Hi Dmitry can you open a ticket for this issue? I reproduced on RHEL 7.6 and it happens because of the following code: container_filter = "(objectclass=posixaccount)" # provisioning system can create non posixaccount stage user # but then they have to create inetOrgPerson stage user stagefilter = filter.replace(container_filter, "(|%s(objectclass=inetOrgPerson))" % container_filter)
We should rather use container_filter = ldap.make_filter_from_attr('objectclass', 'posixaccount') because the filter has been hexlified previously.
Thanks flo! I've opened a case with Red Hat on this, pointing to this thread.
--- Regards, Dmitry Perets