In the case of subtree-rename OFF in a replication environment, it is observed that, after the deletion of the entry, its index is not cleared from the entrydn.db4. This stale entry in the entrydn.db4 seems to be causing the error reported.

static char *protected_attrs_all [] = {PSEUDO_ATTR_UNHASHEDUSERPASSWORD,
SLAPI_ATTR_ENTRYDN,
NULL};

Upon further investigation, it has been observed that "SLAPI_ATTR_ENTRYDN" had been included as part of "protected_attrs_all" in entry.c which is causing the "entrydn" attribute to be skipped from writing into the database (id2entry.db4) though the entry in the cache has the same attribute in it. As this attribute is missing in the database, upon restart, cache, which is populated from this database will not have this attribute as part of the entry. Thus the corresponding index in the entrydn.db4 is not cleared when that particular entry is deleted ( after restart).

So, the fix is to not to skip writing "entrydn" attribute into the database, when subtree rename is turned OFF.

The following changes should fix this issue.

Before Fix :

int
is_type_protected(const char type)
{
char paap = NULL;
for (paap = protected_attrs_all; paap && paap; paap++) {
if (0 == strcasecmp(type, *paap)) {
return 1;
}
}
return 0;
}

Fix :

int
is_type_protected(const char type)
{
char *paap = NULL;

for (paap = protected_attrs_all; paap && *paap; paap++) {
    if (0 == strcasecmp(type, *paap)) {
    /*  Protect SLAPI_ATTR_ENTRYDN only when subtree-rename feature is ON. Or else, when subtree-rename is OFF, */
    /*  the entry from the entrydn.db4 is not removed when the entry is deleted from the database. */
        if (!(entryrdn_get_switch()) && ((strcasecmp(*paap,SLAPI_ATTR_ENTRYDN)) == 0)) {
            return 0;
        } else {
            return 1;
        }
    }
 }

return 0;
}

Bug description:
{{{
1) As reported by baburaje12, regardless of the nsslapd-subtree-
rename-switch, "entrydn" was not stored in the id2entry db. The
attribute value had to be stored in the db file if the switch
was off. Attribute values to avoid storing in the db file are
maintained in an array protected_attrs_all statically. "Entrydn"
should be dynamic depending on the switch.
2) When the switch is off, import was skipping to generate the
parentid index, which leads to skipping to create the entrydn,
as well.
}}}
Fix description:
{{{
1) Instead of keeping "entrydn" in the protected_attrs_all statically,
this patch introduces an api set_attr_to_protected_list to add or
remove "entrydn" based upon the value of nsslapd-subtree-rename-
switch.
2) The condition to create a parentid index is fixed to always
create it if the nsslapd-subtree-rename-switch is off.
}}}

git patch file (master)
0001-Ticket-47422-With-1.3.04-and-subtree-renaming-OFF-wh.patch

Reviewed by Rich (Thank you!!)

Pushed to master:
b23a66b..72a3f9b master -> master
commit 39ba12b

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1044183

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/759

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.