# RE: Help..(NOT Fixed!) ohai doesn't reflect ldap users after ldap config in first chef run

**URL:** <https://discourse.chef.io/t/re-help-not-fixed-ohai-doesnt-reflect-ldap-users-after-ldap-config-in-first-chef-run/2586>\
**Category:** Chef Infra (archive)\
**Created:** [March 22, 2012, 3:35am UTC](https://discourse.chef.io/t/re-help-not-fixed-ohai-doesnt-reflect-ldap-users-after-ldap-config-in-first-chef-run/2586 "2012-03-22T03:35:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Van\_Fossan\_Randy](https://avatars.discourse-cdn.com/v4/letter/v/8797f3/32.png) [@Van\_Fossan\_Randy](https://discourse.chef.io/u/Van_Fossan_Randy)\
**Post date:** [March 22, 2012, 3:35am UTC](https://discourse.chef.io/t/re-help-not-fixed-ohai-doesnt-reflect-ldap-users-after-ldap-config-in-first-chef-run/2586/1 "2012-03-22T03:35:09Z")

</div>

Help,

I have a role that gets applied to a newly installed OS that sets up  
basic OS configuration. This role sets up the ldap configuration and  
all that works correctly. However, the role also sets the ownership for  
some directories and files for a user in ldap. The first run through  
fails with an error stating the user does not exist. If I rerun the  
role, it will complete successfully.

I even added the resource ‘ohai’ with an action of ‘reload’ to the  
recipe and it still doesn’t help. I do not know where to go from here.

Here is an example of the recipe and the error:

[http://pastie.org/3645475](http://pastie.org/3645475)

Here is the error…

[Wed, 21 Mar 2012 23:12:49 -0400] INFO: Processing  
remote\_directory[/usr/local/nagios/libexec] action create  
(nagios::client line 33)

[Wed, 21 Mar 2012 23:12:49 -0400] INFO:  
remote\_directory[/usr/local/nagios/libexec] created directory  
/usr/local/nagios/libexec

[Wed, 21 Mar 2012 23:12:49 -0400] ERROR:  
remote\_directory[/usr/local/nagios/libexec] (nagios::client line 33) has  
had an error

[Wed, 21 Mar 2012 23:12:49 -0400] ERROR:  
remote\_directory[/usr/local/nagios/libexec]  
(/var/chef/cache/cookbooks/nagios/recipes/client.rb:33:in `from\_file’)  
had an error:

remote\_directory[/usr/local/nagios/libexec] (nagios::client line 33) had  
an error: can’t find user for nagacct

Thanks

Randy

From: Van Fossan,Randy  
Sent: Wednesday, March 21, 2012 7:53 PM  
To: [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
Subject: RE: (NOT Fixed!) ldap users (after ldap config) in chef run

Well, I spoke too soon. This is still not working…

From: Van Fossan,Randy  
Sent: Wednesday, March 21, 2012 4:53 PM  
To: [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
Subject: RE: (FIXED!) ldap users (after ldap config) in chef run

I just needed to rerun ohai after configuring ldap…

[http://lists.opscode.com/sympa/arc/chef/2010-07/msg00234.html](http://lists.opscode.com/sympa/arc/chef/2010-07/msg00234.html)

## If you configure ldap for the first time, ohai will not know about

## the accounts within that run.

ruby\_block “reload\_ohai” do

block do

```
ohai = Ohai::System.new

ohai.all_plugins

node.automatic_attrs = ohai.data

node.save

```

end

action :nothing

end

…

…

# Install the template

template “/etc/ldap.conf” do

source “ldap.conf.erb”

owner “root”

group “root”

mode 0644

notifies :create, resources(:ruby\_block =\> ‘reload\_ohai’),  
:immediately

end

…

…

(Below is what fails as the user is in ldap)

remote\_directory node[‘nagios’][‘plugin\_dir’] do

source “plugins”

owner “nagacct”

group “nagacct”

mode 0755

files\_mode 0755

purge true

notifies :restart, “service[xinetd]”, :delayed

end

From: Van Fossan,Randy  
Sent: Wednesday, March 21, 2012 3:22 PM  
To: [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
Subject: ldap users (after ldap config) in chef run

I have a base role that configures ldap on the client and cycles the  
nscd daemon. Later in that role I try to create some directories  
using “owner” and “group” from these ldap accounts. It always fails on  
the first pass through. If I run it again, it will work fine.

I suspect that the chef run cannot yet see these accounts until after  
the chef run is complete. If I run 'getent passwd | grep account’  
right after the chef run, I can indeed see the account.

Anyone have any idea how to deal with ldap account changes within a chef  
run? Does ohai need to be rerun in the middle of the run somehow?

Thanks

Randy

---

<div class="post-metadata">

**Author:** ![Joshua\_Miller](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/joshua_miller/32/212_2.png) [@Joshua\_Miller](https://discourse.chef.io/u/Joshua_Miller)\
**Post date:** [March 22, 2012, 4:33am UTC](https://discourse.chef.io/t/re-help-not-fixed-ohai-doesnt-reflect-ldap-users-after-ldap-config-in-first-chef-run/2586/2 "2012-03-22T04:33:06Z")

</div>

Not sure if this helps as your OS is not listed but might want to have a look.

[http://tickets.opscode.com/browse/CHEF-1699?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16783#comment-16783](http://tickets.opscode.com/browse/CHEF-1699?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16783#comment-16783)

On Mar 21, 2012, at 8:35 PM, "Van Fossan,Randy" [vanfossr@oclc.org](mailto:vanfossr@oclc.org) wrote:

> can't find user for nagacct

---

<div class="post-metadata">

**Author:** ![Van\_Fossan\_Randy](https://avatars.discourse-cdn.com/v4/letter/v/8797f3/32.png) [@Van\_Fossan\_Randy](https://discourse.chef.io/u/Van_Fossan_Randy)\
**Post date:** [March 22, 2012, 1:49pm UTC](https://discourse.chef.io/t/re-help-not-fixed-ohai-doesnt-reflect-ldap-users-after-ldap-config-in-first-chef-run/2586/3 "2012-03-22T13:49:43Z")

</div>

I tried the solutions referred to in the ticket and it still did not  
help. I will keep searching..

I added this to my ldap cookbook  
ohai "reload\_passwd" do  
action :nothing

# plugin "passwd"

end

# fixes CHEF-1699

ruby\_block "reset group list" do  
block do  
Etc.endgrent  
Etc.endpwent  
end  
action :nothing  
end  
....

# Install the template

template "/etc/ldap.conf" do  
source "ldap.conf.erb"  
owner "root"  
group "root"  
mode 0644  
notifies :create, "ruby\_block[reset group list]", :immediately  
notifies :reload, resources(:ohai =\> "reload\_passwd"), :immediately  
end

In Nagios cookbook... (Still fails on the nagacct)  
remote\_directory node['nagios']['plugin\_dir'] do  
source "plugins"  
owner "nagacct"  
group "nagacct"  
mode 0755  
files\_mode 0755  
purge true  
notifies :restart, "service[xinetd]", :delayed  
end

-----Original Message-----  
From: Joshua Miller [[mailto:jassinpain@gmail.com](mailto:jassinpain@gmail.com)]  
Sent: Thursday, March 22, 2012 12:33 AM  
To: [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
Cc: [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
Subject: [chef] Re: RE: Help..(NOT Fixed!) ohai doesn't reflect ldap  
users after ldap config in first chef run

Not sure if this helps as your OS is not listed but might want to have a  
look.

[http://tickets.opscode.com/browse/CHEF-1699?page=com.atlassian.jira.plug](http://tickets.opscode.com/browse/CHEF-1699?page=com.atlassian.jira.plug)  
in.system.issuetabpanels:comment-tabpanel&focusedCommentId=16783#comment  
-16783

On Mar 21, 2012, at 8:35 PM, "Van Fossan,Randy" [vanfossr@oclc.org](mailto:vanfossr@oclc.org)  
wrote:

> can't find user for nagacct