freeipa

#7593 Replication races in DogtagInstance.setup_admin
Closed: fixed Opened by cheimes.

Closed: fixed
Reopen Issue

DogtagInstance.setup_admin and related methods have multiple LDAP replication race conditions. The bugs can cause parallel ipa-replica-install to fail. The issue typically manifests itself as:

com.netscape.certsrv.base.PKIException: Failed to obtain installation token from security domain: com.netscape.certsrv.base.UnauthorizedException: User admin-replica1.ipa.example is not a member of Enterprise CA Administrators group.

_add_admin_to_group

The _add_admin_to_group method https://pagure.io/freeipa/blob/84ae625fe2c3786f7c5430f23a55c171ff54e110/f/ipaserver/install/dogtaginstance.py#_397-407 uses an LDAP search + MOD_REPLACE to add the host admin to the admin group. This is subject to race conditions. In case an other thread, process, or replica modifies the group between read and mod, the previous modification is lost. The method must use MOD_ADD to add the user to the group.

setup_admin

The setup_admin waits until the new admin user has been replicated to the replication source. But that is not sufficient. Since the admin is first created and then appended to the groups, the method must wait until the group membership addition have been replicated, too.

https://pagure.io/freeipa/blob/84ae625fe2c3786f7c5430f23a55c171ff54e110/f/ipaserver/install/dogtaginstance.py#_439-444

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/2051

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1594141

Issue linked to bug 1594141

master:

  • 14c869b347e488e40544ee1e6c4b35341124c76c Improve and fix timeout bug in wait_for_entry()
  • 1b966f708aa33c07f68fc30daaf6e4800a6b4a53 Use common replication wait timeout of 5min
  • ad838c37a9ca2d1c5a2e0becf73ddacb004b3ab6 Fix replication races in Dogtag admin code

ipa-4-6:

  • 735763769855ef01cf34f355a57f35e058d91479 Improve and fix timeout bug in wait_for_entry()
  • 39889882a7b0e5a3dc10208455728e9a678af606 Use common replication wait timeout of 5min
  • 763951c7fd29a8032778b41018cf15d07a88c43b Fix replication races in Dogtag admin code

ipa-4-5:

  • 7e9648736185734fc39752df875321558f4464e4 Improve and fix timeout bug in wait_for_entry()
  • d129cb2ab70f658e4b07e1fbb7f16905c66895e9 Use common replication wait timeout of 5min
  • b763b62069040f3efafc65197063a84411bd4d10 Fix replication races in Dogtag admin code

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 52cdd213b4320ef463c4d0053b436511e3f53709 Catch ACIError instead of invalid credentials

ipa-4-6:

  • d0dd00fd42351c93783294e6bf2613a2f76c2aaa Catch ACIError instead of invalid credentials
Metadata
None
None
None
Lowest
https://github.com/freeipa/freeipa/pull/2051
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.