Re: [Freeipa-devel] [PATCH] 887 add missing aci prefix to dns acis
On Fri, 2011-10-07 at 11:09 -0400, Rob Crittenden wrote: Martin Kosek wrote: I tested the patch when I replaced all add: directives 40-dns.update with addifexist. The clean installation now did not produce any error, memberships were OK. However, updating existing installation with DNS was not OK - privileges are still without memberof attributes: # ipa privilege-find dns 2 privileges matched Privilege name: DNS Administrators Description: DNS Administrators Privilege name: DNS Servers Description: DNS Servers Number of entries returned 2 Martin Strange, it works for me. Can you try this updated patch? rob I must have been doing something wrong. This one works fine - both upgrade and a fresh installation. ACK. Martin ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 887 add missing aci prefix to dns acis
Martin Kosek wrote: On Thu, 2011-10-06 at 17:06 -0400, Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2011-10-06 at 14:05 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Wed, 2011-10-05 at 17:18 -0400, Rob Crittenden wrote: The aci prefix was missing in the description of the three dns acis which made them not show up when viewing their permission entries. rob This works fine, but it is just a part of a solution. DNS related privileges miss memberof attribute for the DNS permissions and thus the permissions are not listed: # ipa permission-show add dns entries Permission name: add dns entries Permissions: add Type: dnsrecord Granted to Privilege: DNS Administrators, DNS Servers # ipa privilege-show DNS Administrators Privilege name: DNS Administrators Description: DNS Administrators Missing permissions I think the reason is that the permissions are in a wrong order in the LDIF and are created before the privilege itself. When member links are being created for DNS permissions, the memberof plugin cannot add memberof attributes for the privilege since it does not exist yet. This is the main issue that the BZ bug complains about. Martin There are two problems: 1. The acis lacked a prefix so they didn't appear as permissions 2. The permission was added before the privilege so the memberof values weren't being calculated. This fixes it for new installs and adds an update to fix up existing installs. rob It works fine when doing upgrade. However, when running a clean install, I get these errors: # ipa-server-install --setup-dns ... [9/13]: publish CA cert [10/13]: creating a keytab for httpd [11/13]: configuring SELinux for httpd [12/13]: restarting httpd [13/13]: configuring httpd to start on boot done configuring httpd. Applying LDAP updates root : ERROR Add failure Object class violation: missing required attribute objectclass root : ERROR Add failure Object class violation: missing required attribute objectclass root : ERROR Add failure Object class violation: missing required attribute objectclass Restarting IPA to initialize updates before performing deletes: [1/2]: stopping directory server [2/2]: starting directory server done configuring dirsrv. Restarting the directory server Restarting the KDC Restarting the web server Configuring named: [1/9]: adding DNS container [2/9]: setting up our zone [3/9]: setting up reverse zone [4/9]: setting up our own record [5/9]: setting up kerberos principal [6/9]: setting up named.conf [7/9]: restarting named [8/9]: configuring named to start on boot [9/9]: changing resolv.conf to point to ourselves done configuring named. == Setup complete Do you hit this too? Permissions and privileges member attributes were OK though. Martin Bah, ok. We only create these permissions when dns is installed so I'll need to find some way to optionally add this. rob I needed to add a new type to the updater to only add new values if the entry exists. rob I still get the same error. We have a new handy addifnew update type ready, lets use it in these DNS .update file too :-) Martin addifnew adds single value attributes if they aren't already in the entry, that will cause the same error. rob ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 887 add missing aci prefix to dns acis
On Fri, 2011-10-07 at 08:52 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2011-10-06 at 17:06 -0400, Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2011-10-06 at 14:05 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Wed, 2011-10-05 at 17:18 -0400, Rob Crittenden wrote: The aci prefix was missing in the description of the three dns acis which made them not show up when viewing their permission entries. rob This works fine, but it is just a part of a solution. DNS related privileges miss memberof attribute for the DNS permissions and thus the permissions are not listed: # ipa permission-show add dns entries Permission name: add dns entries Permissions: add Type: dnsrecord Granted to Privilege: DNS Administrators, DNS Servers # ipa privilege-show DNS Administrators Privilege name: DNS Administrators Description: DNS Administrators Missing permissions I think the reason is that the permissions are in a wrong order in the LDIF and are created before the privilege itself. When member links are being created for DNS permissions, the memberof plugin cannot add memberof attributes for the privilege since it does not exist yet. This is the main issue that the BZ bug complains about. Martin There are two problems: 1. The acis lacked a prefix so they didn't appear as permissions 2. The permission was added before the privilege so the memberof values weren't being calculated. This fixes it for new installs and adds an update to fix up existing installs. rob It works fine when doing upgrade. However, when running a clean install, I get these errors: # ipa-server-install --setup-dns ... [9/13]: publish CA cert [10/13]: creating a keytab for httpd [11/13]: configuring SELinux for httpd [12/13]: restarting httpd [13/13]: configuring httpd to start on boot done configuring httpd. Applying LDAP updates root : ERROR Add failure Object class violation: missing required attribute objectclass root : ERROR Add failure Object class violation: missing required attribute objectclass root : ERROR Add failure Object class violation: missing required attribute objectclass Restarting IPA to initialize updates before performing deletes: [1/2]: stopping directory server [2/2]: starting directory server done configuring dirsrv. Restarting the directory server Restarting the KDC Restarting the web server Configuring named: [1/9]: adding DNS container [2/9]: setting up our zone [3/9]: setting up reverse zone [4/9]: setting up our own record [5/9]: setting up kerberos principal [6/9]: setting up named.conf [7/9]: restarting named [8/9]: configuring named to start on boot [9/9]: changing resolv.conf to point to ourselves done configuring named. == Setup complete Do you hit this too? Permissions and privileges member attributes were OK though. Martin Bah, ok. We only create these permissions when dns is installed so I'll need to find some way to optionally add this. rob I needed to add a new type to the updater to only add new values if the entry exists. rob I still get the same error. We have a new handy addifnew update type ready, lets use it in these DNS .update file too :-) Martin addifnew adds single value attributes if they aren't already in the entry, that will cause the same error. rob I tested the patch when I replaced all add: directives 40-dns.update with addifexist. The clean installation now did not produce any error, memberships were OK. However, updating existing installation with DNS was not OK - privileges are still without memberof attributes: # ipa privilege-find dns 2 privileges matched Privilege name: DNS Administrators Description: DNS Administrators Privilege name: DNS Servers Description: DNS Servers Number of entries returned 2 Martin ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 887 add missing aci prefix to dns acis
Martin Kosek wrote: On Fri, 2011-10-07 at 08:52 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2011-10-06 at 17:06 -0400, Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2011-10-06 at 14:05 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Wed, 2011-10-05 at 17:18 -0400, Rob Crittenden wrote: The aci prefix was missing in the description of the three dns acis which made them not show up when viewing their permission entries. rob This works fine, but it is just a part of a solution. DNS related privileges miss memberof attribute for the DNS permissions and thus the permissions are not listed: # ipa permission-show add dns entries Permission name: add dns entries Permissions: add Type: dnsrecord Granted to Privilege: DNS Administrators, DNS Servers # ipa privilege-show DNS Administrators Privilege name: DNS Administrators Description: DNS Administrators Missing permissions I think the reason is that the permissions are in a wrong order in the LDIF and are created before the privilege itself. When member links are being created for DNS permissions, the memberof plugin cannot add memberof attributes for the privilege since it does not exist yet. This is the main issue that the BZ bug complains about. Martin There are two problems: 1. The acis lacked a prefix so they didn't appear as permissions 2. The permission was added before the privilege so the memberof values weren't being calculated. This fixes it for new installs and adds an update to fix up existing installs. rob It works fine when doing upgrade. However, when running a clean install, I get these errors: # ipa-server-install --setup-dns ... [9/13]: publish CA cert [10/13]: creating a keytab for httpd [11/13]: configuring SELinux for httpd [12/13]: restarting httpd [13/13]: configuring httpd to start on boot done configuring httpd. Applying LDAP updates root : ERROR Add failure Object class violation: missing required attribute objectclass root : ERROR Add failure Object class violation: missing required attribute objectclass root : ERROR Add failure Object class violation: missing required attribute objectclass Restarting IPA to initialize updates before performing deletes: [1/2]: stopping directory server [2/2]: starting directory server done configuring dirsrv. Restarting the directory server Restarting the KDC Restarting the web server Configuring named: [1/9]: adding DNS container [2/9]: setting up our zone [3/9]: setting up reverse zone [4/9]: setting up our own record [5/9]: setting up kerberos principal [6/9]: setting up named.conf [7/9]: restarting named [8/9]: configuring named to start on boot [9/9]: changing resolv.conf to point to ourselves done configuring named. == Setup complete Do you hit this too? Permissions and privileges member attributes were OK though. Martin Bah, ok. We only create these permissions when dns is installed so I'll need to find some way to optionally add this. rob I needed to add a new type to the updater to only add new values if the entry exists. rob I still get the same error. We have a new handy addifnew update type ready, lets use it in these DNS .update file too :-) Martin addifnew adds single value attributes if they aren't already in the entry, that will cause the same error. rob I tested the patch when I replaced all add: directives 40-dns.update with addifexist. The clean installation now did not produce any error, memberships were OK. However, updating existing installation with DNS was not OK - privileges are still without memberof attributes: # ipa privilege-find dns 2 privileges matched Privilege name: DNS Administrators Description: DNS Administrators Privilege name: DNS Servers Description: DNS Servers Number of entries returned 2 Martin Strange, it works for me. Can you try this updated patch? rob From 3af60b5ed587b0a341ba8ceaf4045175954ca621 Mon Sep 17 00:00:00 2001 From: Rob Crittenden rcrit...@redhat.com Date: Wed, 5 Oct 2011 17:16:05 -0400 Subject: [PATCH] Fix DNS permissions and membership in privileges This resolves two issues: 1. The DNS acis lacked a prefix so weren't tied to permissions 2. The permissions were added before the privileges so the member values weren't calculated properly For updates we need to add in the members and recalculate memberof via a DS task. https://fedorahosted.org/freeipa/ticket/1898 --- install/share/dns.ldif | 46 +- install/tools/man/ipa-ldap-updater.1 |1 + install/updates/40-delegation.update |6 install/updates/40-dns.update| 22 install/updates/Makefile.am |1 + ipaserver/install/ldapupdate.py | 16 ++- 6 files changed, 67 insertions(+), 25 deletions(-)
Re: [Freeipa-devel] [PATCH] 887 add missing aci prefix to dns acis
Martin Kosek wrote: On Wed, 2011-10-05 at 17:18 -0400, Rob Crittenden wrote: The aci prefix was missing in the description of the three dns acis which made them not show up when viewing their permission entries. rob This works fine, but it is just a part of a solution. DNS related privileges miss memberof attribute for the DNS permissions and thus the permissions are not listed: # ipa permission-show add dns entries Permission name: add dns entries Permissions: add Type: dnsrecord Granted to Privilege: DNS Administrators, DNS Servers # ipa privilege-show DNS Administrators Privilege name: DNS Administrators Description: DNS Administrators Missing permissions I think the reason is that the permissions are in a wrong order in the LDIF and are created before the privilege itself. When member links are being created for DNS permissions, the memberof plugin cannot add memberof attributes for the privilege since it does not exist yet. This is the main issue that the BZ bug complains about. Martin There are two problems: 1. The acis lacked a prefix so they didn't appear as permissions 2. The permission was added before the privilege so the memberof values weren't being calculated. This fixes it for new installs and adds an update to fix up existing installs. rob From f0c46cac3afea07bbcf02af254f73c29dc122fd8 Mon Sep 17 00:00:00 2001 From: Rob Crittenden rcrit...@redhat.com Date: Wed, 5 Oct 2011 17:16:05 -0400 Subject: [PATCH] Fix DNS permissions and membership in privileges This resolves two issues: 1. The DNS acis lacked a prefix so weren't tied to permissions 2. The permissions were added before the privileges so the member values weren't calculated properly For updates we need to add in the members and recalculate memberof via a DS task. https://fedorahosted.org/freeipa/ticket/1898 --- install/share/dns.ldif | 46 +- install/updates/40-delegation.update |6 install/updates/40-dns.update| 22 install/updates/Makefile.am |1 + 4 files changed, 52 insertions(+), 23 deletions(-) create mode 100644 install/updates/40-dns.update diff --git a/install/share/dns.ldif b/install/share/dns.ldif index dc79222..1ffadb5 100644 --- a/install/share/dns.ldif +++ b/install/share/dns.ldif @@ -4,6 +4,29 @@ objectClass: nsContainer objectClass: top cn: dns +dn: $SUFFIX +changetype: modify +add: aci +aci: (target = ldap:///idnsname=*,cn=dns,$SUFFIX;)(version 3.0;acl permission:add dns entries;allow (add) groupdn = ldap:///cn=add dns entries,cn=permissions,cn=pbac,$SUFFIX;) +aci: (target = ldap:///idnsname=*,cn=dns,$SUFFIX;)(version 3.0;acl permission:remove dns entries;allow (delete) groupdn = ldap:///cn=remove dns entries,cn=permissions,cn=pbac,$SUFFIX;) +aci: (targetattr = idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || record || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy)(target = ldap:///idnsname=*,cn=dns,$SUFFIX;)(version 3.0;acl permission:update dns entries;allow (write) groupdn = ldap:///cn=update dns entries,cn=permissions,cn=pbac,$SUFFIX;) + +dn: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX +changetype: add +objectClass: top +objectClass: groupofnames +objectClass: nestedgroup +cn: DNS Administrators +description: DNS Administrators + +dn: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX +changetype: add +objectClass: top +objectClass: groupofnames +objectClass: nestedgroup +cn: DNS Servers +description: DNS Servers + dn: cn=add dns entries,cn=permissions,cn=pbac,$SUFFIX changetype: add objectClass: groupofnames @@ -30,26 +53,3 @@ cn: update dns entries description: Update DNS entries member: cn=DNS Administrators,cn=privileges,cn=pbac,$SUFFIX member: cn=DNS Servers,cn=privileges,cn=pbac,$SUFFIX - -dn: $SUFFIX -changetype: modify -add: aci -aci: (target = ldap:///idnsname=*,cn=dns,$SUFFIX;)(version 3.0;acl Add DNS entries;allow (add) groupdn = ldap:///cn=add dns entries,cn=permissions,cn=pbac,$SUFFIX;) -aci: (target = ldap:///idnsname=*,cn=dns,$SUFFIX;)(version 3.0;acl Remove DNS entries;allow (delete) groupdn = ldap:///cn=remove dns entries,cn=permissions,cn=pbac,$SUFFIX;) -aci: (targetattr = idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || record || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord
Re: [Freeipa-devel] [PATCH] 887 add missing aci prefix to dns acis
Martin Kosek wrote: On Thu, 2011-10-06 at 14:05 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Wed, 2011-10-05 at 17:18 -0400, Rob Crittenden wrote: The aci prefix was missing in the description of the three dns acis which made them not show up when viewing their permission entries. rob This works fine, but it is just a part of a solution. DNS related privileges miss memberof attribute for the DNS permissions and thus the permissions are not listed: # ipa permission-show add dns entries Permission name: add dns entries Permissions: add Type: dnsrecord Granted to Privilege: DNS Administrators, DNS Servers # ipa privilege-show DNS Administrators Privilege name: DNS Administrators Description: DNS Administrators Missing permissions I think the reason is that the permissions are in a wrong order in the LDIF and are created before the privilege itself. When member links are being created for DNS permissions, the memberof plugin cannot add memberof attributes for the privilege since it does not exist yet. This is the main issue that the BZ bug complains about. Martin There are two problems: 1. The acis lacked a prefix so they didn't appear as permissions 2. The permission was added before the privilege so the memberof values weren't being calculated. This fixes it for new installs and adds an update to fix up existing installs. rob It works fine when doing upgrade. However, when running a clean install, I get these errors: # ipa-server-install --setup-dns ... [9/13]: publish CA cert [10/13]: creating a keytab for httpd [11/13]: configuring SELinux for httpd [12/13]: restarting httpd [13/13]: configuring httpd to start on boot done configuring httpd. Applying LDAP updates root: ERRORAdd failure Object class violation: missing required attribute objectclass root: ERRORAdd failure Object class violation: missing required attribute objectclass root: ERRORAdd failure Object class violation: missing required attribute objectclass Restarting IPA to initialize updates before performing deletes: [1/2]: stopping directory server [2/2]: starting directory server done configuring dirsrv. Restarting the directory server Restarting the KDC Restarting the web server Configuring named: [1/9]: adding DNS container [2/9]: setting up our zone [3/9]: setting up reverse zone [4/9]: setting up our own record [5/9]: setting up kerberos principal [6/9]: setting up named.conf [7/9]: restarting named [8/9]: configuring named to start on boot [9/9]: changing resolv.conf to point to ourselves done configuring named. == Setup complete Do you hit this too? Permissions and privileges member attributes were OK though. Martin Bah, ok. We only create these permissions when dns is installed so I'll need to find some way to optionally add this. rob ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 887 add missing aci prefix to dns acis
Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2011-10-06 at 14:05 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Wed, 2011-10-05 at 17:18 -0400, Rob Crittenden wrote: The aci prefix was missing in the description of the three dns acis which made them not show up when viewing their permission entries. rob This works fine, but it is just a part of a solution. DNS related privileges miss memberof attribute for the DNS permissions and thus the permissions are not listed: # ipa permission-show add dns entries Permission name: add dns entries Permissions: add Type: dnsrecord Granted to Privilege: DNS Administrators, DNS Servers # ipa privilege-show DNS Administrators Privilege name: DNS Administrators Description: DNS Administrators Missing permissions I think the reason is that the permissions are in a wrong order in the LDIF and are created before the privilege itself. When member links are being created for DNS permissions, the memberof plugin cannot add memberof attributes for the privilege since it does not exist yet. This is the main issue that the BZ bug complains about. Martin There are two problems: 1. The acis lacked a prefix so they didn't appear as permissions 2. The permission was added before the privilege so the memberof values weren't being calculated. This fixes it for new installs and adds an update to fix up existing installs. rob It works fine when doing upgrade. However, when running a clean install, I get these errors: # ipa-server-install --setup-dns ... [9/13]: publish CA cert [10/13]: creating a keytab for httpd [11/13]: configuring SELinux for httpd [12/13]: restarting httpd [13/13]: configuring httpd to start on boot done configuring httpd. Applying LDAP updates root : ERROR Add failure Object class violation: missing required attribute objectclass root : ERROR Add failure Object class violation: missing required attribute objectclass root : ERROR Add failure Object class violation: missing required attribute objectclass Restarting IPA to initialize updates before performing deletes: [1/2]: stopping directory server [2/2]: starting directory server done configuring dirsrv. Restarting the directory server Restarting the KDC Restarting the web server Configuring named: [1/9]: adding DNS container [2/9]: setting up our zone [3/9]: setting up reverse zone [4/9]: setting up our own record [5/9]: setting up kerberos principal [6/9]: setting up named.conf [7/9]: restarting named [8/9]: configuring named to start on boot [9/9]: changing resolv.conf to point to ourselves done configuring named. == Setup complete Do you hit this too? Permissions and privileges member attributes were OK though. Martin Bah, ok. We only create these permissions when dns is installed so I'll need to find some way to optionally add this. rob I needed to add a new type to the updater to only add new values if the entry exists. rob From 5b42fd757840c088323f589cfb26b4607b892958 Mon Sep 17 00:00:00 2001 From: Rob Crittenden rcrit...@redhat.com Date: Wed, 5 Oct 2011 17:16:05 -0400 Subject: [PATCH] Fix DNS permissions and membership in privileges This resolves two issues: 1. The DNS acis lacked a prefix so weren't tied to permissions 2. The permissions were added before the privileges so the member values weren't calculated properly For updates we need to add in the members and recalculate memberof via a DS task. https://fedorahosted.org/freeipa/ticket/1898 --- install/share/dns.ldif | 46 +- install/tools/man/ipa-ldap-updater.1 |1 + install/updates/40-delegation.update |6 install/updates/40-dns.update| 22 install/updates/Makefile.am |1 + ipaserver/install/ldapupdate.py | 16 ++- 6 files changed, 67 insertions(+), 25 deletions(-) create mode 100644 install/updates/40-dns.update diff --git a/install/share/dns.ldif b/install/share/dns.ldif index dc79222..1ffadb5 100644 --- a/install/share/dns.ldif +++ b/install/share/dns.ldif @@ -4,6 +4,29 @@ objectClass: nsContainer objectClass: top cn: dns +dn: $SUFFIX +changetype: modify +add: aci +aci: (target = ldap:///idnsname=*,cn=dns,$SUFFIX;)(version 3.0;acl permission:add dns entries;allow (add) groupdn = ldap:///cn=add dns entries,cn=permissions,cn=pbac,$SUFFIX;) +aci: (target = ldap:///idnsname=*,cn=dns,$SUFFIX;)(version 3.0;acl permission:remove dns entries;allow (delete) groupdn = ldap:///cn=remove dns entries,cn=permissions,cn=pbac,$SUFFIX;) +aci: (targetattr = idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || record || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord ||
