On 11/19/2012 05:35 PM, Martin Kosek wrote:
On 11/15/2012 03:19 PM, Petr Viktorin wrote:
Recently, the specfile changed (dce53e4) and the patch for changed Dogtag
defaults made it to master independently (91e477b). Attaching rebased patch.
Note that to continue development on f17, you will need to use the dogtag-devel
repo:
sudo yum-config-manager
--add-repo=http://nkinder.fedorapeople.org/dogtag-devel/dogtag-devel-fedora.repo
On 11/13/2012 03:57 PM, Petr Viktorin wrote:
[...]
For convenience, I've also pushed the changes to a personal repository.
To fetch to branch "pviktori-dogtag-10" you can do:
git fetch -f git://github.com/encukou/freeipa.git
dogtag-10:pviktori-dogtag-10
I went through all the patches again, I found one more issue with the schema
check. As it binds to Directory Server anonymously when retrieving the schema
and tests if "ipaObject" objectclass is present, it can fail and crash when
anonymous binds are not allowed for the Dogtag DS instance. This is what I get
when I disabled anonymous binds and run ipa-replica-install --setup-ca (a
script to turn anonymous binds off attached):
[root@vm-104 ~]# ipa-replica-install
replica-info-vm-104.idm.lab.bos.redhat.com.gpg --setup-ca
Directory Manager (existing master) password:
Run connection check to master
[...]
Connection from master to replica is OK.
Connection check OK
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
LDAP error: INAPPROPRIATE_AUTH
Anonymous access is not allowed
If possible, it would be good authenticate first. This should be doable, we
have a Directory Manager password available, after all. Some schema retrieval
code that we already have in IPA can be found in SchemaCache class in ldap2.py.
Good point. Attaching updated patch.
We may also want to have some flag similar to --skip-conncheck which would
allow admin with an issue like this one skip the check when he is certain that
he copied the schema files.
I named it --skip-schema-check.
Adding Ade to check that this scenario is actually sane and Dogtag is supposed
to work with anonymous access disabled for its DS instance.
When reading the patches, I also saw few places with magic constant "7389"
(your "Fix schema replication from old masters" patch and Ade's patch). I
wonder, would "dogtag.Dogtag9Constants.DS_PORT" be more readable?
Fixed in this patch, I'll look at the other one soon.
For anyone who wants to test: I keep my Github branch updated.
Re-running the fetch command will overwrite your branch with the latest
changes.
When the current issues are solved I'll repost all patches again in a
single mail.
--
Petr³
From acb66227bbc2c7f4ce8345a334753bd264c357ec Mon Sep 17 00:00:00 2001
From: Petr Viktorin <pvikt...@redhat.com>
Date: Wed, 24 Oct 2012 04:37:16 -0400
Subject: [PATCH] Fix schema replication from old masters
The new merged database will replicate with both the IPA and CA trees, so all
DS instances (IPA and CA on the existing master, and the merged one on the
replica) need to have the same schema.
Dogtag does all its schema modifications online. Those are replicated normally.
The basic IPA schema, however, is delivered in ldif files, which are not
replicated. The files are not present on old CA DS instances. Any schema
update that references objects in these files will fail.
The whole 99user.ldif (i.e. changes introduced dynamically over LDAP) is
replicated as a blob. If we updated the old master's CA schema dynamically
during replica install, it would conflict with updates done during the
installation: the one with the lower CSN would get lost.
Dogtag's spawn script recently grew a new flag, 'pki_clone_replicate_schema'.
Turning it off tells Dogtag to create its schema in the clone, where the IPA
modifications are taking place, so that it is not overwritten by the IPA schema
on replication.
The patch solves the problems by:
- In __spawn_instance, turning off the pki_clone_replicate_schema flag.
- Providing a script to copy the IPA schema files to the CA DS instance.
The script needs to be copied to old masters and run there.
- At replica CA install, checking if the schema is updated, and failing if not.
The --skip-schema-check option is added to ipa-{replica,ca}-install to
override the check.
All pre-3.1 CA servers in a domain will have to have the script run on them to
avoid schema replication errors.
https://fedorahosted.org/freeipa/ticket/3213
---
freeipa.spec.in | 1 +
install/share/Makefile.am | 1 +
install/share/copy-schema-to-ca.py | 84 +++++++++++++++++++++++++++++++
install/tools/ipa-ca-install | 7 +++
install/tools/ipa-replica-install | 7 +++
install/tools/man/ipa-ca-install.1 | 3 +
install/tools/man/ipa-replica-install.1 | 3 +
ipaserver/install/cainstance.py | 48 +++++++++++++++++
8 files changed, 154 insertions(+), 0 deletions(-)
create mode 100755 install/share/copy-schema-to-ca.py
diff --git a/freeipa.spec.in b/freeipa.spec.in
index d4f41ddea6c76e6a51a5f86274a0324f520ce615..6cc77cd38570a0b8df8c782ae7a29ee0a75e8849 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -554,6 +554,7 @@ fi
%attr(755,root,root) %{_libdir}/ipa/certmonger/*
%dir %{_usr}/share/ipa
%{_usr}/share/ipa/wsgi.py*
+%{_usr}/share/ipa/copy-schema-to-ca.py*
%{_usr}/share/ipa/*.ldif
%{_usr}/share/ipa/*.uldif
%{_usr}/share/ipa/*.template
diff --git a/install/share/Makefile.am b/install/share/Makefile.am
index 7f953bc4261b9158303e166fd5c5f1c1232986e4..4a5f81a67a4a9e7a59647c755db5f6ad9e69ac31 100644
--- a/install/share/Makefile.am
+++ b/install/share/Makefile.am
@@ -60,6 +60,7 @@ app_DATA = \
automember.ldif \
replica-automember.ldif \
replica-s4u2proxy.ldif \
+ copy-schema-to-ca.py \
$(NULL)
EXTRA_DIST = \
diff --git a/install/share/copy-schema-to-ca.py b/install/share/copy-schema-to-ca.py
new file mode 100755
index 0000000000000000000000000000000000000000..4e2054eacf75f1e2598f1e888fb55c16856599ef
--- /dev/null
+++ b/install/share/copy-schema-to-ca.py
@@ -0,0 +1,84 @@
+#! /usr/bin/python
+
+"""Copy the IPA schema to the CA directory server instance
+
+You need to run this script to prepare a 2.2 or 3.0 IPA master for
+installation of a 3.1 replica.
+
+Once a 3.1 replica is in the domain, every older CA master will emit schema
+replication errors until this script is run on it.
+
+"""
+
+import os
+import sys
+import pwd
+import shutil
+
+from ipapython import services, ipautil, dogtag
+from ipapython.ipa_log_manager import root_logger, standard_logging_setup
+from ipaserver.install.dsinstance import DS_USER, schema_dirname
+from ipaserver.install.cainstance import PKI_USER
+from ipalib import api
+
+SERVERID = "PKI-IPA"
+SCHEMA_FILENAMES = (
+ "60kerberos.ldif",
+ "60samba.ldif",
+ "60ipaconfig.ldif",
+ "60basev2.ldif",
+ "60basev3.ldif",
+ "60ipadns.ldif",
+ "61kerberos-ipav3.ldif",
+ "65ipasudo.ldif",
+ "05rfc2247.ldif",
+)
+
+
+def add_ca_schema():
+ """Copy IPA schema files into the CA DS instance
+ """
+ pki_pent = pwd.getpwnam(PKI_USER)
+ ds_pent = pwd.getpwnam(DS_USER)
+ for schema_fname in SCHEMA_FILENAMES:
+ source_fname = os.path.join(ipautil.SHARE_DIR, schema_fname)
+ target_fname = os.path.join(schema_dirname(SERVERID), schema_fname)
+ if not os.path.exists(source_fname):
+ root_logger.debug('File does not exist: %s', source_fname)
+ continue
+ if os.path.exists(target_fname):
+ root_logger.info(
+ 'Target exists, not overwriting: %s', target_fname)
+ continue
+ try:
+ shutil.copyfile(source_fname, target_fname)
+ except IOError, e:
+ root_logger.warning('Could not install %s: %s', target_fname, e)
+ else:
+ root_logger.info('Installed %s', target_fname)
+ os.chmod(target_fname, 0440) # read access for dirsrv user/group
+ os.chown(target_fname, pki_pent.pw_uid, ds_pent.pw_gid)
+
+
+def restart_pki_ds():
+ """Restart the CA DS instance to pick up schema changes
+ """
+ root_logger.info('Restarting CA DS')
+ services.service('dirsrv').restart(SERVERID)
+
+
+def main():
+ if os.getegid() != 0:
+ sys.exit("Must be root to run this script")
+ standard_logging_setup(verbose=True)
+
+ # In 3.0, restarting needs access to api.env
+ (options, argv) = api.bootstrap_with_global_options(context='server')
+
+ add_ca_schema()
+ restart_pki_ds()
+
+ root_logger.info('Schema updated successfully')
+
+
+main()
diff --git a/install/tools/ipa-ca-install b/install/tools/ipa-ca-install
index df3aebc111069d2d164fee6336182089c09a7195..d5f649de4b64440ba1bb9ae3efc80039edb50a1d 100755
--- a/install/tools/ipa-ca-install
+++ b/install/tools/ipa-ca-install
@@ -58,6 +58,8 @@ def parse_options():
help="Do not use DNS for hostname lookup during installation")
parser.add_option("--skip-conncheck", dest="skip_conncheck", action="store_true",
default=False, help="skip connection check to remote master")
+ parser.add_option("--skip-schema-check", dest="skip_schema_check", action="store_true",
+ default=False, help="skip check for updated CA DS schema on the remote master")
parser.add_option("-U", "--unattended", dest="unattended", action="store_true",
default=False, help="unattended installation never prompts the user")
@@ -154,6 +156,11 @@ def main():
config.master_host_name, config.host_name, config.realm_name, True,
dogtag_master_ds_port, options.admin_password)
+ if options.skip_schema_check:
+ root_logger.info("Skipping CA DS schema check")
+ else:
+ cainstance.replica_ca_install_check(config, dogtag_master_ds_port)
+
# Configure the CA if necessary
(CA, cs) = cainstance.install_replica_ca(
config, dogtag_master_ds_port, postinstall=True)
diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index 69b94f925ce9c42772e384d5a1d0985752c9ec4c..c66bf3e3111d9671a93e9fc3eeb9d381397b75bd 100755
--- a/install/tools/ipa-replica-install
+++ b/install/tools/ipa-replica-install
@@ -90,6 +90,8 @@ def parse_options():
cert_group = OptionGroup(parser, "certificate system options")
cert_group.add_option("--no-pkinit", dest="setup_pkinit", action="store_false",
default=True, help="disables pkinit setup steps")
+ cert_group.add_option("--skip-schema-check", dest="skip_schema_check", action="store_true",
+ default=False, help="skip check for updated CA DS schema on the remote master")
parser.add_option_group(cert_group)
dns_group = OptionGroup(parser, "DNS options")
@@ -602,6 +604,11 @@ def main():
if replman and replman.conn:
replman.conn.unbind_s()
+ if options.skip_schema_check:
+ root_logger.info("Skipping CA DS schema check")
+ else:
+ cainstance.replica_ca_install_check(config, dogtag_master_ds_port)
+
# Configure ntpd
if options.conf_ntp:
ntp = ntpinstance.NTPInstance()
diff --git a/install/tools/man/ipa-ca-install.1 b/install/tools/man/ipa-ca-install.1
index b70dfbd7f42db7ba0ee608e6c22181d0da26d7f0..13ef43a80aa16afad8b7432ef2bce361e45d1fb8 100644
--- a/install/tools/man/ipa-ca-install.1
+++ b/install/tools/man/ipa-ca-install.1
@@ -41,6 +41,9 @@ Do not use DNS for hostname lookup during installation
\fB\-\-skip\-conncheck\fR
Skip connection check to remote master
.TP
+\fB\-\-skip\-schema\-check\fR
+Skip check for updated CA DS schema on the remote master
+.TP
\fB\-U\fR, \fB\-\-unattended\fR
An unattended installation that will never prompt for user input
.SH "EXIT STATUS"
diff --git a/install/tools/man/ipa-replica-install.1 b/install/tools/man/ipa-replica-install.1
index 084b45436941b9f9a277155d2872824cfd700dfd..43d284f576a9c32b3318d7083fbc3d4ee418fd24 100644
--- a/install/tools/man/ipa-replica-install.1
+++ b/install/tools/man/ipa-replica-install.1
@@ -75,6 +75,9 @@ An unattended installation that will never prompt for user input
.TP
\fB\-\-no\-pkinit\fR
Disables pkinit setup steps
+.TP
+\fB\-\-skip\-schema\-check\fR
+Skip check for updated CA DS schema on the remote master
.SS "DNS OPTIONS"
.TP
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
index 68e1485cd5fa0febc27089705f8f5f22c1c22f94..a881ef113cb578b939942bd03af643c60ca35fa8 100644
--- a/ipaserver/install/cainstance.py
+++ b/ipaserver/install/cainstance.py
@@ -56,6 +56,7 @@ from ipaserver.install import installutils
from ipaserver.install import dsinstance
from ipaserver.install import certs
from ipaserver.install.installutils import ReplicaConfig
+from ipaserver.plugins import ldap2
from ipalib import util
from ipapython.ipa_log_manager import *
@@ -673,6 +674,7 @@ class CAInstance(service.Service):
str(self.master_replication_port),
"pki_clone_replication_clone_port":
dogtag.install_constants.DS_PORT,
+ "pki_clone_replicate_schema": "False",
"pki_clone_uri":
"https://%s"; % ipautil.format_netloc(self.master_host, 443)
}
@@ -1557,6 +1559,52 @@ class CAInstance(service.Service):
return master == 'New'
+
+def replica_ca_install_check(config, master_ds_port):
+ if not config.setup_ca:
+ return
+
+ cafile = config.dir + "/cacert.p12"
+ if not ipautil.file_exists(cafile):
+ # self-signed replica
+ return
+
+ master_ds_port = int(master_ds_port)
+
+ # Exit if we have an old-style (Dogtag 9) CA already installed
+ ca = CAInstance(config.realm_name, certs.NSS_DIR,
+ dogtag_constants=dogtag.Dogtag9Constants)
+ if ca.is_installed():
+ root_logger.info('Dogtag 9 style CA instance found')
+ sys.exit("A CA is already configured on this system.")
+
+ if master_ds_port != dogtag.Dogtag9Constants.DS_PORT:
+ root_logger.debug(
+ 'Installing CA Replica from master with a merged database')
+ return
+
+ # Check if the master has the necessary schema in its CA instance
+ ca_ldap_url = 'ldap://%s:%s' % (config.master_host_name, master_ds_port)
+ objectclass = 'ipaObject'
+ root_logger.debug('Checking if IPA schema is present in %s', ca_ldap_url)
+ connection = ldap2.IPASimpleLDAPObject(ca_ldap_url)
+ connection.start_tls_s()
+ connection.simple_bind_s(DN(('cn', 'Directory Manager')),
+ config.dirman_password)
+ rschema = connection.schema
+ if rschema.get_obj(ldap.schema.models.ObjectClass, objectclass):
+ root_logger.debug('Check OK')
+ else:
+ root_logger.critical(
+ 'The master CA directory server does not have necessary schema. '
+ 'Please copy the following script to all CA masters and run it '
+ 'on them: %s\n'
+ 'If you are certain that this is a false positive, use '
+ '--skip-schema-check.',
+ os.path.join(ipautil.SHARE_DIR, 'copy-schema-to-ca.py'))
+ exit('IPA schema missing on master CA directory server')
+
+
def install_replica_ca(config, master_ds_port, postinstall=False):
"""
Install a CA on a replica.
--
1.7.7.6
_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
