Closed wladich closed 3 years ago
I have modified gcsyncer to log received attributes: line https://github.com/abbra/freeipa/blob/3c20e952a990b5aa83c927dbc261ba3017f3ebc4/ipaserver/globalcatalog/gcsyncer.py#L295 now reads:
logger.debug('Detected %s of entry: %s %s %s', change_type, dn, uuid, attributes)
and for the following steps
# ipa user-add RestartChanges --first Restart --last Changes
# sleep 10
# systemctl restart ipa-gcsyncd.service
got following log:
2020-10-27T17:39:13Z 45802 MainThread ipaserver.globalcatalog.gcsyncer DEBUG Ignoring cookie value
2020-10-27T17:39:13Z 45802 MainThread ipaserver.globalcatalog.gcsyncer DEBUG Detected add of entry: uid=restartchanges,cn=users,cn=accounts,dc=testrelm,dc=test 4bff5201-187b-11eb-84be-f66b251f9b08 {'objectclass': [b'top', b'person', b'organizationalperson', b'inetorgperson', b'inetuser', b'posixaccount', b'krbprincipalaux', b'krbticketpolicyaux', b'ipaobject', b'ipasshuser', b'ipaSshGroupOfPubKeys', b'mepOriginEntry', b'ipantuserattrs'], 'cn': [b'Restart Changes'], 'displayname': [b'Restart Changes'], 'gidnumber': [b'651200044'], 'givenname': [b'Restart'], 'homedirectory': [b'/home/restartchanges'], 'ipantsecurityidentifier': [b'S-1-5-21-2664081731-2469522770-2147907431-1044'], 'ipauniqueid': [b'53ffe442-187b-11eb-8c31-525400168bca'], 'krbcanonicalname': [b'restartchanges@TESTRELM.TEST'], 'krbprincipalname': [b'restartchanges@TESTRELM.TEST'], 'mail': [b'restartchanges@testrelm.test'], 'memberof': [b'cn=ipausers,cn=groups,cn=accounts,dc=testrelm,dc=test'], 'sn': [b'Changes'], 'uid': [b'restartchanges'], 'uidnumber': [b'651200044']}
2020-10-27T17:39:13Z 45802 MainThread ipaserver.globalcatalog.gcsyncer DEBUG user_add uid=restartchanges,cn=users,cn=accounts,dc=testrelm,dc=test
2020-10-27T17:39:13Z 45802 MainThread ipaserver.globalcatalog.gcsyncer DEBUG Adding user to the Global Catalog
dn: CN=Restart Changes,CN=Users,dc=testrelm,dc=test
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: ad-top
objectClass: ad-organizationalPerson
objectClass: user
objectClass: securityPrincipal
objectClass: posixAccount
objectClass: inetUser
objectClass: gcobject
cn: Restart Changes
sn: Changes
givenName: Restart
instanceType: 4
displayName: Restart Changes
name: Restart Changes
objectGUID:: U//kQhh7EeuMMVJUABaLyg==
userAccountControl: 66048
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAAQ6nKnlLtMZNndwaAFAQAAA==
sAMAccountName: restartchanges
sAMAccountType: 805306368
userPrincipalName: restartchanges@TESTRELM.TEST
objectCategory: CN=Person,CN=Schema,CN=Configuration,dc=testrelm,dc=test
mail: restartchanges@testrelm.test
uidnumber: 651200044
gidnumber: 651200044
uid: restartchanges
homeDirectory: /home/restartchanges
memberof: cn=ipausers,cn=users,dc=testrelm,dc=test
nTSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)(OA;;WP;736e4812-af31-11d2-b7df-00805f48caeb;bf967ab8-0de6-11d0-a285-00aa003049e2;CO)(A;;SD;;;CO)
gcuuid: 4bff5201-187b-11eb-84be-f66b251f9b08
2020-10-27T17:39:13Z 45802 MainThread ipaserver.globalcatalog.gcsyncer DEBUG New cookie is: master1.testrelm.test:389#cn=Directory Manager:cn=accounts,dc=testrelm,dc=test:(|(objectClass=groupofnames)(objectClass=person))#663
2020-10-27T17:39:24Z 45802 MainThread ipa-gcsyncd INFO Signal 15 received: Shutting down!
2020-10-27T17:39:24Z 45802 MainThread ipaserver.globalcatalog.gcsyncer DEBUG save cookie
2020-10-27T17:39:24Z 45802 MainThread ipaserver.globalcatalog.gcsyncer DEBUG Current cookie is: master1.testrelm.test:389#cn=Directory Manager:cn=accounts,dc=testrelm,dc=test:(|(objectClass=groupofnames)(objectClass=person))#663
2020-10-27T17:39:25Z 46080 MainThread ipalib.plugable DEBUG importing all plugin modules in ipaserver.plugins...
...
2020-10-27T17:39:25Z 46080 MainThread ipalib.plugable DEBUG importing plugin module ipaserver.plugins.xmlserver
2020-10-27T17:39:26Z 46080 MainThread ipa-gcsyncd DEBUG LDAP URL: ldapi://%2Frun%2Fslapd-TESTRELM-TEST.socket/cn%3Daccounts%2Cdc%3Dtestrelm%2Cdc%3Dtest?objectclass,cn,displayname,gidnumber,givenname,homedirectory,ipaexternalmember,ipantsecurityidentifier,ipauniqueid,krbcanonicalname,krbprincipalname,mail,member,memberof,sn,uid,uidnumber?sub?%28%7C%28objectClass%3Dgroupofnames%29%28objectClass%3Dperson%29%29
2020-10-27T17:39:26Z 46080 MainThread ipapython.ipaldap DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-GLOBAL-CATALOG.socket conn=<ldap.ldapobject.ReconnectLDAPObject object at 0x7f812ac8e1f0>
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer DEBUG get_saved_cookie
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer DEBUG Read cookie master1.testrelm.test:389#cn=Directory Manager:cn=accounts,dc=testrelm,dc=test:(|(objectClass=groupofnames)(objectClass=person))#663
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer DEBUG New cookie is: master1.testrelm.test:389#cn=Directory Manager:cn=accounts,dc=testrelm,dc=test:(|(objectClass=groupofnames)(objectClass=person))#663
2020-10-27T17:39:26Z 46080 MainThread ipa-gcsyncd INFO LDAP bind...
2020-10-27T17:39:26Z 46080 MainThread ipa-gcsyncd INFO Commencing sync process
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer DEBUG Current cookie is: master1.testrelm.test:389#cn=Directory Manager:cn=accounts,dc=testrelm,dc=test:(|(objectClass=groupofnames)(objectClass=person))#663
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer DEBUG Detected modify of entry: uid=restartchanges,cn=users,cn=accounts,dc=testrelm,dc=test 4bff5201-187b-11eb-84be-f66b251f9b08 {'ipantsecurityidentifier': [b'S-1-5-21-2664081731-2469522770-2147907431-1044'], 'memberof': [b'cn=ipausers,cn=groups,cn=accounts,dc=testrelm,dc=test'], 'mepmanagedentry': [b'cn=restartchanges,cn=groups,cn=accounts,dc=testrelm,dc=test'], 'givenname': [b'Restart'], 'sn': [b'Changes'], 'uid': [b'restartchanges'], 'cn': [b'Restart Changes'], 'displayname': [b'Restart Changes'], 'initials': [b'RC'], 'gecos': [b'Restart Changes'], 'krbprincipalname': [b'restartchanges@TESTRELM.TEST'], 'objectclass': [b'top', b'person', b'organizationalperson', b'inetorgperson', b'inetuser', b'posixaccount', b'krbprincipalaux', b'krbticketpolicyaux', b'ipaobject', b'ipasshuser', b'ipaSshGroupOfPubKeys', b'mepOriginEntry', b'ipantuserattrs'], 'loginshell': [b'/bin/sh'], 'homedirectory': [b'/home/restartchanges'], 'mail': [b'restartchanges@testrelm.test'], 'krbcanonicalname': [b'restartchanges@TESTRELM.TEST'], 'ipauniqueid': [b'53ffe442-187b-11eb-8c31-525400168bca'], 'uidnumber': [b'651200044'], 'gidnumber': [b'651200044']}
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer DEBUG user_sync uid=restartchanges,cn=users,cn=accounts,dc=testrelm,dc=test
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer DEBUG Syncing user in the Global Catalog (del+add)
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer DEBUG user_del uid=restartchanges,cn=users,cn=accounts,dc=testrelm,dc=test
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer DEBUG Deleting user from the Global Catalog CN=Restart Changes,CN=Users,dc=testrelm,dc=test
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer DEBUG user_add uid=restartchanges,cn=users,cn=accounts,dc=testrelm,dc=test
2020-10-27T17:39:26Z 46080 MainThread ipapython.ipaldap DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-TESTRELM-TEST.socket conn=<ldap.ldapobject.SimpleLDAPObject object at 0x7f812ac8e0a0>
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer DEBUG Adding user to the Global Catalog
dn: CN=Restart Changes,CN=Users,dc=testrelm,dc=test
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: ad-top
objectClass: ad-organizationalPerson
objectClass: user
objectClass: securityPrincipal
objectClass: posixAccount
objectClass: inetUser
objectClass: gcobject
cn: Restart Changes
sn: Changes
givenName: Restart
instanceType: 4
displayName: Restart Changes
name: Restart Changes
objectGUID:: U//kQhh7EeuMMVJUABaLyg==
userAccountControl: 66048
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAAQ6nKnlLtMZNndwaAFAQAAA==
sAMAccountName: restartchanges
sAMAccountType: 805306368
userPrincipalName: restartchanges@TESTRELM.TEST
objectCategory: CN=Person,CN=Schema,CN=Configuration,dc=testrelm,dc=test
mail: restartchanges@testrelm.test
uidnumber: 651200044
gidnumber: 651200044
uid: restartchanges
homeDirectory: /home/restartchanges
memberof: cn=ipausers,cn=users,dc=testrelm,dc=test
nTSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)(OA;;WP;736e4812-af31-11d2-b7df-00805f48caeb;bf967ab8-0de6-11d0-a285-00aa003049e2;CO)(A;;SD;;;CO)
gcuuid: 4bff5201-187b-11eb-84be-f66b251f9b08
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer DEBUG New cookie is: master1.testrelm.test:389#cn=Directory Manager:cn=accounts,dc=testrelm,dc=test:(|(objectClass=groupofnames)(objectClass=person))#663
2020-10-27T17:39:26Z 46080 MainThread ipaserver.globalcatalog.gcsyncer INFO Initial LDAP dump is done, now synchronizing with GC
When searching with a specific cookie it is possible that sync-repl resend the update that is identified in the cookie. If this is a problem, would you check with DS 1.4.4.6 because it is possilby fixed by https://github.com/389ds/389-ds-base/issues/4329.
The issue affects tests which verify that gcsyncd does not replay the changes when it starts up. Unfortunately I do not know how I could test 389-ds vesrion 1.4.4.6: even F33 has version 1.4.4.5. But for testing I am using F32 as copr repo maintained by @abbra provides packages only for that Fedora. This copr also has custom version of 389-ds-base. @abbra does it contain custom patches or can it be safely replaced with a recent version?
It can be replaced. I'll do that tomorrow
The test is passing with following version:
# dnf info 389-ds-base
Last metadata expiration check: 1:00:56 ago on Wed 02 Dec 2020 10:19:11 AM UTC.
Installed Packages
Name : 389-ds-base
Version : 1.4.4.8
Release : 1.fc32
Architecture : x86_64
Size : 5.8 M
Source : 389-ds-base-1.4.4.8-1.fc32.src.rpm
Repository : @System
From repo : copr:copr.fedorainfracloud.org:abbra:gc-wip
Summary : 389 Directory Server (base)
URL : https://www.port389.org
License : GPLv3+
Description : 389 Directory Server is an LDAPv3 compliant server. The base package includes
: the LDAP server and command line utilities for server administration.
Note: this does not apply to users created before first run of
ipa-adtrust-install
Steps:
log 1:
log 2:
log 3: