[SOLVED] LDAP: error code 80 - could not locate parent of entry

[azilber]

A client of mine had Zimbra 4.5.3 running. At some point, he may have removed one of the domains he had setup. For some reason, when it was removed, the user and aliases for that domain remained. Attempting to remove them results in the error above.

I've since upgraded the server to 5.0.4, and the same error remains. zmprov is unable to remove the account or alias either in soap or ldap mode.

From the log file we see this:

com.zimbra.common.service.ServiceException: system failure: unable to purge account: a2746611-de03-4115-883e-9a44b369a3d3
ExceptionId:btpool0-3:1207017968992:1698eb706d3d361b
Code:service.FAILURE
        at com.zimbra.common.service.ServiceException.FAILURE(ServiceException.java:253)
        at com.zimbra.cs.account.ldap.LdapProvisioning.deleteAccount(LdapProvisioning.java:1846)
        at com.zimbra.cs.service.admin.DeleteAccount.handle(DeleteAccount.java:84)
        at com.zimbra.soap.SoapEngine.dispatchRequest(SoapEngine.java:391)
        at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:250)
        at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:156)
        at com.zimbra.soap.SoapServlet.doPost(SoapServlet.java:266)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
        at com.zimbra.cs.servlet.ZimbraServlet.service(ZimbraServlet.java:177)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
        at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:487)
        at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1093)
        at org.mortbay.servlet.UserAgentFilter.doFilter(UserAgentFilter.java:81)
        at org.mortbay.servlet.GzipFilter.doFilter(GzipFilter.java:132)
        at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
        at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:360)
        at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
        at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:181)
        at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:716)
        at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:406)
        at org.mortbay.jetty.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:211)
        at org.mortbay.jetty.handler.HandlerCollection.handle(HandlerCollection.java:114)
        at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:139)
        at org.mortbay.jetty.handler.RewriteHandler.handle(RewriteHandler.java:176)
        at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:139)
        at org.mortbay.jetty.Server.handle(Server.java:313)
        at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:506)
        at org.mortbay.jetty.HttpConnection$RequestHandler.content(HttpConnection.java:844)
        at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:644)
        at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:205)
        at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:381)
        at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:396)
        at org.mortbay.thread.BoundedThreadPool$PoolThread.run(BoundedThreadPool.java:442)
Caused by: javax.naming.NamingException: [LDAP: error code 80 - could not locate parent of entry]; remaining name 'uid=andy,ou=people,dc=xxxxxxxx,dc=com'
        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3049)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2951)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2758)
        at com.sun.jndi.ldap.LdapCtx.c_unbind(LdapCtx.java:600)
        at com.sun.jndi.toolkit.ctx.ComponentContext.p_unbind(ComponentContext.java:634)
        at com.sun.jndi.toolkit.ctx.PartialCompositeContext.unbind(PartialCompositeContext.java:227)
        at javax.naming.InitialContext.unbind(InitialContext.java:420)
        at com.zimbra.cs.account.ldap.LdapUtil.unbindEntry(LdapUtil.java:1346)
        at com.zimbra.cs.account.ldap.LdapProvisioning.deleteAccount(LdapProvisioning.java:1843)
        ... 31 more

Trying from zmprov -l :

ERROR: service.FAILURE (system failure: unable to purge account: a2746611-de03-4115-883e-9a44b369a3d3) (cause: javax.naming.NamingException [LDAP: error code 80 - could not locate parent of entry])

Gah!

[quanah]

Originally Posted by azilber

A client of mine had Zimbra 4.5.3 running. At some point, he may have removed one of the domains he had setup. For some reason, when it was removed, the user and aliases for that domain remained. Attempting to remove them results in the error above.

You'll likely need to slapcat the database, remove the problem domain, and then slapadd the database back in. Current OL won't let you delete entries that have children, but I'm guessing the OL in the 4.5.3 release didn't have that check.

deleting entry "ou=people,dc=freelancer,dc=lab,dc=zimbra,dc=com"
ldapmodify: Operation not allowed on non-leaf (66)
        additional info: subordinate objects must be deleted first

--Quanah

[azilber]

Originally Posted by quanah

You'll likely need to slapcat the database, remove the problem domain, and then slapadd the database back in. Current OL won't let you delete entries that have children, but I'm guessing the OL in the 4.5.3 release didn't have that check.

deleting entry "ou=people,dc=freelancer,dc=lab,dc=zimbra,dc=com"
ldapmodify: Operation not allowed on non-leaf (66)
        additional info: subordinate objects must be deleted first

--Quanah

The openldap with 4.5.3 also didn't allow it, so I'm not sure how it happened. I wanted not to have to resolve to the slapcat slapadd method. Zimbra doesn't come with the slapcat and slapadd utils so it's gonna be a pita to get those on this box.

Thanks!

-Alex

[quanah]

Originally Posted by azilber

I wanted not to have to resolve to the slapcat slapadd method. Zimbra doesn't come with the slapcat and slapadd utils so it's gonna be a pita to get those on this box.

Thanks!

-Alex

I'm not sure what you mean Zimbra doesn't come with those utilities. They've shipped with every version of ZCS I've used...

[quanah@freelancer ~]$ ls /opt/zimbra/openldap/sbin
slapacl  slapadd  slapauth  slapcat  slapdn  slapindex  slappasswd  slaptest

--Quanah

[azilber]

Originally Posted by quanah

I'm not sure what you mean Zimbra doesn't come with those utilities. They've shipped with every version of ZCS I've used...

[quanah@freelancer ~]$ ls /opt/zimbra/openldap/sbin
slapacl  slapadd  slapauth  slapcat  slapdn  slapindex  slappasswd  slaptest

--Quanah

Thank you! I've been looking in /opt/zimbra/bin. Didn't help that they weren't in the path. Well, that changes things. :-)

[jholder]

Can you file a bug to put them in the path?

Thanks, marking as solved.