On 04/29/2015 02:43 PM, Andy Thompson wrote:
-----Original Message-----
From: Martin Kosek [mailto:mko...@redhat.com]
Sent: Wednesday, April 29, 2015 8:31 AM
To: Andy Thompson; freeipa-users@redhat.com; Ludwig Krispenz; Thierry
Bordaz
Subject: Re: [Freeipa-users] deleting ipa user

On 04/29/2015 01:26 PM, Andy Thompson wrote:
I'm trying to delete an IPA account and I get a generic "operations error"
when trying to remove it.  It looks like something is messed up with the
group object.  The user doesn't show up in the ipausers group and there also
isn't a group object for the user in question.  Here is the error from the
attempt.
[29/Apr/2015:07:21:32 -0400] referint-plugin - _update_all_per_mod:
entry cn=ipausers,cn=groups,cn=accounts,dc=domain,dc=com: deleting
"member: uid=<username>,cn=users,cn=accounts,dc=domain,dc=com"
failed
(16)
[29/Apr/2015:07:21:32 -0400] referint-plugin - _update_all_per_mod:
entry
ipaUniqueID=3897c894-e764-11e4-b05b-
005056a92af3,cn=hbac,dc=domain,dc=
com: deleting "memberUser:
uid=<username>,cn=users,cn=accounts,dc=domain,dc=com" failed (16)
[29/Apr/2015:07:21:32 -0400] ldbm_back_delete - conn=0 op=0 Turning a
tombstone into a tombstone!
"nsuniqueid=7e1a1f87-e82611e4-99f1b343-
f0abc1a8,cn=<username>,cn=group
s,cn=accounts,dc=domain,dc=com"; e: 0x7fcc84226070, cache_state: 0x0,
refcnt: 1
[29/Apr/2015:07:21:32 -0400] managed-entries-plugin - mep_del_post_op:
failed to delete managed entry
(cn=<username>,cn=groups,cn=accounts,dc=domain,dc=com) - error (1)
[29/Apr/2015:07:21:32 -0400] ldbm_back_delete - conn=0 op=0 Turning a
tombstone into a tombstone!
"nsuniqueid=7e1a1f87-e82611e4-99f1b343-
f0abc1a8,cn=<username>,cn=group
s,cn=accounts,dc=domain,dc=com"; e: 0x7fcc84226070, cache_state: 0x0,
refcnt: 1
[29/Apr/2015:07:21:32 -0400] managed-entries-plugin - mep_del_post_op:
failed to delete managed entry
(cn=<username>,cn=groups,cn=accounts,dc=domain,dc=com) - error (1)
This is the first time I see this error. CCing Ludwig or Thierry to advise.

Andy, please also include FreeIPA and 389-ds-base packages versions so that
Thierry and Ludwig know what to look at.

Here you go

ipa-server-4.1.0-18.el7_1.3.x86_64
389-ds-base-1.3.3.1-15.el7_1.x86_64

Thanks much

-andy


Hello,

I wonder it is not a similar issue I hit https://fedorahosted.org/389/ticket/48165. What differs is '_update_all_per_mod' logs but could be a consequence of the same bug.
I have a non systematic test case for 48165.
Is it happening systematically in your case ?

thanks
thierry
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to