From 822910bb85c4dedff39faff142e645c5f2922984 Mon Sep 17 00:00:00 2001

From: Martin Basti <mbasti@redhat.com>

Date: Fri, 7 Nov 2014 13:28:01 +0100

Subject: [PATCH] Fix upgrade referint plugin

Mixing 'Old' and 'New' attr style for referential integrity plugin causes errors.

Now old setting are migrated to new style setting before upgrade

Ticket: https://fedorahosted.org/freeipa/ticket/4622

Reviewed-By: David Kupka <dkupka@redhat.com>

---

 install/updates/25-referint.update           | 13 +---

 ipaserver/install/plugins/Makefile.am        |  1 +

 ipaserver/install/plugins/update_referint.py | 90 ++++++++++++++++++++++++++++

 3 files changed, 92 insertions(+), 12 deletions(-)

 create mode 100644 ipaserver/install/plugins/update_referint.py

diff --git a/install/updates/25-referint.update b/install/updates/25-referint.update

index a43d21ad5152358cb939c3545f0eef9d251e7fe0..609eaba74f0fcde6ce875093587315681fbd4584 100644

--- a/install/updates/25-referint.update

+++ b/install/updates/25-referint.update

@@ -1,19 +1,8 @@

 # Expand attributes checked by Referential Integrity plugin

 # pres and eq indexes defined in 20-indices.update must be set for all these

 # attributes

+# NOTE: migration to new style is done in update_referint.py

 dn: cn=referential integrity postoperation,cn=plugins,cn=config

-remove: nsslapd-pluginArg7: manager

-remove: nsslapd-pluginArg8: secretary

-remove: nsslapd-pluginArg9: memberuser

-remove: nsslapd-pluginArg10: memberhost

-remove: nsslapd-pluginArg11: sourcehost

-remove: nsslapd-pluginArg12: memberservice

-remove: nsslapd-pluginArg13: managedby

-remove: nsslapd-pluginArg14: memberallowcmd

-remove: nsslapd-pluginArg15: memberdenycmd

-remove: nsslapd-pluginArg16: ipasudorunas

-remove: nsslapd-pluginArg17: ipasudorunasgroup

-remove: nsslapd-pluginArg18: ipatokenradiusconfiglink

 add: referint-membership-attr: manager

 add: referint-membership-attr: secretary

 add: referint-membership-attr: memberuser

diff --git a/ipaserver/install/plugins/Makefile.am b/ipaserver/install/plugins/Makefile.am

index 635877d8c2160a91208276498cdb4cd9bc82d56b..d651297ac141b0f05831e7fabbb9b561cdd239c7 100644

--- a/ipaserver/install/plugins/Makefile.am

+++ b/ipaserver/install/plugins/Makefile.am

@@ -11,6 +11,7 @@ app_PYTHON = 			\

 	update_services.py	\

 	update_anonymous_aci.py	\

 	update_pacs.py		\

+	update_referint.py	\

 	ca_renewal_master.py	\

 	update_uniqueness.py	\

 	$(NULL)

diff --git a/ipaserver/install/plugins/update_referint.py b/ipaserver/install/plugins/update_referint.py

new file mode 100644

index 0000000000000000000000000000000000000000..1b7411035b27ebba04246a7ee6f220d470b46688

--- /dev/null

+++ b/ipaserver/install/plugins/update_referint.py

@@ -0,0 +1,90 @@

+#

+# Copyright (C) 2014  FreeIPA Contributors see COPYING for license

+#

+

+from ipaserver.install.plugins import MIDDLE

+from ipaserver.install.plugins.baseupdate import PreUpdate

+from ipalib import api, errors

+from ipapython.dn import DN

+from ipapython.ipa_log_manager import root_logger

+

+class update_referint(PreUpdate):

+    """

+    Update referential integrity configuration to new style

+    http://directory.fedoraproject.org/docs/389ds/design/ri-plugin-configuration.html

+

+    old attr              -> new attr

+    nsslapd-pluginArg0    -> referint-update-delay

+    nsslapd-pluginArg1    -> referint-logfile

+    nsslapd-pluginArg2    -> referint-logchanges

+    nsslapd-pluginArg3..N -> referint-membership-attr [3..N]

+

+    Old and new style cannot be mixed, all nslapd-pluginArg* attrs have to be removed

+    """

+

+    order = MIDDLE

+

+    referint_dn = DN(('cn', 'referential integrity postoperation'),

+                           ('cn', 'plugins'), ('cn', 'config'))

+

+    def execute(self, **options):

+

+        root_logger.debug("Upgrading referential integrity plugin configuration")

+        ldap = self.obj.backend

+        try:

+            entry = ldap.get_entry(self.referint_dn)

+        except errors.NotFound:

+            root_logger.error("Referential integrity configuration not found")

+            return False, False, []

+

+        referint_membership_attrs = []

+

+        root_logger.debug("Initial value: %s", repr(entry))

+

+        # nsslapd-pluginArg0    -> referint-update-delay

+        update_delay = entry.get('nsslapd-pluginArg0')

+        if update_delay:

+            root_logger.debug("add: referint-update-delay: %s", update_delay)

+            entry['referint-update-delay'] = update_delay

+            entry['nsslapd-pluginArg0'] = None

+        else:

+            root_logger.info("Plugin already uses new style, skipping")

+            return False, False, []

+

+        # nsslapd-pluginArg1    -> referint-logfile

+        logfile = entry.get('nsslapd-pluginArg1')

+        if logfile:

+            root_logger.debug("add: referint-logfile: %s", logfile)

+            entry['referint-logfile'] = logfile

+            entry['nsslapd-pluginArg1'] = None

+

+        # nsslapd-pluginArg2    -> referint-logchanges

+        logchanges = entry.get('nsslapd-pluginArg2')

+        if logchanges:

+            root_logger.debug("add: referint-logchanges: %s", logchanges)

+            entry['referint-logchanges'] = logchanges

+            entry['nsslapd-pluginArg2'] = None

+

+        # nsslapd-pluginArg3..N -> referint-membership-attr [3..N]

+        for key in entry.keys():

+            if key.lower().startswith('nsslapd-pluginarg'):

+                arg_val = entry.single_value[key]

+                if arg_val:

+                    referint_membership_attrs.append(arg_val)

+                entry[key] = None

+

+        if referint_membership_attrs:

+            # entry['referint-membership-attr'] is None, plugin doesn't allow

+            # mixing old and new style

+            entry['referint-membership-attr'] = referint_membership_attrs

+

+        root_logger.debug("Final value: %s", repr(entry))

+        try:

+            ldap.update_entry(entry)

+        except errors.EmptyModlist:

+            root_logger.debug("No modifications required")

+            return False, False, []

+

+        return False, True, []

+

+api.register(update_referint)

-- 

2.1.0