IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Do not set a replication dn when using SASL/GSSAPI replication

Browse Source 
Fixes: https://fedorahosted.org/freeipa/ticket/817
This commit is contained in:
Simo Sorce
2011-01-19 19:17:48 -05:00
parent e72815771e
commit 5431d56ed4
1 changed files with 16 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
ipaserver/install/replication.py
View File

@@ -371,10 +371,6 @@ class ReplicationManager:
pass pass
port = 389 port = 389
if repl_man_dn is None:
repl_man_dn = self.repl_man_dn
if repl_man_passwd is None:
repl_man_passwd = self.repl_man_passwd
# List of attributes that need to be excluded from replication. # List of attributes that need to be excluded from replication.
excludes = ('memberof', 'entryusn', excludes = ('memberof', 'entryusn',
@@ -393,11 +389,11 @@ class ReplicationManager:
entry.setValues('nsDS5ReplicatedAttributeList', entry.setValues('nsDS5ReplicatedAttributeList',
'(objectclass=*) $ EXCLUDE %s' % " ".join(excludes)) '(objectclass=*) $ EXCLUDE %s' % " ".join(excludes))
entry.setValues('description', "me to %s" % b.host) entry.setValues('description', "me to %s" % b.host)
entry.setValues('nsds5replicabinddn', repl_man_dn)
if isgssapi: if isgssapi:
entry.setValues('nsds5replicatransportinfo', 'LDAP') entry.setValues('nsds5replicatransportinfo', 'LDAP')
entry.setValues('nsds5replicabindmethod', 'SASL/GSSAPI') entry.setValues('nsds5replicabindmethod', 'SASL/GSSAPI')
else: else:
entry.setValues('nsds5replicabinddn', repl_man_dn)
entry.setValues('nsds5replicacredentials', repl_man_passwd) entry.setValues('nsds5replicacredentials', repl_man_passwd)
entry.setValues('nsds5replicatransportinfo', 'TLS') entry.setValues('nsds5replicatransportinfo', 'TLS')
entry.setValues('nsds5replicabindmethod', 'simple') entry.setValues('nsds5replicabindmethod', 'simple')
@@ -436,25 +432,20 @@ class ReplicationManager:
except ldap.TYPE_OR_VALUE_EXISTS: except ldap.TYPE_OR_VALUE_EXISTS:
pass pass
return (a_pn[0].dn, b_pn[0].dn)
def gssapi_update_agreements(self, a, b): def gssapi_update_agreements(self, a, b):
(a_pn_dn, b_pn_dn) = self.setup_krb_princs_as_replica_binddns(a, b) self.setup_krb_princs_as_replica_binddns(a, b)
#change replication agreements to connect to other host using GSSAPI #change replication agreements to connect to other host using GSSAPI
mod = [(ldap.MOD_REPLACE, "nsds5replicatransportinfo", "LDAP"),
(ldap.MOD_REPLACE, "nsds5replicabindmethod", "SASL/GSSAPI"),
(ldap.MOD_DELETE, "nsds5replicabinddn", None),
(ldap.MOD_DELETE, "nsds5replicacredentials", None)]
cn, a_ag_dn = self.agreement_dn(b.host) cn, a_ag_dn = self.agreement_dn(b.host)
mod = [(ldap.MOD_REPLACE, "nsds5replicabinddn", a_pn_dn),
(ldap.MOD_DELETE, "nsds5replicacredentials", None),
(ldap.MOD_REPLACE, "nsds5replicatransportinfo", "LDAP"),
(ldap.MOD_REPLACE, "nsds5replicabindmethod", "SASL/GSSAPI")]
a.modify_s(a_ag_dn, mod) a.modify_s(a_ag_dn, mod)
cn, b_ag_dn = self.agreement_dn(a.host) cn, b_ag_dn = self.agreement_dn(a.host)
mod = [(ldap.MOD_REPLACE, "nsds5replicabinddn", b_pn_dn),
(ldap.MOD_DELETE, "nsds5replicacredentials", None),
(ldap.MOD_REPLACE, "nsds5replicatransportinfo", "LDAP"),
(ldap.MOD_REPLACE, "nsds5replicabindmethod", "SASL/GSSAPI")]
b.modify_s(b_ag_dn, mod) b.modify_s(b_ag_dn, mod)
# Finally remove the temporary replication manager user # Finally remove the temporary replication manager user
@@ -605,8 +596,12 @@ class ReplicationManager:
self.basic_replication_setup(r_conn, r_id, self.basic_replication_setup(r_conn, r_id,
self.repl_man_dn, self.repl_man_passwd) self.repl_man_dn, self.repl_man_passwd)
self.setup_agreement(r_conn, self.conn) self.setup_agreement(r_conn, self.conn,
self.setup_agreement(self.conn, r_conn) repl_man_dn=self.repl_man_dn,
repl_man_passwd=self.repl_man_passwd)
self.setup_agreement(self.conn, r_conn,
repl_man_dn=self.repl_man_dn,
repl_man_passwd=self.repl_man_passwd)
#Finally start replication #Finally start replication
ret = self.start_replication(r_conn) ret = self.start_replication(r_conn)
@@ -690,13 +685,11 @@ class ReplicationManager:
r_conn.sasl_interactive_bind_s('', SASL_AUTH) r_conn.sasl_interactive_bind_s('', SASL_AUTH)
# Allow krb principals to act as replicas # Allow krb principals to act as replicas
(self_dn, r_dn) = self.setup_krb_princs_as_replica_binddns(self.conn, r_conn) self.setup_krb_princs_as_replica_binddns(self.conn, r_conn)
# Create mutual replication agreementsausiung SASL/GSSAPI # Create mutual replication agreementsausiung SASL/GSSAPI
self.setup_agreement(self.conn, r_conn, self.setup_agreement(self.conn, r_conn, isgssapi=True)
repl_man_dn=self_dn, isgssapi=True) self.setup_agreement(r_conn, self.conn, isgssapi=True)
self.setup_agreement(r_conn, self.conn,
repl_man_dn=r_dn, isgssapi=True)
def initialize_replication(self, dn, conn): def initialize_replication(self, dn, conn):
mod = [(ldap.MOD_ADD, 'nsds5BeginReplicaRefresh', 'start')] mod = [(ldap.MOD_ADD, 'nsds5BeginReplicaRefresh', 'start')]