Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[master] gracefully handle setting replica bind dn group on old masters #319

Closed
wants to merge 1 commit into from
Closed

[master] gracefully handle setting replica bind dn group on old masters #319

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
48 changes: 32 additions & 16 deletions ipaserver/install/replication.py
View file
Open in desktop
Expand Up @@ -436,6 +436,34 @@ def replica_dn(self):
return DN(('cn', 'replica'), ('cn', self.db_suffix),
('cn', 'mapping tree'), ('cn', 'config'))

def set_replica_binddngroup(self, r_conn, entry):
"""
Set nsds5replicabinddngroup attribute on remote master's replica entry.
Older masters (ipa < 3.3) may not support setting this attribute. In
this case log the error and fall back to setting replica's binddn
directly.
"""
binddn_groups = {
DN(p) for p in entry.get('nsds5replicabinddngroup', [])}

mod = []
if self.repl_man_group_dn not in binddn_groups:
mod.append((ldap.MOD_ADD, 'nsds5replicabinddngroup',
self.repl_man_group_dn))

if 'nsds5replicabinddngroupcheckinterval' not in entry:
mod.append(
(ldap.MOD_ADD,
'nsds5replicabinddngroupcheckinterval',
'60'))
if mod:
try:
r_conn.modify_s(entry.dn, mod)
except ldap.UNWILLING_TO_PERFORM:
root_logger.debug(
"nsds5replicabinddngroup attribute not supported on "
"remote master.")

def replica_config(self, conn, replica_id, replica_binddn):
assert isinstance(replica_binddn, DN)
dn = self.replica_dn()
Expand All @@ -444,27 +472,15 @@ def replica_config(self, conn, replica_id, replica_binddn):
try:
entry = conn.get_entry(dn)
managers = {DN(m) for m in entry.get('nsDS5ReplicaBindDN', [])}
binddn_groups = {
DN(p) for p in entry.get('nsds5replicabinddngroup', [])}

mod = []
if replica_binddn not in managers:
# Add the new replication manager
mod.append((ldap.MOD_ADD, 'nsDS5ReplicaBindDN',
replica_binddn))

if self.repl_man_group_dn not in binddn_groups:
mod.append((ldap.MOD_ADD, 'nsds5replicabinddngroup',
self.repl_man_group_dn))

if 'nsds5replicabinddngroupcheckinterval' not in entry:
mod.append(
(ldap.MOD_ADD,
'nsds5replicabinddngroupcheckinterval',
'60'))
if mod:
mod = [(ldap.MOD_ADD, 'nsDS5ReplicaBindDN',
replica_binddn)]
conn.modify_s(dn, mod)

self.set_replica_binddngroup(conn, entry)

# replication is already configured
return
except errors.NotFound:
Expand Down