freeipa

#9954 ipa-migrate doesn't properly handle replication conflicts
Closed: fixed by frenaud. Opened by kororland.

Closed: fixed
Reopen Issue

What were you trying to do that didn't work?

if migration data contains replication conflicts, ipa-migrate tries to still add them to the deployment we are migrating to, but fails with 389ds error

What is the impact of this issue to you?

inproper tool behavior

Please provide the package NVR for which the bug is seen:

ipa-server-4.12.2-24.el10_1.1.x86_64

How reproducible is this bug?:

always

Steps to reproduce

  • get replication conflict
  • export data
  • try to import with ipa-migrate

Expected results

conflict entries are handled by the ipa-migrate and skipped

Actual results

ipa-migrate tries to add them and fails:

Failed to add "idnsname=23.3.10.in-addr.arpa.+nsuniqueid=0acc7201-b02311f0-95b88e22-54950682,cn=dns,$suffix" error: Invalid DN syntax: illegal attribute in RDN

copy of https://issues.redhat.com/browse/RHEL-153857

PR: https://github.com/freeipa/freeipa/pull/8226

master:

  • f02500cb5992ff354def8dac6df8ce8c821fc76a ipa-migrate: ignore replication conflicts

ipa-4-12:

  • 088c0f4a69ba35eb202ce7157468c6ed0b7d9b38 ipa-migrate: ignore replication conflicts

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://redhat.atlassian.net/browse/RHEL-153857

ipa-4-13:

  • 5b9c650c56a44a30e97ccbbbfa4003e40dbed2a4 ipa-migrate: ignore replication conflicts

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

The patch introduced a regression in test_integration/test_ipa_ipa_migration.py::TestIPAMigratewithBackupRestore::test_ipa_migrate_stage_mode, re-opening.

Test logs (internal url): https://$ARTIFACTS_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-latest-testing-repo-selinux/master/2026-03-18_17-10/latest-testing-repo-selinux/test_IPAMigrate_backuprestore/2/report.html?sort=result

Metadata Update from @frenaud:
- Issue status updated to: Open (was: Closed)

New PR: https://github.com/freeipa/freeipa/pull/8263

master:

  • 123b4ca6ecc4cf26d2152011293815cc23a08c7b ipa-migrate: normalize objectClass before building the list

ipa-4-12:

  • addacfd2a0843c825fa0d5406457271665fc0561 ipa-migrate: normalize objectClass before building the list

ipa-4-13:

  • 5965b3c ipa-migrate: normalize objectClass before building the list

@frenaud please review and close the issue if it is ready now.

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.