Description of problem:

When ipa-backup is called for the first time, the LDAP database is exported to
/var/lib/dirsrv/slapd-<instance>/ldif/<instance>-userRoot.ldif. db2ldif is
called for this. The tool runs under the dirsrv user context. When you call
ipa-restore, the same ldif file is mangled by RemoveRUVParser(). Since the tool
runs under root, also the mangled ldif file is now owned by root.

When you now call ipa-backup the next time, the db2ldif fails, because the tool
does not have permissions to write to the ldif file which is owned by root
(instead of dirsrv).


I think this is the problematic code in ldif2db():

  ipautil.backup_file(ldiffile)
        with open(ldiffile, 'wb') as out_file:
            ldif_writer = ldif.LDIFWriter(out_file)
            with open(srcldiffile, 'rb') as in_file:
                ldif_parser = RemoveRUVParser(in_file, ldif_writer, self.log)
                ldif_parser.parse()

Another problem is, that ipa-backup returns with "The ipa-backup command was
successful" although the db2ldif failed.

Version-Release number of selected component (if applicable):
ipa-4.4

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info: