Bug 486402
| Summary: | setup-ds.pl + register-ds-admin.pl generates different aci's then setup-ds-admin.pl | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Retired] 389 | Reporter: | Ryan Braun <ryan.braun> | ||||||||||
| Component: | Install/Uninstall | Assignee: | Nathan Kinder <nkinder> | ||||||||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Chandrasekar Kannan <ckannan> | ||||||||||
| Severity: | high | Docs Contact: | |||||||||||
| Priority: | high | ||||||||||||
| Version: | 1.1.3 | CC: | batkisso, benl, jgalipea, rmeggins, shaines | ||||||||||
| Target Milestone: | --- | ||||||||||||
| Target Release: | --- | ||||||||||||
| Hardware: | i686 | ||||||||||||
| OS: | Linux | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | 8.1 | Doc Type: | Bug Fix | ||||||||||
| Doc Text: | Story Points: | --- | |||||||||||
| Clone Of: | Environment: | ||||||||||||
| Last Closed: | 2009-04-29 23:10:37 UTC | Type: | --- | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Embargoed: | |||||||||||||
| Bug Depends On: | |||||||||||||
| Bug Blocks: | 249650, 493682 | ||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Ryan Braun
2009-02-19 16:25:19 UTC
The difference in aci's is due to setup-ds.pl not adding any Admin Server specific aci's (which it shouldn't). The "cn=schema" and "cn=config" trees are not replicated, hence the aci's don't get sync'd up. (there is some replication of schema, but it's not sending the whole tree). I suppose the proper thing would be for register-ds-admin.pl to add the proper default aci's for "cn=schema" and "cn=config" to the instance being registered with the Admin Server. It should be noted that any custom aci's in these two trees will NOT be replicated, however we should attempt to make the defaults the same after registration. Created attachment 333215 [details]
CVS Diffs
Does register-ds-admin.pl also enable and configure the PTA plugin? If not, then the console admin user won't be able to manage the DS. This also seems to be problem with ds_create. (In reply to comment #3) > Does register-ds-admin.pl also enable and configure the PTA plugin? If not, > then the console admin user won't be able to manage the DS. This also seems to > be problem with ds_create. It appears that register-ds-admin-pl doesn't enable and configure PTA either. Created attachment 333503 [details]
New PTA ldif template
Created attachment 333508 [details]
Revised Diffs
There were a few other issues to deal with in addition to the missing ACIs.
The PTA plug-in was not being configured since the LDIF template that was used was an entire new PTA plug-in entry, which never gets added since it already exists. I changed this to a LDIF mod template. We also only want to configure PTA if it is not already configured, or if we are switching the config DS. This will prevent overwriting any custom tweaks to the PTA plug-in, such as using LDAPS to communicate with the config DS.
I found another issue during testing with the ldapStart parameter in adm.conf getting set incorrectly after running register-ds-admin.pl. This parameter is supposed to point to the start-slapd script of the config DS, but register-ds-admin.pl was always changing this to the last instance that it registered (which will never be the config DS if you have more than one instance). We need to ensure that the slapd info in the inf is the config DS before updating the Admin Server config files.
Ok. Another problem is that there is no resource key for error_create_inf_from_config, and we need to pass in the errno ($!) to that error. We can open a separate bug for that though. Created attachment 333511 [details]
CVS commit message
Checked into adminserver (HEAD). Thanks to Rich for his review!
*** Bug 488180 has been marked as a duplicate of this bug. *** I've confirmed that post server registration with another admin server, you are able to access the ds console for the remote replica from the hosting admin server's console without prompting for directory manager's password and that all the proper default ACIs are added to the remote server. However, comment #6 appears that an issue was fixed with PTA - can you add steps to verify this issue? thanks If you are able to create a new instance of directory server, from the command line or console, and you can access it in the console without having to authenticate as directory manager, and are able to change configuration settings, then the PTA bug is fixed. It is PTA that allows the console admin user (not directory manager) to access a directory server instance in the console. Great - fix verfied - RHEL 5 DS 8.1 An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHEA-2009-0455.html |