On 10/01/2012 05:28 PM, Martin Kosek wrote:
From IPA 3.0, services have by default ipakrbprincipal objectclass which
allows ipakrbprincipalalias attribute used for case-insensitive principal
searches. However, as services created in previous version do not have
this objectclass (and attribute), they are not listed in service list
produced by service-find.

Treat the ipakrbprincipal as optional to avoid missing services in
service-find command. Add flag to service-mod command which can fill
ipakrbprincipalalias attribute when case-insensitive principal searches
for a 2.x service are required.


This works, I'm getting all services now & the tests pass.


I am still pondering about a right way to fill ipakrbprincipalalias used in for
IPA 3.0 case-insensitive searches, so far I implemented this command:

ipa service-mod PRINCIPAL --update-principal-alias

But I am thinking it may be a better approach to generalize it and do something
like that:

ipa service-mod PRINCIPAL --upgrade/--update
This command would do a general update of service entry to an up-to-date 3.0
style, in this case it could do 2 things:
* fill ipakrbprincipalalias
* fill ipakrbauthzdata (based on default value in IPA config).

I don't think you're generalizing enough; `service-mod --upgrade` isn't that different from `service-mod --update-principal-alias --update-authzdata`. Scripting this to happen for all services could be a nuisance, though. There should be a way to upgrade all services at once, and since we already have ipa-ldap-updater for it, it should run as part of that.

I think we should keep ipakrbprincipal optional, in case the upgrade goes wrong.


Freeipa-devel mailing list

Reply via email to