summaryrefslogtreecommitdiffstats
path: root/install/tools/ipa-ca-install
diff options
context:
space:
mode:
authorPetr Viktorin <pviktori@redhat.com>2012-10-24 04:37:16 -0400
committerMartin Kosek <mkosek@redhat.com>2012-11-23 12:19:19 +0100
commit1d3ddeff54d91111d7f4f3042a22af76275ef361 (patch)
treec7e2ee72e66fca22786c3bb9d99b34634584905d /install/tools/ipa-ca-install
parent18a210996dc47dbc9979e5ee0bb9f184c22eb173 (diff)
downloadfreeipa-1d3ddeff54d91111d7f4f3042a22af76275ef361.tar.gz
freeipa-1d3ddeff54d91111d7f4f3042a22af76275ef361.tar.xz
freeipa-1d3ddeff54d91111d7f4f3042a22af76275ef361.zip
Fix schema replication from old masters
The new merged database will replicate with both the IPA and CA trees, so all DS instances (IPA and CA on the existing master, and the merged one on the replica) need to have the same schema. Dogtag does all its schema modifications online. Those are replicated normally. The basic IPA schema, however, is delivered in ldif files, which are not replicated. The files are not present on old CA DS instances. Any schema update that references objects in these files will fail. The whole 99user.ldif (i.e. changes introduced dynamically over LDAP) is replicated as a blob. If we updated the old master's CA schema dynamically during replica install, it would conflict with updates done during the installation: the one with the lower CSN would get lost. Dogtag's spawn script recently grew a new flag, 'pki_clone_replicate_schema'. Turning it off tells Dogtag to create its schema in the clone, where the IPA modifications are taking place, so that it is not overwritten by the IPA schema on replication. The patch solves the problems by: - In __spawn_instance, turning off the pki_clone_replicate_schema flag. - Providing a script to copy the IPA schema files to the CA DS instance. The script needs to be copied to old masters and run there. - At replica CA install, checking if the schema is updated, and failing if not. The --skip-schema-check option is added to ipa-{replica,ca}-install to override the check. All pre-3.1 CA servers in a domain will have to have the script run on them to avoid schema replication errors. https://fedorahosted.org/freeipa/ticket/3213
Diffstat (limited to 'install/tools/ipa-ca-install')
-rwxr-xr-xinstall/tools/ipa-ca-install7
1 files changed, 7 insertions, 0 deletions
diff --git a/install/tools/ipa-ca-install b/install/tools/ipa-ca-install
index 05dce8ae5..aefcee8e5 100755
--- a/install/tools/ipa-ca-install
+++ b/install/tools/ipa-ca-install
@@ -58,6 +58,8 @@ def parse_options():
help="Do not use DNS for hostname lookup during installation")
parser.add_option("--skip-conncheck", dest="skip_conncheck", action="store_true",
default=False, help="skip connection check to remote master")
+ parser.add_option("--skip-schema-check", dest="skip_schema_check", action="store_true",
+ default=False, help="skip check for updated CA DS schema on the remote master")
parser.add_option("-U", "--unattended", dest="unattended", action="store_true",
default=False, help="unattended installation never prompts the user")
@@ -154,6 +156,11 @@ def main():
config.master_host_name, config.host_name, config.realm_name, True,
dogtag_master_ds_port, options.admin_password)
+ if options.skip_schema_check:
+ root_logger.info("Skipping CA DS schema check")
+ else:
+ cainstance.replica_ca_install_check(config, dogtag_master_ds_port)
+
# Configure the CA if necessary
(CA, cs) = cainstance.install_replica_ca(
config, dogtag_master_ds_port, postinstall=True)