sudoers tree missing on a 389-ds replica

[Sergei Gerasenko]

Hello,

I’ve run into an interesting situatuion with the sudoers tree in 389-ds. All the nodes in
the 389-ds cluster have it, but one doesn’t. I’ve tried dumping the database on a good
node with db2ldif and reloading on the bad node with ldif2db, but the situation is not
changing. I’ve also tried db2index on the bad node without much luck.

Any ideas?

Thanks,
  Sergei

[Mark Reynolds]

On 9/23/19 11:15 AM, Sergei Gerasenko wrote:
>  Hello,
>
>  I’ve run into an interesting situatuion with the sudoers tree in 389-ds. All the nodes in
> the 389-ds cluster have it, but one doesn’t. I’ve tried dumping the database on a good
> node with db2ldif and reloading on the bad node with ldif2db, but the situation is not
> changing. I’ve also tried db2index on the bad node without much luck. 
What is the sudoers suffix?

If you search for it using ldapsearch and bind as "cn=directory manager" 
does it show up?

What does the access log show when the search "fails".

Is the exported LDIF file empty?

What does the errors log show for the import of the LDIF?

How many entries were processed and imported?

>  Any ideas?
>
>  Thanks,
>     Sergei
>  _______________________________________________
>  389-users mailing list -- 389-users(a)lists.fedoraproject.org
>  To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]... 
-- 

389 Directory Server Development Team

[Sergei Gerasenko]

Looking closer, I see that the sudorules,dc=DC,dc=DC is there, but the combat tree
(ou=sudoers,dc=DC,dc=DC) is not. Do you maintain the compat plugin?

>  On Sep 23, 2019, at 10:15 AM, Sergei Gerasenko
> <gerases(a)gmail.com&gt; wrote:
>  
>  Hello,
>  
>  I’ve run into an interesting situatuion with the sudoers tree in 389-ds. All the nodes in
> the 389-ds cluster have it, but one doesn’t. I’ve tried dumping the database on a good
> node with db2ldif and reloading on the bad node with ldif2db, but the situation is not
> changing. I’ve also tried db2index on the bad node without much luck.
>  
>  Any ideas?
>  
>  Thanks,
>   Sergei

[Rob Crittenden]

Sergei Gerasenko wrote:
>  Looking closer, I see that the sudorules,dc=DC,dc=DC is there, but
> the combat tree (ou=sudoers,dc=DC,dc=DC) is not. Do you maintain the compat plugin?
The freeIPA team maintains the slapi-compat plugin. I gather you aren't
using this in the context of freeIPA?

rob

>  
> > On Sep 23, 2019, at 10:15 AM, Sergei Gerasenko <gerases(a)gmail.com&gt; wrote:
> >
> > Hello,
> >
> > I’ve run into an interesting situatuion with the sudoers tree in 389-ds. All the
> nodes in the 389-ds cluster have it, but one doesn’t. I’ve tried dumping the database on a
> good node with db2ldif and reloading on the bad node with ldif2db, but the situation is
> not changing. I’ve also tried db2index on the bad node without much luck.
> >
> > Any ideas?
> >
> > Thanks,
> >  Sergei
>  _______________________________________________
>  389-users mailing list -- 389-users(a)lists.fedoraproject.org
>  To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]...
>

[Sergei Gerasenko]

The compat plugin was disabled. After enabling, issue was fixed. Hope it helps somebody.

>  On Sep 23, 2019, at 12:12 PM, Sergei Gerasenko
> <gerases(a)gmail.com&gt; wrote:
>  
>  Looking closer, I see that the sudorules,dc=DC,dc=DC is there, but the combat tree
> (ou=sudoers,dc=DC,dc=DC) is not. Do you maintain the compat plugin?
>  
> > On Sep 23, 2019, at 10:15 AM, Sergei Gerasenko <gerases(a)gmail.com&gt; wrote:
> > 
> > Hello,
> > 
> > I’ve run into an interesting situatuion with the sudoers tree in 389-ds. All the
> nodes in the 389-ds cluster have it, but one doesn’t. I’ve tried dumping the database on a
> good node with db2ldif and reloading on the bad node with ldif2db, but the situation is
> not changing. I’ve also tried db2index on the bad node without much luck.
> > 
> > Any ideas?
> > 
> > Thanks,
> > Sergei
>