freeipa

#6406 Use common mechanism for setting up initial replication in both domain levels
Closed: Fixed Opened by mbabinsk.

Closed: Fixed
Reopen Issue

Replica installers use different method to set up replication agreements and do initial sync in domain level 0 and domain level 1, respectively:

  • in DL0 the agreements are created using simple binds/STARTTLS and are converted to use SASL/GSSAPI mech later during KDC install

  • in DL1 the agreements are configured to use GSSAPI right away

Preliminary prototyping shows that both domain levels may share the mechanism used in DL1 after some adjustments are made regarding service keytab retrieval (see #6405). This helps to keep the amount of DL-specific code at minimum.

Care must be taken to ensure that the common mechanism works against older masters.

Part of the installer refactoring effort.

master:

  • 9d7943f3da7fb84975cc8f45047aafee13bf85dc Turn replication manager group into ReplicationManager class member
  • 3dc9ab162141c7d2e4affe73f520e1599e9f8c30 replication: augment setup_promote_replication method
  • cf6048a3ba9998a65858993e52bd4895749f2a79 replication: refactor the code setting principals as replica bind DNs
  • 8378e1e39f44d49c2c90d2d0e7acd75a4fa95787 ensure that the initial sync using GSSAPI works agains old masters
  • ce2bb47cca03eda1ff85f4725abb92c639f34ecc Use common procedure to setup initial replication in both domain levels

Metadata Update from @mbabinsk:
- Issue assigned to mbabinsk
- Issue set to the milestone: FreeIPA 4.5
Metadata
None
None
None
Normal
defect
Installation
#6405
#6392
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.