn=908083 op=2297337 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.765709862 +0200] conn=908083 op=2297338 SRCH base="cn=EXAMPLE.DE,cn=kerberos,dc=example,dc=de" scope=0 filter="(objectClass=krbticketpolicyaux)" attrs="krbMaxTicketLife krbMaxRenewableAge krbTicketFlags" [20/Jun/2018:12:16:40.765759478 +0200] conn=908083 op=2297338 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.765888129 +0200] conn=908083 op=2297339 SRCH base="uid=admin,cn=users,cn=accounts,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs="objectClass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLogonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" [20/Jun/2018:12:16:40.766553583 +0200] conn=908083 op=2297339 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.767753302 +0200] conn=2464253 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO [20/Jun/2018:12:16:40.780767489 +0200] conn=2464253 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=admin,cn=users,cn=accounts,dc=example,dc=de" [20/Jun/2018:12:16:40.782614143 +0200] conn=2464253 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs=ALL [20/Jun/2018:12:16:40.783398529 +0200] conn=2464253 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [20/Jun/2018:12:16:40.784434358 +0200] conn=2464253 op=2 SRCH base="uid=bobs,cn=users,cn=accounts,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs="distinguishedName" [20/Jun/2018:12:16:40.784694413 +0200] conn=2464253 op=2 RESULT err=0 tag=101 nentries=0 etime=0 [20/Jun/2018:12:16:40.785202795 +0200] conn=2464253 op=3 SRCH base="uid=bobs,cn=deleted users,cn=accounts,cn=provisioning,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs="distinguishedName" [20/Jun/2018:12:16:40.785401299 +0200] conn=2464253 op=3 RESULT err=32 tag=101 nentries=0 etime=0 [20/Jun/2018:12:16:40.785884313 +0200] conn=2464253 op=4 SRCH base="uid=bobs,cn=users,cn=accounts,dc=example,dc=de" scope=0 filter="(objectClass=*)" attrs="krbPrincipalName krbCanonicalName" [20/Jun/2018:12:16:40.786113390 +0200] conn=2464253 op=4 RESULT err=0 tag=101 nentries=0 etime=0 [20/Jun/2018:12:16:40.786765978 +0200] conn=2464253 op=5 UNBIND [20/Jun/2018:12:16:40.786788848 +0200] conn=2464253 op=5 fd=414 closed - U1 [20/Jun/2018:12:16:41.222421508 +0200] conn=7241 op=13464 SRCH base="dc=example,dc=de" scope=2 filter="(&(objectClass=posixAccount)(uid=administrator))" attrs="userPassword cn gidNumber uidNumber loginShell objectClass gecos uid homeDirectory" [20/Jun/2018:12:16:41.223604465 +0200] conn=7241 op=13464 RESULT err=0 tag=101 nentries=0 etime=0
_______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected]/message/YLZOPMZKWXV5CYJCI4C3XJDUAHHFRHFI/
