<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Thanks very much, Rob. Would it be best to install the schema file in …/updates so it lives there permanently, or is it enough to just run it through ipa-ldap-updater the one time? I’m sorry if that’s a dumb question; I’ve only been working with IPA for a couple weeks so I’m still working on building my intuition for it.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">I’d be happy to share my DHCP plugin, but it’s pretty sketchy. ISC DHCPd’s LDAP support is kind of idiosyncratic, so my plugin is pretty purpose-built for our environment and needs. It might be a starting point for somebody else, though. I’ll put the polish on the code and share a Github link later today or maybe tomorrow.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Thanks again for the advice.</div> <div id="bloop_sign_1462819573057570816" class="bloop_sign"></div> <br><p class="airmail_on">On May 9, 2016 at 11:45:25 AM, Rob Crittenden (<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>) wrote:</p> <blockquote type="cite" class="clean_bq"><span><div><div></div><div>Jeffery Harrell wrote:
<br>> Good morning. (It’s morning where I am.)
<br>>
<br>> I’ve written several plugins for my deployment, including a DHCP plugin,
<br>> and I’m trying to figure out the best way to deploy them onto production
<br>> servers.
<br>>
<br>> Let’s start with the schema. I could copy a schema file (e.g.,
<br>> 89dhcp.ldif and others) into /etc/dirsrv/slapd-REALM/schema and do a
<br>> schema reload, or I could use ldapmodify to write the schema directly
<br>> into the running system so it gets written into
<br>> /etc/dirsrv/slapd-REALM/schema/99user.ldif.
<br>>
<br>> Is there any reason to prefer one over the other? Doing it the first way
<br>> seems more tidy to me, but it has to be done on each server separately,
<br>> which makes me wonder if it might cause things to get weird with respect
<br>> to replication during that short span of time when one server has the
<br>> schema and the other doesn’t. The Red Hat Directory Server documentation
<br>> stops short of saying that local schemata should always be installed
<br>> with ldapmodify into 99user.ldif, but it seems to kind of head-fake in
<br>> that direction, so I’m not sure what the right method is.
<br>
<br>The answer is neither: you want to use ipa-ldap-updater
<br>--schema-file=<your_schema.ldif>
<br>
<br>You definitely want to do it online so the schema gets replicated (and
<br>into 99user.ldif) so entries on non-updated masters don't blow up.
<br>
<br>> Then there are the update files. For the DHCP plugin, for instance, I
<br>> have a short update file that initializes a few objects (see below). Is
<br>> it better to just RUN this update against a live server with
<br>> ipa-ldap-updater, or is it better to INSTALL this file
<br>> in /usr/share/ipa/updates so it stays on the server permanently? Will
<br>> the second approach be better in case of upgrades or whatever?
<br>
<br>I'd install it into /usr/share/ipa/updates. The updater is more or less
<br>idempotent so it shouldn't hurt anything to run it multiple times.
<br>
<br>Once you have things working you might consider submitting your work
<br>upstream. There is a long-standing ticket for DHCP integration,
<br>https://fedorahosted.org/freeipa/ticket/939
<br>
<br>rob
<br>
<br>> Thanks very much for taking the time. I hope my questions made sense.
<br>>
<br>> Jeffery
<br>>
<br>> DHCP update file for reference, if necessary:
<br>>
<br>> dn: cn=dhcp,$SUFFIX
<br>> add: objectClass: top
<br>> add: objectClass: dhcpService
<br>> add: dhcpStatements: authoritative
<br>> add: dhcpStatements: default-lease-time 43200
<br>> add: dhcpStatements: max-lease-time 86400
<br>> add: dhcpStatements: one-lease-per-client on
<br>>
<br>> dn: cn=dhcpHosts,cn=Schema Compatibility,cn=plugins,cn=config
<br>> add: objectClass: top
<br>> add: objectClass: extensibleObject
<br>> add: schema-compat-container-group: cn=hosts,cn=dhcp,$SUFFIX
<br>> add: schema-compat-search-base: cn=computers,cn=accounts,$SUFFIX
<br>> add: schema-compat-search-filter:
<br>> (&(macAddress=*)(fqdn=*)(objectClass=ipaHost))
<br>> add: schema-compat-entry-rdn: cn=%{fqdn}
<br>> add: schema-compat-entry-attribute: objectClass=dhcpHost
<br>> add: schema-compat-entry-attribute: dhcpHWAddress=ethernet %{macAddress}
<br>> add: schema-compat-entry-attribute: dhcpStatements=fixed-address %{fqdn}
<br>> add: schema-compat-entry-attribute: dhcpOption=host-name "%{fqdn}"
<br>>
<br>> dn: cn=DHCP Administrators,cn=privileges,cn=pbac,$SUFFIX
<br>> add: objectClass: top
<br>> add: objectClass: groupofnames
<br>> add: objectClass: nestedgroup
<br>> only: description: DHCP Administrators
<br>>
<br>> plugin: update_managed_permissions
<br>>
<br>>
<br>>
<br>
<br></div></div></span></blockquote></body></html>