Attachment 158227 Details for Bug 245815 – new AdminMigration.pm.in

new AdminMigration.pm.in

AdminMigration.pm.in (text/plain), 14.79 KB, created by Rich Megginson on 2007-06-29 18:00:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rich Megginson

Created: 2007-06-29 18:00:53 UTC

Size: 14.79 KB

patch

obsolete

># BEGIN COPYRIGHT BLOCK
># This Program is free software; you can redistribute it and/or modify it under
># the terms of the GNU General Public License as published by the Free Software
># Foundation; version 2 of the License.
># 
># This Program is distributed in the hope that it will be useful, but WITHOUT
># ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
># FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
># 
># You should have received a copy of the GNU General Public License along with
># this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
># Place, Suite 330, Boston, MA 02111-1307 USA.
># 
># In addition, as a special exception, Red Hat, Inc. gives You the additional
># right to link the code of this Program with code not covered under the GNU
># General Public License ("Non-GPL Code") and to distribute linked combinations
># including the two, subject to the limitations in this paragraph. Non-GPL Code
># permitted under this exception must only link to the code of this Program
># through those well defined interfaces identified in the file named EXCEPTION
># found in the source code files (the "Approved Interfaces"). The files of
># Non-GPL Code may instantiate templates or use macros or inline functions from
># the Approved Interfaces without causing the resulting work to be covered by
># the GNU General Public License. Only Red Hat, Inc. may make changes or
># additions to the list of Approved Interfaces. You must obey the GNU General
># Public License in all respects for all of the Program code and other code used
># in conjunction with the Program except the Non-GPL Code covered by this
># exception. If you modify this file, you may extend this exception to your
># version of the file, but you are not obligated to do so. If you do not wish to
># provide this exception without modification, you must delete this exception
># statement from your version and license this file solely under the GPL without
># exception. 
># 
># 
># Copyright (C) 2007 Red Hat, Inc.
># All rights reserved.
># END COPYRIGHT BLOCK
>#
>
>package AdminMigration;
>require Exporter;
>@ISA       = qw(Exporter);
>@EXPORT    = qw(migrateAdminServer);
>@EXPORT_OK = qw(migrateAdminServer);
>
># load perldap
>use Mozilla::LDAP::Conn;
>use Mozilla::LDAP::Utils qw(normalizeDN);
>use Mozilla::LDAP::API qw(:constant ldap_url_parse ldap_explode_dn);
>
>use Migration;
>use AdminServer;
>use AdminUtil;
>use Util;
>use SetupLog;
>
>use File::Path;
># tempfiles
>use File::Temp qw(tempfile tempdir);
>
>use strict;
>
># This gathers all of the old information from the old
># scattered config files and updates the corresponding
># parameters in the $mig->{inf}
>sub getOldFileInfo {
>    my $mig = shift;
>
>    # assume the config DS has already been migrated
>    # we need to get our data out of there, and fix it
>    # as needed
>    my $oldAdmConf = getAdmConf($mig->{oldsroot} . "/admin-serv/config");
>    $mig->{inf}->{admin}->{sie} = $oldAdmConf->{sie};
>    $mig->{inf}->{admin}->{isie} = $oldAdmConf->{isie};
>    if (defined($oldAdmConf->{ldapStart})) {
>        $mig->{inf}->{admin}->{ldapStart} = $oldAdmConf->{ldapStart};
>    }
>
>    if (!defined($mig->{inf}->{General}->{FullMachineName}) or
>        !defined($mig->{inf}->{admin}->{ServerIpAddress}) or
>        !defined($mig->{inf}->{admin}->{Port})) {
>        my $oldPset = getPset($oldAdmConf);
>        if (!defined($mig->{inf}->{General}->{FullMachineName})) {
>            $mig->{inf}->{General}->{FullMachineName} = $oldPset->{serverhostname};
>        }
>        if (!defined($mig->{inf}->{admin}->{ServerIpAddress})) {
>            $mig->{inf}->{admin}->{ServerIpAddress} = $oldPset->{'configuration.nsserveraddress'};
>        }
>        if (!defined($mig->{inf}->{admin}->{Port})) {
>            $mig->{inf}->{admin}->{Port} = $oldPset->{'configuration.nsserverport'};
>        }
>    }
>
>    # need sie, isie, config ds url, admin id
>    if (!defined($mig->{inf}->{General}->{ConfigDirectoryLdapURL})) {
>        if (!open(DBSWITCH, $mig->{oldsroot} . "/shared/config/dbswitch.conf")) {
>            $mig->msg('error_opening_dbswitch', $mig->{oldsroot} . "/shared/config/dbswitch.conf", $!);
>            return 0;
>        }
>        while (<DBSWITCH>) {
>            if (/^directory default (.*)$/) {
>                $mig->{inf}->{General}->{ConfigDirectoryLdapURL} = $1;
>            }
>        }
>        close(DBSWITCH);
>    }
>    if (!defined($mig->{inf}->{General}->{ConfigDirectoryAdminID})) {
>        if (!open(LDAPCONF, $mig->{oldsroot} . "/shared/config/ldap.conf")) {
>            $mig->msg('error_opening_ldapconf', $mig->{oldsroot} . "/shared/config/ldap.conf", $!);
>            return 0;
>        }
>        while (<LDAPCONF>) {
>            if (/^admnm\s+(.*)$/) {
>                $mig->{inf}->{General}->{ConfigDirectoryAdminID} = $1;
>            }
>        }
>        close(LDAPCONF);
>    }
>    if (!defined($mig->{inf}->{General}->{SuiteSpotGroup}) or
>        !defined($mig->{inf}->{General}->{SuiteSpotUserID})) {
>        if (!open(SSUSERS, $mig->{oldsroot} . "/shared/config/ssusers.conf")) {
>            $mig->msg('error_opening_ssusersconf', $mig->{oldsroot} . "/shared/config/ssusers.conf", $!);
>            return 0;
>        }
>        while (<SSUSERS>) {
>            if (/^SuiteSpotGroup\s+(.*)$/) {
>                if (!defined($mig->{inf}->{General}->{SuiteSpotGroup})) {
>                    $mig->{inf}->{General}->{SuiteSpotGroup} = $1;
>                }
>            }
>            if (/^SuiteSpotUser\s+(.*)$/) {
>                if (!defined($mig->{inf}->{General}->{SuiteSpotUserID})) {
>                    $mig->{inf}->{General}->{SuiteSpotUserID} = $1;
>                }
>            }
>        }
>        close(SSUSERS);
>    }
>    if (!defined($mig->{inf}->{General}->{AdminDomain})) {
>        my @rdns = ldap_explode_dn($mig->{inf}->{admin}->{isie}, 1);
>        $mig->{inf}->{General}->{AdminDomain} = $rdns[-2];
>    }
>
>    # the old admin server used to run as root - we cannot do that anymore
>    # with Apache based admin server, so by default just use the SuiteSpotUserID
>    # i.e. the same user id that the directory server uses
>    # and if that is not defined, we'll just have to use the default
>    if (!defined($mig->{inf}->{admin}->{SysUser})) {
>        $mig->{inf}->{admin}->{SysUser} = $mig->{inf}->{General}->{SuiteSpotUserID} ||
>            "@httpduser@";
>    }
>
>    if (!defined($mig->{inf}->{General}->{SuiteSpotGroup})) {
>        $mig->{inf}->{General}->{SuiteSpotGroup} = "@httpdgroup@";
>    }
>
>    return 1;
>}
>     
>
># This is how we extract the sie and isie as the as entries are
># being added
>sub migratecb {
>	my ($context, $entry) = @_;
>
>    my @arycontext = ($context);
>    # always replace the tasks and commands with the new ones
>    my $dn = $entry->getDN();
>    if (($entry->getDN() =~ /^cn=Tasks/i) or
>        ($entry->getDN() =~ /^cn=Commands/i)) {
>        push @arycontext, 1; # means to delete any existing entries first
>    }
>
>    my $rc = check_and_add_entry(\@arycontext, $entry);
>
>    return $rc;
>}
>
># The config DS should have already been migrated, including the old
># admin server data.  We need to update that information.  Some of the
># fields no longer apply (userPassword, configuration.encryption.nsCertFile,
># configuration.encryption.nsKeyFile, serverRoot)
># some of the fields must be removed (any ssl2 fields)
># some of the fields must be changed (nsSuiteSpotUser)
>sub migratePset {
>    my $mig = shift;
>    my $configdir = shift;
>    my $inf = $mig->{inf};
>    my @errs;
>
>    my $conn = getConfigDSConn($inf->{General}->{ConfigDirectoryLdapURL},
>                               $inf->{General}->{ConfigDirectoryAdminID},
>                               $inf->{General}->{ConfigDirectoryAdminPwd},
>                               $configdir, \@errs);
>
>    if (@errs) {
>        $mig->msg($FATAL, @errs);
>        return 0;
>    }
>
>    # add the Admin Server configuration entries
>    my @ldiffiles = ("@ldifdir@/asmigrate.ldif.tmpl",
>                     "@ldifdir@/21astasks.ldif.tmpl",
>                     "@ldifdir@/22ascommands.ldif.tmpl"
>                     );
>    my $setupinf = new Inf("@infdir@/setup.inf");
>    my $admininf = new Inf("@infdir@/admin.inf");
>
>    my $mapper = new Inf("@infdir@/asmigrate.map");
>
>    $mapper = process_maptbl($mapper, ($inf, $admininf, $setupinf));
>    if (!$mapper) {
>        $conn->close();
>        $mig->msg($FATAL, 'error_creating_asmigration_maptbl');
>        return 0;
>    }
>
>    # update isie and sie
>    getMappedEntries($mapper, \@ldiffiles, \&migratecb, $conn);
>    my $localconf = "$configdir/local.conf";
>    my $isnew;
>    if (! -f $localconf) {
>        $isnew = 1;
>    }
>    if (!open(LOCALCONF, ">$localconf")) {
>        $mig->msg($FATAL, 'error_updating_localconf', $localconf, $!);
>        return 0;
>    }
>    # now get the entries and write them to local.conf
>    my $entry = $conn->search($inf->{admin}->{sie}, "sub", "(objectclass=*)");
>    while ($entry) {
>        updateLocalConf($entry, $inf->{admin}->{sie}, \*LOCALCONF);
>        $entry = $conn->nextEntry();
>    }
>    $conn->close();
>    close(LOCALCONF);
>
>    if ($isnew) {
>        my $admConf = getAdmConf($configdir);
>        my $uid = getpwnam $admConf->{sysuser};
>        chmod 0600, "$localconf";
>        chown $uid, -1, "$localconf";        
>    }
>
>    return 1;
>}
>
>sub migrateSecurityFiles {
>    my $mig = shift;
>    my $configdir = shift;
>
>    my $admConf = getAdmConf($configdir);
>    my $sie = $admConf->{sie};
>    my @rdns = ldap_explode_dn($sie, 1);
>    my $inst = $rdns[0];
>    my $rc = $mig->migrateSecurityFiles($inst, $configdir);
>    my $haspinfile;
>    if (-f $mig->{oldsroot} . "/admin-serv/config/password.conf") {
>        if (system ("cp -p $mig->{oldsroot}/admin-serv/config/password.conf $configdir/pin.txt")) {
>            $mig->msg('error_copying_passwordconf', "$mig->{oldsroot}/admin-serv/config/password.conf", $!);
>            return 0;
>        }
>    }
>
>    return 1;
>}
>
>sub updateConfFileSecInfo {
>    my $mig = shift;
>    my $configdir = shift;
>
>    my $haspinfile;
>    for (glob("$configdir/*")) {
>        if (/pin\.txt$/) {
>            $haspinfile = 1;
>        }
>    }
>
>    # if the user has specified a pin file, we need to let nss.conf know
>    if ($haspinfile) {
>        if (!open(NSSCONF, "$configdir/nss.conf")) {
>            $mig->msg('error_opening_nssconf', "$configdir/nss.conf", $!);
>            return 0;
>        }
>        my @nssconf = <NSSCONF>;
>        close(NSSCONF);
>        # nss.conf is usually read-only
>        chmod 0600, "$configdir/nss.conf";
>        if (!open(NSSCONF, ">$configdir/nss.conf")) {
>            $mig->msg('error_writing_nssconf', "$configdir/nss.conf", $!);
>            chmod 0400, "$configdir/nss.conf";
>            return 0;
>        }
>        my $found;
>        for (@nssconf) {
>            if (/^NSSPassPhraseDialog/) {
>                $found = 1;
>                $_ = "NSSPassPhraseDialog file:$configdir/pin.txt\n";
>            }
>            print NSSCONF $_;
>        }
>        if (!$found) {
>            print NSSCONF "NSSPassPhraseDialog file:$configdir/pin.txt\n";
>        }
>        close(NSSCONF);
>        chmod 0400, "$configdir/nss.conf";
>    }
>
>    # update console.conf with security info
>    my $pset = getPset($configdir);
>    if (defined($pset->{'configuration.nsserversecurity'}) and
>        ($pset->{'configuration.nsserversecurity'} =~ /on/i)) {
>        my $certname = $pset->{'configuration.encryption.rsa.nssslpersonalityssl'};
>        my $clientauth = $pset->{'configuration.encryption.nssslclientauth'};
>        if (!open(CONSOLECONF, "$configdir/console.conf")) {
>            $mig->msg('error_opening_consoleconf', "$configdir/console.conf", $!);
>            return 0;
>        }
>        my @consoleconf = <CONSOLECONF>;
>        close(CONSOLECONF);
>        if (!open(CONSOLECONF, "> $configdir/console.conf")) {
>            $mig->msg('error_writing_consoleconf', "$configdir/console.conf", $!);
>            return 0;
>        }
>        for (@consoleconf) {
>            if (/^NSSEngine/) {
>                $_ = "NSSEngine on\n";
>            } elsif (/^NSSNickname/) {
>                $_ = "NSSNickname $certname\n";
>            } elsif (/^NSSVerifyClient/) {
>                if ($clientauth =~ /on/) {
>                    $_ = "NSSVerifyClient require\n";
>                } else {
>                    $_ = "NSSVerifyClient none\n";
>                }
>            }
>            print CONSOLECONF $_;
>        }
>        close(CONSOLECONF);
>    }
>
>    return 1;
>}
>
>sub migrateAdmpw {
>    my $mig = shift;
>    my $configdir = shift;
>    if (-f "$mig->{oldsroot}/admin-serv/config/admpw") {
>        if (system ("cp -p $mig->{oldsroot}/admin-serv/config/admpw $configdir/admpw")) {
>            $mig->msg('error_copying_admpw', "$mig->{oldsroot}/admin-serv/config/admpw", $!);
>            return 0;
>        }
>    }
>
>    return 1;
>}
>
>sub migrateAdminServer {
>    my $mig = shift;
>
>    my $configdir = $mig->{inf}->{admin}->{config_dir} ||
>        $ENV{ADMSERV_CONF_DIR} ||
>        $mig->{configdir} . "/admin-serv";
>
>    my $securitydir = $mig->{inf}->{admin}->{security_dir} ||
>        $configdir;
>
>    my $logdir = $mig->{inf}->{admin}->{log_dir} ||
>        $ENV{ADMSERV_LOG_DIR} ||
>        "@logdir@";
>
>    my $rundir = $mig->{inf}->{admin}->{run_dir} ||
>        $ENV{ADMSERV_PID_DIR} ||
>        "@piddir@";
>
>    if (!getOldFileInfo($mig, $configdir)) {
>        return 0;
>    }
>
>    if (!createASFilesAndDirs($mig, $configdir, $securitydir, $logdir, $rundir)) {
>        return 0;
>    }
>
>    if (!updateAdmConf({ldapurl => $mig->{inf}->{General}->{ConfigDirectoryLdapURL},
>                        userdn => $mig->{inf}->{General}->{ConfigDirectoryAdminID},
>                        SuiteSpotUserID => $mig->{inf}->{General}->{SuiteSpotUserID},
>                        SuiteSpotGroup => $mig->{inf}->{General}->{SuiteSpotGroup},
>                        sysuser => $mig->{inf}->{admin}->{SysUser},
>                        sysgroup => $mig->{inf}->{General}->{SuiteSpotGroup},
>                        AdminDomain => $mig->{inf}->{General}->{AdminDomain},
>                        sie => $mig->{inf}->{admin}->{sie},
>                        isie => $mig->{inf}->{admin}->{isie},
>                        ldapStart => $mig->{inf}->{admin}->{ldapStart}},
>                       $configdir)) {
>        return 0;
>    }
>
>    if (!migrateSecurityFiles($mig, $configdir)) {
>        return 0;
>    }
>
>    if (!migratePset($mig, $configdir)) {
>        return 0;
>    }
>
>    if (!migrateAdmpw($mig, $configdir)) {
>        return 0;
>    }
>
>    if (!updateConfFileSecInfo($mig, $configdir)) {
>        return 0;
>    }
>
>    $mig->msg('updating_httpconf');
>    if (!updateHttpConfFiles($mig->{inf}->{admin}->{ServerIpAddress},
>                             $mig->{inf}->{admin}->{Port},
>                             $configdir)) {
>        $mig->msg($FATAL, 'error_updating_httpconf');
>        return 0;
>    }
>
>    if (!setFileOwnerPerms($mig, $configdir)) {
>        return 0;
>    }
>
>    if (!startAdminServer($mig, $configdir, $logdir, $rundir)) {
>        return 0;
>    }
>
>    return 1;
>}
>
>
># obligatory module true return
>1;

Actions: View

Attachments on bug 245815: 158147 | 158227 | 158228 | 158229 | 158230 | 158231 | 158235 | 158236 | 158237 | 158238 | 158239 | 158241 | 158266 | 158269 | 158883 | 158885 | 159053 | 159352