#50400 Ticket 50399 - replication manager create incorrectly changes agreements
Closed by spichugi. Opened by firstyear.
firstyear/389-ds-base 50399-manager-create-corrupts-existing-agreements  into  master

Download 50400.patch

Bug Description: During dsconf instance replication create-manager the command incorrectly modifies
all existing outbound agreements to use the new dn.

-- It is a surprise behaviour - the command only says it is creating a manager, not changing
configuration. It should only do that one thing.

-- The manager we are creating is for replicas to authenticate to this server, not for this server
to provide outbound replications. Changing the outbound agreements to use the DN of the user on
this server is incorrect

-- We are potentially trampling existing intent and configuration. Imagine I have server A and B.
On A I have "incoming manager B" and on B I have "incoming manager A". These agreements were
manually configured and existing. Adding the replication manager on A would break my outgoing
agreement to B now.

Fix Description: Remove the behaviour from the command. Some code cleanups
were also performed to use the get_arg which exists to help reduce boilerplate
throughout the codebase.

https://pagure.io/389-ds-base/issue/50399

Author: William Brown william@blackhats.net.au

Review by: ???

If we are recreating or fixing something that already exists, I think we should log.info that information to the user.
The user has requested creating so we should be clear that it is not exactly what's happening.

Besides that, I think it is a reasonable change. But it is @mreynolds code, so I think he should take a look too.

The UI relies heavily on this code to enable and setup replication. If you don't supply the optional "suffix" arg it doesn't update the config. So can we just clarify the help text?

Also this code does NOT update agreements (no idea where this idea came from), it just updates the replication suffix config entry. Again I see nothing wrong with this code, and all your concerns are around agreements which this code does not touch. Perhaps you made some false assumptions here? If you "must" change it, then you also must fix the UI code to handle this change in behavior, and file a doc bug as it's already in the new admin guide.

I saw on the mailing an actual problem that was not mentioned here, and that is "suffix" is always set in dsrc file. Which makes the optional argument not optional. So what we should do here is simply change the argument name from "--suffix" to something like "--repl-suffix"

I'm going to write a more detailed response on the mailing list I think. I think changing to --repl-suffix here could be a reasonable short-term solution. I'll close this PR since you have a different idea on solving it.

Pull-Request has been closed by firstyear

I'm going to write a more detailed response on the mailing list I think. I think changing to --repl-suffix here could be a reasonable short-term solution. I'll close this PR since you have a different idea on solving it.

Just to clarify why I did it the way I did is this... There is only one thing you do with a replication manager entry after you create it, and that is to add it to the replication configuration entry. It made sense to me to join these two operations into a single command (it being optional of course).

I was actually thinking of what William would do here, and I thought you would want it to be added to the configuration entry as it is created (saving an Admin from an extra configuration step). Again, I'm sorry the CLI is not turning out how you had envisioned it :-(

Don't be sorry <3 you and @spichugi have done a great amount of work on this, so I think I need to re-adjust my expectations. There is a longer mail on the mailing list about this, because I'm worried I tied up too many of my feelings into this, so I would like some advice on how to proceed there.

I'll let you fix this one the way you want. :)

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3458

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi

Metadata