Fix schema replication from old masters

The new merged database will replicate with both the IPA and CA trees, so all
DS instances (IPA and CA on the existing master, and the merged one on the
replica) need to have the same schema.

Dogtag does all its schema modifications online. Those are replicated normally.
The basic IPA schema, however, is delivered in ldif files, which are not
replicated. The files are not present on old CA DS instances. Any schema
update that references objects in these files will fail.

The whole 99user.ldif (i.e. changes introduced dynamically over LDAP) is
replicated as a blob. If we updated the old master's CA schema dynamically
during replica install, it would conflict with updates done during the
installation: the one with the lower CSN would get lost.
Dogtag's spawn script recently grew a new flag, 'pki_clone_replicate_schema'.
Turning it off tells Dogtag to create its schema in the clone, where the IPA
modifications are taking place, so that it is not overwritten by the IPA schema
on replication.

The patch solves the problems by:
- In __spawn_instance, turning off the pki_clone_replicate_schema flag.
- Providing a script to copy the IPA schema files to the CA DS instance.
  The script needs to be copied to old masters and run there.
- At replica CA install, checking if the schema is updated, and failing if not.
  The --skip-schema-check option is added to ipa-{replica,ca}-install to
  override the check.

All pre-3.1 CA servers in a domain will have to have the script run on them to
avoid schema replication errors.

https://fedorahosted.org/freeipa/ticket/3213
This commit is contained in:
Petr Viktorin
2012-10-24 04:37:16 -04:00
committed by Martin Kosek
parent 18a210996d
commit 1d3ddeff54
8 changed files with 161 additions and 0 deletions

View File

@@ -56,6 +56,7 @@ from ipaserver.install import installutils
from ipaserver.install import dsinstance
from ipaserver.install import certs
from ipaserver.install.installutils import ReplicaConfig
from ipaserver.plugins import ldap2
from ipalib import util
from ipapython.ipa_log_manager import *
@@ -673,6 +674,7 @@ class CAInstance(service.Service):
str(self.master_replication_port),
"pki_clone_replication_clone_port":
dogtag.install_constants.DS_PORT,
"pki_clone_replicate_schema": "False",
"pki_clone_uri":
"https://%s" % ipautil.format_netloc(self.master_host, 443)
}
@@ -1557,6 +1559,59 @@ class CAInstance(service.Service):
return master == 'New'
def replica_ca_install_check(config, master_ds_port):
if not config.setup_ca:
return
cafile = config.dir + "/cacert.p12"
if not ipautil.file_exists(cafile):
# self-signed replica
return
master_ds_port = int(master_ds_port)
# Exit if we have an old-style (Dogtag 9) CA already installed
ca = CAInstance(config.realm_name, certs.NSS_DIR,
dogtag_constants=dogtag.Dogtag9Constants)
if ca.is_installed():
root_logger.info('Dogtag 9 style CA instance found')
sys.exit("A CA is already configured on this system.")
if master_ds_port != dogtag.Dogtag9Constants.DS_PORT:
root_logger.debug(
'Installing CA Replica from master with a merged database')
return
# Check if the master has the necessary schema in its CA instance
ca_ldap_url = 'ldap://%s:%s' % (config.master_host_name, master_ds_port)
objectclass = 'ipaObject'
root_logger.debug('Checking if IPA schema is present in %s', ca_ldap_url)
try:
connection = ldap2.IPASimpleLDAPObject(ca_ldap_url)
connection.start_tls_s()
connection.simple_bind_s(DN(('cn', 'Directory Manager')),
config.dirman_password)
rschema = connection.schema
result = rschema.get_obj(ldap.schema.models.ObjectClass, objectclass)
except Exception:
root_logger.critical(
'CA DS schema check failed. Make sure the PKI service on the '
'remote master is operational.')
raise
if result:
root_logger.debug('Check OK')
else:
root_logger.critical(
'The master CA directory server does not have necessary schema. '
'Please copy the following script to all CA masters and run it '
'on them: %s\n'
'If you are certain that this is a false positive, use '
'--skip-schema-check.',
os.path.join(ipautil.SHARE_DIR, 'copy-schema-to-ca.py'))
exit('IPA schema missing on master CA directory server')
def install_replica_ca(config, master_ds_port, postinstall=False):
"""
Install a CA on a replica.