Author: nkinder Update of /cvs/dirsec/adminserver/admserv/newinst/src In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv30030/admserv/newinst/src Modified Files: AdminUtil.pm.in register-ds-admin.pl.in setup-ds-admin.res.in Log Message: Resolves: bug 486402 Bug Description: Using setup-ds.pl and then registering the instance with an admin server using register-ds-admin.pl does not add the proper ACI's to allow admin to manage the instance. Reviewed by: rmeggins (thanks!) Files: see diff Branch: HEAD Fix Description: Add the appropriate aci's when running register-ds-admin.pl. There were a few other issues to deal with in addition to the missing ACIs. The PTA plug-in was not being configured since the LDIF template that was used was an entire new PTA plug-in entry, which never gets added since it already exists. I changed this to a LDIF mod template. We also only want to configure PTA if it is not already configured, or if we are switching the config DS. This will prevent overwriting any custom tweaks to the PTA plug-in, such as using LDAPS to communicate with the config DS. I found another issue during testing with the ldapStart parameter in adm.conf getting set incorrectly after running register-ds-admin.pl. This parameter is supposed to point to the start-slapd script of the config DS, but register-ds-admin.pl was always changing this to the last instance that it registered (which will never be the config DS if you have more than one instance). We need to ensure that the slapd info in the inf is the config DS before updating the Admin Server config files. Platforms tested: F9 Flag Day: no Doc impact: no Index: AdminUtil.pm.in =================================================================== RCS file: /cvs/dirsec/adminserver/admserv/newinst/src/AdminUtil.pm.in,v retrieving revision 1.21 retrieving revision 1.22 diff -u -r1.21 -r1.22 --- AdminUtil.pm.in 27 Feb 2009 14:33:27 -0000 1.21 +++ AdminUtil.pm.in 27 Feb 2009 17:34:21 -0000 1.22 @@ -303,15 +303,29 @@ my $conn = shift; my $inf = shift; my $errs = shift; + my $force_pta = shift; my @additionalLdifFiles = @_; # add the o=NetscapeRoot tree using the mapper and ldif templates my @ldiffiles = ('@ldifdir(a)/12dsconfig.mod.tmpl', '@ldifdir(a)/13dsschema.mod.tmpl', - '@ldifdir(a)/14dsmonitor.mod.tmpl', - '@ldifdir(a)/15dspta.ldif.tmpl' + '@ldifdir(a)/14dsmonitor.mod.tmpl' ); push @ldiffiles, @additionalLdifFiles; + + # If PTA is not enabled yet, we need to enable and configure it + my $ent = $conn->search("cn=Pass Through Authentication,cn=plugins,cn=config", "base", "(objectclass=*)", 0, 'nsslapd-pluginenabled'); + my $errstr = $conn->getErrorString(); + if (!$ent or ($errstr ne "Success")) { + $conn->close(); + @{$errs} = ('error_finding_pta', (($errstr eq "Success") ? 'unknown error' : $errstr)); + return 0; + } + + if (($ent->hasValue("nsslapd-pluginenabled", "off", 1)) || $force_pta == 1) { + push @ldiffiles, '@ldifdir(a)/15dspta.mod.tmpl'; + } + my $setupinf = new Inf("@infdir(a)/setup.inf"); my $admininf = new Inf("@infdir(a)/admin.inf"); my $dsinf = new Inf("@infdir(a)/slapd.inf"); @@ -339,6 +353,7 @@ sub createSubDS { my $inf = shift; my $errs = shift; + my $force_pta = shift; # open a connection to the directory server my $conn = new Mozilla::LDAP::Conn($inf->{General}->{FullMachineName}, @@ -353,7 +368,7 @@ return 0; } - return internalCreateSubDS($conn, $inf, $errs, '@ldifdir(a)/16dssuffixadmin.mod.tmpl'); + return internalCreateSubDS($conn, $inf, $errs, $force_pta, '@ldifdir(a)/16dssuffixadmin.mod.tmpl'); } # same as createSubDS but works directly on the dse.ldif file itself @@ -373,7 +388,7 @@ return 0; } - return internalCreateSubDS($conn, $inf, $errs); + return internalCreateSubDS($conn, $inf, $errs, 0); } sub addConfigACIsToSubDS { Index: register-ds-admin.pl.in =================================================================== RCS file: /cvs/dirsec/adminserver/admserv/newinst/src/register-ds-admin.pl.in,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- register-ds-admin.pl.in 23 Aug 2007 23:51:24 -0000 1.4 +++ register-ds-admin.pl.in 27 Feb 2009 17:34:21 -0000 1.5 @@ -459,13 +459,20 @@ } else { + # If we're switching the config DS, we want to force updating the + # PTA plug-in since it's configured for the old config DS. + my $force_pta = 0; + if ( $orig_confdsid ne $new_confdsid ) { + $force_pta = 1; + } + $setup->{inf}->{slapd} = $subinf->{slapd}; $setup->{inf}->{slapd}->{RootDNPwd} = $passwd; push @{$subinstances{$subconfdir}}, $subinst; $done = 0; - while ( !$done && !createSubDS($setup->{inf}, \@errs) ) + while ( !$done && !createSubDS($setup->{inf}, \@errs, $force_pta) ) { - $setup->msg($FATAL, @errs); + $setup->msg($FATAL, @errs); $passwd = reg_get_passwd($setup, 'input_rootdn_passwd_sub', $subid, $subid); if ( "" eq $passwd || !$passwd ) @@ -478,6 +485,13 @@ $setup->{inf}->{slapd}->{RootDNPwd} = $passwd; } } + + # add the aci that allows the admin user to administer the server + @errs = (); + if (!addConfigACIsToSubDS($setup->{inf}, \@errs)) { + $setup->msg(@errs); + $setup->doExit(1); + } } } } @@ -494,9 +508,20 @@ } } -# configure and register the admin server instance -# need these 3 values for ldapStart -$setup->{inf}->{slapd}->{ServerIdentifier} = $new_confdsid; +# Configure and register the admin server instance. +# Generate a new inf for the config DS and override +# the old slapd data from the last instance we registered. +$new_confdir = $setup->{inf}->{slapd}->{config_dir}; +my $newinst = "slapd-$new_confdsid"; +my $inf = createInfFromConfig("$instconfigdir/$newinst", $newinst); +if ( ! $inf ) +{ + $setup->msg($FATAL, 'error_create_inf_from_config', "$instconfigdir/$newinst"); + $setup->doExit(1); +} +$setup->{inf}->{slapd} = $inf->{slapd}; + +# need these manually set these 2 parameters $setup->{inf}->{slapd}->{UseExistingMC} = "yes"; $setup->{inf}->{slapd}->{SlapdConfigForMC} = "yes"; if ( !$setup->{reconfigas} ) Index: setup-ds-admin.res.in =================================================================== RCS file: /cvs/dirsec/adminserver/admserv/newinst/src/setup-ds-admin.res.in,v retrieving revision 1.11 retrieving revision 1.12 diff -u -r1.11 -r1.12 --- setup-ds-admin.res.in 27 Feb 2009 14:33:27 -0000 1.11 +++ setup-ds-admin.res.in 27 Feb 2009 17:34:21 -0000 1.12 @@ -138,3 +138,4 @@ cacert_already_exists = The certificate database in '%s' already contains a CA certificate. Please remove it first, or use the certutil program to add the CA certificate with a different name.\n error_connection_failed = Error: failed to open an LDAP connection to host '%s' port '%s' as user '%s'. Error: %s.\n registering_dirserver_instances = Registering the directory server instances with the configuration directory server . . .\n +error_finding_pta = Unable to find Pass Through Authentication Plug-In config entry. Error: %s.\n