Update FreeIPA 4.8.6 on PI 4

[Dirk Streubel]

Hello everybody,

i am using a PI4 with Fedora 32 Beta and the latest Packages of IPA.

Everything is working fine, but after an update this Afternoon my IPA
Server would not start any more.

I updated following packages: 389-ds-base-1.4.3.4-1.fc32.aarch64 and
389-ds-base-libs-1.4.3.4-1.fc32.aarch64

The following error message i get:

[root@pifour ~]# systemctl status [e-mail]
● [e-mail] - 389 Directory Server XXX.
     Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled;
vendor preset: disabled)
    Drop-In: /usr/lib/systemd/system/dirsrv@.service.d
             └─custom.conf
             /etc/systemd/system/[e-mail].d
             └─ipa-env.conf
     Active: failed (Result: exit-code) since Thu 2020-04-02 21:50:43
CEST; 21min ago
    Process: 6894
ExecStartPre=/usr/libexec/dirsrv/ds_systemd_ask_password_acl
/etc/dirsrv/slapd-XXX/dse.ldif (code=exited, status=0/SUCCESS)
    Process: 6899 ExecStart=/usr/sbin/ns-slapd -D /etc/dirsrv/slapd-XXX
-i /run/dirsrv/slapd-XXX.pid (code=exited, status=1/FAILURE)
   Main PID: 6899 (code=exited, status=1/FAILURE)
        CPU: 433ms

Apr 02 21:50:42 pifour.linux.schnell.er systemd[1]: Starting 389
Directory Server XXX....
Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]:
[02/Apr/2020:21:50:43.097278875 +0200] - ERR - dse_read_one_file - The
entry cn=schema in file /etc/dirsrv/slapd-XXX/schema/15rfc2307bis.ldif
(lineno: 1) is invalid, error code 20 (Type or value exists) - attribute
type nisDomain: Does not match the OID "1.3.6.1.4.1.1.1.1.12". Another
attribute type is already using the name or OID.
Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]:
[02/Apr/2020:21:50:43.113521126 +0200] - ERR - setup_internal_backends -
Please edit the file to correct the reported problems and then restart
the server.
Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: [e-mail]:
Main process exited, code=exited, status=1/FAILURE
Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: [e-mail]:
Failed with result 'exit-code'.
Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: Failed to start 389
Directory Server XXX..
[root@pifour ~]#

Hope, somebody can help me, maybe a bug in the new packages?

Regards

Dirk

[Rob Crittenden]

Dirk Streubel via FreeIPA-users wrote:
> Hello everybody,
>
> i am using a PI4 with Fedora 32 Beta and the latest Packages of IPA.
>
> Everything is working fine, but after an update this Afternoon my IPA
> Server would not start any more.
>
> I updated following packages: 389-ds-base-1.4.3.4-1.fc32.aarch64 and
> 389-ds-base-libs-1.4.3.4-1.fc32.aarch64
>
> The following error message i get:
>
> [root@pifour ~]# systemctl status [e-mail]
> ● [e-mail] - 389 Directory Server XXX.
>      Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled;
> vendor preset: disabled)
>     Drop-In: /usr/lib/systemd/system/dirsrv@.service.d
>              └─custom.conf
>              /etc/systemd/system/[e-mail].d
>              └─ipa-env.conf
>      Active: failed (Result: exit-code) since Thu 2020-04-02 21:50:43
> CEST; 21min ago
>     Process: 6894
> ExecStartPre=/usr/libexec/dirsrv/ds_systemd_ask_password_acl
> /etc/dirsrv/slapd-XXX/dse.ldif (code=exited, status=0/SUCCESS)
>     Process: 6899 ExecStart=/usr/sbin/ns-slapd -D /etc/dirsrv/slapd-XXX
> -i /run/dirsrv/slapd-XXX.pid (code=exited, status=1/FAILURE)
>    Main PID: 6899 (code=exited, status=1/FAILURE)
>         CPU: 433ms
>
> Apr 02 21:50:42 pifour.linux.schnell.er systemd[1]: Starting 389
> Directory Server XXX....
> Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]:
> [02/Apr/2020:21:50:43.097278875 +0200] - ERR - dse_read_one_file - The
> entry cn=schema in file /etc/dirsrv/slapd-XXX/schema/15rfc2307bis.ldif
> (lineno: 1) is invalid, error code 20 (Type or value exists) - attribute
> type nisDomain: Does not match the OID "1.3.6.1.4.1.1.1.1.12". Another
> attribute type is already using the name or OID.
> Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]:
> [02/Apr/2020:21:50:43.113521126 +0200] - ERR - setup_internal_backends -
> Please edit the file to correct the reported problems and then restart
> the server.
> Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: [e-mail]:
> Main process exited, code=exited, status=1/FAILURE
> Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: [e-mail]:
> Failed with result 'exit-code'.
> Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: Failed to start 389
> Directory Server XXX..
> [root@pifour ~]#
>
> Hope, somebody can help me, maybe a bug in the new packages?

Yes, 389-ds redid their 2307 schema which created a conflict with the
one that IPA provides. Try downgrading 389-ds-base for now.

rob

[Dirk Streubel]

Hello Rob

Am 02.04.20 um 22:34 schrieb Rob Crittenden:
> Dirk Streubel via FreeIPA-users wrote:
> > Hello everybody,
> >
> > i am using a PI4 with Fedora 32 Beta and the latest Packages of IPA.
> >
> > Everything is working fine, but after an update this Afternoon my IPA
> > Server would not start any more.
> >
> > I updated following packages: 389-ds-base-1.4.3.4-1.fc32.aarch64 and
> > 389-ds-base-libs-1.4.3.4-1.fc32.aarch64
> >
> > The following error message i get:
> >
> > [root@pifour ~]# systemctl status [e-mail]
> > ● [e-mail] - 389 Directory Server XXX.
> >      Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled;
> > vendor preset: disabled)
> >     Drop-In: /usr/lib/systemd/system/dirsrv@.service.d
> >              └─custom.conf
> >              /etc/systemd/system/[e-mail].d
> >              └─ipa-env.conf
> >      Active: failed (Result: exit-code) since Thu 2020-04-02 21:50:43
> > CEST; 21min ago
> >     Process: 6894
> > ExecStartPre=/usr/libexec/dirsrv/ds_systemd_ask_password_acl
> > /etc/dirsrv/slapd-XXX/dse.ldif (code=exited, status=0/SUCCESS)
> >     Process: 6899 ExecStart=/usr/sbin/ns-slapd -D /etc/dirsrv/slapd-XXX
> > -i /run/dirsrv/slapd-XXX.pid (code=exited, status=1/FAILURE)
> >    Main PID: 6899 (code=exited, status=1/FAILURE)
> >         CPU: 433ms
> >
> > Apr 02 21:50:42 pifour.linux.schnell.er systemd[1]: Starting 389
> > Directory Server XXX....
> > Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]:
> > [02/Apr/2020:21:50:43.097278875 +0200] - ERR - dse_read_one_file - The
> > entry cn=schema in file /etc/dirsrv/slapd-XXX/schema/15rfc2307bis.ldif
> > (lineno: 1) is invalid, error code 20 (Type or value exists) - attribute
> > type nisDomain: Does not match the OID "1.3.6.1.4.1.1.1.1.12". Another
> > attribute type is already using the name or OID.
> > Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]:
> > [02/Apr/2020:21:50:43.113521126 +0200] - ERR - setup_internal_backends -
> > Please edit the file to correct the reported problems and then restart
> > the server.
> > Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: [e-mail]:
> > Main process exited, code=exited, status=1/FAILURE
> > Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: [e-mail]:
> > Failed with result 'exit-code'.
> > Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: Failed to start 389
> > Directory Server XXX..
> > [root@pifour ~]#
> >
> > Hope, somebody can help me, maybe a bug in the new packages?
>
> Yes, 389-ds redid their 2307 schema which created a conflict with the
> one that IPA provides. Try downgrading 389-ds-base for now.
>
> rob

thanks a lot for your quick answer :) New Packages in sight?

dirk

[Rob Crittenden]

Dirk Streubel wrote:
> Hello Rob
>
> Am 02.04.20 um 22:34 schrieb Rob Crittenden:
> > Dirk Streubel via FreeIPA-users wrote:
> > > Hello everybody,
> > >
> > > i am using a PI4 with Fedora 32 Beta and the latest Packages of IPA.
> > >
> > > Everything is working fine, but after an update this Afternoon my IPA
> > > Server would not start any more.
> > >
> > > I updated following packages: 389-ds-base-1.4.3.4-1.fc32.aarch64 and
> > > 389-ds-base-libs-1.4.3.4-1.fc32.aarch64
> > >
> > > The following error message i get:
> > >
> > > [root@pifour ~]# systemctl status [e-mail]
> > > ● [e-mail] - 389 Directory Server XXX.
> > >      Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled;
> > > vendor preset: disabled)
> > >     Drop-In: /usr/lib/systemd/system/dirsrv@.service.d
> > >              └─custom.conf
> > >              /etc/systemd/system/[e-mail].d
> > >              └─ipa-env.conf
> > >      Active: failed (Result: exit-code) since Thu 2020-04-02 21:50:43
> > > CEST; 21min ago
> > >     Process: 6894
> > > ExecStartPre=/usr/libexec/dirsrv/ds_systemd_ask_password_acl
> > > /etc/dirsrv/slapd-XXX/dse.ldif (code=exited, status=0/SUCCESS)
> > >     Process: 6899 ExecStart=/usr/sbin/ns-slapd -D /etc/dirsrv/slapd-XXX
> > > -i /run/dirsrv/slapd-XXX.pid (code=exited, status=1/FAILURE)
> > >    Main PID: 6899 (code=exited, status=1/FAILURE)
> > >         CPU: 433ms
> > >
> > > Apr 02 21:50:42 pifour.linux.schnell.er systemd[1]: Starting 389
> > > Directory Server XXX....
> > > Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]:
> > > [02/Apr/2020:21:50:43.097278875 +0200] - ERR - dse_read_one_file - The
> > > entry cn=schema in file /etc/dirsrv/slapd-XXX/schema/15rfc2307bis.ldif
> > > (lineno: 1) is invalid, error code 20 (Type or value exists) - attribute
> > > type nisDomain: Does not match the OID "1.3.6.1.4.1.1.1.1.12". Another
> > > attribute type is already using the name or OID.
> > > Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]:
> > > [02/Apr/2020:21:50:43.113521126 +0200] - ERR - setup_internal_backends -
> > > Please edit the file to correct the reported problems and then restart
> > > the server.
> > > Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: [e-mail]:
> > > Main process exited, code=exited, status=1/FAILURE
> > > Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: [e-mail]:
> > > Failed with result 'exit-code'.
> > > Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: Failed to start 389
> > > Directory Server XXX..
> > > [root@pifour ~]#
> > >
> > > Hope, somebody can help me, maybe a bug in the new packages?
> >
> > Yes, 389-ds redid their 2307 schema which created a conflict with the
> > one that IPA provides. Try downgrading 389-ds-base for now.
> >
> > rob
>
> thanks a lot for your quick answer :) New Packages in sight?

We need to coordinate a fix and new pkgs with the 389-ds team. Probably
won't take long. The update has been blocked in Fedora so it shouldn't
hit stable.

rob

[Dirk Streubel]

Am 02.04.20 um 22:58 schrieb Rob Crittenden via FreeIPA-users:
> Dirk Streubel wrote:
> > Hello Rob
> >
> > Am 02.04.20 um 22:34 schrieb Rob Crittenden:
> > > Dirk Streubel via FreeIPA-users wrote:
> > > > Hello everybody,
> > > >
> > > > i am using a PI4 with Fedora 32 Beta and the latest Packages of IPA.
> > > >
> > > > Everything is working fine, but after an update this Afternoon my IPA
> > > > Server would not start any more.
> > > >
> > > > I updated following packages: 389-ds-base-1.4.3.4-1.fc32.aarch64 and
> > > > 389-ds-base-libs-1.4.3.4-1.fc32.aarch64
> > > >
> > > > The following error message i get:
> > > >
> > > > [root@pifour ~]# systemctl status [e-mail]
> > > > ● [e-mail] - 389 Directory Server XXX.
> > > >      Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled;
> > > > vendor preset: disabled)
> > > >     Drop-In: /usr/lib/systemd/system/dirsrv@.service.d
> > > >              └─custom.conf
> > > >              /etc/systemd/system/[e-mail].d
> > > >              └─ipa-env.conf
> > > >      Active: failed (Result: exit-code) since Thu 2020-04-02 21:50:43
> > > > CEST; 21min ago
> > > >     Process: 6894
> > > > ExecStartPre=/usr/libexec/dirsrv/ds_systemd_ask_password_acl
> > > > /etc/dirsrv/slapd-XXX/dse.ldif (code=exited, status=0/SUCCESS)
> > > >     Process: 6899 ExecStart=/usr/sbin/ns-slapd -D /etc/dirsrv/slapd-XXX
> > > > -i /run/dirsrv/slapd-XXX.pid (code=exited, status=1/FAILURE)
> > > >    Main PID: 6899 (code=exited, status=1/FAILURE)
> > > >         CPU: 433ms
> > > >
> > > > Apr 02 21:50:42 pifour.linux.schnell.er systemd[1]: Starting 389
> > > > Directory Server XXX....
> > > > Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]:
> > > > [02/Apr/2020:21:50:43.097278875 +0200] - ERR - dse_read_one_file - The
> > > > entry cn=schema in file /etc/dirsrv/slapd-XXX/schema/15rfc2307bis.ldif
> > > > (lineno: 1) is invalid, error code 20 (Type or value exists) - attribute
> > > > type nisDomain: Does not match the OID "1.3.6.1.4.1.1.1.1.12". Another
> > > > attribute type is already using the name or OID.
> > > > Apr 02 21:50:43 pifour.linux.schnell.er ns-slapd[6899]:
> > > > [02/Apr/2020:21:50:43.113521126 +0200] - ERR - setup_internal_backends -
> > > > Please edit the file to correct the reported problems and then restart
> > > > the server.
> > > > Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: [e-mail]:
> > > > Main process exited, code=exited, status=1/FAILURE
> > > > Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: [e-mail]:
> > > > Failed with result 'exit-code'.
> > > > Apr 02 21:50:43 pifour.linux.schnell.er systemd[1]: Failed to start 389
> > > > Directory Server XXX..
> > > > [root@pifour ~]#
> > > >
> > > > Hope, somebody can help me, maybe a bug in the new packages?
> > >
> > > Yes, 389-ds redid their 2307 schema which created a conflict with the
> > > one that IPA provides. Try downgrading 389-ds-base for now.
> > >
> > > rob

after downgrading everything is now working fine, thanks a lot for your
Help rob

Dirk