On 04/29/2015 05:35 PM, Andy Thompson wrote:
-----Original Message-----
From: Ludwig Krispenz [mailto:lkris...@redhat.com]
Sent: Wednesday, April 29, 2015 11:28 AM
To: Andy Thompson
Cc: thierry bordaz; Martin Kosek; freeipa-users@redhat.com
Subject: Re: [Freeipa-users] deleting ipa user


On 04/29/2015 05:08 PM, Andy Thompson wrote:
-----Original Message-----
From: Ludwig Krispenz [mailto:lkris...@redhat.com]
Sent: Wednesday, April 29, 2015 10:59 AM
To: Andy Thompson
Cc: thierry bordaz; Martin Kosek; freeipa-users@redhat.com
Subject: Re: [Freeipa-users] deleting ipa user


On 04/29/2015 04:49 PM, Andy Thompson wrote:
-----Original Message-----
From: Ludwig Krispenz [mailto:lkris...@redhat.com]
Sent: Wednesday, April 29, 2015 10:51 AM
To: Andy Thompson
Cc: thierry bordaz; Martin Kosek; freeipa-users@redhat.com
Subject: Re: [Freeipa-users] deleting ipa user

did you run the searches as directory manager ?

Yep sure did
that's weird, as directory manager you should be able to see the
nscpentrywsi attribute, could you paste your full search request ?
This returns the object

ldapsearch -LLL -o ldif-wrap=no -H ldap://mdhixnpipa02 -x -D
"cn=directory manager" -W  -b "dc=..."
"(&(objectclass=nstombstone)(nsuniqueid=7e1a1f87-e82611e4-99f1b343-
f0a
bc1a8))"  | grep -i objectClass

This returns nothing

ldapsearch -LLL -o ldif-wrap=no -H ldap://mdhixnpipa02 -x -D
"cn=directory manager" -W  -b "dc=..."
"(&(objectclass=nstombstone)(nsuniqueid=7e1a1f87-e82611e4-99f1b343-
f0a
bc1a8))"  nscpentrywsi | grep -i objectClass
and if you omit the grep ? still puzzled.
Ah if I omit the grep on the second server I get

dn: 
nsuniqueid=7e1a1f87-e82611e4-99f1b343-f0abc1a8,cn=username,cn=groups,cn=accounts,dc=mhbenp,dc=lin
nscpentrywsi: dn: 
nsuniqueid=7e1a1f87-e82611e4-99f1b343-f0abc1a8,cn=username,cn=groups,cn=accounts,dc=mhbenp,dc=lin
nscpentrywsi: objectClass;vucsn-55364a42000500040000: posixgroup
nscpentrywsi: objectClass;vucsn-55364a42000500040000: ipaobject
nscpentrywsi: objectClass;vucsn-55364a42000500040000: mepManagedEntry
nscpentrywsi: objectClass;vucsn-55364a42000500040000: top
nscpentrywsi: objectClass;vucsn-5540deb8000300030000: nsTombstone
nscpentrywsi: cn;vucsn-55364a42000500040000;mdcsn-55364a42000500040000: gfeigh
nscpentrywsi: gidNumber;vucsn-55364a42000500040000: 1249000003
nscpentrywsi: description;vucsn-55364a42000500040000: User private group for 
username
nscpentrywsi: mepManagedBy;vucsn-55364a42000500040000: uid= 
username,cn=users,cn=accounts,dc=mhbenp,dc=lin
nscpentrywsi: creatorsName;vucsn-55364a42000500040000: cn=Managed 
Entries,cn=plugins,cn=config
nscpentrywsi: modifiersName;vucsn-55364a42000500040000: cn=Managed 
Entries,cn=plugins,cn=config
nscpentrywsi: createTimestamp;vucsn-55364a42000500040000: 20150421130152Z
nscpentrywsi: modifyTimestamp;vucsn-55364a42000500040000: 20150421130152Z
nscpentrywsi: nsUniqueId: 7e1a1f87-e82611e4-99f1b343-f0abc1a8
nscpentrywsi: ipaUniqueID;vucsn-55364a42000500040000: 
94dc1638-e826-11e4-878a-005056a92af3
nscpentrywsi: parentid: 4
nscpentrywsi: entryid: 385
nscpentrywsi: nsParentUniqueId: 3763f193-e76411e4-99f1b343-f0abc1a8
nscpentrywsi: nstombstonecsn: 5540deb8000300030000
nscpentrywsi: nscpEntryDN: cn=username,cn=groups,cn=accounts,dc=mhbenp,dc=lin
nscpentrywsi: entryusn: 52327

thought I tried that before, apparently not.
ok, so we have the entry on one server, the csn of the objectclass: tombstone is :

objectClass;vucsn-5540deb8000300030000: nsTombstone

, which matches the csn in the error log:

Consumer failed to replay change (uniqueid 7e1a1f87-e82611e4-99f1b343-f0abc1a8, 
CSN 5540deb8000300030000): Operations error (1)
so the state of the entry is as expected.

Now we nend to find it on the other server. If the search for the & filter with 
nstombstone does return nothing, could you try
-  a plain search (nsuniqueid=7e1a1f87-e82611e4-99f1b343-f0abc1a8) (also with 
nscpentrywsi)
or if this doesn't return anything:
- (objectclass=nstombstone) and grep for your <username>



what is logged in the access log for these two searches?

On 04/29/2015 04:34 PM, Andy Thompson wrote:
-----Original Message-----
From: Ludwig Krispenz [mailto:lkris...@redhat.com]
Sent: Wednesday, April 29, 2015 10:28 AM
To: Andy Thompson
Cc: thierry bordaz; Martin Kosek; freeipa-users@redhat.com
Subject: Re: [Freeipa-users] deleting ipa user

can you do the followin search on both servers ?

      ldapsearch -LLL -o ldif-wrap=no -h xxx p xxx  -x -D
"cn=directory manager" - w xxx  -b "dc=xxx...."
"(&(objectclass=nstombstone)(nsuniqueid=7e1a1f87-e82611e4-
99f1b343-
f0abc1a8))"
nscpentrywsi | grep -i objectClass
The server that I initially attempted the deletion on returns nothing.
The second server (the one currently throwing the consumer failed
replay error)  returns this if I remove the nscpentrywsi attribute
filter.  If I leave the attribute filter I don't get anything

objectClass: posixgroup
objectClass: ipaobject
objectClass: mepManagedEntry
objectClass: top
objectClass: nsTombstone

-andy

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to