Add LDAP upgrade over ldapi support.

This disables all but the ldapi listener in DS so it will be quiet when
we perform our upgrades. It is expected that any other clients that
also use ldapi will be shut down by other already (krb5 and dns).

Add ldapi as an option in ipaldap and add the beginning of pure offline
support (e.g. direct editing of LDIF files).

1 files changed, 37 insertions, 14 deletions

diff --git a/ipaserver/install/ldapupdate.py b/ipaserver/install/ldapupdate.py
index dff94783c..91ff80f55 100644
--- a/ipaserver/install/ldapupdate.py
+++ b/ipaserver/install/ldapupdate.py
@@ -38,6 +38,7 @@ import platform
 import time
 import random
 import os
+import pwd
 import fnmatch
 import csv
 
@@ -48,16 +49,23 @@ class BadSyntax(Exception):
         return repr(self.value)
 
 class LDAPUpdate:
-    def __init__(self, dm_password, sub_dict={}, live_run=True):
+    def __init__(self, dm_password, sub_dict={}, live_run=True,
+                 online=True, ldapi=False):
         """dm_password = Directory Manager password
            sub_dict = substitution dictionary
            live_run = Apply the changes or just test
+           online = do an online LDAP update or use an experimental LDIF updater
+           ldapi = bind using ldapi. This assumes autobind is enabled.
         """
         self.sub_dict = sub_dict
         self.live_run = live_run
         self.dm_password = dm_password
         self.conn = None
         self.modified = False
+        self.online = online
+        self.ldapi = ldapi
+
+        self.pw_name = pwd.getpwuid(os.geteuid()).pw_name
 
         krbctx = krbV.default_context()
 
@@ -68,6 +76,7 @@ class LDAPUpdate:
         domain = ipautil.get_domain_name()
         libarch = self.__identify_arch()
         suffix = util.realm_to_suffix(krbctx.default_realm)
+        self.realm = krbctx.default_realm
 
         if not self.sub_dict.get("REALM"):
             self.sub_dict["REALM"] = krbctx.default_realm
@@ -84,17 +93,24 @@ class LDAPUpdate:
         if not self.sub_dict.get("TIME"):
             self.sub_dict["TIME"] = int(time.time())
 
-        # Try out the password
-        try:
-            conn = ipaldap.IPAdmin(fqdn)
-            conn.do_simple_bind(bindpw=self.dm_password)
-            conn.unbind()
-        except ldap.CONNECT_ERROR:
-            raise RuntimeError("Unable to connect to LDAP server %s" % fqdn)
-        except ldap.SERVER_DOWN:
-            raise RuntimeError("Unable to connect to LDAP server %s" % fqdn)
-        except ldap.INVALID_CREDENTIALS:
-            raise RuntimeError("The password provided is incorrect for LDAP server %s" % fqdn)
+        if online:
+            # Try out the password
+            if not self.ldapi:
+                try:
+                    conn = ipaldap.IPAdmin(fqdn)
+                    conn.do_simple_bind(bindpw=self.dm_password)
+                    conn.unbind()
+                except ldap.CONNECT_ERROR:
+                    raise RuntimeError("Unable to connect to LDAP server %s" % fqdn)
+                except ldap.SERVER_DOWN:
+                    raise RuntimeError("Unable to connect to LDAP server %s" % fqdn)
+                except ldap.INVALID_CREDENTIALS:
+                    raise RuntimeError("The password provided is incorrect for LDAP server %s" % fqdn)
+            else:
+                conn = ipaldap.IPAdmin(ldapi=True, realm=self.realm)
+                conn.do_external_bind(self.pw_name)
+        else:
+            raise RuntimeError("Offline updates are not supported.")
 
     # The following 2 functions were taken from the Python
     # documentation at http://docs.python.org/library/csv.html
@@ -595,8 +611,15 @@ class LDAPUpdate:
         """
 
         try:
-            self.conn = ipaldap.IPAdmin(self.sub_dict['FQDN'])
-            self.conn.do_simple_bind(bindpw=self.dm_password)
+            if self.online:
+                if self.ldapi:
+                    self.conn = ipaldap.IPAdmin(ldapi=True, realm=self.realm)
+                    self.conn.do_external_bind(self.pw_name)
+                else:
+                    self.conn = ipaldap.IPAdmin(self.sub_dict['FQDN'])
+                    self.conn.do_simple_bind(bindpw=self.dm_password)
+            else:
+                raise RuntimeError("Offline updates are not supported.")
             all_updates = {}
             dn_list = {}
             for f in files: