Bug 1810154 - RFE: ipa-backup should compare locally and globally installed server roles
Summary: RFE: ipa-backup should compare locally and globally installed server roles
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: ipa
Version: 8.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.3
Assignee: Thomas Woerner
QA Contact: ipa-qe
Josip Vilicic
URL:
Whiteboard:
Depends On:
Blocks: 1821766
TreeView+ depends on / blocked
 
Reported: 2020-03-04 15:59 UTC by François Cami
Modified: 2020-11-04 21:31 UTC (History)
10 users (show)

Fixed In Version: ipa-4.8.7-1
Doc Type: Enhancement
Doc Text:
.IdM backup utility now checks for required replica roles The `ipa-backup` utility now checks if all of the services used in the IdM cluster, such as a Certificate Authority (CA), Domain Name System (DNS), and Key Recovery Agent (KRA) are installed on the replica where you are running the backup. If the replica does not have all these services installed, the `ipa-backup` utility exits with a warning, because backups taken on that host would not be sufficient for a full cluster restoration. For example, if your IdM deployment uses an integrated Certificate Authority (CA), a backup run on a non-CA replica will not capture CA data. Red Hat recommends verifying that the replica where you perform an `ipa-backup` has all of the IdM services used in the cluster installed. For more information, see link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/preparing_for_disaster_recovery_with_identity_management/preparing-for-data-loss-with-idm-backups_preparing-for-disaster-recovery[Preparing for data loss with IdM backups].
Clone Of:
Environment:
Last Closed: 2020-11-04 02:50:15 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)

Description François Cami 2020-03-04 15:59:41 UTC
Description of problem:

ipa-backup should check whether all globally used server roles are locally installed. If that's not the case, the resulting backup will probably not be sufficient to restore a functioning, identical cluster.
For instance: taking a backup without a CA or KRA, etc.

Comment 1 François Cami 2020-03-04 16:04:19 UTC
Upstream ticket:
https://pagure.io/freeipa/issue/8217

Comment 8 François Cami 2020-04-06 14:55:34 UTC
Additional test-only fixes:

Fixed upstream
master:
https://pagure.io/freeipa/c/a087fd9255ed5d16b6a84a7b84f0507dad5b200e

Comment 10 François Cami 2020-04-06 16:18:51 UTC
Additional test-only fixes:

Fixed upstream
ipa-4-8:
https://pagure.io/freeipa/c/8691e5f8d33e7f023b1535d15637dedaee5bddec

Comment 11 François Cami 2020-04-07 14:40:21 UTC
Hi Jo,
I've opened https://bugzilla.redhat.com/show_bug.cgi?id=1821766 for the non-RN documentation changes.

Comment 13 Christian Heimes 2020-05-20 08:55:41 UTC
devel ack, François' improvement are already in 4.8 branch.

Comment 18 Mohammad Rizwan 2020-07-15 09:10:33 UTC
version:
ipa-server-4.8.7-4.module+el8.3.0+7221+eedbd403.x86_64

api.env: 
{'api_version': '2.239',
 'basedn': ipapython.dn.DN('dc=ipa,dc=test'),
 'bin': '/usr/lib/python3.6/site-packages/ipatests',
 'ca_agent_install_port': None,
 'ca_agent_port': 443,
 'ca_ee_install_port': None,
 'ca_ee_port': 443,
 'ca_host': 'runner.testrelm.test',
 'ca_install_port': None,
 'ca_port': 80,
 'certmonger_wait_timeout': 300,
 'conf': '/root/.ipa/cli.conf',
 'conf_default': '/root/.ipa/default.conf',
 'confdir': '/root/.ipa',
 'container_accounts': ipapython.dn.DN('cn=accounts'),
 'container_adtrusts': ipapython.dn.DN('cn=ad,cn=trusts'),
 'container_applications': ipapython.dn.DN('cn=applications,cn=configs,cn=policies'),
 'container_automember': ipapython.dn.DN('cn=automember,cn=etc'),
 'container_automount': ipapython.dn.DN('cn=automount'),
 'container_ca': ipapython.dn.DN('cn=cas,cn=ca'),
 'container_ca_renewal': ipapython.dn.DN('cn=ca_renewal,cn=ipa,cn=etc'),
 'container_caacl': ipapython.dn.DN('cn=caacls,cn=ca'),
 'container_certmap': ipapython.dn.DN('cn=certmap'),
 'container_certmaprules': ipapython.dn.DN('cn=certmaprules,cn=certmap'),
 'container_certprofile': ipapython.dn.DN('cn=certprofiles,cn=ca'),
 'container_cifsdomains': ipapython.dn.DN('cn=ad,cn=etc'),
 'container_configs': ipapython.dn.DN('cn=configs,cn=policies'),
 'container_custodia': ipapython.dn.DN('cn=custodia,cn=ipa,cn=etc'),
 'container_deleteuser': ipapython.dn.DN('cn=deleted users,cn=accounts,cn=provisioning'),
 'container_dna': ipapython.dn.DN('cn=dna,cn=ipa,cn=etc'),
 'container_dna_posix_ids': ipapython.dn.DN('cn=posix-ids,cn=dna,cn=ipa,cn=etc'),
 'container_dns': ipapython.dn.DN('cn=dns'),
 'container_dnsservers': ipapython.dn.DN('cn=servers,cn=dns'),
 'container_group': ipapython.dn.DN('cn=groups,cn=accounts'),
 'container_hbac': ipapython.dn.DN('cn=hbac'),
 'container_hbacservice': ipapython.dn.DN('cn=hbacservices,cn=hbac'),
 'container_hbacservicegroup': ipapython.dn.DN('cn=hbacservicegroups,cn=hbac'),
 'container_host': ipapython.dn.DN('cn=computers,cn=accounts'),
 'container_hostgroup': ipapython.dn.DN('cn=hostgroups,cn=accounts'),
 'container_locations': ipapython.dn.DN('cn=locations,cn=etc'),
 'container_masters': ipapython.dn.DN('cn=masters,cn=ipa,cn=etc'),
 'container_netgroup': ipapython.dn.DN('cn=ng,cn=alt'),
 'container_otp': ipapython.dn.DN('cn=otp'),
 'container_permission': ipapython.dn.DN('cn=permissions,cn=pbac'),
 'container_policies': ipapython.dn.DN('cn=policies'),
 'container_policygroups': ipapython.dn.DN('cn=policygroups,cn=configs,cn=policies'),
 'container_policylinks': ipapython.dn.DN('cn=policylinks,cn=configs,cn=policies'),
 'container_privilege': ipapython.dn.DN('cn=privileges,cn=pbac'),
 'container_radiusproxy': ipapython.dn.DN('cn=radiusproxy'),
 'container_ranges': ipapython.dn.DN('cn=ranges,cn=etc'),
 'container_realm_domains': ipapython.dn.DN('cn=Realm Domains,cn=ipa,cn=etc'),
 'container_rolegroup': ipapython.dn.DN('cn=roles,cn=accounts'),
 'container_roles': ipapython.dn.DN('cn=roles,cn=policies'),
 'container_s4u2proxy': ipapython.dn.DN('cn=s4u2proxy,cn=etc'),
 'container_selinux': ipapython.dn.DN('cn=usermap,cn=selinux'),
 'container_service': ipapython.dn.DN('cn=services,cn=accounts'),
 'container_stageuser': ipapython.dn.DN('cn=staged users,cn=accounts,cn=provisioning'),
 'container_sudocmd': ipapython.dn.DN('cn=sudocmds,cn=sudo'),
 'container_sudocmdgroup': ipapython.dn.DN('cn=sudocmdgroups,cn=sudo'),
 'container_sudorule': ipapython.dn.DN('cn=sudorules,cn=sudo'),
 'container_sysaccounts': ipapython.dn.DN('cn=sysaccounts,cn=etc'),
 'container_topology': ipapython.dn.DN('cn=topology,cn=ipa,cn=etc'),
 'container_trusts': ipapython.dn.DN('cn=trusts'),
 'container_user': ipapython.dn.DN('cn=users,cn=accounts'),
 'container_vault': ipapython.dn.DN('cn=vaults,cn=kra'),
 'container_views': ipapython.dn.DN('cn=views,cn=accounts'),
 'container_virtual': ipapython.dn.DN('cn=virtual operations,cn=etc'),
 'context': 'cli',
 'debug': False,
 'delegate': False,
 'dogtag_version': 9,
 'domain': 'ipa.test',
 'dot_ipa': '/root/.ipa',
 'enable_ra': False,
 'env_confdir': None,
 'fallback': False,
 'fips_mode': False,
 'force_schema_check': False,
 'home': '/root',
 'host': 'runner.testrelm.test',
 'http_timeout': 30,
 'in_server': False,
 'in_tree': True,
 'interactive': True,
 'ipalib': '/usr/lib/python3.6/site-packages/ipalib',
 'jsonrpc_uri': 'https://master.ipa.test/ipa/json',
 'kinit_lifetime': None,
 'ldap_uri': 'ldap://master.ipa.test',
 'log': '/root/.ipa/log/cli.log',
 'logdir': '/root/.ipa/log',
 'mode': 'developer',
 'mount_ipa': '/ipa/',
 'nss_dir': '/root/.ipa/nssdb',
 'plugins_on_demand': True,
 'prompt_all': False,
 'ra_plugin': 'selfsign',
 'recommended_max_agmts': 4,
 'replication_wait_timeout': 300,
 'rpc_protocol': 'jsonrpc',
 'script': '/usr/lib/python3.6/site-packages/ipatests/-c',
 'server': 'master.ipa.test',
 'site_packages': '/usr/lib/python3.6/site-packages',
 'skip_version_check': False,
 'startup_timeout': 120,
 'startup_traceback': False,
 'tls_ca_cert': '/root/.ipa/ca.crt',
 'tls_version_max': None,
 'tls_version_min': None,
 'validate_api': False,
 'verbose': 0,
 'version': '4.8.7',
 'wait_for_dns': 0,
 'webui_prod': True,
 'xmlrpc_uri': 'https://master.ipa.test/ipa/xml'}
uname: posix.uname_result(sysname='Linux', nodename='runner.testrelm.test', release='4.18.0-221.el8.x86_64', version='#1 SMP Thu Jun 25 20:58:19 UTC 2020', machine='x86_64')
euid: 0, egid: 0
working dir: /usr/lib/python3.6/site-packages/ipatests
sys.version: 3.6.8 (default, Jun 26 2020, 12:10:09) 
[GCC 8.3.1 20191121 (Red Hat 8.3.1-5)]
============================= test session starts ==============================
platform linux -- Python 3.6.8, pytest-3.10.1, py-1.9.0, pluggy-0.13.1 -- /usr/libexec/platform-python
cachedir: /home/cloud-user/.pytest_cache
metadata: {'Python': '3.6.8', 'Platform': 'Linux-4.18.0-221.el8.x86_64-x86_64-with-redhat-8.3-Ootpa', 'Packages': {'pytest': '3.10.1', 'py': '1.9.0', 'pluggy': '0.13.1'}, 'Plugins': {'metadata': '1.10.0', 'html': '1.22.1', 'multihost': '3.0', 'sourceorder': '0.5'}}
rootdir: /usr/lib/python3.6/site-packages/ipatests, inifile:
plugins: metadata-1.10.0, html-1.22.1, multihost-3.0, sourceorder-0.5
collecting ... collected 3 items

test_integration/test_backup_and_restore.py::TestBackupRoles::test_rolecheck_DNS_CA PASSED [ 33%]
test_integration/test_backup_and_restore.py::TestBackupRoles::test_rolecheck_KRA PASSED [ 66%]
test_integration/test_backup_and_restore.py::TestBackupRoles::test_rolecheck_Trust PASSED [100%]

---------------- generated xml file: /home/cloud-user/junit.xml ----------------
----------- generated html file: file:///home/cloud-user/report.html -----------
========================= 3 passed in 2518.27 seconds ==========================


Automation passed.

Comment 24 errata-xmlrpc 2020-11-04 02:50:15 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4670


Note You need to log in before you can comment on or make changes to this bug.