IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-23 15:40:01 -06:00
Code Issues Packages Projects Releases Wiki Activity
0708f603e2
freeipa/install/updates/20-indices.update

643 lines
18 KiB
Plaintext
Raw Normal View History

Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
# Indices
Adding an index for memberuid. Alsthough we do not use this attribute, many clients still ask for it so let's index it and make stuff faster.
2008-12-02 16:22:08 -06:00
#
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
# DS 1.4.3 defines default indices for:
Adding an index for memberuid. Alsthough we do not use this attribute, many clients still ask for it so let's index it and make stuff faster.
2008-12-02 16:22:08 -06:00
#
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
# * aci: pres [SYSTEM]
# * cn: eq, pres, sub
# * entryusn: eq / integerOrderingMatch [SYSTEM]
# * givenName: eq, pres, sub
# * mail: eq, pres, sub
# * mailAlternateAddress: eq
# * mailHost: eq
# * member: eq
# * memberOf: eq
# * nsCertSubjectDN: eq [SYSTEM]
# * nsTombstoneCSN: eq [SYSTEM]
# * nsUniqueId: eq [SYSTEM]
# * ntUniqueId: eq [IPA: +pres]
# * ntUserDomainId: eq [IPA: +pres]
# * numsubordinates: pres [SYSTEM]
# * objectClass: eq [SYSTEM]
# * owner: eq [IPA: +sub]
# * parentId: eq / integerOrderingMatch [SYSTEM]
# * seealso: eq [IPA: +sub]
# * sn: eq, pres, sub
# * targetuniqueid: eq
# * telephoneNumber: eq, pres, sub
# * uid: eq [IPA: +pres]
# * uniqueMember: eq [IPA: +sub]
Add memberHost and memberUser to default indexes https://fedorahosted.org/freeipa/ticket/1138
2011-03-30 15:12:31 -05:00
#
Add more indices ipaCASubjectDN is used by lightweight sub CA feature. ipaExternalMember is used by KRB driver to assemble MS-PAC records. ipaNTSecurityIdentifier was only index for "pres" and was missing an index on "eq". Samba and ipasam perform queries with SID string. memberPrincipal is used by S4U2Proxy constrained delegation and by ipa-custodia. Also note that dnaHostname, ipServiceProtocol, ipaCertSubject, and ipaKeyUsage are currently not index because an index would rarely used or have a poor selectivity. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-28 06:20:45 -05:00
#
# Unindex attributes
# ------------------
#
# Some attributes are currently not indexed because an index would not be
# rarely used or have a poor selectivity.
#
# - dnaHostname: only used by update_dna_shared_config, server_del, and
# ipa-replica-install
# - ipServiceProtocol: not used by SSSD at the moment and has a poor
# selectivity ('tcp' or 'udp')
# - ipaCertSubject: only queried in update_fix_duplicate_cacrt_in_ldap
# - ipaKeyUsage: rarely used by ipa-custodia and poor selectivity
# ('digitalSignature' or 'dataEncipherment')
#
# Update rules
# ------------
#
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
# - cn uses "only" to avoid bugs like https://pagure.io/freeipa/issue/6975
# - nsIndexType and nsMatchingRule use "add" to allow users to add
# additional index types and matching rules more easily. The "add" command
# adds additional attribute values that are required by IPA but does not
# remove user defined values.
#
# Please keep entries in alphanumeric order.
#
dn: cn=accessRuleType,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: accessRuleType
default:objectClass: nsIndex
default:objectClass: top
Adding an index for memberuid. Alsthough we do not use this attribute, many clients still ask for it so let's index it and make stuff faster.
2008-12-02 16:22:08 -06:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
Adding an index for memberuid. Alsthough we do not use this attribute, many clients still ask for it so let's index it and make stuff faster.
2008-12-02 16:22:08 -06:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=altSecurityIdentities,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: altSecurityIdentities
default:objectClass: nsIndex
default:objectClass: top
memberof was not indexed in older versions of fedora-ds, keep it around as an update so that if it is not there it will be added
2008-12-05 08:21:13 -06:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
memberof was not indexed in older versions of fedora-ds, keep it around as an update so that if it is not there it will be added
2008-12-05 08:21:13 -06:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=automountkey,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: automountkey
default:objectClass: nsIndex
default:objectClass: top
Add memberHost and memberUser to default indexes https://fedorahosted.org/freeipa/ticket/1138
2011-03-30 15:12:31 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: pres
Add memberHost and memberUser to default indexes https://fedorahosted.org/freeipa/ticket/1138
2011-03-30 15:12:31 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=automountMapName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: automountMapName
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=carLicense,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: carLicense
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
Add missing substring indices for attributes managed by the referint plugin. The referint plugin does a substring search on these attributes each time an entry is deleted, which causes a noticable slowdown for large directories if the attributes are not indexed. https://fedorahosted.org/freeipa/ticket/3706
2013-06-25 08:16:40 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=description,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config
only:cn: description
default:objectClass: nsindex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
Add missing substring indices for attributes managed by the referint plugin. The referint plugin does a substring search on these attributes each time an entry is deleted, which causes a noticable slowdown for large directories if the attributes are not indexed. https://fedorahosted.org/freeipa/ticket/3706
2013-06-25 08:16:40 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=displayname,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: displayname
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
Add missing substring indices for attributes managed by the referint plugin. The referint plugin does a substring search on these attributes each time an entry is deleted, which causes a noticable slowdown for large directories if the attributes are not indexed. https://fedorahosted.org/freeipa/ticket/3706
2013-06-25 08:16:40 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=fqdn,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: fqdn
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Add missing substring indices for attributes managed by the referint plugin. The referint plugin does a substring search on these attributes each time an entry is deleted, which causes a noticable slowdown for large directories if the attributes are not indexed. https://fedorahosted.org/freeipa/ticket/3706
2013-06-25 08:16:40 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=gidnumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: gidnumber
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsMatchingRule: integerOrderingMatch
Add missing substring indices for attributes managed by the referint plugin. The referint plugin does a substring search on these attributes each time an entry is deleted, which causes a noticable slowdown for large directories if the attributes are not indexed. https://fedorahosted.org/freeipa/ticket/3706
2013-06-25 08:16:40 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=hostCategory,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: hostCategory
default:objectClass: nsIndex
default:objectClass: top
Add memberHost and memberUser to default indexes https://fedorahosted.org/freeipa/ticket/1138
2011-03-30 15:12:31 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
- index the fqdn and macAddress attributes for the sake of the compat plugin
2012-04-16 14:26:50 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=idnsName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: idnsName
default:objectClass: nsIndex
default:objectClass: top
- index the fqdn and macAddress attributes for the sake of the compat plugin
2012-04-16 14:26:50 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
- index the fqdn and macAddress attributes for the sake of the compat plugin
2012-04-16 14:26:50 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipaallowedtarget,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaallowedtarget
default:objectClass: nsIndex
default:objectClass: top
- index the fqdn and macAddress attributes for the sake of the compat plugin
2012-04-16 14:26:50 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipaAnchorUUID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaAnchorUUID
default:objectClass: nsIndex
default:objectClass: top
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: pres
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipaassignedidview,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaassignedidview
default:objectClass: nsIndex
default:objectClass: top
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
Add more indices ipaCASubjectDN is used by lightweight sub CA feature. ipaExternalMember is used by KRB driver to assemble MS-PAC records. ipaNTSecurityIdentifier was only index for "pres" and was missing an index on "eq". Samba and ipasam perform queries with SID string. memberPrincipal is used by S4U2Proxy constrained delegation and by ipa-custodia. Also note that dnaHostname, ipServiceProtocol, ipaCertSubject, and ipaKeyUsage are currently not index because an index would rarely used or have a poor selectivity. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-28 06:20:45 -05:00
dn: cn=ipaCASubjectDN,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaCASubjectDN
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipaCertmapData,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaCertmapData
default:objectClass: nsIndex
default:objectClass: top
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipaConfigString,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaConfigString
default:objectClass: nsIndex
default:objectClass: top
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipaEnabledFlag,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaEnabledFlag
default:objectClass: nsIndex
default:objectClass: top
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
Add more indices ipaCASubjectDN is used by lightweight sub CA feature. ipaExternalMember is used by KRB driver to assemble MS-PAC records. ipaNTSecurityIdentifier was only index for "pres" and was missing an index on "eq". Samba and ipasam perform queries with SID string. memberPrincipal is used by S4U2Proxy constrained delegation and by ipa-custodia. Also note that dnaHostname, ipServiceProtocol, ipaCertSubject, and ipaKeyUsage are currently not index because an index would rarely used or have a poor selectivity. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-28 06:20:45 -05:00
dn: cn=ipaExternalMember,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaExternalMember
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
external-idp: add LDAP schema, indices and other LDAP objects Fixes: https://pagure.io/freeipa/issue/8803 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Francisco Trivino <ftrivino@redhat.com> Reviewed-By: Sumit Bose <sbose@redhat.com>
2022-05-03 03:37:08 -05:00
dn: cn=ipaIdpDevAuthEndpoint,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaIdpDevAuthEndpoint
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
dn: cn=ipaIdpAuthEndpoint,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaIdpAuthEndpoint
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
dn: cn=ipaIdpScope,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaIdpScope
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
dn: cn=ipaIdpTokenEndpoint,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaIdpTokenEndpoint
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipaKrbAuthzData,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaKrbAuthzData
default:objectClass: nsIndex
default:objectClass: top
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: sub
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipakrbprincipalalias,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipakrbprincipalalias
default:objectClass: nsIndex
default:objectClass: top
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
Index ipakrbprincipalalias and ipaautomountkey attributes An unindexed search for ipakrbprincipalalias is fired for every ipa command (and other authentication events) which would degrade IPA server performance if not indexed. ipaautomountkey unindexed searches are hit when new key entries are being added. Add both indexes to new and updated IPA installs. https://fedorahosted.org/freeipa/ticket/3020 https://fedorahosted.org/freeipa/ticket/3025
2012-09-25 10:16:20 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipalocation,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipalocation
default:objectClass: nsIndex
default:objectClass: top
Index ipakrbprincipalalias and ipaautomountkey attributes An unindexed search for ipakrbprincipalalias is fired for every ipa command (and other authentication events) which would degrade IPA server performance if not indexed. ipaautomountkey unindexed searches are hit when new key entries are being added. Add both indexes to new and updated IPA installs. https://fedorahosted.org/freeipa/ticket/3020 https://fedorahosted.org/freeipa/ticket/3025
2012-09-25 10:16:20 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
Add more LDAP indices An index is used to optimize an LDAP operation. Without an index, 389-DS has to perform a partial or even full table scan. A full database scan can easily take 10 seconds or more in a large installation. * automountMapKey: eq, pres (was: eq) * autoMountMapName: eq * ipaConfigString: eq * ipaEnabledFlag: eq * ipaKrbAuthzData: eq, sub * accessRuleType: eq * hostCategory: eq automountMapKey and autoMountMapName filters are used for automount. Installation and service discovery (CA, KRA) use ipaConfigString to find active services and CA renewal master. SSSD filters with ipaEnabledFlag, accessRuleType, and hostCategory to find and cache HBAC rules for each host. ipaKrbAuthzData is used by ipa host-del. The framework performs a '*arg*' query, therefore a sub index is required, too. Partly fixes: https://pagure.io/freeipa/issue/7786 Fixes: https://pagure.io/freeipa/issue/7787 Fixes: https://pagure.io/freeipa/issue/7790 Fixes: https://pagure.io/freeipa/issue/7792 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-12-05 10:55:58 -06:00
add:nsIndexType: pres
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipaMemberCa,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaMemberCa
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Add more LDAP indices An index is used to optimize an LDAP operation. Without an index, 389-DS has to perform a partial or even full table scan. A full database scan can easily take 10 seconds or more in a large installation. * automountMapKey: eq, pres (was: eq) * autoMountMapName: eq * ipaConfigString: eq * ipaEnabledFlag: eq * ipaKrbAuthzData: eq, sub * accessRuleType: eq * hostCategory: eq automountMapKey and autoMountMapName filters are used for automount. Installation and service discovery (CA, KRA) use ipaConfigString to find active services and CA renewal master. SSSD filters with ipaEnabledFlag, accessRuleType, and hostCategory to find and cache HBAC rules for each host. ipaKrbAuthzData is used by ipa host-del. The framework performs a '*arg*' query, therefore a sub index is required, too. Partly fixes: https://pagure.io/freeipa/issue/7786 Fixes: https://pagure.io/freeipa/issue/7787 Fixes: https://pagure.io/freeipa/issue/7790 Fixes: https://pagure.io/freeipa/issue/7792 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-12-05 10:55:58 -06:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipaMemberCertProfile,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaMemberCertProfile
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Add more LDAP indices An index is used to optimize an LDAP operation. Without an index, 389-DS has to perform a partial or even full table scan. A full database scan can easily take 10 seconds or more in a large installation. * automountMapKey: eq, pres (was: eq) * autoMountMapName: eq * ipaConfigString: eq * ipaEnabledFlag: eq * ipaKrbAuthzData: eq, sub * accessRuleType: eq * hostCategory: eq automountMapKey and autoMountMapName filters are used for automount. Installation and service discovery (CA, KRA) use ipaConfigString to find active services and CA renewal master. SSSD filters with ipaEnabledFlag, accessRuleType, and hostCategory to find and cache HBAC rules for each host. ipaKrbAuthzData is used by ipa host-del. The framework performs a '*arg*' query, therefore a sub index is required, too. Partly fixes: https://pagure.io/freeipa/issue/7786 Fixes: https://pagure.io/freeipa/issue/7787 Fixes: https://pagure.io/freeipa/issue/7790 Fixes: https://pagure.io/freeipa/issue/7792 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-12-05 10:55:58 -06:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipaNTSecurityIdentifier,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only: cn: ipaNTSecurityIdentifier
default: objectClass: top
default: objectClass: nsIndex
Add more LDAP indices An index is used to optimize an LDAP operation. Without an index, 389-DS has to perform a partial or even full table scan. A full database scan can easily take 10 seconds or more in a large installation. * automountMapKey: eq, pres (was: eq) * autoMountMapName: eq * ipaConfigString: eq * ipaEnabledFlag: eq * ipaKrbAuthzData: eq, sub * accessRuleType: eq * hostCategory: eq automountMapKey and autoMountMapName filters are used for automount. Installation and service discovery (CA, KRA) use ipaConfigString to find active services and CA renewal master. SSSD filters with ipaEnabledFlag, accessRuleType, and hostCategory to find and cache HBAC rules for each host. ipaKrbAuthzData is used by ipa host-del. The framework performs a '*arg*' query, therefore a sub index is required, too. Partly fixes: https://pagure.io/freeipa/issue/7786 Fixes: https://pagure.io/freeipa/issue/7787 Fixes: https://pagure.io/freeipa/issue/7790 Fixes: https://pagure.io/freeipa/issue/7792 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-12-05 10:55:58 -06:00
default: nsSystemIndex: false
Add more indices ipaCASubjectDN is used by lightweight sub CA feature. ipaExternalMember is used by KRB driver to assemble MS-PAC records. ipaNTSecurityIdentifier was only index for "pres" and was missing an index on "eq". Samba and ipasam perform queries with SID string. memberPrincipal is used by S4U2Proxy constrained delegation and by ipa-custodia. Also note that dnaHostname, ipServiceProtocol, ipaCertSubject, and ipaKeyUsage are currently not index because an index would rarely used or have a poor selectivity. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-28 06:20:45 -05:00
add: nsIndexType: eq
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add: nsIndexType: pres
Add more LDAP indices An index is used to optimize an LDAP operation. Without an index, 389-DS has to perform a partial or even full table scan. A full database scan can easily take 10 seconds or more in a large installation. * automountMapKey: eq, pres (was: eq) * autoMountMapName: eq * ipaConfigString: eq * ipaEnabledFlag: eq * ipaKrbAuthzData: eq, sub * accessRuleType: eq * hostCategory: eq automountMapKey and autoMountMapName filters are used for automount. Installation and service discovery (CA, KRA) use ipaConfigString to find active services and CA renewal master. SSSD filters with ipaEnabledFlag, accessRuleType, and hostCategory to find and cache HBAC rules for each host. ipaKrbAuthzData is used by ipa host-del. The framework performs a '*arg*' query, therefore a sub index is required, too. Partly fixes: https://pagure.io/freeipa/issue/7786 Fixes: https://pagure.io/freeipa/issue/7787 Fixes: https://pagure.io/freeipa/issue/7790 Fixes: https://pagure.io/freeipa/issue/7792 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-12-05 10:55:58 -06:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipaNTTrustPartner,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only: cn: ipaNTTrustPartner
Add more LDAP indices An index is used to optimize an LDAP operation. Without an index, 389-DS has to perform a partial or even full table scan. A full database scan can easily take 10 seconds or more in a large installation. * automountMapKey: eq, pres (was: eq) * autoMountMapName: eq * ipaConfigString: eq * ipaEnabledFlag: eq * ipaKrbAuthzData: eq, sub * accessRuleType: eq * hostCategory: eq automountMapKey and autoMountMapName filters are used for automount. Installation and service discovery (CA, KRA) use ipaConfigString to find active services and CA renewal master. SSSD filters with ipaEnabledFlag, accessRuleType, and hostCategory to find and cache HBAC rules for each host. ipaKrbAuthzData is used by ipa host-del. The framework performs a '*arg*' query, therefore a sub index is required, too. Partly fixes: https://pagure.io/freeipa/issue/7786 Fixes: https://pagure.io/freeipa/issue/7787 Fixes: https://pagure.io/freeipa/issue/7790 Fixes: https://pagure.io/freeipa/issue/7792 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-12-05 10:55:58 -06:00
default: objectClass: top
default: objectClass: nsIndex
default: nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add: nsIndexType: pres
Index ipakrbprincipalalias and ipaautomountkey attributes An unindexed search for ipakrbprincipalalias is fired for every ipa command (and other authentication events) which would degrade IPA server performance if not indexed. ipaautomountkey unindexed searches are hit when new key entries are being added. Add both indexes to new and updated IPA installs. https://fedorahosted.org/freeipa/ticket/3020 https://fedorahosted.org/freeipa/ticket/3025
2012-09-25 10:16:20 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipaOriginalUid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaOriginalUid
default:objectClass: nsIndex
default:objectClass: top
Index ipakrbprincipalalias and ipaautomountkey attributes An unindexed search for ipakrbprincipalalias is fired for every ipa command (and other authentication events) which would degrade IPA server performance if not indexed. ipaautomountkey unindexed searches are hit when new key entries are being added. Add both indexes to new and updated IPA installs. https://fedorahosted.org/freeipa/ticket/3020 https://fedorahosted.org/freeipa/ticket/3025
2012-09-25 10:16:20 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: pres
Add missing equality index for ipaUniqueId. https://fedorahosted.org/freeipa/ticket/3743
2013-06-25 08:19:01 -05:00
Redesign subid feature Subordinate ids are now handled by a new plugin class and stored in separate entries in the cn=subids,cn=accounts subtree. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-04-14 08:21:18 -05:00
dn: cn=ipaOwner,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaOwner
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipasudorunas,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipasudorunas
default:objectClass: nsIndex
default:objectClass: top
Add missing equality index for ipaUniqueId. https://fedorahosted.org/freeipa/ticket/3743
2013-06-25 08:19:01 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Add basic support for subordinate user/group ids New LDAP object class "ipaUserSubordinate" with four new fields: - ipasubuidnumber / ipasubuidcount - ipasubgidnumber / ipasgbuidcount New self-service permission to add subids. New command user-auto-subid to auto-assign subid The code hard-codes counts to 65536, sets subgid equal to subuid, and does not allow removal of subids. There is also a hack that emulates a DNA plugin with step interval 65536 for testing. Work around problem with older SSSD clients that fail with unknown idrange type "ipa-local-subid", see: https://github.com/SSSD/sssd/issues/5571 Related: https://pagure.io/freeipa/issue/8361 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-03-19 05:48:38 -05:00
dn: cn=ipaSubGidNumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaSubGidNumber
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsMatchingRule: integerOrderingMatch
dn: cn=ipaSubUidNumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipaSubUidNumber
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsMatchingRule: integerOrderingMatch
Add index for sudoorder sudorule-mod <rule> --order=<num> does a search for an existing order and this search is unindexed. https://pagure.io/freeipa/issue/8939 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
2021-07-29 13:36:18 -05:00
dn: cn=sudoorder,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: sudoorder
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsMatchingRule: integerOrderingMatch
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipasudorunasgroup,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipasudorunasgroup
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Add RADIUS proxy support to ipalib CLI https://fedorahosted.org/freeipa/ticket/3368
2013-11-11 15:58:02 -06:00
dn: cn=ipatokenradiusconfiglink,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
only:cn: ipatokenradiusconfiglink
default:objectClass: nsIndex
default:objectClass: top
Add RADIUS proxy support to ipalib CLI https://fedorahosted.org/freeipa/ticket/3368
2013-11-11 15:58:02 -06:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
idviews: Update the referential plugin config to watch for ipaAssignedIDView We need the referential plugin config to watch for changes in the ID view objects, since hosts refer to them in ipaAssignedIDView attribute. Part of: https://fedorahosted.org/freeipa/ticket/3979 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-09-17 07:13:16 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipauniqueid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipauniqueid
default:objectClass: nsIndex
default:objectClass: top
idviews: Update the referential plugin config to watch for ipaAssignedIDView We need the referential plugin config to watch for changes in the ID view objects, since hosts refer to them in ipaAssignedIDView attribute. Part of: https://fedorahosted.org/freeipa/ticket/3979 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-09-17 07:13:16 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
Add plugin to manage service constraint delegations Service Constraints are the delegation model used by ipa-kdb to grant service A to obtain a TGT for a user against service B. https://fedorahosted.org/freeipa/ticket/3644 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-05-14 08:08:58 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ipServicePort,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ipServicePort
default:objectClass: nsIndex
default:objectClass: top
Add plugin to manage service constraint delegations Service Constraints are the delegation model used by ipa-kdb to grant service A to obtain a TGT for a user against service B. https://fedorahosted.org/freeipa/ticket/3644 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-05-14 08:08:58 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
Add CA ACL plugin Implement the caacl commands, which are used to indicate which principals may be issued certificates from which (sub-)CAs, using which profiles. At this commit, and until sub-CAs are implemented, all rules refer to the top-level CA (represented as ".") and no ca-ref argument is exposed. Also, during install and upgrade add a default CA ACL that permits certificate issuance for all hosts and services using the profile 'caIPAserviceCert' on the top-level CA. Part of: https://fedorahosted.org/freeipa/ticket/57 Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-05-25 07:39:07 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=krbCanonicalName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: krbCanonicalName
default:objectClass: nsIndex
default:objectClass: top
Add CA ACL plugin Implement the caacl commands, which are used to indicate which principals may be issued certificates from which (sub-)CAs, using which profiles. At this commit, and until sub-CAs are implemented, all rules refer to the top-level CA (represented as ".") and no ca-ref argument is exposed. Also, during install and upgrade add a default CA ACL that permits certificate issuance for all hosts and services using the profile 'caIPAserviceCert' on the top-level CA. Part of: https://fedorahosted.org/freeipa/ticket/57 Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-05-25 07:39:07 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: sub
Add CA ACL plugin Implement the caacl commands, which are used to indicate which principals may be issued certificates from which (sub-)CAs, using which profiles. At this commit, and until sub-CAs are implemented, all rules refer to the top-level CA (represented as ".") and no ca-ref argument is exposed. Also, during install and upgrade add a default CA ACL that permits certificate issuance for all hosts and services using the profile 'caIPAserviceCert' on the top-level CA. Part of: https://fedorahosted.org/freeipa/ticket/57 Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-05-25 07:39:07 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=krbPasswordExpiration,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: krbPasswordExpiration
default:objectClass: nsIndex
default:objectClass: top
Add CA ACL plugin Implement the caacl commands, which are used to indicate which principals may be issued certificates from which (sub-)CAs, using which profiles. At this commit, and until sub-CAs are implemented, all rules refer to the top-level CA (represented as ".") and no ca-ref argument is exposed. Also, during install and upgrade add a default CA ACL that permits certificate issuance for all hosts and services using the profile 'caIPAserviceCert' on the top-level CA. Part of: https://fedorahosted.org/freeipa/ticket/57 Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-05-25 07:39:07 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add DS index for userCertificate attribute 'eq' and 'pres' indices for userCertificate attribute allow for more efficient lookup and matching of binary certificates assigned to users, hosts, and services. Part of http://www.freeipa.org/page/V4/User_Certificates Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-16 06:20:15 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=krbPrincipalName,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: krbPrincipalName
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
add:nsMatchingRule: caseIgnoreIA5Match
add:nsMatchingRule: caseExactIA5Match
Fix indicies ntUserDomainId, ntUniqueId ntUserDomainId and ntUniqueId contained "eq,pres" index value, which is not valid. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-06-26 10:14:41 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=l,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config
only:cn: l
default:objectClass: nsindex
default:objectClass: top
Add missing nsSystemIndex attributes https://fedorahosted.org/freeipa/ticket/5947 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-06-24 07:21:01 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: sub
Fix indicies ntUserDomainId, ntUniqueId ntUserDomainId and ntUniqueId contained "eq,pres" index value, which is not valid. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-06-26 10:14:41 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=macAddress,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: macAddress
default:objectClass: nsIndex
default:objectClass: top
Add missing nsSystemIndex attributes https://fedorahosted.org/freeipa/ticket/5947 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-06-24 07:21:01 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: pres
DNS Locations: add index for ipalocation attribute For performace ipalocation should be indexed because it is used by referint plugin https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-07 03:43:50 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=managedby,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: managedby
default:objectClass: nsIndex
default:objectClass: top
DNS Locations: add index for ipalocation attribute For performace ipalocation should be indexed because it is used by referint plugin https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-07 03:43:50 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
add case-insensitive matching rule to krbprincipalname index Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-09-08 11:01:57 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=manager,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: manager
default:objectClass: nsIndex
default:objectClass: top
add case-insensitive matching rule to krbprincipalname index Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-09-08 11:01:57 -05:00
default:nsSystemIndex: false
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Create indexes for krbCanonicalName attribute krbCanonicalName is for a long time among the attributes guarded by uniqueness plugins, but there was never an index for it. Now that the attribute is really used to store canonical principal names we need to add index for it to avoid performance regressions. https://fedorahosted.org/freeipa/ticket/6100 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
2016-07-22 06:02:38 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=member,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: member
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Create indexes for 'serverhostname' attribute IPA installation with large number of host entries gets timeout when invoking ipaserver.plugins.host.get_dn() method. Resolves: https://pagure.io/freeipa/issue/6939 Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-06-08 08:40:20 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=memberallowcmd,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: memberallowcmd
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Add indexing to improve host-find performance host-find <host_name> command performance gets deteriorated when there's way too many hosts in the LDAP tree. We're adding indices to try and mitigate this behavior. https://pagure.io/freeipa/issue/6371 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-27 02:34:38 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=memberdenycmd,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: memberdenycmd
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Add indexing to improve host-find performance host-find <host_name> command performance gets deteriorated when there's way too many hosts in the LDAP tree. We're adding indices to try and mitigate this behavior. https://pagure.io/freeipa/issue/6371 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-27 02:34:38 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=memberHost,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: memberHost
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Add indexing to improve host-find performance host-find <host_name> command performance gets deteriorated when there's way too many hosts in the LDAP tree. We're adding indices to try and mitigate this behavior. https://pagure.io/freeipa/issue/6371 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-27 02:34:38 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=memberManager,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: memberManager
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
Redesign subid feature Subordinate ids are now handled by a new plugin class and stored in separate entries in the cn=subids,cn=accounts subtree. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-04-14 08:21:18 -05:00
dn: cn=memberOf,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
Index: Fix definition for memberOf The index definition for memberOf is inconsistent: dn: cn=memberOf,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config cn: member nsIndexType: eq nsIndexType: sub nsSystemIndex: false objectClass: top objectClass: nsIndex The cn attribute should be memberOf, not member. Fix the definition. Fixes: https://pagure.io/freeipa/issue/8920 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2021-07-16 02:43:54 -05:00
only:cn: memberOf
Redesign subid feature Subordinate ids are now handled by a new plugin class and stored in separate entries in the cn=subids,cn=accounts subtree. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-04-14 08:21:18 -05:00
add:nsIndexType: sub
Add more indices ipaCASubjectDN is used by lightweight sub CA feature. ipaExternalMember is used by KRB driver to assemble MS-PAC records. ipaNTSecurityIdentifier was only index for "pres" and was missing an index on "eq". Samba and ipasam perform queries with SID string. memberPrincipal is used by S4U2Proxy constrained delegation and by ipa-custodia. Also note that dnaHostname, ipServiceProtocol, ipaCertSubject, and ipaKeyUsage are currently not index because an index would rarely used or have a poor selectivity. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-28 06:20:45 -05:00
dn: cn=memberPrincipal,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: memberPrincipal
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=memberservice,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: memberservice
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
dn: cn=memberuid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: memberuid
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
dn: cn=memberUser,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: memberUser
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Add indexing to improve host-find performance host-find <host_name> command performance gets deteriorated when there's way too many hosts in the LDAP tree. We're adding indices to try and mitigate this behavior. https://pagure.io/freeipa/issue/6371 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-27 02:34:38 -05:00
dn: cn=nsHardwarePlatform,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
only:cn: nsHardwarePlatform
default:objectClass: nsindex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
Add indexing to improve host-find performance host-find <host_name> command performance gets deteriorated when there's way too many hosts in the LDAP tree. We're adding indices to try and mitigate this behavior. https://pagure.io/freeipa/issue/6371 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-27 02:34:38 -05:00
dn: cn=nsHostLocation,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
only:cn: nsHostLocation
default:objectClass: nsindex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
Add index and container for RFC 2307 IP services IPA doesn't officially support RFC 2307 IP services. However SSSD has a nsswitch plugin to provide service lookups. The subtree search for (&(ipserviceport=$PORT)(ipserviceprotocol=$SRV)(objectclass=ipservice)) in cn=accounts,$SUFFIX has caused performance issues on large installations. This patch introduced a dedicated container cn=ipservices,cn=accounts,$SUFFIX for IP services for future use or 3rd party extensions. SSSD will be change its search base in an upcoming release, too. A new ipServicePort index is added to optimize searches for an IP service by port. There is no index on ipServiceProtocol because the index would have poor selectivity. An ipService entry has either 'tcp' or 'udp' as protocol. Fixes: https://pagure.io/freeipa/issue/7797 See: https://pagure.io/freeipa/issue/7786 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-12-07 06:08:49 -06:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=nsOsVersion,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config
only:cn: nsOsVersion
default:objectClass: nsindex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
Add more LDAP indices An index is used to optimize an LDAP operation. Without an index, 389-DS has to perform a partial or even full table scan. A full database scan can easily take 10 seconds or more in a large installation. * automountMapKey: eq, pres (was: eq) * autoMountMapName: eq * ipaConfigString: eq * ipaEnabledFlag: eq * ipaKrbAuthzData: eq, sub * accessRuleType: eq * hostCategory: eq automountMapKey and autoMountMapName filters are used for automount. Installation and service discovery (CA, KRA) use ipaConfigString to find active services and CA renewal master. SSSD filters with ipaEnabledFlag, accessRuleType, and hostCategory to find and cache HBAC rules for each host. ipaKrbAuthzData is used by ipa host-del. The framework performs a '*arg*' query, therefore a sub index is required, too. Partly fixes: https://pagure.io/freeipa/issue/7786 Fixes: https://pagure.io/freeipa/issue/7787 Fixes: https://pagure.io/freeipa/issue/7790 Fixes: https://pagure.io/freeipa/issue/7792 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-12-05 10:55:58 -06:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ntUniqueId,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ntUniqueId
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
Add more LDAP indices An index is used to optimize an LDAP operation. Without an index, 389-DS has to perform a partial or even full table scan. A full database scan can easily take 10 seconds or more in a large installation. * automountMapKey: eq, pres (was: eq) * autoMountMapName: eq * ipaConfigString: eq * ipaEnabledFlag: eq * ipaKrbAuthzData: eq, sub * accessRuleType: eq * hostCategory: eq automountMapKey and autoMountMapName filters are used for automount. Installation and service discovery (CA, KRA) use ipaConfigString to find active services and CA renewal master. SSSD filters with ipaEnabledFlag, accessRuleType, and hostCategory to find and cache HBAC rules for each host. ipaKrbAuthzData is used by ipa host-del. The framework performs a '*arg*' query, therefore a sub index is required, too. Partly fixes: https://pagure.io/freeipa/issue/7786 Fixes: https://pagure.io/freeipa/issue/7787 Fixes: https://pagure.io/freeipa/issue/7790 Fixes: https://pagure.io/freeipa/issue/7792 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2018-12-05 10:55:58 -06:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ntUserDomainId,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ntUserDomainId
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
Add index on idnsName The data structures for the internal DNS server use the attribute idnsName instead of cn in the DN. It's also used to search for entries when entries are added, modified, or removed. The new index speeds up dnsrecord and dnszone related commands as well as commands like host-add and host-del --updatedns. Fixes: https://pagure.io/freeipa/issue/7803 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2018-12-05 10:55:58 -06:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=ou,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: ou
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
Create indexes for altSecurityIdentities and ipaCertmapData attributes During an investigation into filter optimisation in 389DS it was discovered that two attributes of the certmap query are unindexed. Due to the nature of LDAP filters, if any member of an OR query is unindexed, the entire OR becomes unindexed. This is then basically a full-table scan, which applies the filter test to the contained members. Fixes: https://pagure.io/freeipa/issue/7932 Fixes: https://pagure.io/freeipa/issue/7933 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
2019-05-03 01:00:09 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=owner,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: owner
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
Create indexes for altSecurityIdentities and ipaCertmapData attributes During an investigation into filter optimisation in 389DS it was discovered that two attributes of the certmap query are unindexed. Due to the nature of LDAP filters, if any member of an OR query is unindexed, the entire OR becomes unindexed. This is then basically a full-table scan, which applies the filter test to the contained members. Fixes: https://pagure.io/freeipa/issue/7932 Fixes: https://pagure.io/freeipa/issue/7933 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
2019-05-03 01:00:09 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=secretary,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: secretary
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Add group membership management A group membership manager is a user or a group that can add members to a group or remove members from a group or host group. Fixes: https://pagure.io/freeipa/issue/8114 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2019-11-05 23:58:42 -06:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=seealso,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: seealso
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
Add index for krbPasswordExpiration for EPN Expiring Password Notifications search for expiring passwords between dates. Add an equality index for this attribute. https://pagure.io/freeipa/issue/3687 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Michal Polovka <mpolovka@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2020-05-15 10:50:45 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=serverhostname,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: serverhostname
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
Add index for more trust-related attributes Add index for ipaNTTrustPartner, ipaNTSecurityIdentifier and krbprincipalname https://pagure.io/freeipa/issue/8491 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-11 14:15:53 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=sourcehost,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: sourcehost
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
add:nsIndexType: sub
Add index for more trust-related attributes Add index for ipaNTTrustPartner, ipaNTSecurityIdentifier and krbprincipalname https://pagure.io/freeipa/issue/8491 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-11 14:15:53 -05:00
Use single update LDIF for indices Index definitions were split across four files. indices.ldif contained the initial subset of indices. Three update files partly duplicated the indices and partly added new indices. All indices are now defined in a single update file that is sorted alphanumerically. The changeset avoids two additional index tasks and reduces installation time by 5 to 10 seconds. Fixes: https://pagure.io/freeipa/issue/8493 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-09-21 08:12:57 -05:00
dn: cn=title,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: title
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
dn: cn=uid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: uid
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
dn: cn=uidnumber,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: uidnumber
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsMatchingRule: integerOrderingMatch
dn: cn=uniquemember,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: uniquemember
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: sub
dn: cn=userCertificate,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
only:cn: userCertificate
default:objectClass: nsIndex
default:objectClass: top
default:nsSystemIndex: false
add:nsIndexType: eq
add:nsIndexType: pres
Reference in New Issue Copy Permalink