AccountPolicy erroring for some users

[LUCAS GUILHERME DIEDRICH]

Hey,

Since i updated to the lastest Freeipa version (IPA, version: 4.10.1), i started noticing some error in the 389 error.log.

[11/Jul/2023:13:50:20.591388308 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet'
[11/Jul/2023:13:51:52.993254666 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710114037Z) failed.
[11/Jul/2023:13:51:52.995079255 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710114037Z) failed.
[11/Jul/2023:13:51:53.014918310 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet'
[11/Jul/2023:13:52:12.898523693 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165203Z) failed.
[11/Jul/2023:13:52:12.901073197 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165203Z) failed.
[11/Jul/2023:13:52:12.914936792 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet'
[11/Jul/2023:13:52:21.897598474 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165144Z) failed.
[11/Jul/2023:13:52:21.899560503 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165144Z) failed.
[11/Jul/2023:13:52:21.913459796 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet'
[11/Jul/2023:13:52:42.939623733 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710221057Z) failed.
[11/Jul/2023:13:52:42.942050331 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710221057Z) failed.
[11/Jul/2023:13:52:42.955004117 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'fqdn=hostname.unila.intranet,cn=computers,cn=accounts,dc=unila,dc=intranet'

I'm not sure why this is happening and how can i fix this, unfortunetly i'm using the account_plugin to update the last auth date via LDAP, but the field lastLoginHistory seems to be something added in the lastest releases.

I have 3 replicas, but the account_plugin is enabled only in the machines which is currently erroring.

Any ideas how to fix this?

Thanks.

[Rob Crittenden]

LUCAS GUILHERME DIEDRICH via FreeIPA-users wrote:
> Hey,
>
> Since i updated to the lastest Freeipa version (IPA, version: 4.10.1), i started noticing some error in the 389 error.log.
>
> [11/Jul/2023:13:50:20.591388308 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet'
> [11/Jul/2023:13:51:52.993254666 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710114037Z) failed.
> [11/Jul/2023:13:51:52.995079255 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710114037Z) failed.
> [11/Jul/2023:13:51:53.014918310 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet'
> [11/Jul/2023:13:52:12.898523693 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165203Z) failed.
> [11/Jul/2023:13:52:12.901073197 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165203Z) failed.
> [11/Jul/2023:13:52:12.914936792 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet'
> [11/Jul/2023:13:52:21.897598474 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165144Z) failed.
> [11/Jul/2023:13:52:21.899560503 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165144Z) failed.
> [11/Jul/2023:13:52:21.913459796 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet'
> [11/Jul/2023:13:52:42.939623733 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710221057Z) failed.
> [11/Jul/2023:13:52:42.942050331 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710221057Z) failed.
> [11/Jul/2023:13:52:42.955004117 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'fqdn=hostname.unila.intranet,cn=computers,cn=accounts,dc=unila,dc=intranet'
>
> I'm not sure why this is happening and how can i fix this, unfortunetly i'm using the account_plugin to update the last auth date via LDAP, but the field lastLoginHistory seems to be something added in the lastest releases.
>
> I have 3 replicas, but the account_plugin is enabled only in the machines which is currently erroring.
>
> Any ideas how to fix this?

I'm not familiar with this plugin. Where did it come from?

rob

[Mark Reynolds]

On 7/11/23 12:56 PM, LUCAS GUILHERME DIEDRICH via FreeIPA-users wrote:
> Hey,
>
> Since i updated to the lastest Freeipa version (IPA, version: 4.10.1), i started noticing some error in the 389 error.log.
>
> [11/Jul/2023:13:50:20.591388308 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet'
> [11/Jul/2023:13:51:52.993254666 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710114037Z) failed.
> [11/Jul/2023:13:51:52.995079255 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710114037Z) failed.
> [11/Jul/2023:13:51:53.014918310 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet'
> [11/Jul/2023:13:52:12.898523693 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165203Z) failed.
> [11/Jul/2023:13:52:12.901073197 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165203Z) failed.
> [11/Jul/2023:13:52:12.914936792 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet'
> [11/Jul/2023:13:52:21.897598474 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165144Z) failed.
> [11/Jul/2023:13:52:21.899560503 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165144Z) failed.
> [11/Jul/2023:13:52:21.913459796 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet'
> [11/Jul/2023:13:52:42.939623733 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710221057Z) failed.
> [11/Jul/2023:13:52:42.942050331 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710221057Z) failed.
> [11/Jul/2023:13:52:42.955004117 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'fqdn=hostname.unila.intranet,cn=computers,cn=accounts,dc=unila,dc=intranet'
>
> I'm not sure why this is happening and how can i fix this, unfortunetly i'm using the account_plugin to update the last auth date via LDAP, but the field lastLoginHistory seems to be something added in the lastest releases.

This is a new feature feature just added upstream.   Please file a 
ticket for DS:

https://github.com/389ds/389-ds-base/issues/new

Thanks,
Mark
> I have 3 replicas, but the account_plugin is enabled only in the machines which is currently erroring.
>
> Any ideas how to fix this?
>
> Thanks.
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Lucas Diedrich]

Hey Marc, thanks for sending the link, opened a ticket here:
https://github.com/389ds/389-ds-base/issues/5834

Thanks.

Em ter., 11 de jul. de 2023 às 15:37, Mark Reynolds 
escreveu:
> On 7/11/23 12:56 PM, LUCAS GUILHERME DIEDRICH via FreeIPA-users wrote:
> > Hey,
> >
> > Since i updated to the lastest Freeipa version (IPA, version: 4.10.1), i
>
> started noticing some error in the 389 error.log.
> > [11/Jul/2023:13:50:20.591388308 -0300] - ERR - acct_update_login_history
> Modify error 20 on entry
>
> 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet'
> > [11/Jul/2023:13:51:52.993254666 -0300] - ERR - attrlist_replace -
>
> attr_replace (lastLoginHistory, 20230710114037Z) failed.
> > [11/Jul/2023:13:51:52.995079255 -0300] - ERR - attrlist_replace -
>
> attr_replace (lastLoginHistory, 20230710114037Z) failed.
> > [11/Jul/2023:13:51:53.014918310 -0300] - ERR - acct_update_login_history
> Modify error 20 on entry
>
> 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet'
> > [11/Jul/2023:13:52:12.898523693 -0300] - ERR - attrlist_replace -
>
> attr_replace (lastLoginHistory, 20230711165203Z) failed.
> > [11/Jul/2023:13:52:12.901073197 -0300] - ERR - attrlist_replace -
>
> attr_replace (lastLoginHistory, 20230711165203Z) failed.
> > [11/Jul/2023:13:52:12.914936792 -0300] - ERR - acct_update_login_history
> Modify error 20 on entry
>
> 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet'
> > [11/Jul/2023:13:52:21.897598474 -0300] - ERR - attrlist_replace -
>
> attr_replace (lastLoginHistory, 20230711165144Z) failed.
> > [11/Jul/2023:13:52:21.899560503 -0300] - ERR - attrlist_replace -
>
> attr_replace (lastLoginHistory, 20230711165144Z) failed.
> > [11/Jul/2023:13:52:21.913459796 -0300] - ERR - acct_update_login_history
> Modify error 20 on entry
>
> 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet'
> > [11/Jul/2023:13:52:42.939623733 -0300] - ERR - attrlist_replace -
>
> attr_replace (lastLoginHistory, 20230710221057Z) failed.
> > [11/Jul/2023:13:52:42.942050331 -0300] - ERR - attrlist_replace -
>
> attr_replace (lastLoginHistory, 20230710221057Z) failed.
> > [11/Jul/2023:13:52:42.955004117 -0300] - ERR - acct_update_login_history
> Modify error 20 on entry
>
> 'fqdn=hostname.unila.intranet,cn=computers,cn=accounts,dc=unila,dc=intranet'
> > I'm not sure why this is happening and how can i fix this, unfortunetly
>
> i'm using the account_plugin to update the last auth date via LDAP, but the
> field lastLoginHistory seems to be something added in the lastest releases.
>
> This is a new feature feature just added upstream.   Please file a
> ticket for DS:
>
> https://github.com/389ds/389-ds-base/issues/new
>
> Thanks,
> Mark
> > I have 3 replicas, but the account_plugin is enabled only in the
>
> machines which is currently erroring.
> > Any ideas how to fix this?
> >
> > Thanks.
> > _______________________________________________
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to
>
> [e-mail]
> > Fedora Code of Conduct:
>
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
>
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam, report it:
>
> https://pagure.io/fedora-infrastructure/new_issue
>
> --
> Directory Server Development Team

[Mark Reynolds]

Hi Lukas,

It's being worked on right now.

Thanks,

Mark :-)

On 7/12/23 7:38 AM, Lucas Diedrich via FreeIPA-users wrote:
> Hey Marc, thanks for sending the link, opened a ticket here: 
> https://github.com/389ds/389-ds-base/issues/5834
>
> Thanks.
>
> Em ter., 11 de jul. de 2023 às 15:37, Mark Reynolds 
>  escreveu:
> On 7/11/23 12:56 PM, LUCAS GUILHERME DIEDRICH via FreeIPA-users wrote:
> > Hey,
> >
> > Since i updated to the lastest Freeipa version (IPA, version:
> 4.10.1), i started noticing some error in the 389 error.log.
> >
> > [11/Jul/2023:13:50:20.591388308 -0300] - ERR -
> acct_update_login_history - Modify error 20 on entry
> 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet'
> > [11/Jul/2023:13:51:52.993254666 -0300] - ERR - attrlist_replace
> - attr_replace (lastLoginHistory, 20230710114037Z) failed.
> > [11/Jul/2023:13:51:52.995079255 -0300] - ERR - attrlist_replace
> - attr_replace (lastLoginHistory, 20230710114037Z) failed.
> > [11/Jul/2023:13:51:53.014918310 -0300] - ERR -
> acct_update_login_history - Modify error 20 on entry
> 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet'
> > [11/Jul/2023:13:52:12.898523693 -0300] - ERR - attrlist_replace
> - attr_replace (lastLoginHistory, 20230711165203Z) failed.
> > [11/Jul/2023:13:52:12.901073197 -0300] - ERR - attrlist_replace
> - attr_replace (lastLoginHistory, 20230711165203Z) failed.
> > [11/Jul/2023:13:52:12.914936792 -0300] - ERR -
> acct_update_login_history - Modify error 20 on entry
> 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet'
> > [11/Jul/2023:13:52:21.897598474 -0300] - ERR - attrlist_replace
> - attr_replace (lastLoginHistory, 20230711165144Z) failed.
> > [11/Jul/2023:13:52:21.899560503 -0300] - ERR - attrlist_replace
> - attr_replace (lastLoginHistory, 20230711165144Z) failed.
> > [11/Jul/2023:13:52:21.913459796 -0300] - ERR -
> acct_update_login_history - Modify error 20 on entry
> 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet'
> > [11/Jul/2023:13:52:42.939623733 -0300] - ERR - attrlist_replace
> - attr_replace (lastLoginHistory, 20230710221057Z) failed.
> > [11/Jul/2023:13:52:42.942050331 -0300] - ERR - attrlist_replace
> - attr_replace (lastLoginHistory, 20230710221057Z) failed.
> > [11/Jul/2023:13:52:42.955004117 -0300] - ERR -
> acct_update_login_history - Modify error 20 on entry
> 'fqdn=hostname.unila.intranet,cn=computers,cn=accounts,dc=unila,dc=intranet'
> >
> > I'm not sure why this is happening and how can i fix this,
> unfortunetly i'm using the account_plugin to update the last auth
> date via LDAP, but the field lastLoginHistory seems to be
> something added in the lastest releases.
>
> This is a new feature feature just added upstream.   Please file a
> ticket for DS:
>
> https://github.com/389ds/389-ds-base/issues/new
>
> Thanks,
> Mark
>
> >
> > I have 3 replicas, but the account_plugin is enabled only in the
> machines which is currently erroring.
> >
> > Any ideas how to fix this?
> >
> > Thanks.
> > _______________________________________________
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to
> [e-mail]
> > Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]
> > Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>
> -- 
> Directory Server Development Team
>
>
> FreeIPA-users mailing list [e-mail]
> To unsubscribe send an email [e-mail]
> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it:https://pagure.io/fedora-infrastructure/new_issue