pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0192-upgrade-fix-config-of-sidgen-and-extdom-plugins.patch

aa60fb
From c7df4a1856e740e88ac3633344815d5a0ff0d1f2 Mon Sep 17 00:00:00 2001
aa60fb
From: Martin Basti <mbasti@redhat.com>
aa60fb
Date: Thu, 18 Feb 2016 19:59:50 +0100
aa60fb
Subject: [PATCH] upgrade: fix config of sidgen and extdom plugins
aa60fb
aa60fb
During upgrade to IPA 4.2, literally "$SUFFIX" value was added to
aa60fb
configuration of sidgen and extdom plugins. This cause that SID are not properly configured.
aa60fb
aa60fb
Upgrade must fix "$SUFFIX" to reals suffix DN, and run sidgen task
aa60fb
against IPA domain (if exists).
aa60fb
aa60fb
All trusts added when plugins configuration was broken must be re-added.
aa60fb
aa60fb
https://fedorahosted.org/freeipa/ticket/5665
aa60fb
aa60fb
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
aa60fb
Reviewed-By: Tomas Babej <tbabej@redhat.com>
aa60fb
---
aa60fb
 install/updates/90-post_upgrade_plugins.update |   2 +
aa60fb
 ipaserver/install/dsinstance.py                |  12 +-
aa60fb
 ipaserver/install/plugins/adtrust.py           | 153 ++++++++++++++++++++++++-
aa60fb
 ipaserver/install/server/upgrade.py            |   4 +-
aa60fb
 4 files changed, 162 insertions(+), 9 deletions(-)
aa60fb
aa60fb
diff --git a/install/updates/90-post_upgrade_plugins.update b/install/updates/90-post_upgrade_plugins.update
aa60fb
index 3df3a4574705dbd8df8f25149c13877898afb66b..f0d77138520f41376d71478d3633ea4c19f66195 100644
aa60fb
--- a/install/updates/90-post_upgrade_plugins.update
aa60fb
+++ b/install/updates/90-post_upgrade_plugins.update
aa60fb
@@ -4,6 +4,8 @@
aa60fb
 # middle
aa60fb
 plugin: update_dnszones
aa60fb
 plugin: update_dns_limits
aa60fb
+plugin: update_sigden_extdom_broken_config
aa60fb
+plugin: update_sids
aa60fb
 plugin: update_default_range
aa60fb
 plugin: update_default_trust_view
aa60fb
 plugin: update_ca_renewal_master
aa60fb
diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py
aa60fb
index d78158532c4c88d9aa9acf3c65d278f5151458d8..7044782bac8068f7470b62bd7489b5319269b119 100644
aa60fb
--- a/ipaserver/install/dsinstance.py
aa60fb
+++ b/ipaserver/install/dsinstance.py
aa60fb
@@ -925,9 +925,9 @@ class DsInstance(service.Service):
aa60fb
         """
aa60fb
         Add sidgen directory server plugin configuration if it does not already exist.
aa60fb
         """
aa60fb
-        self._ldap_mod('ipa-sidgen-conf.ldif', self.sub_dict)
aa60fb
+        self.add_sidgen_plugin(self.sub_dict['SUFFIX'])
aa60fb
 
aa60fb
-    def add_sidgen_plugin(self):
aa60fb
+    def add_sidgen_plugin(self, suffix):
aa60fb
         """
aa60fb
         Add sidgen plugin configuration only if it does not already exist.
aa60fb
         """
aa60fb
@@ -935,7 +935,7 @@ class DsInstance(service.Service):
aa60fb
         try:
aa60fb
             self.admin_conn.get_entry(dn)
aa60fb
         except errors.NotFound:
aa60fb
-            self._add_sidgen_plugin()
aa60fb
+            self._ldap_mod('ipa-sidgen-conf.ldif', dict(SUFFIX=suffix))
aa60fb
         else:
aa60fb
             root_logger.debug("sidgen plugin is already configured")
aa60fb
 
aa60fb
@@ -943,9 +943,9 @@ class DsInstance(service.Service):
aa60fb
         """
aa60fb
         Add directory server configuration for the extdom extended operation.
aa60fb
         """
aa60fb
-        self._ldap_mod('ipa-extdom-extop-conf.ldif', self.sub_dict)
aa60fb
+        self.add_extdom_plugin(self.sub_dict['SUFFIX'])
aa60fb
 
aa60fb
-    def add_extdom_plugin(self):
aa60fb
+    def add_extdom_plugin(self, suffix):
aa60fb
         """
aa60fb
         Add extdom configuration if it does not already exist.
aa60fb
         """
aa60fb
@@ -953,7 +953,7 @@ class DsInstance(service.Service):
aa60fb
         try:
aa60fb
             self.admin_conn.get_entry(dn)
aa60fb
         except errors.NotFound:
aa60fb
-            self._add_extdom_plugin()
aa60fb
+            self._ldap_mod('ipa-extdom-extop-conf.ldif', dict(SUFFIX=suffix))
aa60fb
         else:
aa60fb
             root_logger.debug("extdom plugin is already configured")
aa60fb
 
aa60fb
diff --git a/ipaserver/install/plugins/adtrust.py b/ipaserver/install/plugins/adtrust.py
aa60fb
index 45bcc5f2fe532446342300ff0c5e1e7149cf023b..4990a34f8972a0ffba098642c1ead09f976852e6 100644
aa60fb
--- a/ipaserver/install/plugins/adtrust.py
aa60fb
+++ b/ipaserver/install/plugins/adtrust.py
aa60fb
@@ -24,6 +24,7 @@ from ipapython.dn import DN
aa60fb
 from ipapython.ipa_log_manager import *
aa60fb
 from ipapython import sysrestore
aa60fb
 from ipaserver.install import installutils
aa60fb
+from ipaserver.install import sysupgrade
aa60fb
 
aa60fb
 DEFAULT_ID_RANGE_SIZE = 200000
aa60fb
 
aa60fb
@@ -164,7 +165,6 @@ class update_default_trust_view(Updater):
aa60fb
 
aa60fb
         return False, [update]
aa60fb
 
aa60fb
-
aa60fb
 class update_oddjobd_for_adtrust(Updater):
aa60fb
     """
aa60fb
     Enables and starts oddjobd daemon if ipa-adtrust-install has been run
aa60fb
@@ -184,6 +184,157 @@ class update_oddjobd_for_adtrust(Updater):
aa60fb
 
aa60fb
         return False, []
aa60fb
 
aa60fb
+
aa60fb
+class update_sigden_extdom_broken_config(Updater):
aa60fb
+    """Fix configuration of sidgen and extdom plugins
aa60fb
+
aa60fb
+    Upgrade to IPA 4.2+ cause that sidgen and extdom plugins have improperly
aa60fb
+    configured basedn.
aa60fb
+
aa60fb
+    All trusts which have been added when config was broken must to be
aa60fb
+    re-added manually.
aa60fb
+
aa60fb
+    https://fedorahosted.org/freeipa/ticket/5665
aa60fb
+    """
aa60fb
+
aa60fb
+    sidgen_config_dn = DN("cn=IPA SIDGEN,cn=plugins,cn=config")
aa60fb
+    extdom_config_dn = DN("cn=ipa_extdom_extop,cn=plugins,cn=config")
aa60fb
+
aa60fb
+    def _fix_config(self):
aa60fb
+        """Due upgrade error configuration of sidgen and extdom plugins may
aa60fb
+        contain literally "$SUFFIX" value instead of real DN in nsslapd-basedn
aa60fb
+        attribute
aa60fb
+
aa60fb
+        :return: True if config was fixed, False if fix is not needed
aa60fb
+        """
aa60fb
+        ldap = self.api.Backend.ldap2
aa60fb
+        basedn_attr = 'nsslapd-basedn'
aa60fb
+        modified = False
aa60fb
+
aa60fb
+        for dn in (self.sidgen_config_dn, self.extdom_config_dn):
aa60fb
+            try:
aa60fb
+                entry = ldap.get_entry(dn, attrs_list=[basedn_attr])
aa60fb
+            except errors.NotFound:
aa60fb
+                self.log.debug("configuration for %s not found, skipping", dn)
aa60fb
+            else:
aa60fb
+                configured_suffix = entry.single_value.get(basedn_attr)
aa60fb
+                if configured_suffix is None:
aa60fb
+                    raise RuntimeError(
aa60fb
+                        "Missing attribute {attr} in {dn}".format(
aa60fb
+                            attr=basedn_attr, dn=dn
aa60fb
+                        )
aa60fb
+                    )
aa60fb
+                elif configured_suffix == "$SUFFIX":
aa60fb
+                    # configured value is wrong, fix it
aa60fb
+                    entry.single_value[basedn_attr] = str(self.api.env.basedn)
aa60fb
+                    self.log.debug("updating attribute %s of %s to correct "
aa60fb
+                                   "value %s", basedn_attr, dn,
aa60fb
+                                   self.api.env.basedn)
aa60fb
+                    ldap.update_entry(entry)
aa60fb
+                    modified = True
aa60fb
+                else:
aa60fb
+                    self.log.debug("configured basedn for %s is okay", dn)
aa60fb
+
aa60fb
+        return modified
aa60fb
+
aa60fb
+    def execute(self, **options):
aa60fb
+        if sysupgrade.get_upgrade_state('sidgen', 'config_basedn_updated'):
aa60fb
+            self.log.debug("Already done, skipping")
aa60fb
+            return False, ()
aa60fb
+
aa60fb
+        restart = False
aa60fb
+        if self._fix_config():
aa60fb
+            sysupgrade.set_upgrade_state('sidgen', 'update_sids', True)
aa60fb
+            restart = True  # DS has to be restarted to apply changes
aa60fb
+
aa60fb
+        sysupgrade.set_upgrade_state('sidgen', 'config_basedn_updated', True)
aa60fb
+        return restart, ()
aa60fb
+
aa60fb
+
aa60fb
+class update_sids(Updater):
aa60fb
+    """SIDs may be not created properly if bug with wrong configuration for
aa60fb
+    sidgen and extdom plugins is effective
aa60fb
+
aa60fb
+    This must be run after "update_sigden_extdom_broken_config"
aa60fb
+    https://fedorahosted.org/freeipa/ticket/5665
aa60fb
+    """
aa60fb
+    sidgen_config_dn = DN("cn=IPA SIDGEN,cn=plugins,cn=config")
aa60fb
+
aa60fb
+    def execute(self, **options):
aa60fb
+        ldap = self.api.Backend.ldap2
aa60fb
+
aa60fb
+        if sysupgrade.get_upgrade_state('sidgen', 'update_sids') is not True:
aa60fb
+            self.log.debug("SIDs do not need to be generated")
aa60fb
+            return False, ()
aa60fb
+
aa60fb
+        # check if IPA domain for AD trust has been created, and if we need to
aa60fb
+        # regenerate missing SIDs if attribute 'ipaNTSecurityIdentifier'
aa60fb
+        domain_IPA_AD_dn = DN(
aa60fb
+            ('cn', self.api.env.domain),
aa60fb
+            self.api.env.container_cifsdomains,
aa60fb
+            self.api.env.basedn)
aa60fb
+        attr_name = 'ipaNTSecurityIdentifier'
aa60fb
+
aa60fb
+        try:
aa60fb
+            entry = ldap.get_entry(domain_IPA_AD_dn, attrs_list=[attr_name])
aa60fb
+        except errors.NotFound:
aa60fb
+            self.log.debug("IPA domain object %s is not configured",
aa60fb
+                           domain_IPA_AD_dn)
aa60fb
+            sysupgrade.set_upgrade_state('sidgen', 'update_sids', False)
aa60fb
+            return False, ()
aa60fb
+        else:
aa60fb
+            if not entry.single_value.get(attr_name):
aa60fb
+                # we need to run sidgen task
aa60fb
+                sidgen_task_dn = DN(
aa60fb
+                    "cn=generate domain sid,cn=ipa-sidgen-task,cn=tasks,"
aa60fb
+                    "cn=config")
aa60fb
+                sidgen_tasks_attr = {
aa60fb
+                    "objectclass": ["top", "extensibleObject"],
aa60fb
+                    "cn": ["sidgen"],
aa60fb
+                    "delay": [0],
aa60fb
+                    "nsslapd-basedn": [self.api.env.basedn],
aa60fb
+                }
aa60fb
+
aa60fb
+                task_entry = ldap.make_entry(sidgen_task_dn,
aa60fb
+                                             **sidgen_tasks_attr)
aa60fb
+                try:
aa60fb
+                    ldap.add_entry(task_entry)
aa60fb
+                except errors.DuplicateEntry:
aa60fb
+                    self.log.debug("sidgen task already created")
aa60fb
+                else:
aa60fb
+                    self.log.debug("sidgen task has been created")
aa60fb
+
aa60fb
+        # we have to check all trusts domains which may been affected by the
aa60fb
+        # bug. Symptom is missing 'ipaNTSecurityIdentifier' attribute
aa60fb
+
aa60fb
+        base_dn = DN(self.api.env.container_adtrusts, self.api.env.basedn)
aa60fb
+        try:
aa60fb
+            trust_domain_entries, truncated = ldap.find_entries(
aa60fb
+                base_dn=base_dn,
aa60fb
+                scope=ldap.SCOPE_ONELEVEL,
aa60fb
+                attrs_list=["cn"],
aa60fb
+                # more types of trusts can be stored under cn=trusts, we need
aa60fb
+                # the type with ipaNTTrustPartner attribute
aa60fb
+                filter="(!(%s=*))" % attr_name
aa60fb
+            )
aa60fb
+        except errors.NotFound:
aa60fb
+            pass
aa60fb
+        else:
aa60fb
+            if truncated:
aa60fb
+                self.log.warning("update_sids: Search results were truncated")
aa60fb
+
aa60fb
+            for entry in trust_domain_entries:
aa60fb
+                domain = entry.single_value["cn"]
aa60fb
+                self.log.error(
aa60fb
+                    "Your trust to %s is broken. Please re-create it by "
aa60fb
+                    "running 'ipa trust-add' again.", domain)
aa60fb
+
aa60fb
+        sysupgrade.set_upgrade_state('sidgen', 'update_sids', False)
aa60fb
+        return False, ()
aa60fb
+
aa60fb
+
aa60fb
 api.register(update_default_range)
aa60fb
 api.register(update_default_trust_view)
aa60fb
 api.register(update_oddjobd_for_adtrust)
aa60fb
+api.register(update_sids)
aa60fb
+api.register(update_sigden_extdom_broken_config)
aa60fb
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
aa60fb
index 258d976c83844f89c1a939303b685fd6565b79e5..c53b19a937d559b25da256670a5205ab40e0cadb 100644
aa60fb
--- a/ipaserver/install/server/upgrade.py
aa60fb
+++ b/ipaserver/install/server/upgrade.py
aa60fb
@@ -1290,8 +1290,8 @@ def ds_enable_sidgen_extdom_plugins(ds):
aa60fb
         root_logger.debug('sidgen and extdom plugins are enabled already')
aa60fb
         return
aa60fb
 
aa60fb
-    ds.add_sidgen_plugin()
aa60fb
-    ds.add_extdom_plugin()
aa60fb
+    ds.add_sidgen_plugin(api.env.basedn)
aa60fb
+    ds.add_extdom_plugin(api.env.basedn)
aa60fb
     sysupgrade.set_upgrade_state('ds', 'enable_ds_sidgen_extdom_plugins', True)
aa60fb
 
aa60fb
 def ca_upgrade_schema(ca):
aa60fb
-- 
aa60fb
2.5.0
aa60fb