Bug 1810154

Summary:	RFE: ipa-backup should compare locally and globally installed server roles
Product:	Red Hat Enterprise Linux 8	Reporter:	François Cami <fcami>
Component:	ipa	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED ERRATA	QA Contact:	ipa-qe <ipa-qe>
Severity:	unspecified	Docs Contact:	Josip Vilicic <jvilicic>
Priority:	unspecified
Version:	8.1	CC:	cheimes, jvilicic, ksiddiqu, lmanasko, myusuf, pasik, pcech, rcritten, tscherf, twoerner
Target Milestone:	rc	Keywords:	FutureFeature, TestCaseProvided
Target Release:	8.3
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-4.8.7-1	Doc Type:	Enhancement
Doc Text:	.IdM backup utility now checks for required replica roles The `ipa-backup` utility now checks if all of the services used in the IdM cluster, such as a Certificate Authority (CA), Domain Name System (DNS), and Key Recovery Agent (KRA) are installed on the replica where you are running the backup. If the replica does not have all these services installed, the `ipa-backup` utility exits with a warning, because backups taken on that host would not be sufficient for a full cluster restoration. For example, if your IdM deployment uses an integrated Certificate Authority (CA), a backup run on a non-CA replica will not capture CA data. Red Hat recommends verifying that the replica where you perform an `ipa-backup` has all of the IdM services used in the cluster installed. For more information, see link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/preparing_for_disaster_recovery_with_identity_management/preparing-for-data-loss-with-idm-backups_preparing-for-disaster-recovery[Preparing for data loss with IdM backups].	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-04 02:50:15 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1821766

Description François Cami 2020-03-04 15:59:41 UTC

Description of problem:

ipa-backup should check whether all globally used server roles are locally installed. If that's not the case, the resulting backup will probably not be sufficient to restore a functioning, identical cluster.
For instance: taking a backup without a CA or KRA, etc.

Comment 1 François Cami 2020-03-04 16:04:19 UTC

Upstream ticket:
https://pagure.io/freeipa/issue/8217

Comment 3 François Cami 2020-04-01 10:13:08 UTC

Fixed upstream
master:
https://pagure.io/freeipa/c/3a9b66b5302903f4abe75c3ee93b457f5c1dc405
https://pagure.io/freeipa/c/9324bba6b7db4152ff85017d59000fc204ce2c90
https://pagure.io/freeipa/c/3665ba928b25c017465588bd505e93d15d72290f

Comment 4 François Cami 2020-04-03 09:46:35 UTC

Fixed upstream
ipa-4-8:
https://pagure.io/freeipa/c/00e2a488726a353b7183d5d3b4c2084b9bf5dbc2
https://pagure.io/freeipa/c/69a2b6d71478094356ed78295b4c7177e200825c
https://pagure.io/freeipa/c/37a60b25a342d723bfe4b4b91373ad5003bd4d29

Comment 8 François Cami 2020-04-06 14:55:34 UTC

Additional test-only fixes:

Fixed upstream
master:
https://pagure.io/freeipa/c/a087fd9255ed5d16b6a84a7b84f0507dad5b200e

Comment 10 François Cami 2020-04-06 16:18:51 UTC

Additional test-only fixes:

Fixed upstream
ipa-4-8:
https://pagure.io/freeipa/c/8691e5f8d33e7f023b1535d15637dedaee5bddec

Comment 11 François Cami 2020-04-07 14:40:21 UTC

Hi Jo,
I've opened https://bugzilla.redhat.com/show_bug.cgi?id=1821766 for the non-RN documentation changes.

Comment 13 Christian Heimes 2020-05-20 08:55:41 UTC

devel ack, François' improvement are already in 4.8 branch.

Comment 18 Mohammad Rizwan 2020-07-15 09:10:33 UTC

version:
ipa-server-4.8.7-4.module+el8.3.0+7221+eedbd403.x86_64

api.env: 
{'api_version': '2.239',
 'basedn': ipapython.dn.DN('dc=ipa,dc=test'),
 'bin': '/usr/lib/python3.6/site-packages/ipatests',
 'ca_agent_install_port': None,
 'ca_agent_port': 443,
 'ca_ee_install_port': None,
 'ca_ee_port': 443,
 'ca_host': 'runner.testrelm.test',
 'ca_install_port': None,
 'ca_port': 80,
 'certmonger_wait_timeout': 300,
 'conf': '/root/.ipa/cli.conf',
 'conf_default': '/root/.ipa/default.conf',
 'confdir': '/root/.ipa',
 'container_accounts': ipapython.dn.DN('cn=accounts'),
 'container_adtrusts': ipapython.dn.DN('cn=ad,cn=trusts'),
 'container_applications': ipapython.dn.DN('cn=applications,cn=configs,cn=policies'),
 'container_automember': ipapython.dn.DN('cn=automember,cn=etc'),
 'container_automount': ipapython.dn.DN('cn=automount'),
 'container_ca': ipapython.dn.DN('cn=cas,cn=ca'),
 'container_ca_renewal': ipapython.dn.DN('cn=ca_renewal,cn=ipa,cn=etc'),
 'container_caacl': ipapython.dn.DN('cn=caacls,cn=ca'),
 'container_certmap': ipapython.dn.DN('cn=certmap'),
 'container_certmaprules': ipapython.dn.DN('cn=certmaprules,cn=certmap'),
 'container_certprofile': ipapython.dn.DN('cn=certprofiles,cn=ca'),
 'container_cifsdomains': ipapython.dn.DN('cn=ad,cn=etc'),
 'container_configs': ipapython.dn.DN('cn=configs,cn=policies'),
 'container_custodia': ipapython.dn.DN('cn=custodia,cn=ipa,cn=etc'),
 'container_deleteuser': ipapython.dn.DN('cn=deleted users,cn=accounts,cn=provisioning'),
 'container_dna': ipapython.dn.DN('cn=dna,cn=ipa,cn=etc'),
 'container_dna_posix_ids': ipapython.dn.DN('cn=posix-ids,cn=dna,cn=ipa,cn=etc'),
 'container_dns': ipapython.dn.DN('cn=dns'),
 'container_dnsservers': ipapython.dn.DN('cn=servers,cn=dns'),
 'container_group': ipapython.dn.DN('cn=groups,cn=accounts'),
 'container_hbac': ipapython.dn.DN('cn=hbac'),
 'container_hbacservice': ipapython.dn.DN('cn=hbacservices,cn=hbac'),
 'container_hbacservicegroup': ipapython.dn.DN('cn=hbacservicegroups,cn=hbac'),
 'container_host': ipapython.dn.DN('cn=computers,cn=accounts'),
 'container_hostgroup': ipapython.dn.DN('cn=hostgroups,cn=accounts'),
 'container_locations': ipapython.dn.DN('cn=locations,cn=etc'),
 'container_masters': ipapython.dn.DN('cn=masters,cn=ipa,cn=etc'),
 'container_netgroup': ipapython.dn.DN('cn=ng,cn=alt'),
 'container_otp': ipapython.dn.DN('cn=otp'),
 'container_permission': ipapython.dn.DN('cn=permissions,cn=pbac'),
 'container_policies': ipapython.dn.DN('cn=policies'),
 'container_policygroups': ipapython.dn.DN('cn=policygroups,cn=configs,cn=policies'),
 'container_policylinks': ipapython.dn.DN('cn=policylinks,cn=configs,cn=policies'),
 'container_privilege': ipapython.dn.DN('cn=privileges,cn=pbac'),
 'container_radiusproxy': ipapython.dn.DN('cn=radiusproxy'),
 'container_ranges': ipapython.dn.DN('cn=ranges,cn=etc'),
 'container_realm_domains': ipapython.dn.DN('cn=Realm Domains,cn=ipa,cn=etc'),
 'container_rolegroup': ipapython.dn.DN('cn=roles,cn=accounts'),
 'container_roles': ipapython.dn.DN('cn=roles,cn=policies'),
 'container_s4u2proxy': ipapython.dn.DN('cn=s4u2proxy,cn=etc'),
 'container_selinux': ipapython.dn.DN('cn=usermap,cn=selinux'),
 'container_service': ipapython.dn.DN('cn=services,cn=accounts'),
 'container_stageuser': ipapython.dn.DN('cn=staged users,cn=accounts,cn=provisioning'),
 'container_sudocmd': ipapython.dn.DN('cn=sudocmds,cn=sudo'),
 'container_sudocmdgroup': ipapython.dn.DN('cn=sudocmdgroups,cn=sudo'),
 'container_sudorule': ipapython.dn.DN('cn=sudorules,cn=sudo'),
 'container_sysaccounts': ipapython.dn.DN('cn=sysaccounts,cn=etc'),
 'container_topology': ipapython.dn.DN('cn=topology,cn=ipa,cn=etc'),
 'container_trusts': ipapython.dn.DN('cn=trusts'),
 'container_user': ipapython.dn.DN('cn=users,cn=accounts'),
 'container_vault': ipapython.dn.DN('cn=vaults,cn=kra'),
 'container_views': ipapython.dn.DN('cn=views,cn=accounts'),
 'container_virtual': ipapython.dn.DN('cn=virtual operations,cn=etc'),
 'context': 'cli',
 'debug': False,
 'delegate': False,
 'dogtag_version': 9,
 'domain': 'ipa.test',
 'dot_ipa': '/root/.ipa',
 'enable_ra': False,
 'env_confdir': None,
 'fallback': False,
 'fips_mode': False,
 'force_schema_check': False,
 'home': '/root',
 'host': 'runner.testrelm.test',
 'http_timeout': 30,
 'in_server': False,
 'in_tree': True,
 'interactive': True,
 'ipalib': '/usr/lib/python3.6/site-packages/ipalib',
 'jsonrpc_uri': 'https://master.ipa.test/ipa/json',
 'kinit_lifetime': None,
 'ldap_uri': 'ldap://master.ipa.test',
 'log': '/root/.ipa/log/cli.log',
 'logdir': '/root/.ipa/log',
 'mode': 'developer',
 'mount_ipa': '/ipa/',
 'nss_dir': '/root/.ipa/nssdb',
 'plugins_on_demand': True,
 'prompt_all': False,
 'ra_plugin': 'selfsign',
 'recommended_max_agmts': 4,
 'replication_wait_timeout': 300,
 'rpc_protocol': 'jsonrpc',
 'script': '/usr/lib/python3.6/site-packages/ipatests/-c',
 'server': 'master.ipa.test',
 'site_packages': '/usr/lib/python3.6/site-packages',
 'skip_version_check': False,
 'startup_timeout': 120,
 'startup_traceback': False,
 'tls_ca_cert': '/root/.ipa/ca.crt',
 'tls_version_max': None,
 'tls_version_min': None,
 'validate_api': False,
 'verbose': 0,
 'version': '4.8.7',
 'wait_for_dns': 0,
 'webui_prod': True,
 'xmlrpc_uri': 'https://master.ipa.test/ipa/xml'}
uname: posix.uname_result(sysname='Linux', nodename='runner.testrelm.test', release='4.18.0-221.el8.x86_64', version='#1 SMP Thu Jun 25 20:58:19 UTC 2020', machine='x86_64')
euid: 0, egid: 0
working dir: /usr/lib/python3.6/site-packages/ipatests
sys.version: 3.6.8 (default, Jun 26 2020, 12:10:09) 
[GCC 8.3.1 20191121 (Red Hat 8.3.1-5)]
============================= test session starts ==============================
platform linux -- Python 3.6.8, pytest-3.10.1, py-1.9.0, pluggy-0.13.1 -- /usr/libexec/platform-python
cachedir: /home/cloud-user/.pytest_cache
metadata: {'Python': '3.6.8', 'Platform': 'Linux-4.18.0-221.el8.x86_64-x86_64-with-redhat-8.3-Ootpa', 'Packages': {'pytest': '3.10.1', 'py': '1.9.0', 'pluggy': '0.13.1'}, 'Plugins': {'metadata': '1.10.0', 'html': '1.22.1', 'multihost': '3.0', 'sourceorder': '0.5'}}
rootdir: /usr/lib/python3.6/site-packages/ipatests, inifile:
plugins: metadata-1.10.0, html-1.22.1, multihost-3.0, sourceorder-0.5
collecting ... collected 3 items

test_integration/test_backup_and_restore.py::TestBackupRoles::test_rolecheck_DNS_CA PASSED [ 33%]
test_integration/test_backup_and_restore.py::TestBackupRoles::test_rolecheck_KRA PASSED [ 66%]
test_integration/test_backup_and_restore.py::TestBackupRoles::test_rolecheck_Trust PASSED [100%]

---------------- generated xml file: /home/cloud-user/junit.xml ----------------
----------- generated html file: file:///home/cloud-user/report.html -----------
========================= 3 passed in 2518.27 seconds ==========================


Automation passed.

Comment 24 errata-xmlrpc 2020-11-04 02:50:15 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4670