From a3bcb05ce1c554aa98af9343bec7335521db3a3e Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Mon, 16 Oct 2017 13:32:38 +0300 Subject: [PATCH] ds: ignore time skew during initial replication step Initial replica creation can go with ignoring time skew checks. We should, however, force time skew checks during normal operation. Fixes https://pagure.io/freeipa/issue/7211 Reviewed-By: Rob Crittenden --- install/share/Makefile.am | 1 + install/share/replica-prevent-time-skew.ldif | 4 ++++ ipaserver/install/dsinstance.py | 24 ++++++++++++++++++++++++ 3 files changed, 29 insertions(+) create mode 100644 install/share/replica-prevent-time-skew.ldif diff --git a/install/share/Makefile.am b/install/share/Makefile.am index 85a061c6976dcc55b0ba2250423a344e14f2ce97..46b3d77663113f770765c8bd1d8a916791d628f4 100644 --- a/install/share/Makefile.am +++ b/install/share/Makefile.am @@ -38,6 +38,7 @@ dist_app_DATA = \ default-trust-view.ldif \ delegation.ldif \ replica-acis.ldif \ + replica-prevent-time-skew.ldif \ ds-nfiles.ldif \ dns.ldif \ dnssec.ldif \ diff --git a/install/share/replica-prevent-time-skew.ldif b/install/share/replica-prevent-time-skew.ldif new file mode 100644 index 0000000000000000000000000000000000000000..5d301feddb56347f3b35be89edaae1a7d91e07de --- /dev/null +++ b/install/share/replica-prevent-time-skew.ldif @@ -0,0 +1,4 @@ +dn: cn=config +changetype: modify +replace: nsslapd-ignore-time-skew +nsslapd-ignore-time-skew: $SKEWVALUE diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py index c9db8ac28c3ca10539b745ca09f4d8aaece02e0c..7a88612997a3fa96cf394852401fb01e5e4501d5 100644 --- a/ipaserver/install/dsinstance.py +++ b/ipaserver/install/dsinstance.py @@ -392,7 +392,21 @@ class DsInstance(service.Service): self.step("restarting directory server", self.__restart_instance) self.step("creating DS keytab", self.request_service_keytab) + + # 389-ds allows to ignore time skew during replication. It is disabled + # by default to avoid issues with non-contiguous CSN values which + # derived from a time stamp when the change occurs. However, there are + # cases when we are interested only in the changes coming from the + # other side and should therefore allow ignoring the time skew. + # + # This helps with initial replication or force-sync because + # the receiving side has no valuable changes itself yet. + self.step("ignore time skew for initial replication", + self.__replica_ignore_initial_time_skew) + self.step("setting up initial replication", self.__setup_replica) + self.step("prevent time skew after initial replication", + self.replica_manage_time_skew) self.step("adding sasl mappings to the directory", self.__configure_sasl_mappings) self.step("updating schema", self.__update_schema) # See LDIFs for automember configuration during replica install @@ -929,6 +943,16 @@ class DsInstance(service.Service): def __add_replication_acis(self): self._ldap_mod("replica-acis.ldif", self.sub_dict) + def __replica_ignore_initial_time_skew(self): + self.replica_manage_time_skew(prevent=False) + + def replica_manage_time_skew(self, prevent=True): + if prevent: + self.sub_dict['SKEWVALUE'] = 'off' + else: + self.sub_dict['SKEWVALUE'] = 'on' + self._ldap_mod("replica-prevent-time-skew.ldif", self.sub_dict) + def __setup_s4u2proxy(self): self._ldap_mod("replica-s4u2proxy.ldif", self.sub_dict) -- 2.9.5