diff options
author | Rob Crittenden <rcritten@redhat.com> | 2011-03-18 11:19:53 -0400 |
---|---|---|
committer | Rob Crittenden <rcritten@redhat.com> | 2011-03-21 13:23:53 -0400 |
commit | ca5332951c68904b0763f79f3612209271206b2a (patch) | |
tree | d2e39143f5d1b7b78fb40fd906e0d722c1b19d3d /ipaserver/install/ldapupdate.py | |
parent | ba5e0c43070c1ec77e45a032cd3dabbe0f7a76fc (diff) | |
download | freeipa-ca5332951c68904b0763f79f3612209271206b2a.tar.gz freeipa-ca5332951c68904b0763f79f3612209271206b2a.tar.xz freeipa-ca5332951c68904b0763f79f3612209271206b2a.zip |
Automatically update IPA LDAP on rpm upgrades
Re-enable ldapi code in ipa-ldap-updater and remove the searchbase
restriction when run in --upgrade mode. This allows us to autobind
giving root Directory Manager powers.
This also:
* corrects the ipa-ldap-updater man page
* remove automatic --realm, --server, --domain options
* handle upgrade errors properly
* saves a copy of dse.ldif before we change it so it can be recovered
* fixes an error discovered by pylint
ticket 1087
Diffstat (limited to 'ipaserver/install/ldapupdate.py')
-rw-r--r-- | ipaserver/install/ldapupdate.py | 43 |
1 files changed, 26 insertions, 17 deletions
diff --git a/ipaserver/install/ldapupdate.py b/ipaserver/install/ldapupdate.py index a2eebebcc..44a95465f 100644 --- a/ipaserver/install/ldapupdate.py +++ b/ipaserver/install/ldapupdate.py @@ -109,7 +109,7 @@ class LDAPUpdate: if online: # Try out the password - #if not self.ldapi: + if not self.ldapi: try: conn = ipaldap.IPAdmin(fqdn, ldapi=True, realm=self.realm) conn.do_simple_bind(binddn="cn=directory manager", bindpw=self.dm_password) @@ -120,13 +120,16 @@ class LDAPUpdate: raise RuntimeError("Unable to connect to LDAP server %s" % fqdn) except ldap.INVALID_CREDENTIALS: raise RuntimeError("The password provided is incorrect for LDAP server %s" % fqdn) - # THIS IS COMMENTED OUT, BECAUSE: - # external_bind does work, but even as root, you don't always have - # enought power to do everything we need due to strict ACI rules - # - #else: - # conn = ipaldap.IPAdmin(ldapi=True, realm=self.realm) - # conn.do_external_bind(self.pw_name) + else: + conn = ipaldap.IPAdmin(ldapi=True, realm=self.realm) + try: + if os.getegid() == 0: + # autobind + conn.do_external_bind(self.pw_name) + else: + conn.do_sasl_gssapi_bind() + except ldap.LOCAL_ERROR, e: + raise RuntimeError('%s' % e.args[0].get('info', '').strip()) else: raise RuntimeError("Offline updates are not supported.") @@ -476,7 +479,7 @@ class LDAPUpdate: try: (old, new) = v.split(':', 1) except ValueError: - raise BadSyntax, "bad syntax in replace, needs to be in the format old: new in %s" % new_entry.dn + raise BadSyntax, "bad syntax in replace, needs to be in the format old: new in %s" % v try: e.remove(old) e.append(new) @@ -596,6 +599,9 @@ class LDAPUpdate: except errors.DatabaseError, e: logging.error("Update failed: %s", e) updated = False + except errors.ACIError, e: + logging.error("Update failed: %s", e) + updated = False if ("cn=index" in entry.dn and "cn=userRoot" in entry.dn): @@ -654,14 +660,17 @@ class LDAPUpdate: try: if self.online: - # THIS IS COMMENTED OUT, BECAUSE: - # external_bind does work, but even as root, you don't always have - # enought power to do everything we need due to strict ACI rules - # - #if self.ldapi: - # self.conn = ipaldap.IPAdmin(ldapi=True, realm=self.realm) - # self.conn.do_external_bind(self.pw_name) - #else: + if self.ldapi: + self.conn = ipaldap.IPAdmin(ldapi=True, realm=self.realm) + try: + if os.getegid() == 0: + # autobind + self.conn.do_external_bind(self.pw_name) + else: + self.conn.do_sasl_gssapi_bind() + except ldap.LOCAL_ERROR, e: + raise RuntimeError('%s' % e.args[0].get('info', '').strip()) + else: self.conn = ipaldap.IPAdmin(self.sub_dict['FQDN'], ldapi=self.ldapi, realm=self.realm) |