summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/replication.py
Commit message (Collapse)AuthorAgeFilesLines
* Update only selected attributes for winsync agreementTomas Babej2013-04-161-7/+2
| | | | | | | | | | | | Trying to insert nsDS5ReplicatedAttributeListTotal and nsds5ReplicaStripAttrs to winsync agreements caused upgrade errors. With this patch, these attributes are skipped for winsync agreements. Made find_ipa_replication_agreements() in replication.py more corresponding to find_replication_agreements. It returns list of entries instead of unicode strings now. https://fedorahosted.org/freeipa/ticket/3522
* Full system backup and restoreRob Crittenden2013-04-121-10/+153
| | | | | | | | | This will allow one to backup and restore the IPA files and data. This does not cover individual entry restoration. http://freeipa.org/page/V3/Backup_and_Restore https://fedorahosted.org/freeipa/ticket/3128
* Extend ipa-replica-manage to be able to manage DNA ranges.Rob Crittenden2013-03-131-0/+98
| | | | | | | | | | | | | | | | | Attempt to automatically save DNA ranges when a master is removed. This is done by trying to find a master that does not yet define a DNA on-deck range. If one can be found then the range on the deleted master is added. If one cannot be found then it is reported as an error. Some validation of the ranges are done to ensure that they do overlap an IPA local range and do not overlap existing DNA ranges configured on other masters. http://freeipa.org/page/V3/Recover_DNA_Ranges https://fedorahosted.org/freeipa/ticket/3321
* Remove ipaserver/ipaldap.pyPetr Viktorin2013-03-131-2/+1
| | | | | | In addition to removing the module, fix all places where it was imported. Preparation for: https://fedorahosted.org/freeipa/ticket/3446
* Replace IPAdmin.start_tls_s by an __init__ argumentPetr Viktorin2013-03-011-6/+6
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove search_s and search_ext_s from IPAdminPetr Viktorin2013-03-011-2/+4
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Inline waitForEntry in its only callerPetr Viktorin2013-03-011-1/+40
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* replace getEntry with get_entry (or get_entries if scope != SCOPE_BASE)Petr Viktorin2013-03-011-18/+23
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Fix typo and traceback suppression in replication.pyPetr Viktorin2013-03-011-3/+4
|
* Replace deleteEntry with delete_entryPetr Viktorin2013-03-011-7/+7
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Replace addEntry with add_entryPetr Viktorin2013-03-011-9/+9
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Replace getList by a get_entries methodPetr Viktorin2013-03-011-14/+18
| | | | | | | | | | | The find_entries method is cumbersome to use: it requires keyword arguments for simple uses, and callers are tempted to ignore the 'truncated' flag it returns. Introduce a simpler method, get_entries, that returns the found list directly, and raises an errors if the list is truncated. Replace the getList method by get_entries. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Replace entry.getValue by entry.single_valuePetr Viktorin2013-03-011-21/+23
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Replace IPAdmin.checkTask by replication.wait_for_taskPetr Viktorin2013-03-011-2/+23
| | | | | | The method was only used for waiting, not actual checking. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove IPAdmin.get_dns_sorted_by_lengthPetr Viktorin2013-03-011-12/+8
| | | | | | | A simple sort(key=len) is simpler both implementation-wise and semantics-wise. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove dbdir, binddn, bindpwd from IPAdminPetr Viktorin2013-03-011-1/+9
| | | | | | | The dbdir logic was moved to replication.py, the only caller. The binddn and bindpwd attributes were unused. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Replace add_s and delete_s by their newer equivalentsPetr Viktorin2013-03-011-6/+6
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Replace entry.setValue/setValues by item assignmentPetr Viktorin2013-03-011-6/+6
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Replace entry.getValues() by entry.get()Petr Viktorin2013-03-011-3/+3
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Replace setValue by keyword arguments when creating entriesPetr Viktorin2013-03-011-64/+89
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Add make_entry factory method to LDAPConnection.Jan Cholasta2013-03-011-9/+9
| | | | Replace all occurences of Entry instantiation with calls to make_entry.
* Remove some unused importsPetr Viktorin2013-03-011-5/+4
| | | | | | Remove all unused LDAP-related imports, plus some other ones. This should make it easier to quickly check what uses which LDAP wrapper
* Make ipa-csreplica-manage work with both merged and non-merged DBsPetr Viktorin2012-11-231-13/+11
| | | | | | | | | | | | The ipa-csreplica-manage tool often assumed that the port numbers are the same on both sides of a replication agreement. This assumption doesn't hold in a cluster with both old-style hosts and ones with merged DBs. When managing agreements, determine the port with the PKI (or merged) DS on each master, and use it. Also, in CSReplicationManager, always use starttls rather than ldaps://.
* Filter suffix in replication management toolsMartin Kosek2012-11-231-7/+30
| | | | | | | | | With the new unified Dogtag10 LDAP database, PKI-CA data and the agreements themselves are now in the main LDAP instance. Replication management tools now need to properly filter replication agreements based on the suffix to avoid clashing of agreements of different types.
* Changes to use a single database for dogtag and IPAAde Lee2012-11-231-9/+11
| | | | | | | | | | | | New servers that are installed with dogtag 10 instances will use a single database instance for dogtag and IPA, albeit with different suffixes. Dogtag will communicate with the instance through a database user with permissions to modify the dogtag suffix only. This user will authenticate using client auth using the subsystem cert for the instance. This patch includes changes to allow the creation of masters and clones with single ds instances.
* Fix CS replication management.Rob Crittenden2012-10-091-5/+17
| | | | | | | | | | | | | | | | | The master side should be on the local side, replica1, not the remote. This required reversing a few master variables. This impacts the naming of the replication agreements. When deleting an agreement pass in the DN of that agreement rather than trying to calculate what it is on-the-fly. We cannot be sure which side is the master/clone and since we search for it anyway to determine if the agreement exists it is more correct to use what we find. The force flag wasn't being passed into del_link so there was no way to force a deletion. https://fedorahosted.org/freeipa/ticket/2858
* Run the CLEANALLRUV task when deleting a replication agreement.Rob Crittenden2012-09-171-0/+68
| | | | | | | | | | | | This adds two new commands to ipa-replica-manage: list-ruv & clean-ruv list-ruv can be use to list the update vectors the master has configugured clean-ruv can be used to fire off the CLEANRUV task to remove a replication vector. It should be used with caution. https://fedorahosted.org/freeipa/ticket/2303
* Add nsds5ReplicaStripAttrs to replica agreementsPetr Viktorin2012-09-041-0/+9
| | | | | | | | | | Generalize the fix_replica_memberof update plugin to allow updating more replication attributes. Add nsds5ReplicaStripAttrs to replication agreements on update and replica install. https://fedorahosted.org/freeipa/ticket/2534
* Make replica install more robustMartin Kosek2012-09-031-12/+26
| | | | | | | | | | | | | | | | | Under certain circumstances, replica installation may fail in "enable GSSAPI for replication" step when it cannot sync LDAP service principals. There is often not much we can do as Directory Server may be in an unrecoverable state but we should at least wait longer before we give up. A function checking replication status was also fixed to give more accurate results by properly comparing start/end time of the replication process and returning an error message to calling function. This error message is then returned to user if do not manage to get the LDAP service principals to give him a pointer to the actual issue. https://fedorahosted.org/freeipa/ticket/2950
* Fix winsync agreements creationMartin Kosek2012-08-121-1/+1
| | | | | | | | | | | | | | Due to recent addition of ID range support to DsInstance, the class could no longer be instantiated when realm_name was passed but ID range parameters were not. This condition broke winsync agreements creation in ipa-replica-manage. Make sure that ID range computation in DsInstance does not crash in this cases so that winsync replica can be created. Also convert --binddn option of ipa-replica-manage script to IPA native DN type so that setup_agreement does not crash. https://fedorahosted.org/freeipa/ticket/2987
* Use DN objects instead of stringsJohn Dennis2012-08-121-98/+106
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Convert every string specifying a DN into a DN object * Every place a dn was manipulated in some fashion it was replaced by the use of DN operators * Add new DNParam parameter type for parameters which are DN's * DN objects are used 100% of the time throughout the entire data pipeline whenever something is logically a dn. * Many classes now enforce DN usage for their attributes which are dn's. This is implmented via ipautil.dn_attribute_property(). The only permitted types for a class attribute specified to be a DN are either None or a DN object. * Require that every place a dn is used it must be a DN object. This translates into lot of:: assert isinstance(dn, DN) sprinkled through out the code. Maintaining these asserts is valuable to preserve DN type enforcement. The asserts can be disabled in production. The goal of 100% DN usage 100% of the time has been realized, these asserts are meant to preserve that. The asserts also proved valuable in detecting functions which did not obey their function signatures, such as the baseldap pre and post callbacks. * Moved ipalib.dn to ipapython.dn because DN class is shared with all components, not just the server which uses ipalib. * All API's now accept DN's natively, no need to convert to str (or unicode). * Removed ipalib.encoder and encode/decode decorators. Type conversion is now explicitly performed in each IPASimpleLDAPObject method which emulates a ldap.SimpleLDAPObject method. * Entity & Entry classes now utilize DN's * Removed __getattr__ in Entity & Entity clases. There were two problems with it. It presented synthetic Python object attributes based on the current LDAP data it contained. There is no way to validate synthetic attributes using code checkers, you can't search the code to find LDAP attribute accesses (because synthetic attriutes look like Python attributes instead of LDAP data) and error handling is circumscribed. Secondly __getattr__ was hiding Python internal methods which broke class semantics. * Replace use of methods inherited from ldap.SimpleLDAPObject via IPAdmin class with IPAdmin methods. Directly using inherited methods was causing us to bypass IPA logic. Mostly this meant replacing the use of search_s() with getEntry() or getList(). Similarly direct access of the LDAP data in classes using IPAdmin were replaced with calls to getValue() or getValues(). * Objects returned by ldap2.find_entries() are now compatible with either the python-ldap access methodology or the Entity/Entry access methodology. * All ldap operations now funnel through the common IPASimpleLDAPObject giving us a single location where we interface to python-ldap and perform conversions. * The above 4 modifications means we've greatly reduced the proliferation of multiple inconsistent ways to perform LDAP operations. We are well on the way to having a single API in IPA for doing LDAP (a long range goal). * All certificate subject bases are now DN's * DN objects were enhanced thusly: - find, rfind, index, rindex, replace and insert methods were added - AVA, RDN and DN classes were refactored in immutable and mutable variants, the mutable variants are EditableAVA, EditableRDN and EditableDN. By default we use the immutable variants preserving important semantics. To edit a DN cast it to an EditableDN and cast it back to DN when done editing. These issues are fully described in other documentation. - first_key_match was removed - DN equalty comparison permits comparison to a basestring * Fixed ldapupdate to work with DN's. This work included: - Enhance test_updates.py to do more checking after applying update. Add test for update_from_dict(). Convert code to use unittest classes. - Consolidated duplicate code. - Moved code which should have been in the class into the class. - Fix the handling of the 'deleteentry' update action. It's no longer necessary to supply fake attributes to make it work. Detect case where subsequent update applies a change to entry previously marked for deletetion. General clean-up and simplification of the 'deleteentry' logic. - Rewrote a couple of functions to be clearer and more Pythonic. - Added documentation on the data structure being used. - Simplfy the use of update_from_dict() * Removed all usage of get_schema() which was being called prior to accessing the .schema attribute of an object. If a class is using internal lazy loading as an optimization it's not right to require users of the interface to be aware of internal optimization's. schema is now a property and when the schema property is accessed it calls a private internal method to perform the lazy loading. * Added SchemaCache class to cache the schema's from individual servers. This was done because of the observation we talk to different LDAP servers, each of which may have it's own schema. Previously we globally cached the schema from the first server we connected to and returned that schema in all contexts. The cache includes controls to invalidate it thus forcing a schema refresh. * Schema caching is now senstive to the run time context. During install and upgrade the schema can change leading to errors due to out-of-date cached schema. The schema cache is refreshed in these contexts. * We are aware of the LDAP syntax of all LDAP attributes. Every attribute returned from an LDAP operation is passed through a central table look-up based on it's LDAP syntax. The table key is the LDAP syntax it's value is a Python callable that returns a Python object matching the LDAP syntax. There are a handful of LDAP attributes whose syntax is historically incorrect (e.g. DistguishedNames that are defined as DirectoryStrings). The table driven conversion mechanism is augmented with a table of hard coded exceptions. Currently only the following conversions occur via the table: - dn's are converted to DN objects - binary objects are converted to Python str objects (IPA convention). - everything else is converted to unicode using UTF-8 decoding (IPA convention). However, now that the table driven conversion mechanism is in place it would be trivial to do things such as converting attributes which have LDAP integer syntax into a Python integer, etc. * Expected values in the unit tests which are a DN no longer need to use lambda expressions to promote the returned value to a DN for equality comparison. The return value is automatically promoted to a DN. The lambda expressions have been removed making the code much simpler and easier to read. * Add class level logging to a number of classes which did not support logging, less need for use of root_logger. * Remove ipaserver/conn.py, it was unused. * Consolidated duplicate code wherever it was found. * Fixed many places that used string concatenation to form a new string rather than string formatting operators. This is necessary because string formatting converts it's arguments to a string prior to building the result string. You can't concatenate a string and a non-string. * Simplify logic in rename_managed plugin. Use DN operators to edit dn's. * The live version of ipa-ldap-updater did not generate a log file. The offline version did, now both do. https://fedorahosted.org/freeipa/ticket/1670 https://fedorahosted.org/freeipa/ticket/1671 https://fedorahosted.org/freeipa/ticket/1672 https://fedorahosted.org/freeipa/ticket/1673 https://fedorahosted.org/freeipa/ticket/1674 https://fedorahosted.org/freeipa/ticket/1392 https://fedorahosted.org/freeipa/ticket/2872
* Enable SOA serial autoincrementMartin Kosek2012-07-131-11/+11
| | | | | | | | | | | | | | | | | | SOA serial autoincrement is a requirement for major DNS features, e.g. zone transfers or DNSSEC. Enable it by default in named.conf both for new and upgraded installations. Name of the bind-dyndb-ldap option is "serial_autoincrement". From now on, idnsSOAserial attribute also has to be put to replication agreement exclude list as serial will be incremented on each DNS server separately and won't be shared. Exclude list has to be updated both for new replication agreements and the current ones. Minimum number of connections for bind-dyndb-ldap has been rised to 4 connections, the setting will be updated during package upgrade. https://fedorahosted.org/freeipa/ticket/2554
* Centralize timeout for waiting for servers to start.Rob Crittenden2012-07-021-2/+0
| | | | | | | | | | | | | All service start/restart currently go through ipapython/platform so move the "wait for service to start" code there as well. A dictionary of known services and ports to wait on is defined in base.py This is referenced by the platforms by instance name to determine what to wait for. For the case of dirsrv if we get that as a plain name (no specific instance) it is assumed to be the main IPA service. https://fedorahosted.org/freeipa/ticket/2375 https://fedorahosted.org/freeipa/ticket/2610
* Add separate attribute to store trusted domain SIDAlexander Bokovoy2012-06-071-1/+5
| | | | | | | | | | | We need two attributes in the ipaNTTrustedDomain objectclass to store different kind of SID. Currently ipaNTSecurityIdentifier is used to store the Domain-SID of the trusted domain. A second attribute is needed to store the SID for the trusted domain user. Since it cannot be derived safely from other values and since it does not make sense to create a separate object for the user a new attribute is needed. https://fedorahosted.org/freeipa/ticket/2191
* Retry retrieving ldap principals when setting up replication.Rob Crittenden2012-05-221-18/+60
| | | | | | | | | | | | We've seen on a few occassions where one side or the other is missing the ldap principal. This causes replication to fail when trying to convert to using GSSAPI. If this happens force a synchronization again and try the retrieval again, up to 10 times. This should also make the error report clearer if even after the retries one of the principals doesn't exist. https://fedorahosted.org/freeipa/ticket/2737
* Remove duplicate and unused utility codePetr Viktorin2012-05-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPA has some unused code from abandoned features (Radius, ipa 1.x user input, commant-line tab completion), as well as some duplicate utilities. This patch cleans up the utility modules. Duplicate code consolidated into ipapython.ipautil: {ipalib.util,ipaserver.ipautil,ipapython.ipautil}.realm_to_suffix {ipaserver,ipapython}.ipautil.CIDict (with style improvements from the ipaserver version) {ipapython.entity,ipaserver.ipautil}.utf8_encode_value {ipapython.entity,ipaserver.ipautil}.utf8_encode_values ipalib.util.get_fqdn was removed in favor of the same function in ipaserver.install.installutils Removed unused code: ipalib.util: load_plugins_in_dir import_plugins_subpackage make_repr (was imported but unused; also removed from tests) ipapython.ipautil: format_list parse_key_value_pairs read_pairs_file read_items_file user_input_plain AttributeValueCompleter ItemCompleter ipaserver.ipautil: get_gsserror (a different version exists in ipapython.ipautil) ipaserver.ipautil ended up empty and is removed entirely. https://fedorahosted.org/freeipa/ticket/2650
* Fix ipa-replica-manage TLS connection errorMartin Kosek2012-03-141-2/+5
| | | | | | | | | | | | | | New version of openldap (openldap-2.4.26-6.fc16.x86_64) changed its ABI and broke our TLS connection in ipa-replica-manage. This makes it impossible to connect for example to Active Directory to set up a winsync replication. We always receive a connection error stating that Peer's certificate is not recognized even though we pass a correct certificate. This patch fixes the way we set up TLS. The change is backwards compatible with older versions of openldap. https://fedorahosted.org/freeipa/ticket/2500
* Remove memberPrincipal for deleted replicasMartin Kosek2012-03-021-2/+22
| | | | | | | | | | | | When a replica is deleted, its memberPrincipal entries in cn=s4u2proxy,cn=etc,SUFFIX were not removed. Then, if the replica is reinstalled and connected again, the installer would report an error with duplicate value in LDAP. This patch extends replica cleanup procedure to remove replica principal from s4u2proxy configuration. https://fedorahosted.org/freeipa/ticket/2451
* Fix managing winsync replication agreements with ipa-replica-manageRob Crittenden2012-02-271-1/+1
| | | | | | | | | | | | force-sync, re-initialize and del were not working because they all attempted to contact the AD server. winsync agreements are managed on the local 389-ds instance. This also: - requires root to create winsync agreement (for updating NSS db) - fixes filter in get_replication_agreement() to work with winsync https://fedorahosted.org/freeipa/ticket/2128
* Make sure memberof is in replication attribute exclusion list.Rob Crittenden2012-02-231-12/+17
| | | | | | | A previous bug caused this attribute to not be added which would lead to unnecessary replication. This runs as an updater plugin. https://fedorahosted.org/freeipa/ticket/2223
* Check for the existence of a replication agreement before deleting it.Rob Crittenden2012-01-301-0/+22
| | | | | | | | | | | | | When using ipa-replica-manage or ipa-csreplica-manage to delete an agreement with a host we would try to make a connection to that host prior to tryign to delete it. This meant that the trying to delete a host we don't have an agreement with would return a connection error instead of a "no agreement with host foo" error. Also display a completed message when an agreement is removed. https://fedorahosted.org/freeipa/ticket/2048 https://fedorahosted.org/freeipa/ticket/2125
* Leave nsds5replicaupdateschedule parameter unsetOndrej Hamada2012-01-241-11/+8
| | | | | | | | The nsDS5ReplicaUpdateSchedule parameter is omited what results in replication being run all the time. The parameter is still used for forcing replica update but after that action it is always deleted. https://fedorahosted.org/freeipa/ticket/1482
* Fix replication setupSimo Sorce2012-01-131-9/+19
| | | | | | Changes to add a cs-replication management tool mistakenly always set a flag that caused replicas to not add the list of attribute we exclude from replication.
* Fix LDAP add calls in replication moduleMartin Kosek2012-01-131-11/+11
| | | | | | | Replace conn.add_s(entry) with conn.addEntry(entry) to avoid function calls with an invalid number of parameters. https://fedorahosted.org/freeipa/ticket/2139
* ticket 2022 - modify codebase to utilize IPALogManager, obsoletes loggingJohn Dennis2011-11-231-23/+24
| | | | | | | | | | | | change default_logger_level to debug in configure_standard_logging add new ipa_log_manager module, move log_mgr there, also export root_logger from log_mgr. change all log_manager imports to ipa_log_manager and change log_manager.root_logger to root_logger. add missing import for parse_log_level()
* Replication: Adjust replica installation to omit processing memberof ↵JR Aquino2011-11-141-5/+23
| | | | | | | | | | | | | computations https://fedorahosted.org/freeipa/ticket/1794 If the master does not yet support the total update list feature we still run the memberof fixup task and not fail to replicate due to the new attribute not being settable. Jointly-developed-with: Simo Sorce <ssorce@redhat.com> Jointly-developed-with: Nathank Kinder <nkinder@redhat.com>
* Add a function for formatting network locations of the form host:port for ↵Jan Cholasta2011-10-051-3/+3
| | | | | | | | | use in URLs. If the host part is a literal IPv6 address, it must be enclosed in square brackets (RFC 2732). ticket 1869
* Remove checks for ds-replication pluginMartin Kosek2011-09-221-15/+0
| | | | | | | The replication plugin is no longer shipped as a separate package. Remove the code checking its existence. https://fedorahosted.org/freeipa/ticket/1815
* Convert server install code to platform-independent access to system servicesAlexander Bokovoy2011-09-131-2/+2
| | | | https://fedorahosted.org/freeipa/ticket/1605
* Clean up existing DN object usageJohn Dennis2011-07-291-4/+4
|
generated by cgit (git 2.34.1) at 2024-06-17 21:26:54 +0000