search

voxpupuli / puppet-openldap

Manage OpenLDAP with Puppet
Apache License 2.0
37 stars 134 forks source link

Create olcDbDirectory before its database and the start of slapd #397

Closed gcoxmoz closed 6 months ago

gcoxmoz commented 11 months ago

Pull Request (PR) description

There is an ordering in manifests/server/database.pp:

  Class['openldap::server::service']
  -> Openldap::Server::Database[$title]

This is subtly bad. The service (slapd) must be spun up before a database can be created. That makes sense. However, it means the service happens before Openldap::Server::Database ... and there is more going on in manifests/server/database.pp than just the openldap_database creation: there is also the creation of File[$manage_directory]. In most folks' cases, this directory will be /var/lib/ldap, which happens to be installed by the RPM/dpkg package, so "you get it for free" / it already exists and the file creation doesn't need to be done by puppet. However, if you set the directory to something else (that doesn't exist), you have a circular dependency problem. slapd (the service) needs the database directory to exist before slapd starts up -> slapd is ordered before the database manifest -> the database manifest creates the database directory -> the database directory has to happen before the service.

Ultimately, the ordering is in error. The service has to happen before openldap_database BUT NOT all of the ridealong items in openldap::server::database. That breaks out of the dependency loop, and allows the directory creation to be marked as required before the Service is started.

Very likely, most folks are running one-DB-only in /var/lib/ldap (which matches most examples) and haven't tickled this issue. That said, OpenLDAP maintainers are advising you to use subdirectories which puts this into the realm of needing to make a directory upon install.

gcoxmoz commented 11 months ago

And clearly this is failing due to more class errors than I can spot.