IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-23 15:40:01 -06:00
Code Issues Packages Projects Releases Wiki Activity
efa5719363
freeipa/install/updates/20-syncrepl.update

30 lines
1.2 KiB
Plaintext
Raw Normal View History

Limit memberOf and refInt DS plugins to main IPA suffix. This drastically improves performance of retro changelog trimming. https://fedorahosted.org/freeipa/ticket/3967
2014-01-23 05:22:38 -06:00
# Enable Retro changelog - it is necessary for SyncRepl
Enable Retro Changelog and Content Synchronization DS plugins Enable Retro Changelog and Content Synchronization DS plugins which are required for SyncRepl support. Create a working directory /var/named/ipa required by bind-dyndb-ldap v4+. https://fedorahosted.org/freeipa/ticket/3967
2013-10-25 05:41:25 -05:00
dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
only:nsslapd-pluginEnabled: on
Limit memberOf and refInt DS plugins to main IPA suffix. This drastically improves performance of retro changelog trimming. https://fedorahosted.org/freeipa/ticket/3967
2014-01-23 05:22:38 -06:00
# Remember original nsuniqueid for objects referenced from cn=changelog
Enable Retro Changelog and Content Synchronization DS plugins Enable Retro Changelog and Content Synchronization DS plugins which are required for SyncRepl support. Create a working directory /var/named/ipa required by bind-dyndb-ldap v4+. https://fedorahosted.org/freeipa/ticket/3967
2013-10-25 05:41:25 -05:00
add:nsslapd-attribute: nsuniqueid:targetUniqueId
add:nsslapd-changelogmaxage: 2d
ldap: limit the retro changelog to dns subtree The content synchronization plugin can be limited to the dns subtree in Directory Server. This increases performance and helps to prevent some potential issues. Fixes: https://pagure.io/freeipa/issue/6515 Signed-off-by: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-23 07:06:20 -05:00
add:nsslapd-include-suffix: cn=dns,$SUFFIX
Enable Retro Changelog and Content Synchronization DS plugins Enable Retro Changelog and Content Synchronization DS plugins which are required for SyncRepl support. Create a working directory /var/named/ipa required by bind-dyndb-ldap v4+. https://fedorahosted.org/freeipa/ticket/3967
2013-10-25 05:41:25 -05:00
Limit memberOf and refInt DS plugins to main IPA suffix. This drastically improves performance of retro changelog trimming. https://fedorahosted.org/freeipa/ticket/3967
2014-01-23 05:22:38 -06:00
# Keep memberOf and referential integrity plugins away from cn=changelog.
# It is necessary for performance reasons because we don't have appropriate
# indices for cn=changelog.
dn: cn=MemberOf Plugin,cn=plugins,cn=config
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:memberofentryscope: $SUFFIX
DS deadlock when memberof scopes topology plugin updates Topology plugin may merge (aka DEL) segments that would trigger internal search for groups owning that segment. The problem is that it is searching those groups into the full suffix and so need the schema compat map lock. If any other operation holding schema compat map lock need to access the page involved in the DEL, there is a deadlock. This fix is to prevent useless group searching if the target entry is a segment or is in compat tree. https://fedorahosted.org/freeipa/ticket/5637 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-03-17 06:09:42 -05:00
add:memberofentryscopeexcludesubtree: cn=compat,$SUFFIX
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:memberofentryscopeexcludesubtree: cn=provisioning,$SUFFIX
DS deadlock when memberof scopes topology plugin updates Topology plugin may merge (aka DEL) segments that would trigger internal search for groups owning that segment. The problem is that it is searching those groups into the full suffix and so need the schema compat map lock. If any other operation holding schema compat map lock need to access the page involved in the DEL, there is a deadlock. This fix is to prevent useless group searching if the target entry is a segment or is in compat tree. https://fedorahosted.org/freeipa/ticket/5637 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-03-17 06:09:42 -05:00
add:memberofentryscopeexcludesubtree: cn=topology,cn=ipa,cn=etc,$SUFFIX
Limit memberOf and refInt DS plugins to main IPA suffix. This drastically improves performance of retro changelog trimming. https://fedorahosted.org/freeipa/ticket/3967
2014-01-23 05:22:38 -06:00
dn: cn=referential integrity postoperation,cn=plugins,cn=config
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:nsslapd-plugincontainerscope: $SUFFIX
add:nsslapd-pluginentryscope: $SUFFIX
add:nsslapd-pluginExcludeEntryScope: cn=provisioning,$SUFFIX
Limit memberOf and refInt DS plugins to main IPA suffix. This drastically improves performance of retro changelog trimming. https://fedorahosted.org/freeipa/ticket/3967
2014-01-23 05:22:38 -06:00
Enable Retro Changelog and Content Synchronization DS plugins Enable Retro Changelog and Content Synchronization DS plugins which are required for SyncRepl support. Create a working directory /var/named/ipa required by bind-dyndb-ldap v4+. https://fedorahosted.org/freeipa/ticket/3967
2013-10-25 05:41:25 -05:00
# Enable SyncRepl
dn: cn=Content Synchronization,cn=plugins,cn=config
only:nsslapd-pluginEnabled: on
User Life Cycle: create containers and scoping DS plugins User Life Cycle is designed http://www.freeipa.org/page/V4/User_Life-Cycle_Management It manages 3 containers (Staging, Active, Delete). At install/upgrade Delete and Staging containers needs to be created. Active: cn=users,cn=accounts,$SUFFIX Delete: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX Stage: cn=staged users ,cn=accounts,cn=provisioning,$SUFFIX Plugins scopes: krbPrincipalName, krbCanonicalName, ipaUniqueID, uid: cn=accounts,SUFFIX cn=deleted users,cn=accounts,cn=provisioning,SUFFIX DNA: cn=accounts,SUFFIX Plugins exclude subtree: IPA UUID, Referential Integrity, memberOf: cn=provisioning,SUFFIX https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-08-07 09:29:02 -05:00
# Make sure IPA UUID does not generate ipaUniqueID for Stage/Delete entries
dn: cn=IPA Unique IDs,cn=IPA UUID,cn=plugins,cn=config
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:ipaUuidExcludeSubtree: cn=provisioning,$SUFFIX
Reference in New Issue Copy Permalink