Hide Forgot
Description of problem: When upgrading IPA we shut down dirsrv, reconfigure it to only listen on ldapi, restart it, apply our updates, then reverse it. It would be safer if we could pass in the configuration changes on the command-line rather than changing dse.ldif directly. It might look something like: -C cn=config:nsslapd-port=0 -C cn=config:nsslapd-ldapisocket=/var/run/ipa-update.socket ...
Upstream ticket: https://fedorahosted.org/389/ticket/41
*** Bug 766327 has been marked as a duplicate of this bug. ***
DS 41 has this comment. Can we at least assess the possibility? Replying to [comment:10 nhosoi]: > Comment by Ludwig: > but not this specific suggestion, but could we allow enabling/disabling ports without restart. Is this something that could be done in the context of nunc-stans?
Is this bug needed/valid anymore? You can set ldapi values using ldapmodify
It can be closed. I'll open a ticket against freeipa to make these changes over LDAP instead of directly tweaking the files. I assume a restart needed if the listeners are updated?
(In reply to Rob Crittenden from comment #10) > It can be closed. I'll open a ticket against freeipa to make these changes > over LDAP instead of directly tweaking the files. > > I assume a restart needed if the listeners are updated? Yeah a restart is still needed. But Ludwig just pointed out that this RFE might have been related to passing config options directly to ns-slapd? I guess openldap does something like this. If that's the case, and it does provide value we could move this RFE to a later RHEL release instead of closing it.
Passing as arguments to ns-slapd was the original idea but making the changes over ldapi I think is sufficient for our needs, and certainly better than directly tweaking dse.ldif. You may close this.
(In reply to Rob Crittenden from comment #12) > Passing as arguments to ns-slapd was the original idea but making the > changes over ldapi I think is sufficient for our needs, and certainly better > than directly tweaking dse.ldif. You may close this. Will do, thanks Rob!