On 10/26/2012 02:25 PM, Petr Viktorin wrote:
On 10/26/2012 02:20 PM, Petr Viktorin wrote:
Attached are this thread's patches rebased and squashed into one.
... and here is a patch to address replication problems related to
merging the schemata of the IPA and CA databases. See the commit message
for details.
https://fedorahosted.org/freeipa/ticket/3213
With the previous patch, if an old split-database DT9 CA was inatalled,
ipa-ca-install didn't detect this, started installing another CA, and
then failed a bit later in the process.
I've added a check for this to the patch.
--
Petr³
From b0c5942b7590b0c65d401ee1d79f7bb029a8d81d Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pvikt...@redhat.com>
Date: Wed, 24 Oct 2012 04:37:16 -0400
Subject: [PATCH] Fix schema replication from old masters
The new merged database will replicate with both the IPA and CA trees, so all
DS instances (IPA and CA on the existing master, and the merged one on the
replica) need to have the same schema.
Dogtag does all its schema modifications online. Those are replicated normally.
The basic IPA schema, however, is delivered in ldif files, which are not
replicated. The files are not present on old CA DS instances. Any schema
update that references objects in these files will fail.
The whole 99user.ldif (i.e. changes introduced dynamically over LDAP) is
replicated as a blob. If we updated the old master's CA schema dynamically
during replica install, it would conflict with updates done during the
installation: the one with the lower CSN would get lost.
Dogtag's spawn script recently grew a new flag, 'pki_clone_replicate_schema'.
Turning it off tells Dogtag to create its schema in the clone, where the IPA
modifications are taking place, so that it is not overwritten by the IPA schema
on replication.
The patch solves the problems by:
- In __spawn_instance, turning off the pki_clone_replicate_schema flag.
- Providing a script to copy the IPA schema files to the CA DS instance.
The script needs to be copied to old masters and run there.
- At replica CA install, checking if the schema is updated, and failing if not.
All pre-3.1 CA servers in a domain will have to have the script run on them to
avoid schema replication errors.
https://fedorahosted.org/freeipa/ticket/3213
---
freeipa.spec.in | 1 +
install/share/Makefile.am | 1 +
install/share/copy-schema-to-ca.py | 84 ++++++++++++++++++++++++++++++++++++
install/tools/ipa-ca-install | 2 +
install/tools/ipa-replica-install | 2 +
ipaserver/install/cainstance.py | 34 ++++++++++++++
6 files changed, 124 insertions(+), 0 deletions(-)
create mode 100755 install/share/copy-schema-to-ca.py
diff --git a/freeipa.spec.in b/freeipa.spec.in
index 2914ef839d415419c50c6b1d3eb186f5fb9fdf8c..41c478fe8dc302f0fc9fa4b4540adfb5aa1a1751 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -644,6 +644,7 @@ fi
%attr(755,root,root) %{_libdir}/ipa/certmonger/*
%dir %{_usr}/share/ipa
%{_usr}/share/ipa/wsgi.py*
+%{_usr}/share/ipa/copy-schema-to-ca.py*
%{_usr}/share/ipa/*.ldif
%{_usr}/share/ipa/*.uldif
%{_usr}/share/ipa/*.template
diff --git a/install/share/Makefile.am b/install/share/Makefile.am
index 7f953bc4261b9158303e166fd5c5f1c1232986e4..4a5f81a67a4a9e7a59647c755db5f6ad9e69ac31 100644
--- a/install/share/Makefile.am
+++ b/install/share/Makefile.am
@@ -60,6 +60,7 @@ app_DATA = \
automember.ldif \
replica-automember.ldif \
replica-s4u2proxy.ldif \
+ copy-schema-to-ca.py \
$(NULL)
EXTRA_DIST = \
diff --git a/install/share/copy-schema-to-ca.py b/install/share/copy-schema-to-ca.py
new file mode 100755
index 0000000000000000000000000000000000000000..cc878353717ed34141c99671fba1560d1c58fd72
--- /dev/null
+++ b/install/share/copy-schema-to-ca.py
@@ -0,0 +1,84 @@
+#! /usr/bin/python
+
+"""Copy the IPA schema to the CA directory server instance
+
+You need to run this script to prepare a 2.2 or 3.0 IPA masters for
+installation of a 3.1 replica.
+
+Once a 3.1 replica is in the domain, every older server will emit schema
+replication errors until this script is run on it.
+
+"""
+
+import os
+import sys
+import pwd
+import shutil
+
+from ipapython import services, ipautil, dogtag
+from ipapython.ipa_log_manager import root_logger, standard_logging_setup
+from ipaserver.install.dsinstance import DS_USER, schema_dirname
+from ipaserver.install.cainstance import PKI_USER
+from ipalib import api
+
+SERVERID = "PKI-IPA"
+SCHEMA_FILENAMES = (
+ "60kerberos.ldif",
+ "60samba.ldif",
+ "60ipaconfig.ldif",
+ "60basev2.ldif",
+ "60basev3.ldif",
+ "60ipadns.ldif",
+ "61kerberos-ipav3.ldif",
+ "65ipasudo.ldif",
+ "05rfc2247.ldif",
+)
+
+
+def add_ca_schema():
+ """Copy IPA schema files into the CA DS instance
+ """
+ pki_pent = pwd.getpwnam(PKI_USER)
+ ds_pent = pwd.getpwnam(DS_USER)
+ for schema_fname in SCHEMA_FILENAMES:
+ source_fname = os.path.join(ipautil.SHARE_DIR, schema_fname)
+ target_fname = os.path.join(schema_dirname(SERVERID), schema_fname)
+ if not os.path.exists(source_fname):
+ root_logger.debug('File does not exist: %s', source_fname)
+ continue
+ if os.path.exists(target_fname):
+ root_logger.info(
+ 'Target exists, not overwriting: %s', target_fname)
+ continue
+ try:
+ shutil.copyfile(source_fname, target_fname)
+ except IOError, e:
+ root_logger.warning('Could not install %s: %s', target_fname, e)
+ else:
+ root_logger.info('Installed %s', target_fname)
+ os.chmod(target_fname, 0440) # read access for dirsrv user/group
+ os.chown(target_fname, pki_pent.pw_uid, ds_pent.pw_gid)
+
+
+def restart_pki_ds():
+ """Restart the CA DS instance to pick up schema changes
+ """
+ root_logger.info('Restarting CA DS')
+ services.service('dirsrv').restart(SERVERID)
+
+
+def main():
+ if os.getegid() != 0:
+ sys.exit("Must be root to run this script")
+ standard_logging_setup(verbose=True)
+
+ # In 3.0, restarting needs access to api.env
+ (options, argv) = api.bootstrap_with_global_options(context='server')
+
+ add_ca_schema()
+ restart_pki_ds()
+
+ root_logger.info('Schema updated successfully')
+
+
+main()
diff --git a/install/tools/ipa-ca-install b/install/tools/ipa-ca-install
index df3aebc111069d2d164fee6336182089c09a7195..fca953fa54c40dbb03e6091caf93a8a33a742665 100755
--- a/install/tools/ipa-ca-install
+++ b/install/tools/ipa-ca-install
@@ -154,6 +154,8 @@ def main():
config.master_host_name, config.host_name, config.realm_name, True,
dogtag_master_ds_port, options.admin_password)
+ cainstance.replica_ca_install_check(config, dogtag_master_ds_port)
+
# Configure the CA if necessary
(CA, cs) = cainstance.install_replica_ca(
config, dogtag_master_ds_port, postinstall=True)
diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index 69b94f925ce9c42772e384d5a1d0985752c9ec4c..c343f6087a33358cda9f91054493743b4840e8b8 100755
--- a/install/tools/ipa-replica-install
+++ b/install/tools/ipa-replica-install
@@ -602,6 +602,8 @@ def main():
if replman and replman.conn:
replman.conn.unbind_s()
+ cainstance.replica_ca_install_check(config, dogtag_master_ds_port)
+
# Configure ntpd
if options.conf_ntp:
ntp = ntpinstance.NTPInstance()
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
index 9ca120d44b738c3a6138c12c8f73084502f31641..83752579dab0ad9075b93047b8b9a7699f967405 100644
--- a/ipaserver/install/cainstance.py
+++ b/ipaserver/install/cainstance.py
@@ -670,6 +670,7 @@ class CAInstance(service.Service):
str(self.master_replication_port),
"pki_clone_replication_clone_port":
dogtag.install_constants.DS_PORT,
+ "pki_clone_replicate_schema": "False",
"pki_clone_uri":
"https://%s"; % ipautil.format_netloc(self.master_host, 443)
}
@@ -1554,6 +1555,39 @@ class CAInstance(service.Service):
return master == 'New'
+
+def replica_ca_install_check(config, master_ds_port):
+ if not config.setup_ca:
+ return
+
+ # Exit if we have an old-style (Dogtag 9) CA already installed
+ ca = CAInstance(config.realm_name, certs.NSS_DIR,
+ dogtag_constants=dogtag.Dogtag9Constants)
+ if ca.is_installed():
+ root_logger.info('Dogtag 9 style CA instance found')
+ sys.exit("A CA is already configured on this system.")
+
+ if int(master_ds_port) != 7389:
+ root_logger.debug(
+ 'Installing CA Replica from master with a merged database')
+ return
+
+ # Check if the master has the necessary schema in its CA instance
+ ca_ldap_url = 'ldap://%s:%s' % (config.master_host_name, master_ds_port)
+ objectclass = 'ipaObject'
+ root_logger.debug('Checking if IPA schema is present in %s', ca_ldap_url)
+ cn, rschema = ldap.schema.subentry.urlfetch(ca_ldap_url)
+ if rschema.get_obj(ldap.schema.models.ObjectClass, objectclass):
+ root_logger.debug('Check OK')
+ else:
+ root_logger.critical(
+ 'The master CA directory server does not have necessary schema. '
+ 'Please copy the following script to all masters and run it '
+ 'on them: %s' %
+ os.path.join(ipautil.SHARE_DIR, 'copy-schema-to-ca.py'))
+ exit('IPA schema missing on master CA directory server')
+
+
def install_replica_ca(config, master_ds_port, postinstall=False):
"""
Install a CA on a replica.
--
1.7.7.6
_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
