freeipa

#8193 Re-order 50-externalmembers.update to be after 80-schema_compat.update
Closed: fixed by cheimes. Opened by abbra.

Closed: fixed
Reopen Issue

There are two parts here.

  1. ipaExternalGroup is only handled for trust to AD configurations. The compat tree configuration for that is only set up when you run ipa-adtrust-install --enable-compat on the specific master (turning the master into a trust controller). When you have no external group members configured for some external groups (this is a concept in IPA, 'ipa group-add --external' and 'ipa group-add-member --external'), and these groups aren't included into some POSIX groups, you should not see any of AD groups pulled in.

  2. Second part is actual addition of the 'objectclass: ipaExternalGroup' into the entries under cn=groups,cn=compat,$BASEDN. This happens after /usr/share/ipa/updates/50-externalmembers.update file is automatically imported on IPA upgrade. The file content is:

$ cat install/updates/50-externalmembers.update
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
addifexist: schema-compat-entry-attribute: ipaexternalmember=%deref_r("member","ipaexternalmember")
addifexist: schema-compat-entry-attribute: objectclass=ipaexternalgroup

The upgrade should happen during replica deployment as one of last steps before enabling optional services. You can see that in the replica installation log with 'Applying LDAP updates'. But I think there might be an ordering discrepancy because the base compat tree configuration is in install/updates/80-schema_compat.update so it is ran after 50-externalmembers.update. And since at that point cn=groups,cn=Schema ... does not exist yet, it is not applied.

Metadata Update from @abbra:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1801791
- Issue assigned to abbra
- Issue set to the milestone: FreeIPA 4.6

PR: https://github.com/freeipa/freeipa/pull/4229

master:

  • ff547a2777d63609faba42101e9802f5e988fa00 install/updates: move external members past schema compat update

ipa-4-8:

  • 14dbf04148c6284b176eca34aa70df4bef09b857 install/updates: move external members past schema compat update

ipa-4-7:

  • 9db61a51f4cfcaae5e51d10c9ce2ed751cce4c49 install/updates: move external members past schema compat update

ipa-4-6:

  • a5a201fc008b19841f98bb70d44ede7d04ef1126 install/updates: move external members past schema compat update

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 9120d65e881e582cc37ee8445fb66a54f6fb4d75 Test if schema-compat-entry-attribute is set
  • 312d00df90fc40c1c4c934945c3c73053b6ea18a Test if schema-compat-entry-attribute is set

Failed to apply patches onto origin/ipa-4-6. Manual backport is needed.

Metadata Update from @cheimes:
- Issue status updated to: Open (was: Closed)

ipa-4-8:

  • 210619a98f0d8a042a181bab5891bdd595aa5351 Test if schema-compat-entry-attribute is set
  • 3f3fa403a944035cf5531939fe3a2e338da99612 Test if schema-compat-entry-attribute is set

ipa-4-6:

  • e6960b7af2e8d8e4746245d8ba82a46225174529 Test if schema-compat-entry-attribute is set
  • b739bc2089774cea0437347283c821ac86f8251d Test if schema-compat-entry-attribute is set

ipa-4-7:

  • 405363baa62c7a2e875aae516abc8080031094f2 Test if schema-compat-entry-attribute is set
  • 651d97a47d1f60875648ae72c2c0e6fe6ffabe04 Test if schema-compat-entry-attribute is set

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.