samba - Oct 2016 - "incorrect GUID component for member" ... cannot delete member

I have defunct user's in groups in my domain groups - but it appears
that I cannot remove them.  This membership is reported by "samba-tool
dbcheck" but are not fixed even if "-fix" is specified.


=== ldbmodify ==
[root at larkin27 ~]# ldbmodify -H /var/lib/samba/private/sam.ldb fix.ldif
ERR: (Unwilling to perform) "Unable to find GUID for DN
CN=mstudtma,OU=Industries Users,DC=EXAMPLE,DC=COM
" on DN CN=Domain Users,CN=Users,DC=EXAMPLE,DC=COM at block before line
6
Modify failed after processing 0 records
[root at larkin27 ~]# cat fix.ldif 
dn: CN=Domain Users,CN=Users,DC=EXAMPLE,DC=COM
changetype: modify
delete: member
member: CN=mstudtma,OU=Industries Users,DC=EXAMPLE,DC=COM
-


=== dbcheck ==
ERROR: incorrect GUID component for member in object CN=Domain
Users,CN=Users,DC=EXAMPLE,DC=COM - <GUID=4adc8e8c-db48-46d9-9a55
-1f222350d4fa>;CN=mstudtma,OU=Industries Users,DC=EXAMPLE,DC=COM
unable to find object for DN CN=mstudtma,OU=Industries
Users,DC=EXAMPLE,DC=COM - (No such Base DN: CN=mstudtma,OU=Industries
Users,DC=EXAMPLE,DC=COM)
Not removing dangling forward link


-- 
Adam Tauno Williams <mailto:awilliam at whitemice.org> GPG D95ED383
openSUSE, a LINUX desktop for humans who need to get work done.

On Tue, 2016-10-25 at 11:17 -0400, Adam Tauno Williams via samba
wrote:
> I have defunct user's in groups in my domain groups - but it appears
> that I cannot remove them.  This membership is reported by "samba-
> tool
> dbcheck" but are not fixed even if "-fix" is specified.
> 
> 
> === ldbmodify ==> 
> [root at larkin27 ~]# ldbmodify -H /var/lib/samba/private/sam.ldb
> fix.ldif
> ERR: (Unwilling to perform) "Unable to find GUID for DN
> CN=mstudtma,OU=Industries Users,DC=EXAMPLE,DC=COM
> " on DN CN=Domain Users,CN=Users,DC=EXAMPLE,DC=COM at block before
> line
> 6
> Modify failed after processing 0 records
> [root at larkin27 ~]# cat fix.ldif 
> dn: CN=Domain Users,CN=Users,DC=EXAMPLE,DC=COM
> changetype: modify
> delete: member
> member: CN=mstudtma,OU=Industries Users,DC=EXAMPLE,DC=COM
> -
> 
> 
> === dbcheck ==> 
> ERROR: incorrect GUID component for member in object CN=Domain
> Users,CN=Users,DC=EXAMPLE,DC=COM - <GUID=4adc8e8c-db48-46d9-9a55
> -1f222350d4fa>;CN=mstudtma,OU=Industries Users,DC=EXAMPLE,DC=COM
> unable to find object for DN CN=mstudtma,OU=Industries
> Users,DC=EXAMPLE,DC=COM - (No such Base DN: CN=mstudtma,OU=Industries
> Users,DC=EXAMPLE,DC=COM)
> Not removing dangling forward link
It is harmless, but if you file a bug that will help me getting the fix
for this in dbcheck backported once it lands in master.

Some of these may go away if you run samba-tool domain tombstones
expunge from v4-5-test.

I hope to get to that next week. 

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

On Sat, 2016-10-29 at 07:21 +1300, Andrew Bartlett
wrote:
> On Tue, 2016-10-25 at 11:17 -0400, Adam Tauno Williams via samba
> wrote:
> > 
> > I have defunct user's in groups in my domain groups - but it
> > appears
> > that I cannot remove them.  This membership is reported by
"samba-
> > tool
> > dbcheck" but are not fixed even if "-fix" is specified.
> > 
> > 
> > === ldbmodify ==> > 
> > [root at larkin27 ~]# ldbmodify -H /var/lib/samba/private/sam.ldb
> > fix.ldif
> > ERR: (Unwilling to perform) "Unable to find GUID for DN
> > CN=mstudtma,OU=Industries Users,DC=EXAMPLE,DC=COM
> > " on DN CN=Domain Users,CN=Users,DC=EXAMPLE,DC=COM at block
before
> > line
> > 6
> > Modify failed after processing 0 records
> > [root at larkin27 ~]# cat fix.ldif 
> > dn: CN=Domain Users,CN=Users,DC=EXAMPLE,DC=COM
> > changetype: modify
> > delete: member
> > member: CN=mstudtma,OU=Industries Users,DC=EXAMPLE,DC=COM
> > -
> > 
> > 
> > === dbcheck ==> > 
> > ERROR: incorrect GUID component for member in object CN=Domain
> > Users,CN=Users,DC=EXAMPLE,DC=COM - <GUID=4adc8e8c-db48-46d9-9a55
> > -1f222350d4fa>;CN=mstudtma,OU=Industries Users,DC=EXAMPLE,DC=COM
> > unable to find object for DN CN=mstudtma,OU=Industries
> > Users,DC=EXAMPLE,DC=COM - (No such Base DN:
> > CN=mstudtma,OU=Industries
> > Users,DC=EXAMPLE,DC=COM)
> > Not removing dangling forward link
> 
> It is harmless, but if you file a bug that will help me getting the
> fix
> for this in dbcheck backported once it lands in master.
Sorry, I forgot, it is already reported, just add yourself to
 https://bugzilla.samba.org/show_bug.cgi?id=12297
> Some of these may go away if you run samba-tool domain tombstones
> expunge from v4-5-test.
> 
> I hope to get to that next week. 
> 
> Andrew Bartlett
> 
-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba