saltstack / saltstack/salt

Ldap.managed plugin is unable to modify/replace cn=config olcSyncRepl Attribute

Open
#54,444 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug severity-medium
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description of Issue

The ldap.managed plugin is unable to modify the olcSyncRepl attribute when it already exists in the cn=config database. Note this error only occurs after the initial run as the plugin is attempting to update an existing attribute. I can also verify that the directive is set to 'replace'

Setup
 - 'olcDatabase={0}config,cn=config':
      - replace:
          olcSyncRepl
            - 'rid=001 provider=ldap://ldap_poc1.xxxx.xxxx binddn="cn=config" 
              bindmethod=simple credentials=x searchbase="cn=config" 
              type=refreshAndPersist retry="5 5 300 5" timeout=1'
            - 'rid=002 provider=ldap://ldap_poc2.xxxx.xxxxx binddn="cn=config" 
              bindmethod=simple credentials=x searchbase="cn=config" 
              type=refreshAndPersist retry="5 5 300 5" timeout=1'
            - 'rid=003 provider=ldap://ldap_poc3.xxx.xxxx binddn="cn=config" 
              bindmethod=simple credentials=x searchbase="cn=config" 
              type=refreshAndPersist retry="5 5 300 5" timeout=1'
          olcMirrorMode: 'TRUE
Steps to Reproduce Issue

Error occurs on the second pass, would be relevant to a update operation

[root@dev-master ~]# salt dev-minion-01 state.apply openldap
dev-minion-01:
----------
          ID: openldap_entries
    Function: ldap.managed
      Result: False
     Comment: failed to modify entry olcDatabase={0}config,cn=config(exception in ldap backend: TYPE_OR_VALUE_EXISTS({'info': 'modify/add: olcSyncrepl: value #0 already exists', 'desc': 'Type or value exists'},)), modify entry olcDatabase={2}hdb,cn=config(exception in ldap backend: TYPE_OR_VALUE_EXISTS({'info': 'modify/add: olcSyncrepl: value #0 already exists', 'desc': 'Type or value exists'},))
     Started: 21:31:00.411394
    Duration: 28.915 ms
     Changes:   
Versions Report

Salt Version:
Salt: 2019.2.0

Dependency Versions:
cffi: Not Installed
cherrypy: Not Installed
dateutil: Not Installed
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
ioflo: Not Installed
Jinja2: 2.7.2
libgit2: Not Installed
libnacl: Not Installed
M2Crypto: Not Installed
Mako: Not Installed
msgpack-pure: Not Installed
msgpack-python: 0.5.6
mysql-python: Not Installed
pycparser: Not Installed
pycrypto: 2.6.1
pycryptodome: Not Installed
pygit2: Not Installed
Python: 2.7.5 (default, Oct 30 2018, 23:45:53)
python-gnupg: Not Installed
PyYAML: 3.11
PyZMQ: 15.3.0
RAET: Not Installed
smmap: Not Installed
timelib: Not Installed
Tornado: 4.2.1
ZMQ: 4.1.4

System Versions:
dist: centos 7.6.1810 Core
locale: UTF-8
machine: x86_64
release: 3.10.0-957.5.1.el7.x86_64
system: Linux
version: CentOS Linux 7.6.1810 Core

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the ldap.managed plugin and reproduce the issue by running salt dev-minion-01 state.apply openldap twice using the provided cn=config and olcSyncRepl setup. Trace the second-pass update for the replace directive; done means an existing olcSyncRepl attribute can be updated without the TYPE_OR_VALUE_EXISTS error.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.