diff options
| -rw-r--r-- | freeipa.spec.in | 1 | ||||
| -rw-r--r-- | install/share/Makefile.am | 1 | ||||
| -rwxr-xr-x | install/share/copy-schema-to-ca.py | 126 | ||||
| -rw-r--r-- | ipaserver/install/cainstance.py | 6 |
4 files changed, 2 insertions, 132 deletions
diff --git a/freeipa.spec.in b/freeipa.spec.in index 14106f515..bbce24687 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -1221,7 +1221,6 @@ fi # END %dir %{_usr}/share/ipa %{_usr}/share/ipa/wsgi.py* -%{_usr}/share/ipa/copy-schema-to-ca.py* %{_usr}/share/ipa/*.ldif %{_usr}/share/ipa/*.uldif %{_usr}/share/ipa/*.template diff --git a/install/share/Makefile.am b/install/share/Makefile.am index 1e8f0d572..9e539a3f3 100644 --- a/install/share/Makefile.am +++ b/install/share/Makefile.am @@ -81,7 +81,6 @@ dist_app_DATA = \ automember.ldif \ replica-automember.ldif \ replica-s4u2proxy.ldif \ - copy-schema-to-ca.py \ sasl-mapping-fallback.ldif \ schema-update.ldif \ vault.ldif \ diff --git a/install/share/copy-schema-to-ca.py b/install/share/copy-schema-to-ca.py deleted file mode 100755 index 4daed6f51..000000000 --- a/install/share/copy-schema-to-ca.py +++ /dev/null @@ -1,126 +0,0 @@ -#! /usr/bin/python2 - -"""Copy the IPA schema to the CA directory server instance - -You need to run this script to prepare a 2.2 or 3.0 IPA master for -installation of a 3.1 replica. - -Once a 3.1 replica is in the domain, every older CA master will emit schema -replication errors until this script is run on it. - -""" - -import os -import sys -import pwd -import shutil - -from hashlib import sha1 - -from ipaplatform.paths import paths -from ipapython import ipautil -from ipapython.ipa_log_manager import root_logger, standard_logging_setup -from ipaserver.install.dsinstance import schema_dirname -from ipalib import api - -try: - # BE CAREFUL when using the constants module - you need to define all - # the constants separately because of old IPA installations - from ipaplatform.constants import constants - PKI_USER = constants.PKI_USER - DS_USER = constants.DS_USER -except ImportError: - # oh dear, this is an old IPA (3.0+) - from ipaserver.install.dsinstance import DS_USER #pylint: disable=E0611 - from ipaserver.install.cainstance import PKI_USER #pylint: disable=E0611 - -try: - from ipaplatform import services -except ImportError: - from ipapython import services # pylint: disable=no-name-in-module - -SERVERID = "PKI-IPA" -SCHEMA_FILENAMES = ( - "60kerberos.ldif", - "60samba.ldif", - "60ipaconfig.ldif", - "60basev2.ldif", - "60basev3.ldif", - "60ipadns.ldif", - "61kerberos-ipav3.ldif", - "65ipacertstore.ldif", - "65ipasudo.ldif", - "70ipaotp.ldif", - "05rfc2247.ldif", -) - - -def _sha1_file(filename): - with open(filename, 'rb') as f: - return sha1(f.read()).hexdigest() - - -def add_ca_schema(): - """Copy IPA schema files into the CA DS instance - """ - pki_pent = pwd.getpwnam(PKI_USER) - ds_pent = pwd.getpwnam(DS_USER) - for schema_fname in SCHEMA_FILENAMES: - source_fname = os.path.join(paths.USR_SHARE_IPA_DIR, schema_fname) - target_fname = os.path.join(schema_dirname(SERVERID), schema_fname) - if not os.path.exists(source_fname): - root_logger.debug('File does not exist: %s', source_fname) - continue - if os.path.exists(target_fname): - target_sha1 = _sha1_file(target_fname) - source_sha1 = _sha1_file(source_fname) - if target_sha1 != source_sha1: - target_size = os.stat(target_fname).st_size - source_size = os.stat(source_fname).st_size - root_logger.info('Target file %s exists but the content is ' - 'different', target_fname) - root_logger.info('\tTarget file: sha1: %s, size: %s B', - target_sha1, target_size) - root_logger.info('\tSource file: sha1: %s, size: %s B', - source_sha1, source_size) - if not ipautil.user_input("Do you want replace %s file?" % - target_fname, True): - continue - - else: - root_logger.info( - 'Target exists, not overwriting: %s', target_fname) - continue - try: - shutil.copyfile(source_fname, target_fname) - except IOError as e: - root_logger.warning('Could not install %s: %s', target_fname, e) - else: - root_logger.info('Installed %s', target_fname) - os.chmod(target_fname, 0o440) # read access for dirsrv user/group - os.chown(target_fname, pki_pent.pw_uid, ds_pent.pw_gid) - - -def restart_pki_ds(): - """Restart the CA DS instance to pick up schema changes - """ - root_logger.info('Restarting CA DS') - services.service('dirsrv').restart(SERVERID) - - -def main(): - if os.getegid() != 0: - sys.exit("Must be root to run this script") - standard_logging_setup(verbose=True) - - # In 3.0, restarting needs access to api.env - api.bootstrap_with_global_options(context='server', confdir=paths.ETC_IPA) - - add_ca_schema() - restart_pki_ds() - - root_logger.info('Schema updated successfully') - - -if __name__ == '__main__': - main() diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index 42e45411a..f0d3c2368 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -1290,11 +1290,9 @@ def replica_ca_install_check(config, promote): else: root_logger.critical( 'The master CA directory server does not have necessary schema. ' - 'Please copy the following script to all CA masters and run it ' - 'on them: %s\n' + 'Please run copy-schema-to-ca.py on all CA masters.\n' 'If you are certain that this is a false positive, use ' - '--skip-schema-check.', - os.path.join(paths.USR_SHARE_IPA_DIR, 'copy-schema-to-ca.py')) + '--skip-schema-check.') exit('IPA schema missing on master CA directory server') |