summaryrefslogtreecommitdiffstats
path: root/install
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2011-11-23 16:52:40 -0500
committerRob Crittenden <rcritten@redhat.com>2011-11-22 23:57:10 -0500
commit2f4b3972a04e3ebf99ea7fd51c2b102cc8342582 (patch)
treee2dcc0f790fd56b4067b4f8f50ee7756a2e87e41 /install
parent56401c1abe7d4c78650acfcd9bbe8c8edc1dac57 (diff)
downloadfreeipa-2f4b3972a04e3ebf99ea7fd51c2b102cc8342582.tar.gz
freeipa-2f4b3972a04e3ebf99ea7fd51c2b102cc8342582.tar.xz
freeipa-2f4b3972a04e3ebf99ea7fd51c2b102cc8342582.zip
Add plugin framework to LDAP updates.
There are two reasons for the plugin framework: 1. To provide a way of doing manual/complex LDAP changes without having to keep extending ldapupdate.py (like we did with managed entries). 2. Allows for better control of restarts. There are two types of plugins, preop and postop. A preop plugin runs before any file-based updates are loaded. A postop plugin runs after all file-based updates are applied. A preop plugin may update LDAP directly or craft update entries to be applied with the file-based updates. Either a preop or postop plugin may attempt to restart the dirsrv instance. The instance is only restartable if ipa-ldap-updater is being executed as root. A warning is printed if a restart is requested for a non-root user. Plugins are not executed by default. This is so we can use ldapupdate to apply simple updates in commands like ipa-nis-manage. https://fedorahosted.org/freeipa/ticket/1789 https://fedorahosted.org/freeipa/ticket/1790 https://fedorahosted.org/freeipa/ticket/2032
Diffstat (limited to 'install')
-rwxr-xr-xinstall/tools/ipa-ldap-updater35
-rwxr-xr-xinstall/tools/ipa-managed-entries4
-rw-r--r--install/tools/man/ipa-ldap-updater.15
-rw-r--r--install/updates/20-user_private_groups.update4
4 files changed, 38 insertions, 10 deletions
diff --git a/install/tools/ipa-ldap-updater b/install/tools/ipa-ldap-updater
index 472495471..bd2233a94 100755
--- a/install/tools/ipa-ldap-updater
+++ b/install/tools/ipa-ldap-updater
@@ -33,6 +33,7 @@ try:
from ipaserver.install.upgradeinstance import IPAUpgrade
from ipapython import sysrestore
import krbV
+ from ipalib import api
from ipapython.ipa_log_manager import *
except ImportError:
print >> sys.stderr, """\
@@ -49,15 +50,19 @@ def parse_options():
parser = IPAOptionParser(usage=usage, formatter=config.IPAFormatter())
parser.add_option("-d", "--debug", action="store_true", dest="debug",
- help="Display debugging information about the update(s)")
+ help="Display debugging information about the update(s)",
+ default=False)
parser.add_option("-t", "--test", action="store_true", dest="test",
- help="Run through the update without changing anything")
+ help="Run through the update without changing anything",
+ default=False)
parser.add_option("-y", dest="password",
help="File containing the Directory Manager password")
parser.add_option("-l", '--ldapi', action="store_true", dest="ldapi",
default=False, help="Connect to the LDAP server using the ldapi socket")
parser.add_option("-u", '--upgrade', action="store_true", dest="upgrade",
default=False, help="Upgrade an installed server in offline mode")
+ parser.add_option("-p", '--plugins', action="store_true", dest="plugins",
+ default=False, help="Execute update plugins. Always true when applying all update files.")
parser.add_option("-W", '--password', action="store_true",
dest="ask_password",
help="Prompt for the Directory Manager password")
@@ -78,6 +83,7 @@ def get_dirman_password():
def main():
badsyntax = False
upgradefailed = False
+ run_plugins = False
safe_options, options, args = parse_options()
@@ -96,14 +102,30 @@ def main():
if dirman_password is None:
sys.exit("\nDirectory Manager password required")
+ if options.upgrade:
+ standard_logging_setup('/var/log/ipaupgrade.log', verbose=True, debug=options.debug, filemode='a')
+ else:
+ standard_logging_setup(None, verbose=True, debug=options.debug)
+
+ cfg = dict (
+ in_server=True,
+ context='updates',
+ debug=options.debug,
+ )
+ api.bootstrap(**cfg)
+ api.finalize()
+
files = []
if len(args) > 0:
files = args
+ if len(files) < 1:
+ run_plugins = True
+
+ updates = None
if options.upgrade:
if os.getegid() != 0:
sys.exit('Upgrade can only be done as root')
- standard_logging_setup('/var/log/ipaupgrade.log', verbose=True, debug=options.debug, filemode='a')
root_logger.debug('%s was invoked with arguments %s and options: %s' % (sys.argv[0], args, safe_options))
realm = krbV.default_context().default_realm
upgrade = IPAUpgrade(realm, files, live_run=not options.test)
@@ -112,21 +134,24 @@ def main():
badsyntax = upgrade.badsyntax
upgradefailed = upgrade.upgradefailed
else:
- standard_logging_setup(None, verbose=True, debug=options.debug)
- ld = LDAPUpdate(dm_password=dirman_password, sub_dict={}, live_run=not options.test, ldapi=options.ldapi)
+ ld = LDAPUpdate(dm_password=dirman_password, sub_dict={}, live_run=not options.test, ldapi=options.ldapi, plugins=options.plugins or run_plugins)
if len(files) < 1:
files = ld.get_all_files(UPDATES_DIR)
modified = ld.update(files)
if badsyntax:
+ root_logger.info('Bad syntax detected in upgrade file(s).')
print 'Bad syntax detected in upgrade file(s).'
return 1
elif upgradefailed:
+ root_logger.info('IPA upgrade failed.')
print 'IPA upgrade failed.'
return 1
elif modified and options.test:
+ root_logger.info('Update complete, changes to be made, test mode')
return 2
else:
+ root_logger.info('Update complete')
return 0
try:
diff --git a/install/tools/ipa-managed-entries b/install/tools/ipa-managed-entries
index 24ba0e760..f3473e2b0 100755
--- a/install/tools/ipa-managed-entries
+++ b/install/tools/ipa-managed-entries
@@ -130,12 +130,10 @@ def main():
entries = conn.search_s(
managed_entry_definitions_dn, ldap.SCOPE_SUBTREE, filter
)
- managed_entries = [entry.dn for entry in entries]
+ managed_entries = [entry.cn for entry in entries]
if managed_entries:
print "Available Managed Entry Definitions:"
for managed_entry in managed_entries:
- rdn = DN(managed_entry)
- managed_entry = rdn[0].value
print managed_entry
retval = 0
sys.exit()
diff --git a/install/tools/man/ipa-ldap-updater.1 b/install/tools/man/ipa-ldap-updater.1
index d896a1bed..df8dfe650 100644
--- a/install/tools/man/ipa-ldap-updater.1
+++ b/install/tools/man/ipa-ldap-updater.1
@@ -83,8 +83,11 @@ File containing the Directory Manager password
\fB\-l\fR, \fB\-\-ldapi\fR
Connect to the LDAP server using the ldapi socket
.TP
+\fB\-p\fR, \fB\-\-\-plugins\fR
+Execute update plugins as well as any update files. There is no way to execute only the plugins.
+.TP
\fB\-u\fR, \fB\-\-\-upgrade\fR
-Upgrade an installed server in offline mode (implies \-\-ldapi)
+Upgrade an installed server in offline mode (implies \-\-ldapi and \-\-plugins)
.TP
\fB\-W\fR, \fB\-\-\-password\fR
Prompt for the Directory Manager password
diff --git a/install/updates/20-user_private_groups.update b/install/updates/20-user_private_groups.update
index d54cc02d6..93b79b80a 100644
--- a/install/updates/20-user_private_groups.update
+++ b/install/updates/20-user_private_groups.update
@@ -16,9 +16,11 @@ default:mepMappedAttr: description: User private group for $$uid
dn: cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,$SUFFIX
default:objectclass: extensibleObject
-replace:originFilter:objectclass=posixAccount::(&(objectclass=posixAccount)(!(description=__no_upg__)))
default:cn: UPG Definition
default:originScope: cn=users,cn=accounts,$SUFFIX
default:originFilter: objectclass=posixAccount
default:managedBase: cn=groups,cn=accounts,$SUFFIX
default:managedTemplate: cn=UPG Template,cn=Templates,cn=Managed Entries,cn=etc,$SUFFIX
+
+dn: cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,$SUFFIX
+replace:originFilter: objectclass=posixAccount::(&(objectclass=posixAccount)(!(description=__no_upg__)))