Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
When upgrading IPA we shut down dirsrv, reconfigure it to only listen on ldapi, restart it, apply our updates, then reverse it.
It would be safer if we could pass in the configuration changes on the command-line rather than changing dse.ldif directly.
It might look something like:
-C cn=config:nsslapd-port=0 -C cn=config:nsslapd-ldapisocket=/var/run/ipa-update.socket ...
DS 41 has this comment. Can we at least assess the possibility?
Replying to [comment:10 nhosoi]:
> Comment by Ludwig:
> but not this specific suggestion, but could we allow enabling/disabling ports without restart. Is this something that could be done in the context of nunc-stans?
It can be closed. I'll open a ticket against freeipa to make these changes over LDAP instead of directly tweaking the files.
I assume a restart needed if the listeners are updated?
(In reply to Rob Crittenden from comment #10)
> It can be closed. I'll open a ticket against freeipa to make these changes
> over LDAP instead of directly tweaking the files.
>
> I assume a restart needed if the listeners are updated?
Yeah a restart is still needed. But Ludwig just pointed out that this RFE might have been related to passing config options directly to ns-slapd? I guess openldap does something like this. If that's the case, and it does provide value we could move this RFE to a later RHEL release instead of closing it.
Passing as arguments to ns-slapd was the original idea but making the changes over ldapi I think is sufficient for our needs, and certainly better than directly tweaking dse.ldif. You may close this.
(In reply to Rob Crittenden from comment #12)
> Passing as arguments to ns-slapd was the original idea but making the
> changes over ldapi I think is sufficient for our needs, and certainly better
> than directly tweaking dse.ldif. You may close this.
Will do, thanks Rob!