Initial replication setup.

This add replication setup through two new commands: ipa-replica-prepare
and ipa-replica-install. The procedure is to run ipa-replica-prepare
on an existing master. This will collect information about the realm
and the current master and create a file storing all of the information.
After copying that file to the new replica, ipa-replica-install is
run (with -r to create a read-only replica).

This version of the patch also includes fixes for the sasl mappings
on the replicas.

Remaining features:
- ssl for replication.
- automatic configuration of mesh topology for
  master (or a simpler way to replicate multiple
  masters.
- tool for view / configuring current replication.

5 files changed, 276 insertions, 159 deletions

diff --git a/ipa-server/ipa-install/Makefile.am b/ipa-server/ipa-install/Makefile.am
index 9ecf7e20d..4765cfb54 100644
--- a/ipa-server/ipa-install/Makefile.am
+++ b/ipa-server/ipa-install/Makefile.am
@@ -6,6 +6,8 @@ SUBDIRS =			\
 
 sbin_SCRIPTS =			\
 	ipa-server-install	\
+	ipa-replica-install	\
+	ipa-replica-prepare	\
 	$(NULL)
 
 appdir = $(IPA_DATA_DIR)
diff --git a/ipa-server/ipa-install/ipa-replica-install b/ipa-server/ipa-install/ipa-replica-install
new file mode 100644
index 000000000..706dc323d
--- /dev/null
+++ b/ipa-server/ipa-install/ipa-replica-install
@@ -0,0 +1,142 @@
+#! /usr/bin/python -E
+# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
+#
+# Copyright (C) 2007  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; version 2 or later
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+#
+
+import sys
+sys.path.append("/usr/share/ipa")
+
+import tempfile
+from ConfigParser import SafeConfigParser
+
+from ipa import ipautil
+
+from ipaserver import dsinstance, replication, installutils, krbinstance, service
+from ipaserver import httpinstance, webguiinstance, radiusinstance, ntpinstance
+
+class ReplicaConfig:
+    def __init__(self):
+        self.realm_name = ""
+        self.master_host_name = ""
+        self.dirman_password = ""
+        self.ds_user = ""
+        self.host_name = ""
+        self.repl_password = ""
+        self.dir = ""
+
+def parse_options():
+    from optparse import OptionParser
+    parser = OptionParser()
+    parser.add_option("-r", "--read-only", dest="master", action="store_false",
+                      default=True, help="create read-only replica - default is master")
+
+    options, args = parser.parse_args()
+
+    if len(args) != 1:
+        parser.error("you must provide a file generated by ipa-replica-prepare")
+
+    return options, args[0]
+
+def get_dirman_password():
+    return installutils.read_password("Directory Manager (existing master)")
+
+def expand_info(filename):
+    top_dir = tempfile.mkdtemp("ipa")
+    dir = top_dir + "/realm_info"
+    ipautil.run(["tar", "xfz", filename, "-C", top_dir])
+
+    return top_dir, dir
+
+def read_info(dir, rconfig):
+    filename = dir + "/realm_info"
+    fd = open(filename)
+    config = SafeConfigParser()
+    config.readfp(fd)
+
+    rconfig.realm_name = config.get("realm", "realm_name")
+    rconfig.master_host_name = config.get("realm", "master_host_name")
+    rconfig.ds_user = config.get("realm", "ds_user")
+
+def get_host_name():
+    hostname = installutils.get_fqdn()
+    try:
+        installutils.verify_fqdn(hostname)
+    except RuntimeError, e:
+        logging.error(str(e))
+        sys.exit(1)
+
+    return hostname
+
+def install_ds(config):
+    dsinstance.check_existing_installation()
+    dsinstance.check_ports()
+
+    ds = dsinstance.DsInstance()
+    ds.create_instance(config.ds_user, config.realm_name, config.host_name, config.dirman_password)
+
+def install_krb(config):
+    krb = krbinstance.KrbInstance()
+    ldappwd_filename = config.dir + "/ldappwd"
+    krb.create_replica(config.ds_user, config.realm_name, config.host_name,
+                       config.dirman_password, ldappwd_filename)
+
+def install_http(config):
+    http = httpinstance.HTTPInstance()
+    http.create_instance(config.realm_name, config.host_name)
+
+def main():
+    options, filename = parse_options()
+    top_dir, dir = expand_info(filename)
+    
+    config = ReplicaConfig()
+    read_info(dir, config)
+    config.host_name = get_host_name()
+    config.repl_password = "box"
+    config.dir = dir
+
+    # get the directory manager password
+    config.dirman_password = get_dirman_password()
+
+    install_ds(config)
+    
+    repl = replication.ReplicationManager(config.host_name, config.dirman_password)
+    repl.setup_replication(config.master_host_name, config.realm_name, options.master)
+
+    install_krb(config)
+    install_http(config)
+    
+    # Create a Web Gui instance
+    webgui = webguiinstance.WebGuiInstance()
+    webgui.create_instance()
+
+    # Create a radius instance
+    radius = radiusinstance.RadiusInstance()
+    # FIXME: ldap_server should be derived, not hardcoded to localhost, also should it be a URL?
+    radius.create_instance(config.realm_name, config.host_name, 'localhost')
+
+    # Configure ntpd
+    ntp = ntpinstance.NTPInstance()
+    ntp.create_instance()
+
+
+    service.restart("dirsrv")
+    service.restart("krb5kdc")
+    
+main()
+    
+    
diff --git a/ipa-server/ipa-install/ipa-replica-prepare b/ipa-server/ipa-install/ipa-replica-prepare
new file mode 100644
index 000000000..705c731d8
--- /dev/null
+++ b/ipa-server/ipa-install/ipa-replica-prepare
@@ -0,0 +1,114 @@
+#! /usr/bin/python -E
+# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
+#
+# Copyright (C) 2007  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; version 2 or later
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+#
+
+import sys
+sys.path.append("/usr/share/ipa")
+
+import logging, tempfile, shutil, os, pwd
+from ConfigParser import SafeConfigParser
+import krbV
+
+from ipa import ipautil
+from ipaserver import dsinstance
+from ipaserver import installutils
+
+certutil = "/usr/bin/certutil"
+
+def get_host_name():
+    hostname = installutils.get_fqdn()
+    try:
+        installutils.verify_fqdn(hostname)
+    except RuntimeError, e:
+        logging.error(str(e))
+        sys.exit(1)
+
+    return hostname
+
+def get_realm_name():
+    c = krbV.default_context()
+    return c.default_realm
+
+def check_ipa_configuration(realm_name):
+    config_dir = dsinstance.config_dirname(realm_name)
+    if not ipautil.dir_exists(config_dir):
+        logging.error("could not find directory instance: %s" % config_dir)
+        sys.exit(1)
+
+def create_certdb(ds_dir, dir):
+    # copy the passwd, noise, and pin files
+    shutil.copyfile(ds_dir + "/pwdfile.txt", dir + "/pwdfile.txt")
+    shutil.copyfile(ds_dir + "/noise.txt", dir + "/noise.txt")
+    shutil.copyfile(ds_dir + "/pin.txt", dir + "/pin.txt")
+
+    # create a new cert db
+    ipautil.run([certutil, "-N", "-d", dir, "-f", dir + "/pwdfile.txt"])
+
+    # Add the CA cert
+    ipautil.run([certutil, "-A", "-d", dir, "-n", "CA certificate", "-t", "CT,CT", "-a", "-i",
+                 ds_dir + "/cacert.asc"])
+
+def get_ds_user(ds_dir):
+    uid = os.stat(ds_dir).st_uid
+    user = pwd.getpwuid(uid)[0]
+
+    return user
+
+def copy_files(realm_name, dir):
+    shutil.copy("/var/kerberos/krb5kdc/ldappwd", dir + "/ldappwd")
+    
+    
+def save_config(dir, realm_name, host_name, ds_user):
+    config = SafeConfigParser()
+    config.add_section("realm")
+    config.set("realm", "realm_name", realm_name)
+    config.set("realm", "master_host_name", host_name)
+    config.set("realm", "ds_user", ds_user)
+    fd = open(dir + "/realm_info", "w")
+    config.write(fd)
+    
+
+def main():
+    realm_name = get_realm_name()
+    host_name = get_host_name()
+    ds_dir = dsinstance.config_dirname(realm_name)
+    ds_user = get_ds_user(ds_dir)
+
+    check_ipa_configuration(realm_name)
+
+    top_dir = tempfile.mkdtemp("ipa")
+    dir = top_dir + "/realm_info"
+    os.mkdir(dir, 0700)
+
+    create_certdb(ds_dir, dir)
+
+    copy_files(realm_name, dir)
+
+    save_config(dir, realm_name, host_name, ds_user)
+
+    ipautil.run(["/bin/tar", "cfz", "replica-info-" + realm_name, "-C", top_dir, "realm_info"])
+
+    shutil.rmtree(dir)
+
+main()    
+    
+
+
+    
+    
diff --git a/ipa-server/ipa-install/ipa-server-install b/ipa-server/ipa-install/ipa-server-install
index 2de687fd7..b957e522f 100644
--- a/ipa-server/ipa-install/ipa-server-install
+++ b/ipa-server/ipa-install/ipa-server-install
@@ -34,7 +34,6 @@ import socket
 import errno
 import logging
 import pwd
-import getpass
 import subprocess
 import signal
 import shutil
@@ -51,8 +50,9 @@ import ipaserver.radiusinstance
 import ipaserver.webguiinstance
 
 from ipaserver import service
+from ipaserver.installutils import *
 
-from ipa.ipautil import run
+from ipa.ipautil import *
 
 def parse_options():
     parser = OptionParser(version=VERSION)
@@ -86,39 +86,6 @@ def parse_options():
 
     return options
 
-def logging_setup(options):
-    # Always log everything (i.e., DEBUG) to the log
-    # file.
-    logging.basicConfig(level=logging.DEBUG,
-                        format='%(asctime)s %(levelname)s %(message)s',
-                        filename='ipaserver-install.log',
-                        filemode='w')
-
-    console = logging.StreamHandler()
-    # If the debug option is set, also log debug messages to the console
-    if options.debug:
-        console.setLevel(logging.DEBUG)
-    else:
-        # Otherwise, log critical and error messages
-        console.setLevel(logging.ERROR)
-    formatter = logging.Formatter('%(name)-12s: %(levelname)-8s %(message)s')
-    console.setFormatter(formatter)
-    logging.getLogger('').addHandler(console)
-
-def erase_ds_instance_data(serverid):
-    try:
-        shutil.rmtree("/etc/dirsrv/slapd-%s" % serverid)
-    except:
-        pass
-    try:
-        shutil.rmtree("/var/lib/dirsrv/slapd-%s" % serverid)
-    except:
-        pass
-    try:
-        shutil.rmtree("/var/lock/dirsrv/slapd-%s" % serverid)
-    except:
-        pass
-
 def signal_handler(signum, frame):
     global ds
     print "\nCleaning up..."
@@ -126,59 +93,9 @@ def signal_handler(signum, frame):
         print "Removing configuration for %s instance" % ds.serverid
         ds.stop()
         if ds.serverid:
-            erase_ds_instance_data (ds.serverid)
+            ipaserver.dsinstance.erase_ds_instance_data (ds.serverid)
     sys.exit(1)
 
-def check_existing_installation():
-    dirs = glob.glob("/etc/dirsrv/slapd-*")
-    if not dirs:
-        return
-    print ""
-    print "An existing Directory Server has been detected."
-    yesno = raw_input("Do you wish to remove it and create a new one? [no]: ")
-    if not yesno or yesno.lower()[0] != "y":
-        sys.exit(1)
-
-    try:
-        run(["/sbin/service", "dirsrv", "stop"])
-    except:
-        pass
-    for d in dirs:
-        serverid = os.path.basename(d).split("slapd-", 1)[1]
-        if serverid:
-            erase_ds_instance_data(serverid)
-
-def check_ports():
-    ds_unsecure = port_available(389)
-    ds_secure = port_available(636)
-    if not ds_unsecure or not ds_secure:
-        print "IPA requires ports 389 and 636 for the Directory Server."
-        print "These are currently in use:"
-        if not ds_unsecure:
-            print "\t389"
-        if not ds_secure:
-            print "\t636"
-        sys.exit(1)
-
-def get_fqdn():
-    fqdn = ""
-    try:
-        fqdn = socket.getfqdn()
-    except:
-        try:
-            fqdn = socket.gethostname()
-        except:
-            fqdn = ""
-    return fqdn
-   
-def verify_fqdn(host_name):
-    is_ok = True
-    if len(host_name.split(".")) < 2 or host_name == "localhost.localdomain":
-        print "Invalid hostname: " + host_name
-        print "This host name can't be used as a hostname for an IPA Server"
-        is_ok = False
-    return is_ok
-
 def read_host_name(host_default):
     host_ok = False
     host_name = ""
@@ -198,7 +115,9 @@ def read_host_name(host_default):
             host_name = host_default
         else:
             host_name = host_input
-        if not verify_fqdn(host_name):
+        try:
+            verify_fqdn(host_name)
+        except:
             host_name = ""
             continue
         else:
@@ -256,36 +175,6 @@ def read_ip_address(host_name):
 
         return ip
 
-def port_available(port):
-    """Try to bind to a port on the wildcard host
-       Return 1 if the port is available
-       Return 0 if the port is in use
-    """
-    rv = 1
-
-    try:
-        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-        s.bind(('', port))
-        s.shutdown(0)
-        s.close()
-    except socket.error, e:
-        if e[0] == errno.EADDRINUSE:
-            rv = 0
-
-    if rv:
-        try:
-            s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
-            s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-            s.bind(('', port))
-            s.shutdown(0)
-            s.close()
-        except socket.error, e:
-            if e[0] == errno.EADDRINUSE:
-                rv = 0
-
-    return rv
-
 def read_ds_user():
     print "The server must run as a specific user in a specific group."
     print "It is strongly recommended that this user should have no privileges"
@@ -333,23 +222,6 @@ def read_realm_name(domain_name):
             realm_name = upper_dom
     return realm_name
 
-def read_password(user):
-    correct = False
-    pwd = ""
-    while not correct:
-        pwd = getpass.getpass(user + " password: ")
-        if not pwd:
-            continue
-        pwd_confirm = getpass.getpass("Password (confirm): ")
-        if pwd != pwd_confirm:
-            print "Password mismatch!"
-            print ""
-        else:
-            correct = True
-        #TODO: check validity/length
-    print ""
-    return pwd
-
 def read_dm_password():
     print "Certain directory server operations require an administrative user."
     print "This user is referred to as the Directory Manager and has full access"
@@ -392,6 +264,8 @@ def main():
     global ds
     ds = None
 
+    options = parse_options()
+
     if os.getegid() != 0:
         print "Must be root to setup server"
         return
@@ -399,17 +273,17 @@ def main():
     signal.signal(signal.SIGTERM, signal_handler)
     signal.signal(signal.SIGINT, signal_handler)
 
+    standard_logging_setup("ipaserver-install.log", options.debug)
+
     print "=============================================================================="
     print "This program will setup the FreeIPA Server."
     print ""
     print "To accept the default shown in brackets, press the Enter key."
     print ""
 
-    check_existing_installation()
-    check_ports()
+    ipaserver.dsinstance.check_existing_installation()
+    ipaserver.dsinstance.check_ports()
 
-    options = parse_options()
-    logging_setup(options)
 
     ds_user = ""
     realm_name = ""
@@ -439,10 +313,13 @@ def main():
         host_default = get_fqdn()
         
     if options.unattended:
-        if not verify_fqdn(host_default):
+        try:
+            verify_fqdn(host_default)
+        except RuntimeError, e:
+            logging.error(str(e) + "\n")
             return "-Fatal Error-"
-        else:
-            host_name = host_default
+
+        host_name = host_default
     else:
         host_name = read_host_name(host_default)
     
diff --git a/ipa-server/ipa-install/share/kerberos.ldif b/ipa-server/ipa-install/share/kerberos.ldif
index d55f39ce4..75057aa3a 100644
--- a/ipa-server/ipa-install/share/kerberos.ldif
+++ b/ipa-server/ipa-install/share/kerberos.ldif
@@ -14,22 +14,4 @@ objectClass: top
 cn: kerberos
 aci: (targetattr="*")(version 3.0; acl "KDC System Account"; allow (all) userdn= "ldap:///uid=kdc,cn=sysaccounts,cn=etc,$SUFFIX";)
 
-#sasl mapping
-dn: cn=Full Principal,cn=mapping,cn=sasl,cn=config
-changetype: add
-objectclass: top
-objectclass: nsSaslMapping
-cn: Full Principal
-nsSaslMapRegexString: \(.*\)@\(.*\)
-nsSaslMapBaseDNTemplate: $SUFFIX
-nsSaslMapFilterTemplate: (krbPrincipalName=\1@\2)
-
-dn: cn=Name Only,cn=mapping,cn=sasl,cn=config
-changetype: add
-objectclass: top
-objectclass: nsSaslMapping
-cn: Name Only
-nsSaslMapRegexString: \(.*\)
-nsSaslMapBaseDNTemplate: $SUFFIX
-nsSaslMapFilterTemplate: (krbPrincipalName=\1@$REALM)