freeipa

#8522 Remove cainstance.migrate_profiles_to_ldap()
Closed: fixed by antorres. Opened by cheimes.

Closed: fixed
Reopen Issue

Request for enhancement

The function migrate_profiles_to_ldap() migrates file-based Dogtag certificate profiles to LDAP. The function was added in commit 3827137b32 in 2015 for FreeIPA 4.2.0 to migrate old installations. FreeIPA's Dogtag instance has been configured to use LDAPProfiles since commit ba075b195c (2015). With pki_profiles_in_ldap=True pkispawn loads profiles into LDAP when the first CA instance is configure in a cluster (not for clones).

Server installer, replica installer, and server upgrader spend 10 to 15 seconds in the function. I think the function can safely removed. See https://github.com/freeipa/freeipa/pull/5167 for more discussion.

Alexander raise a possible issue. He mentioned that Dogtag will soon have a new profile for KRA. How does Dogtag handle new profiles? Is there a migration step in Dogtag that imports new profiles for us?

@cheimes I'll get back to you about that tomorrow. Profile additions/updates are usually handled in PKI upgrade scripts but I have to check if it works when LDAPProfileSubsystem is used. Too late for me to investigate now, though.

For the record Fraser has investigated the issue. Dogtag does not yet upgrade LDAPProfile subsystem.

master:

  • a9d34c8e66590c6ddb18a227fa0201cacdc7d72d Speed up cainstance.migrate_profiles_to_ldap
  • fa58071221bfb37159db6d6dc4f3bcfd088d80b1 Reuse main LDAP connection

According to discussion in https://github.com/freeipa/freeipa/pull/5167 , the function can't be removed. It was sped up instead.

Metadata Update from @antorres:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

performance

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.