|
 |
c58629 |
From a3bcb05ce1c554aa98af9343bec7335521db3a3e Mon Sep 17 00:00:00 2001
|
|
|
c58629 |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
c58629 |
Date: Mon, 16 Oct 2017 13:32:38 +0300
|
|
|
c58629 |
Subject: [PATCH] ds: ignore time skew during initial replication step
|
|
|
c58629 |
|
|
|
c58629 |
Initial replica creation can go with ignoring time skew checks.
|
|
|
c58629 |
We should, however, force time skew checks during normal operation.
|
|
|
c58629 |
|
|
|
c58629 |
Fixes https://pagure.io/freeipa/issue/7211
|
|
|
c58629 |
|
|
|
c58629 |
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
|
|
c58629 |
---
|
|
|
c58629 |
install/share/Makefile.am | 1 +
|
|
|
c58629 |
install/share/replica-prevent-time-skew.ldif | 4 ++++
|
|
|
c58629 |
ipaserver/install/dsinstance.py | 24 ++++++++++++++++++++++++
|
|
|
c58629 |
3 files changed, 29 insertions(+)
|
|
|
c58629 |
create mode 100644 install/share/replica-prevent-time-skew.ldif
|
|
|
c58629 |
|
|
|
c58629 |
diff --git a/install/share/Makefile.am b/install/share/Makefile.am
|
|
|
c58629 |
index 85a061c6976dcc55b0ba2250423a344e14f2ce97..46b3d77663113f770765c8bd1d8a916791d628f4 100644
|
|
|
c58629 |
--- a/install/share/Makefile.am
|
|
|
c58629 |
+++ b/install/share/Makefile.am
|
|
|
c58629 |
@@ -38,6 +38,7 @@ dist_app_DATA = \
|
|
|
c58629 |
default-trust-view.ldif \
|
|
|
c58629 |
delegation.ldif \
|
|
|
c58629 |
replica-acis.ldif \
|
|
|
c58629 |
+ replica-prevent-time-skew.ldif \
|
|
|
c58629 |
ds-nfiles.ldif \
|
|
|
c58629 |
dns.ldif \
|
|
|
c58629 |
dnssec.ldif \
|
|
|
c58629 |
diff --git a/install/share/replica-prevent-time-skew.ldif b/install/share/replica-prevent-time-skew.ldif
|
|
|
c58629 |
new file mode 100644
|
|
|
c58629 |
index 0000000000000000000000000000000000000000..5d301feddb56347f3b35be89edaae1a7d91e07de
|
|
|
c58629 |
--- /dev/null
|
|
|
c58629 |
+++ b/install/share/replica-prevent-time-skew.ldif
|
|
|
c58629 |
@@ -0,0 +1,4 @@
|
|
|
c58629 |
+dn: cn=config
|
|
|
c58629 |
+changetype: modify
|
|
|
c58629 |
+replace: nsslapd-ignore-time-skew
|
|
|
c58629 |
+nsslapd-ignore-time-skew: $SKEWVALUE
|
|
|
c58629 |
diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py
|
|
|
c58629 |
index c9db8ac28c3ca10539b745ca09f4d8aaece02e0c..7a88612997a3fa96cf394852401fb01e5e4501d5 100644
|
|
|
c58629 |
--- a/ipaserver/install/dsinstance.py
|
|
|
c58629 |
+++ b/ipaserver/install/dsinstance.py
|
|
|
c58629 |
@@ -392,7 +392,21 @@ class DsInstance(service.Service):
|
|
|
c58629 |
self.step("restarting directory server", self.__restart_instance)
|
|
|
c58629 |
|
|
|
c58629 |
self.step("creating DS keytab", self.request_service_keytab)
|
|
|
c58629 |
+
|
|
|
c58629 |
+ # 389-ds allows to ignore time skew during replication. It is disabled
|
|
|
c58629 |
+ # by default to avoid issues with non-contiguous CSN values which
|
|
|
c58629 |
+ # derived from a time stamp when the change occurs. However, there are
|
|
|
c58629 |
+ # cases when we are interested only in the changes coming from the
|
|
|
c58629 |
+ # other side and should therefore allow ignoring the time skew.
|
|
|
c58629 |
+ #
|
|
|
c58629 |
+ # This helps with initial replication or force-sync because
|
|
|
c58629 |
+ # the receiving side has no valuable changes itself yet.
|
|
|
c58629 |
+ self.step("ignore time skew for initial replication",
|
|
|
c58629 |
+ self.__replica_ignore_initial_time_skew)
|
|
|
c58629 |
+
|
|
|
c58629 |
self.step("setting up initial replication", self.__setup_replica)
|
|
|
c58629 |
+ self.step("prevent time skew after initial replication",
|
|
|
c58629 |
+ self.replica_manage_time_skew)
|
|
|
c58629 |
self.step("adding sasl mappings to the directory", self.__configure_sasl_mappings)
|
|
|
c58629 |
self.step("updating schema", self.__update_schema)
|
|
|
c58629 |
# See LDIFs for automember configuration during replica install
|
|
|
c58629 |
@@ -929,6 +943,16 @@ class DsInstance(service.Service):
|
|
|
c58629 |
def __add_replication_acis(self):
|
|
|
c58629 |
self._ldap_mod("replica-acis.ldif", self.sub_dict)
|
|
|
c58629 |
|
|
|
c58629 |
+ def __replica_ignore_initial_time_skew(self):
|
|
|
c58629 |
+ self.replica_manage_time_skew(prevent=False)
|
|
|
c58629 |
+
|
|
|
c58629 |
+ def replica_manage_time_skew(self, prevent=True):
|
|
|
c58629 |
+ if prevent:
|
|
|
c58629 |
+ self.sub_dict['SKEWVALUE'] = 'off'
|
|
|
c58629 |
+ else:
|
|
|
c58629 |
+ self.sub_dict['SKEWVALUE'] = 'on'
|
|
|
c58629 |
+ self._ldap_mod("replica-prevent-time-skew.ldif", self.sub_dict)
|
|
|
c58629 |
+
|
|
|
c58629 |
def __setup_s4u2proxy(self):
|
|
|
c58629 |
self._ldap_mod("replica-s4u2proxy.ldif", self.sub_dict)
|
|
|
c58629 |
|
|
|
c58629 |
--
|
|
|
c58629 |
2.9.5
|
|
|
c58629 |
|