26 Aug, 2007

5 commits


25 Aug, 2007

7 commits

  • allow for backend-compact-encoding property, enabled by default.
    
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2796 41b1ffd8-f28e-4786-ab96-9950f0a78031
    abobrov
     
  • This is a followup to commit r2774.
    
    Secure replication depends on ADS containing at least the instance-to-be-initialized's instance key public-key certificate in the ADS-based truststore because the existing replication domain server requires it to "trust" the new server. (The new server trusts the domain server by some future ADSContext code that will fetch the domain host's public-key certificate and write it into the new server's truststore backend - all via LDAP.)
    
    Subsequent to commit r2774, we discovered that configuring replication results in the replication server opening its server socket and configuring it for TLS. The TLS configuration requires the local truststore to be initialized with the local instance key and the instance key of any to-be-replicated servers must be added. Hence, the Installer's ADS configuration step must be run before its replication configuration step.
    
    In the current implementation of the ADS configuration step, ADS replication is configured and initialized (distinct from the suffixes specified by the user). These changes 1) move the ADS replication configuration and initialization from the ADS configuration step, and merge them into the code that handles configuring and initializing replication of the user specified suffixes (Installer.java); and 2) move the invocation of the ADS configuration ahead of the replication configuration (OfflineInstaller,WebStartInstaller.java).
    
    M      src/quicksetup/org/opends/quicksetup/installer/offline/OfflineInstaller.java
    M      src/quicksetup/org/opends/quicksetup/installer/webstart/WebStartInstaller.java
    M      src/quicksetup/org/opends/quicksetup/installer/Installer.java
    
    Tests:
    
    In addition to the precommit target, I've run the following setup scenarios using the OfflineInstaller:
    
    1) Setup standalone server with data; setup new server as part of existing replication. Then the new server setup configures replication, ADS, and initializes suffixes on both instances.
    
    2) Setup initial replicated server with data; setup new server as part of existing replication.
    
    I'm not sure how to test the WebStartInstaller, but the code and changes are identical to the OfflineInstaller, so perhaps it is ok.
    
    ---
    Thanks to Josu for reviewing.
    
    
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2795 41b1ffd8-f28e-4786-ab96-9950f0a78031
    david_page
     
  • dependencies in backup/restore and binary copy that could cause problems for
    administrators if they're not aware of them.  We should leave it disabled
    until issue #2158 has been addressed.
    
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2794 41b1ffd8-f28e-4786-ab96-9950f0a78031
    neil_a_wilson
     
  • git-svn-id: https://svn.forgerock.org/opendj/trunk@2793 41b1ffd8-f28e-4786-ab96-9950f0a78031
    al_xipe
     
  • git-svn-id: https://svn.forgerock.org/opendj/trunk@2792 41b1ffd8-f28e-4786-ab96-9950f0a78031
    al_xipe
     
  • git-svn-id: https://svn.forgerock.org/opendj/trunk@2791 41b1ffd8-f28e-4786-ab96-9950f0a78031
    al_xipe
     
  • git-svn-id: https://svn.forgerock.org/opendj/trunk@2790 41b1ffd8-f28e-4786-ab96-9950f0a78031
    al_xipe
     

24 Aug, 2007

17 commits

  • frequently failing.
    
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2789 41b1ffd8-f28e-4786-ab96-9950f0a78031
    neil_a_wilson
     
  • configure the server to automatically start when the system boots.
    
    Also, update the stop-ds script so that if the server is to be stopped via kill
    but no PID file is present, the stop script will generate an error instead of
    trying to invoke the stop task (which is guaranteed to fail since the attempt
    will be made anonymously, and this will give a confusing error message).
    
    OpenDS Issue Number:  526
    
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2788 41b1ffd8-f28e-4786-ab96-9950f0a78031
    neil_a_wilson
     
  • 
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2787 41b1ffd8-f28e-4786-ab96-9950f0a78031
    neil_a_wilson
     
  • 
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2786 41b1ffd8-f28e-4786-ab96-9950f0a78031
    boli
     
  • Each instance has an associated public-private key-pair called the "instance key". The collection of public-key certificates from all instances forms an ADS-domain truststore. Secure replication uses this truststore in its TLS setup.
    
    The instance key is maintained by the local instance using a new "truststore" backend type that manages a local keystore file. The backend is induced to generate and self-sign a key when an entry with a special dn is written to it.  Once the truststore has been so initialized, the public-key certificate can be retrieved with an LDAP search operation.
    
    This change adds a method to the ADSContext to retrieve the instance key public-key certificate from the instance to which the context is bound, and set a field in the context with the cert. The method detects if it needs to induce the backend to produce the key. A subsequent change will publish the key in ADS.  For now (until Andy commits the truststore backend code), the attempt to retrieve the key is guarded by a check for the ads-truststore backend's presence.
    
    There is also some minor cleanup of existing code, and some additional code related to upcoming CryptoManager related ADS setup.
    
    M      src/ads/org/opends/admin/ads/ADSContext.java
    
    Tests:
    
    In addition to the precommit target, I've run the following setup scenarios using the OfflineInstaller:
    
    1) Setup standalone server with data; setup new server as part of existing replication. Then the new server setup configures replication, ADS, and initializes suffixes on both instances.
    
    2) Setup initial replicated server with data; setup new server as part of existing replication.
    
    
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2785 41b1ffd8-f28e-4786-ab96-9950f0a78031
    david_page
     
  • …tring for the default-password-storage-scheme.
    
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2784 41b1ffd8-f28e-4786-ab96-9950f0a78031
    mkeyes
     
  • … default, fair ordering will be used.
    
    
    
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2783 41b1ffd8-f28e-4786-ab96-9950f0a78031
    boli
     
  • 
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2782 41b1ffd8-f28e-4786-ab96-9950f0a78031
    mkeyes
     
  • can be provided as a string, contained in a file, or piped in via standard
    input, and the result can be sent to standard output or written to a file.
    
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2781 41b1ffd8-f28e-4786-ab96-9950f0a78031
    neil_a_wilson
     
  • is indexed for equality by default.  Also, include the
    ds-cfg-backend-compact-encoding in the userRoot configuration entry so that
    it's more obvious what the value is when looking at the configuration.
    
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2780 41b1ffd8-f28e-4786-ab96-9950f0a78031
    neil_a_wilson
     
  • 
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2779 41b1ffd8-f28e-4786-ab96-9950f0a78031
    abobrov
     
  • 
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2778 41b1ffd8-f28e-4786-ab96-9950f0a78031
    mkeyes
     
  • - replace atomic init followed by clear in favor of before/after group to improve concurrency.
    - fix FIFO rotation test bug to assert for all rotated entries.
     
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2777 41b1ffd8-f28e-4786-ab96-9950f0a78031
    abobrov
     
  • 
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2776 41b1ffd8-f28e-4786-ab96-9950f0a78031
    jvergara
     
  • …de dsconfig commands to create, modify, and delete a custom password validator.
    
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2775 41b1ffd8-f28e-4786-ab96-9950f0a78031
    mkeyes
     
  • Secure replication depends on ADS containing at least the instance-to-be-initialized's instance key public-key certificate in the ADS-based truststore because the existing replication domain server requires it to "trust" the new server. (The new server trusts the domain server by some future ADSContext code that will fetch the domain host's public-key certificate and write it into the new server's truststore backend - all via LDAP.)
    
    Hence, this change reverses the invocation order of Installer.initializeSuffixes and Installer.updateADS so that the latter is now run first (but still subsequent to Installer.configureReplication).  Note that Installer.updateADS does require Installer.configureReplication to have been run, since it configures replication for and initializes "cn=admin data".
    
    M      src/quicksetup/org/opends/quicksetup/installer/offline/OfflineInstaller.java
    M      src/quicksetup/org/opends/quicksetup/installer/webstart/WebStartInstaller.java
    
    Tests:
    
    In addition to the precommit target, I've run the following setup scenarios using the OfflineInstaller:
    
    1) Setup standalone server with data; setup new server as part of existing replication. Then the new server setup configures replication, ADS, and initializes suffixes on both instances.
    
    2) Setup initial replicated server with data; setup new server as part of existing replication.
    
    I'm not sure how to test the WebStartInstaller, but the code and changes are identical to the OfflineInstaller, so perhaps it is ok.
    
    --
    Thanks to Josu for the review.
    
    
    
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2774 41b1ffd8-f28e-4786-ab96-9950f0a78031
    david_page
     
  • 
    git-svn-id: https://svn.forgerock.org/opendj/trunk@2773 41b1ffd8-f28e-4786-ab96-9950f0a78031
    gary_williams
     

23 Aug, 2007

11 commits