summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/replication.py
diff options
context:
space:
mode:
authorAde Lee <alee@redhat.com>2012-09-19 23:35:42 -0400
committerMartin Kosek <mkosek@redhat.com>2012-11-23 12:19:19 +0100
commit18a210996dc47dbc9979e5ee0bb9f184c22eb173 (patch)
tree41a99a8d78e7f32a5372518f36415ff2f15ca466 /ipaserver/install/replication.py
parent7960b5c67f0577e305d9fd86564b19957872d0e3 (diff)
downloadfreeipa.git-18a210996dc47dbc9979e5ee0bb9f184c22eb173.tar.gz
freeipa.git-18a210996dc47dbc9979e5ee0bb9f184c22eb173.tar.xz
freeipa.git-18a210996dc47dbc9979e5ee0bb9f184c22eb173.zip
Changes to use a single database for dogtag and IPA
New servers that are installed with dogtag 10 instances will use a single database instance for dogtag and IPA, albeit with different suffixes. Dogtag will communicate with the instance through a database user with permissions to modify the dogtag suffix only. This user will authenticate using client auth using the subsystem cert for the instance. This patch includes changes to allow the creation of masters and clones with single ds instances.
Diffstat (limited to 'ipaserver/install/replication.py')
-rw-r--r--ipaserver/install/replication.py20
1 files changed, 11 insertions, 9 deletions
diff --git a/ipaserver/install/replication.py b/ipaserver/install/replication.py
index 260e7bba..23de883a 100644
--- a/ipaserver/install/replication.py
+++ b/ipaserver/install/replication.py
@@ -27,7 +27,7 @@ from ipaserver import ipaldap
from ipapython import services as ipaservices
from ldap import modlist
from ipalib import api, util, errors
-from ipapython import ipautil
+from ipapython import ipautil, dogtag
from ipapython.dn import DN
CACERT = "/etc/ipa/ca.crt"
@@ -59,7 +59,7 @@ STRIP_ATTRS = ('modifiersName',
def replica_conn_check(master_host, host_name, realm, check_ca,
- admin_password=None):
+ dogtag_master_ds_port, admin_password=None):
"""
Check the ports used by the replica both locally and remotely to be sure
that replication will work.
@@ -77,10 +77,10 @@ def replica_conn_check(master_host, host_name, realm, check_ca,
args.extend(["--password", admin_password])
nolog=(admin_password,)
- if check_ca:
+ if check_ca and dogtag_master_ds_port == dogtag.Dogtag9Constants.DS_PORT:
args.append('--check-ca')
- (stdin, stderr, returncode) = ipautil.run(args,raiseonerr=False,capture_output=False,
- nolog=nolog)
+ (stdin, stderr, returncode) = ipautil.run(
+ args, raiseonerr=False, capture_output=False, nolog=nolog)
if returncode != 0:
sys.exit("Connection check failed!" +
@@ -958,10 +958,12 @@ class ReplicationManager(object):
newschedule = '2358-2359 0'
- filter = '(&(nsDS5ReplicaHost=%s)' \
- '(|(objectclass=nsDSWindowsReplicationAgreement)' \
- '(objectclass=nsds5ReplicationAgreement)))' % hostname
- entries = conn.getList(DN(('cn', 'config')), ldap.SCOPE_SUBTREE, filter)
+ filter = ('(&(nsDS5ReplicaHost=%s)'
+ '(&(!(nsDS5ReplicaRoot=o=ipaca))'
+ '(|(objectclass=nsDSWindowsReplicationAgreement)'
+ '(objectclass=nsds5ReplicationAgreement))))' % hostname)
+ entries = conn.getList(
+ DN(('cn', 'config')), ldap.SCOPE_SUBTREE, filter)
if len(entries) == 0:
root_logger.error("Unable to find replication agreement for %s" %
(hostname))