#50399 dsconf replica create-manager incorrectly changes replicabinddn
Closed: wontfix 2 years ago by mreynolds. Opened 2 years ago by firstyear.

Issue Description

During dsconf instance replication create-manager the command incorrectly modifies all existing outbound agreements to use the new dn.

This is a mistake.

-- It is a surprise behaviour - the command only says it is creating a manager, not changing configuration. It should only do that one thing.

-- The manager we are creating is for replicas to authenticate to this server, not for this server to provide outbound replications. Changing the outbound agreements to use the DN of the user on this server is incorrect

-- We are potentially trampling existing intent and configuration. Imagine I have server A and B. on A I have "incoming manager B" and on B I have "incoming manager A". These agreements were manually configured and existing.

I now run the create-manager command to standardise my process on the new method. I do this on A. This would have "replication manager", but would change my agreement incorrectly to connect to "replication manager",when it should remain as "incoming manager B".

As a result, the nsds5ReplicaBindDN attribute should not be altered in the repication manager creation process. It is up to the admin to alter their replication agreements to configure this value if required.

keep in mind - due to dsrc, args.suffix is ALWAYS populated if it exists in your dsrc, meaning this will always corrupt the agreements if you create-manager while you have a dsrc in your env.

Metadata Update from @firstyear:
- Custom field origin adjusted to None
- Custom field reviewstatus adjusted to None

2 years ago

@mreynolds has a different idea on solving this, so the PR as mentioned is not relevant.

Metadata Update from @mreynolds:
- Issue set to the milestone: 1.4.0

2 years ago

Metadata Update from @mreynolds:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

2 years ago

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/3457

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @spichugi:
- Issue close_status updated to: wontfix (was: fixed)

2 years ago

Login to comment on this ticket.