mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-24 08:00:02 -06:00
c0630950a1
Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
119 lines
3.5 KiB
Plaintext
119 lines
3.5 KiB
Plaintext
#
|
|
# Some nss_ldap implementations will always ask for memberuid so we must
|
|
# have an index for it.
|
|
#
|
|
# FreeIPA frequently searches for memberHost and memberUser to determine
|
|
# group membership.
|
|
#
|
|
dn: cn=memberuid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: memberuid
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq,pres
|
|
|
|
dn: cn=memberof,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: memberof
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq
|
|
|
|
dn: cn=memberHost,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: memberHost
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq
|
|
|
|
dn: cn=memberHost,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
add:nsIndexType: pres
|
|
|
|
dn: cn=memberUser,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: memberUser
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq
|
|
|
|
dn: cn=memberUser,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
only: nsIndexType: eq,pres
|
|
|
|
dn: cn=fqdn,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: fqdn
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq
|
|
default:nsIndexType: pres
|
|
|
|
dn: cn=macAddress,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: macAddress
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq
|
|
default:nsIndexType: pres
|
|
|
|
dn: cn=manager,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
only: nsIndexType: eq,pres
|
|
|
|
dn: cn=secretary,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
only: nsIndexType: eq,pres
|
|
|
|
dn: cn=sourcehost,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: sourcehost
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq
|
|
default:nsIndexType: pres
|
|
|
|
dn: cn=memberservice,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: memberservice
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq
|
|
default:nsIndexType: pres
|
|
|
|
dn: cn=managedby,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: managedby
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq
|
|
default:nsIndexType: pres
|
|
|
|
dn: cn=memberallowcmd,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: memberallowcmd
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq
|
|
default:nsIndexType: pres
|
|
|
|
dn: cn=memberdenycmd,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: memberdenycmd
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq
|
|
default:nsIndexType: pres
|
|
|
|
dn: cn=ipasudorunas,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: ipasudorunas
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq
|
|
default:nsIndexType: pres
|
|
|
|
dn: cn=ipasudorunasgroup,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
|
|
default:cn: ipasudorunasgroup
|
|
default:ObjectClass: top
|
|
default:ObjectClass: nsIndex
|
|
default:nsSystemIndex: false
|
|
default:nsIndexType: eq
|
|
default:nsIndexType: pres
|