From 9b09e9b7240ccedca60e812ed1b2337ed476e471 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Thu, 8 Jan 2026 10:05:18 +0100 Subject: [PATCH] ipa-migrate: avoid KeyError before attributes are normalized The ipa-migrate tool reads the content of the source LDAP server and processes the entries. When the entry is a tombstone it must be discarded. In order to detect if the entry is a tombstone, the code checks if the objectclass attribute contains the value 'nsTombstone'. The problem is that the key ('objectClass') is not normalized and may either be 'objectclass' (all lowercase) or 'objectClass'. Take both cases into account and avoid KeyError exception by normalizing the attribute + looking for case-insensitive value. Fixes: https://pagure.io/freeipa/issue/9910 Signed-off-by: Florence Blanc-Renaud Reviewed-By: Mark Reynolds Reviewed-By: Rob Crittenden --- ipaserver/install/ipa_migrate.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ipaserver/install/ipa_migrate.py b/ipaserver/install/ipa_migrate.py index f07a878e7..5318603d6 100644 --- a/ipaserver/install/ipa_migrate.py +++ b/ipaserver/install/ipa_migrate.py @@ -1472,7 +1472,9 @@ class IPAMigrate(): return # Skip tombstones - if 'nsTombstone' in entry_attrs['objectClass']: + # The attributes haven't been normalized yet + normalize_attr(entry_attrs, 'objectClass') + if 'nstombstone' in [oc.lower() for oc in entry_attrs['objectClass']]: return # Determine entry type: user, group, hbac, etc