Description of problem:
there is an error with attribute value already exists while doing:
ipa host-mod --auth-ind=otp <host>
We have enabled "fail audit log" and we had the exact operation that is failing
and that is being attempted by the command line:
=======================================================
time: 20170412101350
dn: fqdn=rhtest2.ncsd.corp,cn=computers,cn=accounts,dc=ipa,dc=example,dc=test
result: 20
changetype: modify
add: objectClass
objectClass: krbprincipalaux
-
replace: krbPrincipalAuthInd
krbPrincipalAuthInd: otp
-
replace: modifiersname
modifiersname: uid=extsyto,cn=users,cn=accounts,dc=ipa,dc=example,dc=test
-
replace: modifytimestamp
modifytimestamp: 20170412071350Z
-
replace: entryusn
entryusn: 453907
-
=======================================================
It's quite evident that error 20 is because of
==============================
add: objectClass
objectClass: krbprincipalaux
==============================
that already exists in the entry.
I have tried to reproduce it on my side but I had not the same modify
operation:
=================================================
time: 20170412043112
dn: fqdn=newhost.cgparente.local,cn=computers,cn=accounts,dc=cgparente,dc=local
result: 0
changetype: modify
replace: krbPrincipalAuthInd
krbPrincipalAuthInd: otp
-
replace: modifiersname
modifiersname: uid=admin,cn=users,cn=accounts,dc=cgparente,dc=local
-
replace: modifytimestamp
modifytimestamp: 20170412083112Z
-
replace: entryusn
entryusn: 39407
-
===================================================
For a certain reason, something provoked the objectclass add that drove to the
err=20 in customer environment.
Customer is running same version than me.
Version-Release number of selected component (if applicable):
ipa-server-4.4.0-14.el7_3.6.x86_64
How reproducible: only customer.
Steps to Reproduce: just add the otp indicator to a host.