Move DS's Kerberos env vars to unit file

The IPA specific env vars KRB5_KTNAME and KRB5CCNAME are now defined in
a instance specific ipa-env.conf unit file.

Fixes: https://pagure.io/freeipa/issue/7860
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

install/share/Makefile.am

@@ -39,6 +39,7 @@ dist_app_DATA =				\
 	replica-acis.ldif		\
 	replica-prevent-time-skew.ldif  \
 	ds-nfiles.ldif			\
+	ds-ipa-env.conf.template	\
 	dns.ldif			\
 	dnssec.ldif			\
 	domainlevel.ldif			\

install/share/ds-ipa-env.conf.template

@@ -0,0 +1,5 @@
+# Installed and maintained by ipa update tools, please do not modify
+
+[Service]
+Environment=KRB5_KTNAME=$KRB5_KTNAME
+Environment=KRB5CCNAME=$KRB5CCNAME

ipaplatform/base/paths.py

@@ -382,6 +382,8 @@ class BasePathNamespace:
     VAR_LOG_DIRSRV_INSTANCE_TEMPLATE = "/var/log/dirsrv/slapd-%s"
     SLAPD_INSTANCE_ACCESS_LOG_TEMPLATE = "/var/log/dirsrv/slapd-%s/access"
     SLAPD_INSTANCE_ERROR_LOG_TEMPLATE = "/var/log/dirsrv/slapd-%s/errors"
+    SLAPD_INSTANCE_SYSTEMD_IPA_ENV_TEMPLATE = \
+        "/etc/systemd/system/dirsrv@%s.service.d/ipa-env.conf"
     # Legacy 389 commands
     LDIF2DB = '/usr/sbin/ldif2db'
     DB2LDIF = '/usr/sbin/db2ldif'

ipaserver/install/dsinstance.py

@@ -26,7 +26,6 @@ import pwd
 import os
 import time
 import tempfile
-import stat
 import fnmatch
 
 from lib389 import DirSrv
@@ -200,7 +199,6 @@ class DsInstance(service.Service):
         self.nickname = 'Server-Cert'
         self.sub_dict = None
         self.domain = domain_name
-        self.serverid = None
         self.master_fqdn = None
         self.pkcs12_info = None
         self.cacert_name = None
@@ -216,9 +214,11 @@ class DsInstance(service.Service):
         self.domainlevel = domainlevel
         if realm_name:
             self.suffix = ipautil.realm_to_suffix(self.realm)
+            self.serverid = ipaldap.realm_to_serverid(self.realm)
             self.__setup_sub_dict()
         else:
             self.suffix = DN()
+            self.serverid = None
 
     subject_base = ipautil.dn_attribute_property('_subject_base')
 
@@ -245,7 +245,8 @@ class DsInstance(service.Service):
         self.step("enabling referential integrity plugin", self.__add_referint_module)
         self.step("configuring certmap.conf", self.__certmap_conf)
         self.step("configure new location for managed entries", self.__repoint_managed_entries)
-        self.step("configure dirsrv ccache", self.configure_dirsrv_ccache)
+        self.step("configure dirsrv ccache and keytab",
+                  self.configure_systemd_ipa_env)
         self.step("enabling SASL mapping fallback",
                   self.__enable_sasl_mapping_fallback)
 
@@ -521,7 +522,6 @@ class DsInstance(service.Service):
 
     def __create_instance(self):
         self.backup_state("serverid", self.serverid)
-        self.fstore.backup_file(paths.SYSCONFIG_DIRSRV)
 
         # The new installer is api driven. We can pass it a log function
         # and it will use it. Because of this, we can pass verbose true,
@@ -756,21 +756,39 @@ class DsInstance(service.Service):
     def __repoint_managed_entries(self):
         self._ldap_mod("repoint-managed-entries.ldif", self.sub_dict)
 
-    def configure_dirsrv_ccache(self):
+    def configure_systemd_ipa_env(self):
         pent = pwd.getpwnam(platformconstants.DS_USER)
-        ccache = paths.TMP_KRB5CC % pent.pw_uid
+        template = os.path.join(
-        filepath = paths.SYSCONFIG_DIRSRV
+            paths.USR_SHARE_IPA_DIR, "ds-ipa-env.conf.template"
-        if not os.path.exists(filepath):
+        )
-            # file doesn't exist; create it with correct ownership & mode
+        sub_dict = dict(
-            open(filepath, 'a').close()
+            KRB5_KTNAME=paths.DS_KEYTAB,
-            os.chmod(filepath,
+            KRB5CCNAME=paths.TMP_KRB5CC % pent.pw_uid
-                stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH)
+        )
-            os.chown(filepath, 0, 0)
+        conf = ipautil.template_file(template, sub_dict)
 
-        replacevars = {'KRB5CCNAME': ccache}
+        destfile = paths.SLAPD_INSTANCE_SYSTEMD_IPA_ENV_TEMPLATE % (
-        ipautil.backup_config_and_replace_variables(
+            self.serverid
-            self.fstore, filepath, replacevars=replacevars)
+        )
-        tasks.restore_context(filepath)
+        destdir = os.path.dirname(destfile)
+
+        if not os.path.isdir(destdir):
+            # create dirsrv-$SERVERID.service.d
+            os.mkdir(destdir, 0o755)
+        with open(destfile, 'w') as f:
+            os.fchmod(f.fileno(), 0o644)
+            f.write(conf)
+        tasks.restore_context(destfile)
+
+        # remove variables from old /etc/sysconfig/dirsrv file
+        if os.path.isfile(paths.SYSCONFIG_DIRSRV):
+            self.fstore.backup_file(paths.SYSCONFIG_DIRSRV)
+            ipautil.config_replace_variables(
+                paths.SYSCONFIG_DIRSRV,
+                removevars={'KRB5_KTNAME', 'KRB5CCNAME'}
+            )
+        # reload systemd to materialize new config file
+        tasks.systemd_daemon_reload()
 
     def __managed_entries(self):
         self._ldap_mod("managed-entries.ldif", self.sub_dict)
@@ -1083,6 +1101,17 @@ class DsInstance(service.Service):
                 serverid)
             installutils.rmtree(scripts)
 
+            # remove systemd unit file
+            unitfile = paths.SLAPD_INSTANCE_SYSTEMD_IPA_ENV_TEMPLATE % (
+                serverid
+            )
+            installutils.remove_file(unitfile)
+            try:
+                os.rmdir(os.path.dirname(unitfile))
+            except OSError:
+                # not empty
+                pass
+
         # Just eat this state
         self.restore_state("user_exists")
 

ipaserver/install/ipa_backup.py

@@ -375,6 +375,7 @@ class Backup(admintool.AdminTool):
         for file in (
             paths.SYSCONFIG_DIRSRV_INSTANCE % serverid,
             paths.ETC_TMPFILESD_DIRSRV % serverid,
+            paths.SLAPD_INSTANCE_SYSTEMD_IPA_ENV_TEMPLATE % serverid,
         ):
             if os.path.exists(file):
                 self.files.append(file)

ipaserver/install/krbinstance.py

@@ -386,10 +386,6 @@ class KrbInstance(service.Service):
 
         self.fstore.backup_file(paths.DS_KEYTAB)
         installutils.create_keytab(paths.DS_KEYTAB, ldap_principal)
-
-        vardict = {"KRB5_KTNAME": paths.DS_KEYTAB}
-        ipautil.config_replace_variables(paths.SYSCONFIG_DIRSRV,
-                                         replacevars=vardict)
         pent = pwd.getpwnam(constants.DS_USER)
         os.chown(paths.DS_KEYTAB, pent.pw_uid, pent.pw_gid)
 

ipaserver/install/server/upgrade.py

@@ -1812,13 +1812,12 @@ def upgrade_configuration():
     fqdn = api.env.host
 
     # Ok, we are an IPA server, do the additional tests
-    ds_serverid = ipaldap.realm_to_serverid(api.env.realm)
+    ds = dsinstance.DsInstance(realm_name=api.env.realm)
-    ds = dsinstance.DsInstance()
 
     # start DS, CA will not start without running DS, and cause error
     ds_running = ds.is_running()
     if not ds_running:
-        ds.start(ds_serverid)
+        ds.start(ds.serverid)
 
     if not sysupgrade.get_upgrade_state('ntpd', 'ntpd_cleaned'):
         ntpd_cleanup(fqdn, fstore)
@@ -1872,7 +1871,7 @@ def upgrade_configuration():
                 paths.CA_CS_CFG_PATH, 'ca.crl.MasterCRL.enableCRLUpdates', '=')
             sub_dict['CLONE']='#' if crl.lower() == 'true' else ''
 
-        ds_dirname = dsinstance.config_dirname(ds_serverid)
+        ds_dirname = dsinstance.config_dirname(ds.serverid)
 
         upgrade_file(sub_dict, paths.HTTPD_IPA_CONF,
                      os.path.join(paths.USR_SHARE_IPA_DIR,
@@ -1948,16 +1947,16 @@ def upgrade_configuration():
 
     http.enable_and_start_oddjobd()
 
-    ds.configure_dirsrv_ccache()
+    ds.configure_systemd_ipa_env()
 
     update_replica_config(ipautil.realm_to_suffix(api.env.realm))
     if ca.is_configured():
         update_replica_config(DN(('o', 'ipaca')))
 
-    ds.stop(ds_serverid)
+    ds.stop(ds.serverid)
     fix_schema_file_syntax()
     remove_ds_ra_cert(subject_base)
-    ds.start(ds_serverid)
+    ds.start(ds.serverid)
 
     ds.fqdn = fqdn
     ds.realm = api.env.realm
@@ -2116,7 +2115,7 @@ def upgrade_configuration():
     enable_certauth(krb)
 
     if not ds_running:
-        ds.stop(ds_serverid)
+        ds.stop(ds.serverid)
 
     if ca.is_configured():
         if ca_running and not ca.is_running():