From 85ce7acb733e09ea7916a8a26d42fb3d4b5fe3bd Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Mon, 7 Feb 2022 08:42:40 +0200 Subject: [PATCH] OpenLDAP 2.6+: use only -H option to specify LDAP url OpenLDAP 2.6+ finally deprecated -h and -p options in all its command line tools. They are not allowed anymore and cause ldap* tools to stop hard with 'unknown option' error. Fix this by always using -H url option instead. Deriving default value for -H url from the configuration file still works, it is only -h and -p that were deprecated. See also: https://bugs.openldap.org/show_bug.cgi?id=8618 Fixes: https://pagure.io/freeipa/issue/9106 Signed-off-by: Alexander Bokovoy Reviewed-By: Florence Blanc-Renaud Reviewed-By: Florence Blanc-Renaud --- ipaclient/remote_plugins/2_114/sudorule.py | 4 +++- ipaclient/remote_plugins/2_156/sudorule.py | 4 +++- ipaclient/remote_plugins/2_164/sudorule.py | 4 +++- ipaclient/remote_plugins/2_49/sudorule.py | 4 +++- ipaserver/install/dsinstance.py | 2 +- ipaserver/plugins/sudorule.py | 2 +- ipatests/pytest_ipa/integration/tasks.py | 3 +-- 7 files changed, 15 insertions(+), 8 deletions(-) diff --git a/ipaclient/remote_plugins/2_114/sudorule.py b/ipaclient/remote_plugins/2_114/sudorule.py index 4b020738f..48a107ff9 100644 --- a/ipaclient/remote_plugins/2_114/sudorule.py +++ b/ipaclient/remote_plugins/2_114/sudorule.py @@ -41,7 +41,9 @@ IPA provides a designated binddn to use with Sudo located at: uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com To enable the binddn run the following command to set the password: -LDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W -h ipa.example.com -ZZ -D "cn=Directory Manager" uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com +LDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W \\ + -H ldap://ipa.example.com -ZZ -D "cn=Directory Manager" \\ + uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com EXAMPLES: diff --git a/ipaclient/remote_plugins/2_156/sudorule.py b/ipaclient/remote_plugins/2_156/sudorule.py index d475e68a6..04b3a3e10 100644 --- a/ipaclient/remote_plugins/2_156/sudorule.py +++ b/ipaclient/remote_plugins/2_156/sudorule.py @@ -41,7 +41,9 @@ IPA provides a designated binddn to use with Sudo located at: uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com To enable the binddn run the following command to set the password: -LDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W -h ipa.example.com -ZZ -D "cn=Directory Manager" uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com +LDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W \\ + -H ldap://ipa.example.com -ZZ -D "cn=Directory Manager" \\ + uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com EXAMPLES: diff --git a/ipaclient/remote_plugins/2_164/sudorule.py b/ipaclient/remote_plugins/2_164/sudorule.py index d475e68a6..04b3a3e10 100644 --- a/ipaclient/remote_plugins/2_164/sudorule.py +++ b/ipaclient/remote_plugins/2_164/sudorule.py @@ -41,7 +41,9 @@ IPA provides a designated binddn to use with Sudo located at: uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com To enable the binddn run the following command to set the password: -LDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W -h ipa.example.com -ZZ -D "cn=Directory Manager" uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com +LDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W \\ + -H ldap://ipa.example.com -ZZ -D "cn=Directory Manager" \\ + uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com EXAMPLES: diff --git a/ipaclient/remote_plugins/2_49/sudorule.py b/ipaclient/remote_plugins/2_49/sudorule.py index 912a0b1ef..44f8ae7fe 100644 --- a/ipaclient/remote_plugins/2_49/sudorule.py +++ b/ipaclient/remote_plugins/2_49/sudorule.py @@ -41,7 +41,9 @@ IPA provides a designated binddn to use with Sudo located at: uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com To enable the binddn run the following command to set the password: -LDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W -h ipa.example.com -ZZ -D "cn=Directory Manager" uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com +LDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W \\ + -H ldap://ipa.example.com -ZZ -D "cn=Directory Manager" \\ + uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com For more information, see the IPA Documentation to Sudo. """) diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py index ac9e131bb..04d26452d 100644 --- a/ipaserver/install/dsinstance.py +++ b/ipaserver/install/dsinstance.py @@ -1040,7 +1040,7 @@ class DsInstance(service.Service): admpwdfile.write(password) admpwdfile.flush() - args = [paths.LDAPPASSWD, "-h", self.fqdn, + args = [paths.LDAPPASSWD, "-H", "ldap://{}".format(self.fqdn), "-ZZ", "-x", "-D", str(DN(('cn', 'Directory Manager'))), "-y", dmpwdfile.name, "-T", admpwdfile.name, str(DN(('uid', 'admin'), ('cn', 'users'), ('cn', 'accounts'), self.suffix))] diff --git a/ipaserver/plugins/sudorule.py b/ipaserver/plugins/sudorule.py index 688065715..8528b6328 100644 --- a/ipaserver/plugins/sudorule.py +++ b/ipaserver/plugins/sudorule.py @@ -66,7 +66,7 @@ uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com """) + _(""" To enable the binddn run the following command to set the password: LDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W \ --h ipa.example.com -ZZ -D "cn=Directory Manager" \ +-H ldap://ipa.example.com -ZZ -D "cn=Directory Manager" \ uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com """) + _(""" EXAMPLES: diff --git a/ipatests/pytest_ipa/integration/tasks.py b/ipatests/pytest_ipa/integration/tasks.py index 836d140d4..7e1b7c24d 100755 --- a/ipatests/pytest_ipa/integration/tasks.py +++ b/ipatests/pytest_ipa/integration/tasks.py @@ -2086,8 +2086,7 @@ def ldapsearch_dm(host, base, ldap_args, scope='sub', **kwargs): args = [ 'ldapsearch', '-x', '-ZZ', - '-h', host.hostname, - '-p', '389', + '-H', "ldap://{}".format(host.hostname), '-D', str(host.config.dirman_dn), '-w', host.config.dirman_password, '-s', scope,