fedora-infrastructure

#12668 Can't activate account in IPA
Closed: Will Not/Can Not fix by zlopez. Opened by zlopez.

Closed: Will Not/Can Not fix
Reopen Issue

Describe what you would like us to do:

I was trying to resolve user problem with account activation and got this when trying to activate it manually in IPA web UI Server is unwilling to perform: Managed Entry Plugin rejected add operation (see errors log).

When do you need this to be done by? (YYYY/MM/DD)

This is urgent as the users can't finish account activation.

I can see this in the httpd error_log

ipa: INFO: [jsonserver_session] zlopez@FEDORAPROJECT.ORG: stageuser_activate('freecad', version='2.254'): DatabaseError

And found this in LDAP logs:

[17/Jul/2025:12:37:20.025719950 +0000] - ERR - managed-entries-plugin - mep_add_managed_entry - Unable to add managed entry "cn=freecad,cn=groups,cn=accounts,dc=fedoraproject,dc=org" for origin entry "uid=freecad,cn=users,cn=accounts,dc=fedoraproject,dc=org" (Already exists).
[17/Jul/2025:12:37:20.046741537 +0000] - WARN - flush_hash - Upon BETXN callback failure, entry cache is flushed during 0.018897521
[17/Jul/2025:12:37:20.057966151 +0000] - WARN - flush_hash - Upon BETXN callback failure, entry cache is flushed during 0.010387477
[17/Jul/2025:12:37:20.060203817 +0000] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 128]: Missing target entry.

I checked the active users and no user freecad exists in IPA. So I'm not sure what is happening.

I will try to delete it from stage users and ask the reporter to try it again. It's probably just this one account.

Metadata Update from @zlopez:
- Issue untagged with: high-gain, high-trouble
- Issue assigned to zlopez
- Issue priority set to: Waiting on Assignee
- Issue tagged with: low-gain, low-trouble

So removing the account and creating it again didn't help. I wonder how we end up with duplicate entry in database :/

I will try to check the LDAP directly and see how that looks inside.

I just realized that there is a group called freecad and that is blocking the account activation.

Will let the reporter know that he needs to choose different username.

Metadata Update from @zlopez:
- Issue close_status updated to: Will Not/Can Not fix
- Issue status updated to: Closed (was: Open)
Metadata

authentication low-gain low-trouble ops

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.