Use api.env.container_sysaccounts

Refactor code to use api.env.container_sysaccounts instead of
('cn', 'sysaccounts'), ('cn', 'etc')

Related: https://pagure.io/freeipa/issue/8276
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

ipaserver/install/adtrust.py

@@ -297,8 +297,8 @@ def add_hosts_to_adtrust_agents(api, host_list):
     :param host_list: list of potential AD trust agent FQDNs
     """
     agents_dn = DN(
-        ('cn', 'adtrust agents'), ('cn', 'sysaccounts'),
-        ('cn', 'etc'), api.env.basedn)
+        ('cn', 'adtrust agents'), api.env.container_sysaccounts,
+        api.env.basedn)
 
     service.add_principals_to_group(
         api.Backend.ldap2,

ipaserver/install/adtrustinstance.py

@@ -192,8 +192,7 @@ class ADTRUSTInstance(service.Service):
         self.trust_dn = DN(api.env.container_trusts, self.suffix)
 
         self.smb_dn = DN(('cn', 'adtrust agents'),
-                         ('cn', 'sysaccounts'),
-                         ('cn', 'etc'),
+                         api.env.container_sysaccounts,
                          self.suffix)
 
         self.smb_dom_dn = DN(('cn', api.env.domain),

ipaserver/install/plugins/adtrust.py

@@ -903,8 +903,8 @@ class update_adtrust_agents_members(Updater):
             return False, []
 
         agents_dn = DN(
-            ('cn', 'adtrust agents'), ('cn', 'sysaccounts'),
-            ('cn', 'etc'), self.api.env.basedn)
+            ('cn', 'adtrust agents'), self.api.env.container_sysaccounts,
+            self.api.env.basedn)
 
         try:
             agents_entry = ldap.get_entry(agents_dn, ['member'])

ipaserver/install/plugins/update_passsync.py

@@ -56,8 +56,11 @@ class update_passync_privilege_update(Updater):
 
         logger.debug("Add PassSync user as a member of PassSync privilege")
         ldap = self.api.Backend.ldap2
-        passsync_dn = DN(('uid','passsync'), ('cn', 'sysaccounts'), ('cn', 'etc'),
-            self.api.env.basedn)
+        passsync_dn = DN(
+            ('uid', 'passsync'),
+            self.api.env.container_sysaccounts,
+            self.api.env.basedn
+        )
         passsync_privilege_dn = DN(('cn','PassSync Service'),
                 self.api.env.container_privilege,
                 self.api.env.basedn)

ipaserver/install/replication.py

@@ -720,7 +720,8 @@ class ReplicationManager:
         self.enable_chain_on_update(chainbe)
 
     def add_passsync_user(self, conn, password):
-        pass_dn = DN(('uid', 'passsync'), ('cn', 'sysaccounts'), ('cn', 'etc'), self.suffix)
+        pass_dn = DN(('uid', 'passsync'), api.env.container_sysaccounts,
+                     self.suffix)
         print("The user for the Windows PassSync service is %s" % pass_dn)
         try:
             conn.get_entry(pass_dn)

ipaserver/install/server/replicainstall.py

@@ -1010,8 +1010,9 @@ def promote_check(installer):
 
         # Detect if the other master can handle replication managers
         # cn=replication managers,cn=sysaccounts,cn=etc,$SUFFIX
-        dn = DN(('cn', 'replication managers'), ('cn', 'sysaccounts'),
-                ('cn', 'etc'), ipautil.realm_to_suffix(config.realm_name))
+        dn = DN(('cn', 'replication managers'),
+                api.env.container_sysaccounts,
+                ipautil.realm_to_suffix(config.realm_name))
         try:
             conn.get_entry(dn)
         except errors.NotFound:

ipaserver/servroles.py

@@ -584,8 +584,9 @@ class ADtrustBasedRole(BaseServerRole):
 
         search_filter = ldap.make_filter_from_attr(
             "memberof",
-            DN(('cn', 'adtrust agents'), ('cn', 'sysaccounts'),
-               ('cn', 'etc'), api_instance.env.basedn)
+            DN(('cn', 'adtrust agents'),
+               api_instance.env.container_sysaccounts,
+               api_instance.env.basedn)
         )
         if server is not None:
             server_filter = ldap.make_filter_from_attr(

ipatests/test_ipaserver/test_serverroles.py

@@ -55,8 +55,7 @@ def _make_master_entry(ldap_backend, dn, ca=False):
 
 _adtrust_agents = DN(
     ('cn', 'adtrust agents'),
-    ('cn', 'sysaccounts'),
-    ('cn', 'etc'),
+    api.env.container_sysaccounts,
     api.env.basedn
 )