#48948 RFE: Allow a mepManagedEntry to be removed if other side of link doesn't exist
Opened 4 years ago by rcritten. Modified 3 years ago

I don't have a reproducer to get into a state where the dependent side of a mepManagedEntry doesn't exist but we've seen it in the wild a few times. I suspect it may be related to replication issues where only one half of the pair gets replicated.

In any case, it would be handy to be able to delete that managed entry if its other end doesn't exist. There is a workaround using ldapmodify to remove the managed attributes but it isn't very user-friendly.

Using ldapmodify I was able to pretty easily artificially get an entry into this state using 389-ds-base-

Thank you for the proposal, Rob! How urgent is it? Is 1.3.6 acceptable for you?

It has only come up in IPA a few times so it isn't super hot. If you can fit it into 1.3.6 that would be great.

The way to reproduce manually in IPA is to:

  • Do a default install which will enable user-private groups
  • Add a user which will create a group of the same name, managed by the user
  • Detach the group from the user using ipa group-detach username
  • Delete the user
  • Use ldapmodify to add mepManagedEntry to the group objectclass and set mepManagedBy to the DN of the user. So now we have only half of the management in place.
  • Try to delete the group, you'll get: ipa: ERROR: Deleting a managed group is not allowed. It must be detached first.

Note I don't think you even need to delete the user because the user now lacks the managed entries attributes, so I assume some search is happening today.

Thanks for your input, Rob!
There should not be a problem to set the target to 1.3.6.
We are going to decide it in tomorrow's triage. ;)

Metadata Update from @nhosoi:
- Issue set to the milestone:

3 years ago

Metadata Update from @firstyear:
- Issue assigned to firstyear

3 years ago

Metadata Update from @firstyear:
- Issue close_status updated to: None
- Issue tagged with: Complex, RFE

3 years ago

Metadata Update from @mreynolds:
- Issue set to the milestone: 1.4 backlog (was:

3 years ago

Login to comment on this ticket.