Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at
Bug 1159816 - ignoring user attributes in migrate-ds does not work if uppercase characters are returned by ldap
Summary: ignoring user attributes in migrate-ds does not work if uppercase characters ...
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.1
Hardware: x86_64
OS: Linux
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Namita Soman
Depends On: 1150040
TreeView+ depends on / blocked
Reported: 2014-11-03 12:18 UTC by Martin Kosek
Modified: 2015-03-05 10:14 UTC (History)
11 users (show)

Fixed In Version: ipa-4.1.0-8.el7
Doc Type: Bug Fix
Doc Text:
Clone Of: 1150040
Last Closed: 2015-03-05 10:14:19 UTC
Target Upstream Version:

Attachments (Terms of Use)
steps with console output (5.38 KB, text/plain)
2015-01-13 13:21 UTC, Kaleem
no flags Details

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:0442 0 normal SHIPPED_LIVE Moderate: ipa security, bug fix, and enhancement update 2015-03-05 14:50:39 UTC

Description Martin Kosek 2014-11-03 12:18:51 UTC
+++ This bug was initially created as a clone of Bug #1150040 +++

Description of problem:
I tried to migrate a openldap based directory to FreeIPA, while removing several objectclasses. --user-ignore-attribute didn't work.

The Problem seems to be, that the LDAPEntry Object entry_attry in isn't lowercased while the blacklist is force to lower case by the script.

the problem can be resolved by replacing
        if attr in attr_blacklist:
        if attr.lower() in attr_blacklist:

Version-Release number of selected component (if applicable): 4.0.3 on Fedora 20

How reproducible: use migrate-ds with --user-ignore-attribute

Steps to Reproduce:

Actual results:

Failed user:
  xxx: attribute "shadowLastChange" not allowed
  xxx: attribute "shadowLastChange" not allowed

Expected results:
user is migrated

Additional info:

--- Additional comment from Martin Kosek on 2014-10-07 06:59:28 EDT ---

Thanks for the bug report! I will clone it to upstream Trac. The change looks OK, would you consider sending it in form of a patch to freeipa-devel list? This way, your contribute could be recognized in FreeIPA git repository!

--- Additional comment from Martin Kosek on 2014-10-07 06:59:57 EDT ---

Upstream ticket:

Comment 3 Kaleem 2015-01-12 08:38:54 UTC
How to verify this?

Comment 4 Martin Kosek 2015-01-12 12:20:28 UTC
As noted in the description, you would need to setup Directory Server which returns attributes with mixed case (like OpenLDAP) and try to run migrate-ds and blacklist some mixed-case attribute.

Jan, do you know about an easier change with 389 DS how to reproduce this issue?

Comment 5 Jan Cholasta 2015-01-12 12:29:21 UTC
Maybe install IPA A, look for mixed-case attribute names in "ipa user-find --all --raw" output, run migrate-ds on IPA B from IPA A and blacklist some of the mixed-case attributes. Or you can add some custom user schema to IPA A and set a mixed-case attribute on a user before migrating.

Comment 6 Kaleem 2015-01-13 13:21:38 UTC
Created attachment 979619 [details]
steps with console output


[root@vm-idm-004 ~]# rpm -q ipa-server
[root@vm-idm-004 ~]# 

Please find the attached verification steps along with console output.

Comment 8 errata-xmlrpc 2015-03-05 10:14:19 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

Note You need to log in before you can comment on or make changes to this bug.