|
 |
ad1545 |
From e879ca9b693a10f456f03d3c471afa49321516f9 Mon Sep 17 00:00:00 2001
|
|
|
ad1545 |
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
ad1545 |
Date: Thu, 13 Dec 2018 14:54:07 +0100
|
|
|
ad1545 |
Subject: [PATCH] replication: check remote ds version before editing
|
|
|
ad1545 |
attributes
|
|
|
ad1545 |
|
|
|
ad1545 |
When the remote server has an old DS version, update of the
|
|
|
ad1545 |
replication attributes nsds5ReplicaReleaseTimeout nsds5ReplicaBackoffMax
|
|
|
ad1545 |
and nsDS5ReplicaBindDnGroupCheckInterval fails even if the remote
|
|
|
ad1545 |
schema has been updated.
|
|
|
ad1545 |
|
|
|
ad1545 |
Check first the remote server version and update the attributes only if
|
|
|
ad1545 |
the version is high enough.
|
|
|
ad1545 |
A previous fix was already performing this check (commit 02f4a7a),
|
|
|
ad1545 |
but not in all the cases. This fix also handles when the remote server
|
|
|
ad1545 |
already has a cn=replica entry (for instance because it has already
|
|
|
ad1545 |
established replication with another host).
|
|
|
ad1545 |
|
|
|
ad1545 |
Fixes https://pagure.io/freeipa/issue/7796
|
|
|
ad1545 |
|
|
|
ad1545 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
ad1545 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
ad1545 |
---
|
|
|
ad1545 |
ipaserver/install/replication.py | 33 ++++++++++++++++++++++++++------
|
|
|
ad1545 |
1 file changed, 27 insertions(+), 6 deletions(-)
|
|
|
ad1545 |
|
|
|
ad1545 |
diff --git a/ipaserver/install/replication.py b/ipaserver/install/replication.py
|
|
|
ad1545 |
index 92a99cd9482f86d6820230479bf94c871669572e..70629b4528f033908c584bfaf0793cfa4ce259d4 100644
|
|
|
ad1545 |
--- a/ipaserver/install/replication.py
|
|
|
ad1545 |
+++ b/ipaserver/install/replication.py
|
|
|
ad1545 |
@@ -215,6 +215,22 @@ def wait_for_entry(connection, dn, timeout, attr=None, attrvalue='*',
|
|
|
ad1545 |
time.sleep(1)
|
|
|
ad1545 |
|
|
|
ad1545 |
|
|
|
ad1545 |
+def get_ds_version(conn):
|
|
|
ad1545 |
+ """Returns the DS version
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+ Retrieves the DS version from the vendorVersion attribute stored in LDAP.
|
|
|
ad1545 |
+ :param conn: LDAP connection established and authenticated to the server
|
|
|
ad1545 |
+ for which we need the version
|
|
|
ad1545 |
+ :return: a tuple containing the DS version
|
|
|
ad1545 |
+ """
|
|
|
ad1545 |
+ # Find which 389-ds is installed
|
|
|
ad1545 |
+ rootdse = conn.get_entry(DN(''), ['vendorVersion'])
|
|
|
ad1545 |
+ version = rootdse.single_value.get('vendorVersion')
|
|
|
ad1545 |
+ mo = re.search(r'(\d+)\.(\d+)\.(\d+)[\.\d]*', version)
|
|
|
ad1545 |
+ vendor_version = tuple(int(v) for v in mo.groups())
|
|
|
ad1545 |
+ return vendor_version
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+
|
|
|
ad1545 |
class ReplicationManager(object):
|
|
|
ad1545 |
"""Manage replication agreements
|
|
|
ad1545 |
|
|
|
ad1545 |
@@ -527,8 +543,16 @@ class ReplicationManager(object):
|
|
|
ad1545 |
# Add the new replication manager
|
|
|
ad1545 |
binddns.append(replica_binddn)
|
|
|
ad1545 |
|
|
|
ad1545 |
- for key, value in REPLICA_CREATION_SETTINGS.items():
|
|
|
ad1545 |
- entry[key] = value
|
|
|
ad1545 |
+ # If the remote server has 389-ds < 1.3, it does not
|
|
|
ad1545 |
+ # support the attributes we are trying to set.
|
|
|
ad1545 |
+ # Find which 389-ds is installed
|
|
|
ad1545 |
+ vendor_version = get_ds_version(conn)
|
|
|
ad1545 |
+ if vendor_version >= (1, 3, 0):
|
|
|
ad1545 |
+ for key, value in REPLICA_CREATION_SETTINGS.items():
|
|
|
ad1545 |
+ entry[key] = value
|
|
|
ad1545 |
+ else:
|
|
|
ad1545 |
+ logger.debug("replication attributes not supported "
|
|
|
ad1545 |
+ "on remote master, skipping update.")
|
|
|
ad1545 |
|
|
|
ad1545 |
try:
|
|
|
ad1545 |
conn.update_entry(entry)
|
|
|
ad1545 |
@@ -604,10 +628,7 @@ class ReplicationManager(object):
|
|
|
ad1545 |
# If the remote server has 389-ds < 1.3, it does not
|
|
|
ad1545 |
# support the attributes we are trying to set.
|
|
|
ad1545 |
# Find which 389-ds is installed
|
|
|
ad1545 |
- rootdse = r_conn.get_entry(DN(''), ['vendorVersion'])
|
|
|
ad1545 |
- version = rootdse.single_value.get('vendorVersion')
|
|
|
ad1545 |
- mo = re.search(r'(\d+)\.(\d+)\.(\d+)[\.\d]*', version)
|
|
|
ad1545 |
- vendor_version = tuple(int(v) for v in mo.groups())
|
|
|
ad1545 |
+ vendor_version = get_ds_version(r_conn)
|
|
|
ad1545 |
if vendor_version >= (1, 3, 0):
|
|
|
ad1545 |
# 389-ds understands the replication attributes,
|
|
|
ad1545 |
# we can safely modify them
|
|
|
ad1545 |
--
|
|
|
ad1545 |
2.17.2
|
|
|
ad1545 |
|