zmmboxmove to 8.8.15 fails with "no authtoken cookie"

[gabrieles]

Hi, I'm having some problems moving mailboxes to a freshly installed 8.8.15 server.
At this moment we have a multiserver installation in rolling upgrade configuration

old.mydomain.com (ZCS 8.6 p14 NETWORK - Ubuntu 14)
new.mydomain.com (ZCS 8.8.15 NETWORK - Ubuntu 16)

All the services have been moved to the new.mydomain.com (LDAP, logger, proxy etc.) and the users are correctly using their old mailboxes through proxy without problems.
We can't install ANYTHING on the old.mydomain.com for explicit customer request, so no Zextras Migration tool is allowed.
When moving mailboxes with zmmboxmove

zmmboxmove -a account@mydomain.com -f old.mydomain.com -t new.mydomain.com

we get this error

Error occurred: system failure: Failed to export blobs from source server old.mydomain.com: no authtoken cookie

Actions taken:
- needless to say, google or the forums don't know anything about this "no authtoken cookie" error...
- checked zimbraMailboxMoveTempDir for each server, /opt/zimbra/backup/tmp/mboxmove. This folder exists, is owned and is readable and writable by zimbra user
- zmfixperms and zmfixperms -ev a go go on every server
- tried with --sync and without, no difference
- tried zmmboxmove pushing or pulling (from the source or from the destination server), no difference.
- regenerated and updated keys (zmsshkeygen + zmupdateauthkeys), no difference
- no problems in any other action performed with administrative authentication (zmmailbox -z -m account@mydomain.com gaf or similar)
- tried with direct soap request, no difference

zmsoap -v -z MoveMailboxRequest/account @name=account@mydomain.com @dest="new.mydomain.com" @src="old.mydomain.com" @sync=1

- thinking about an authentication problem, created a new admin account (zimbraIsAdminAccount TRUE) and tried a zmmboxmove via direct soap request, no difference.

zmsoap -v -a tempadmin@mydomain.com -p t3mp.p455w0rd MoveMailboxRequest/account @name=account@mydomain.com @dest="new.mydomain.com" @src="old.mydomain.com" @sync=1

- at the last, tried a -vv very verbose zmsoap

zmsoap -vv -a tempadmin@mydomain.com -p t3mp.p455w0rd MoveMailboxRequest/account @name=account@mydomain.com @dest="new.mydomain.com" @src="old.mydomain.com" @sync=1

and got this:

(excerpt from request)

Code: Select all

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
blablabla
    <AuthRequest xmlns="urn:zimbraAdmin">
      <name>tempadmin@mydomain.com</name>
      <password>***</password>
    </AuthRequest>
blablabla
    <AuthResponse xmlns="urn:zimbraAdmin">
      <authToken>0_a97a959bb34b3b24ee323df0cea3fc0c4902e796_69643d33363a66316236323665372d343832382d343864382d383633622d3434326337346133346366613b6578703d31333a313536353132333434323331333b61646d696e3d313a313b747970653d363a7a696d6272613b753d313a613b7469643d31303a313036303339353936393b76657273696f6e3d31333a382e362e305f47415f313135333b</authToken>
      <lifetime>43199997</lifetime>
    </AuthResponse>
  </soap:Body>
</soap:Envelope>
Sending request to https://localhost:7071/service/admin/soap

(excerpt from response)

Code: Select all

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
blablabla
    <soap:Fault>
blablabla
      <soap:Reason>
        <soap:Text>system failure: Failed to export blobs from source server old.mydomain.com: no authtoken cookie</soap:Text>
      </soap:Reason>
      <soap:Detail>
        <Error xmlns="urn:zimbra">
          <Code>service.FAILURE</Code>
          <Trace>qtp961409111-41756:1565080246630:958904e0f2d3a152</Trace>
        </Error>
blablabla
</soap:Envelope>

The authToken was correctly released, but it keeps responding no authtoken cookie.

Do they finally broken the zmmboxmove as predicted here viewtopic.php?f=14&t=65908?

[L. Mark Stone]

From the 8.8.15 Admin Guide:

"If the HSM NG module is installed and enabled, this command replaces the old zmmboxmove and zmmailboxmove commands. Using any of the legacy commands will return an error and won’t move any data."

Reference URL: https://zimbra.github.io/adminguide/lat ... mailstores

What happens if you execute the "zxsuite hsm doMailboxMove john.doe@example.com destinationHost mb1-8-8-15.example.com" command from the target 8.8.15 server?

Hope that helps,
Mark

[gabrieles]

What happens if you execute the "zxsuite hsm doMailboxMove john.doe@example.com destinationHost mb1-8-8-15.example.com" command from the target 8.8.15 server?

Just tried, from the target server (the only one with zxsuite):

zxsuite hsm doMailboxMove account@mydomain.com destinationHost new.mydomain.com

No account found to be moved from server new.mydomain.com

The "from server new.mydomain.com" is not a misprint, it says just like that.

"If the HSM NG module is installed and enabled, this command replaces the old zmmboxmove and zmmailboxmove commands. Using any of the legacy commands will return an error and won’t move any data."

So first I tried to disable NG modules on new.mydomain.com, completely restart zcs, and retried
zmprov ms $(zmhostname ) zimbraNetworkAdminNGEnabled FALSE zimbraNetworkModulesNGEnabled FALSE zimbraNetworkMobileNGEnabled FALSE
zmprov mcf zimbraNetworkAdminNGEnabled FALSE zimbraNetworkModulesNGEnabled FALSE zimbraNetworkMobileNGEnabled FALSE
and even
apt-get remove zimbra-network-modules-ng
zmcontrol restart
zmmboxmove -a account@mydomain.com -f old.mydomain.com -t new.mydomain.com --sync

but the result, again is:

com.zimbra.common.service.ServiceException: system failure: Failed to export blobs from source server u14test.zimbra0.local: no authtoken cookie

Then I installed a brand new ZCS 8.8.15 mailstore, newer.mydomain.com, without NG from the beginning

Code: Select all

Install zimbra-drive [Y] n
Install zimbra-imapd (BETA - for evaluation only) [N] n
Install zimbra-network-modules-ng [Y] n
Install zimbra-chat [Y] n

and tried

zmmboxmove -a account@mydomain.com -f old.mydomain.com -t newer.mydomain.com --sync

but the result, again is:
com.zimbra.common.service.ServiceException: system failure: Failed to export blobs from source server u14test.zimbra0.local: no authtoken cookie

So, how to perform rolling upgrades?

[L. Mark Stone]

I would recommend opening a Support Case with Zimbra on this.

Rolling Upgrades are the preferred upgrade strategy for large deployments; I know that Zimbra Professional Services are doing this currently, and I have two rolling upgrade migrations coming up.

Please keep us posted as to what Zimbra Support says?

I'll ask around as well and if I find out anything, I will post it here.

All the best,
Mark

[L. Mark Stone]

Not an answer to your situation, but I did confirm that to move a mailbox using the NG (ZeXtras) tools, the command must be issued from the source server; i.e., the mailbox server where the mailbox you want to move currently resides.

Any news from Zimbra Support?

All the best,
Mark

[andrey.ivanov]

Not sure if it is relevant but this recent commit of dev branch (https://github.com/Zimbra/zm-mailbox/commits/develop) could be related to fixing the problem :
https://github.com/Zimbra/zm-mailbox/co ... bda3ffeb45

[lfasci]

I had the same problem, here is the latest response from Zimbra Support

....that seem to be a bug in the 8.8.15 version. They have kept the 8.8.12 non NG modules code, but that is a bug. The solution will be in 8.8.15 Patch 1....

Bye
Lorenzo

[lfasci]

The patch is on zimbra repos but after upgrade the error is still here

Bye
Lorenzo

[mongeslack]

Hello!, Did anyone find a solution?

I'm runnnig zimbra 8.8.15 patch 9 and just opened a case with zimbra about it, because I have the problem "No account found to be moved from server xxxxxxxxx"