IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-24 16:10:02 -06:00
Code Issues Packages Projects Releases Wiki Activity
45b8cc1d83
freeipa/install/updates/90-post_upgrade_plugins.update

38 lines
1.1 KiB
Plaintext
Raw Normal View History

Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
# first
# middle
topology: manage ca replication agreements Configure IPA so that topology plugin will manage also CA replication agreements. upgrades if CA is congigured: - ipaca suffix is added to cn=topology,cn=ipa,cn=etc,$SUFFIX - ipaReplTopoManagedSuffix: o=ipaca is added to master entry - binddngroup is added to o=ipaca replica entry Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-15 04:17:14 -05:00
plugin: update_ca_topology
Add ipaDNSVersion option to dnsconfig* commands and use new attribute Ad-hoc LDAP calls in DNS upgrade code were hard to maintain and ipaConfigString was bad idea from the very beginning as it was hard to manipulate the number in it. To avoid problems in future we are introducing new ipaDNSVersion attribute which is used on cn=dns instead of ipaConfigString. Original value of ipaConfigString is kept in the tree for now so older upgraders see it and do not execute the upgrade procedure again. The attribute can be changed only by installer/upgrade so it is not exposed in dnsconfig_mod API. Command dnsconfig_show displays it only if --all option was used. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-04-25 07:07:16 -05:00
plugin: update_ipaconfigstring_dnsversion_to_ipadnsversion
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_dnszones
plugin: update_dns_limits
upgrade: fix config of sidgen and extdom plugins During upgrade to IPA 4.2, literally "$SUFFIX" value was added to configuration of sidgen and extdom plugins. This cause that SID are not properly configured. Upgrade must fix "$SUFFIX" to reals suffix DN, and run sidgen task against IPA domain (if exists). All trusts added when plugins configuration was broken must be re-added. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-02-18 12:59:50 -06:00
plugin: update_sigden_extdom_broken_config
plugin: update_sids
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_default_range
plugin: update_default_trust_view
Upgrade: add gidnumber to trusted domain entry The trusted domain entries created in earlier versions are missing gidnumber. During upgrade, a new plugin will read the gidnumber of the fallback group cn=Default SMB Group and add this value to trusted domain entries which do not have a gidNumber. https://pagure.io/freeipa/issue/6827 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-04-03 08:57:47 -05:00
plugin: update_tdo_gidnumber
upgrade: add trust upgrade to actual upgrade code Fixes: https://pagure.io/freeipa/issue/6077 Reviewed-By: Christian Heimes <cheimes@redhat.com>
2019-03-22 12:08:33 -05:00
plugin: update_tdo_to_new_layout
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_ca_renewal_master
plugin: update_idrange_type
plugin: update_pacs
plugin: update_service_principalalias
Fix ipa-server-upgrade: This entry already exists ipa-server-upgrade fails when running the ipaload_cacrt plugin. The plugin finds all CA certificates in /etc/httpd/alias and uploads them in LDAP below cn=certificates,cn=ipa,cn=etc,$BASEDN. The issue happens because there is already an entry in LDAP for IPA CA, but with a different DN. The nickname in /etc/httpd/alias can differ from $DOMAIN IPA CA. To avoid the issue: 1/ during upgrade, run a new plugin that removes duplicates and restarts ldap (to make sure that uniqueness attr plugin is working after the new plugin) 2/ modify upload_cacert plugin so that it is using $DOMAIN IPA CA instead of cn=$nickname,cn=ipa,cn=etc,$BASEDN when uploading IPA CA. https://pagure.io/freeipa/issue/7125 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-08-28 03:50:58 -05:00
plugin: update_fix_duplicate_cacrt_in_ldap
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_upload_cacrt
server upgrade: fix upgrade from pre-4.0 update_ca_renewal_master uses ipaCert certmonger tracking information to decide whether the local server is the CA renewal master or not. The information is lost when migrating from /etc/httpd/alias to /var/lib/ipa/radb in update_ra_cert_store. Make sure update_ra_cert_store is executed after update_ca_renewal_master so that correct information is used. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-16 04:13:13 -06:00
# update_ra_cert_store has to be executed after update_ca_renewal_master
plugin: update_ra_cert_store
Support Samba 4.9 Samba 4.9 became a bit more strict about creating a local NT token and a failure to resolve or create BUILTIN\Guests group will cause a rejection of the connection for a successfully authenticated one. Add a default mapping of the nobody group to BUILTIN\Guests. BUILTIN\Guests is a special group SID that is added to the NT token for authenticated users. For real guests there is 'guest account' option in smb.conf which defaults to 'nobody' user. This was implicit behavior before as 'guest account = nobody' by default would pick up 'nobody' group as well. Fixes: https://pagure.io/freeipa/issue/7705 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2018-09-21 02:57:23 -05:00
plugin: update_mapping_Guests_to_nobody
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
# last
DNS upgrade: change forwarding policy to = only for conflicting forward zones This change is necessary to override automatic empty zone configuration in latest BIND and bind-dyndb-ldap 9.0+. This procedure is still not complete because we need to handle global forwarders too (in LDAP and in named.conf on each server). https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-04-27 07:44:17 -05:00
# DNS version 1
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_master_to_dnsforwardzones
DNS upgrade: change forwarding policy to = only for conflicting forward zones This change is necessary to override automatic empty zone configuration in latest BIND and bind-dyndb-ldap 9.0+. This procedure is still not complete because we need to handle global forwarders too (in LDAP and in named.conf on each server). https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-04-27 07:44:17 -05:00
# DNS version 2
plugin: update_dnsforward_emptyzones
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_managed_post
plugin: update_managed_permissions
fix permission: Read Replication Agreements This permission cannot be MANAGED permission because it is located in nonreplicating part of the LDAP tree. As side effect, the particular ACI has not been created on all replicas. This commit makes Read Replication Agreements non managed permission and also fix missing ACI on replicas. https://fedorahosted.org/freeipa/ticket/5631 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-04 09:23:40 -06:00
plugin: update_read_replication_agreements_permission
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_idrange_baserid
plugin: update_passync_privilege_update
DNS Locations: dnsserver: put server_id option into named.conf The option server_id is required for DNS location feature, otherwise it will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-13 13:41:24 -05:00
plugin: update_dnsserver_configuration_into_ldap
Move ds.replica_populate to an update plugin Replica populate can be applied with other update plugins. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-10-13 08:08:31 -05:00
plugin: update_ldap_server_list
Moved update of DNA plugin among update plugins To make the code more general, moved the update_dna_shared_config among other update plugins. Bugfix: DNA shared config connection protocol was compared to a method string which would result in a try to always update it even if there was no need to. https://fedorahosted.org/389/ticket/48373 causes that two shared DNA config entries are created instead of one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-10-18 03:16:29 -05:00
plugin: update_dna_shared_config
Reference in New Issue Copy Permalink