Changes between Version 1 and Version 2 of ALL__disable_updates


Ignore:
Timestamp:
11/19/14 16:48:40 (10 years ago)
Author:
lttoth@…
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • ALL__disable_updates

    v1 v2  
    33    Original Author:  Beth Mercer - 20081031 
    44 
     5== Historical Use of Locks  
    56EDIR, AUTHSERV and their shared update back end are configured to look for a lock  
    67file before presenting a form that supports directory updates.  The lock file name  
    78is configured in the runtime_common.cfg or runtime.cfg files of the three applications: 
    89 
    9         ~iplanet/UPDATE<INST>/config/runtime_common.cfg 
    10         ~ldapgw/AUTH<INST>/config/runtime*.cfg 
    11         ~ldapgw/EDIR<INST>/config/runtime*.cfg 
     10        * ~iplanet/UPDATE<INST>/config/runtime_common.cfg 
     11          * lock_file: /export/home/iplanet/local/ldap/web/log/gateway_updates_disabled 
     12        * ~ldapgw/AUTH<INST>/config/runtime*.cfg 
     13          * lock_file: /export/home/iplanet/local/ldap/web/log/gateway_updates_disabled 
     14        * ~ldapgw/EDIR<INST>/config/runtime*.cfg 
     15          * lock_file: /export/home/iplanet/local/ldap/web/log/gateway_updates_disabled 
    1216 
    1317Though the lock file can be separately configured, in practical terms all three 
    … …  
    1822As of September 2008, updates of userPassword, uakSecQuestion and uakSecResponse were 
    1923configured to bypass the Oracle registry (to address significant outage related to  
    20 weekly cold backups of registry databases).  When that change was implemented, the test  
    21 for the lock file had to be moved or alter in underlying code.  Otherwise when the  
    22 registry went down for backups, the presence of the lock file would have prohibited  
    23 updates to attributes which didn't rely on the registry.  
     24weekly cold backups of registry databases).   
    2425 
    25 That issue should be resolved in some graceful manner.  Perhaps through creation of a  
    26 secondary lock file applicable to attributes that bypass the registry.  In the meantime,  
    27 the only way to insure that no updates are performed (actually, always the only way to  
    28 insure no updates are performed) is to disable updates to all directory instances  
    29 using the iPlanet console. 
     26As of 2014, all password changes and security questions are maintained in ELMO, supported by UAS IT.  EDIR cgi-bins no longer handled any aspect of this maintenance.  The need to disable directories based on locks is not applicable at this time. 
    3027 
    31 To disable directory updates regardless of source: 
     28''NOTE:''  The EDIR interface needs to be modified to drop the option to edit these fields. 
    3229 
    33         <<ssh to iplanet account on an "e" box>> 
    34         <<start admin server and console>> 
    35         <<navigate console and open a directory instance>> 
    36         <<click on configuration tab>> 
    37         <<highlight server:port line in left most frame>> 
    38         <<check Server is Read Only box in Settings tab>> 
    39         <<click Save>> 
    40         <<repeat for all "e" boxes>> 
     30== Disable Directory Updates Regardless of Source == 
     31Two methods for disabling updates were suggested historically. 
    4132 
     33=== Using the Admin Server Console === 
     34If there is a need to disable updates, follow the steps below: 
     35{{{ 
     36        1. ssh to iplanet account on an "e" box 
     37        2. start admin server and console 
     38        3. navigate console and open a directory instance 
     39        4. click on configuration tab 
     40        5. highlight server:port line in left most frame 
     41        6. check Server is Read Only box in Settings tab 
     42        7. click Save 
     43        8. repeat for all "e" boxes 
     44}}} 
    4245 
     46=== Via the EDIR/AUTHSERV Web Gatewasy === 
    4347To disable updates via the EDIR/AUTHSERV web gateways on all "e" boxes from either  
    4448iplanet or ldapgw accounts (disables all updates excepting userPassword, uakSecQuestion  
    4549and uakSecResponse): 
    4650 
    47 At this writing (2/16/2010) the iplanet-owned version of disable_updates.ksh will not work 
    48 because it looks for the all_servers configuration variable in runtime.cfg; all-servers is  
    49 defined in runtime_common.cfg.  The ldapgw-owned version of disable_updates.ksh will not 
    50 work because ldapgw cannot ssh to elfin without providing a password, which the script  
    51 requires. 
     51As of 2/16/2010, the iplanet-owned version of disable_updates.ksh did not work 
     52because it looks for the all_servers configuration variable in runtime.cfg; all-servers is 
     53defined in runtime_common.cfg. 
    5254 
    53         <<ssh to iplanet account on an "e" box>> 
     55As of 11/2014, the iplanet-owned version of disable_updates.ksh may work but has not been tested.  
     56It failed previously because ldapgw could not shell to elfin without providing a password, which the script 
     57requires. Elfin has been removed from "E" box processing in many places. 
     58 
     59If these issue are corrected, the following steps will disable updates: 
     60{{{ 
     61        <<execute 'pbrun su - iplanet'  on an "e" box>> 
    5462        $HOME/local/ldap/scripts/disable_updates.ksh test 
    5563        $HOME/local/ldap/scripts/disable_updates.ksh prep 
    5664        $HOME/local/ldap/scripts/disable_updates.ksh prod 
    57  
     65}}} 
    5866-OR- 
    59  
    60         <<ssh to ldapgw account on an "e" box>> 
     67{{{ 
     68        <<execute 'pbrun su - ldapgw' on an "e" box>> 
    6169        $HOME/local/scripts/disable_updates.ksh test 
    6270        $HOME/local/scripts/disable_updates.ksh prep 
    6371        $HOME/local/scripts/disable_updates.ksh prod 
    6472 
     73}}} 
     74 
     75== Enabling updates == 
     76 
     77The same comments regarding issues for using the disable_updates,ksh script apply to the enable_updates.ksh scripts.  Should the issues be resolved and there is a need to disable updates, the following processes would apply. 
    6578 
    6679To enable updates via the EDIR/AUTHSERV web gateway on all "e" boxes from either iplanet  
    6780or ldapgw accounts: 
    68  
    69 At this writing (2/16/2010) the enable_update scripts will not work for the same reasons as their  
    70 disable_update counterparts. 
    71  
    72         <<ssh to iplanet account on an "e" box>> 
     81{{{ 
     82        <<execute 'pbrun su - iplanet'  on an "e" box>> 
    7383        $HOME/local/ldap/scripts/enable_updates.ksh test 
    7484        $HOME/local/ldap/scripts/enable_updates.ksh prep 
    7585        $HOME/local/ldap/scripts/enable_updates.ksh prod 
    76  
     86}}} 
    7787-OR- 
    78  
    79         <<ssh to ldapgw account on an "e" box>> 
     88{{{ 
     89        <<execute 'pbrun su - ldapgw' on an "e" box>> 
    8090        $HOME/local/scripts/enable_updates.ksh test 
    8191        $HOME/local/scripts/enable_updates.ksh prep 
    8292        $HOME/local/scripts/enable_updates.ksh prod 
     93}}} 
    8394 
    84  
     95== Legacy Method for disabling Updates == 
    8596As of 10/26/2007, the process of shutting down and then starting the registry databases (RPTT, 
    8697RPTQ and RPTS) now results in EDIR/AUTHSERV updates being disabled (before database shutdown)  
    8798and then re-enabled (after database startup).  The scripts called as part of the shutdown/startup  
    8899process are these: 
    89  
    90         <<ssh to iplanet account on an "e" box>> 
     100{{{ 
     101        <<execute 'pbrun su - iplanet' on an "e" box>> 
    91102        $HOME/local/ldap/scripts/oracle_disable_updates.ksh test 
    92103        $HOME/local/ldap/scripts/oracle_disable_updates.ksh prep 
    93104        $HOME/local/ldap/scripts/oracle_disable_updates.ksh prod 
    94  
     105}}} 
    95106-OR- 
    96  
    97         <<ssh to iplanet account on an "e" box>> 
     107{{{ 
     108        <<execute 'pbrun su - iplanet' on an "e" box>> 
    98109        $HOME/local/ldap/scripts/oracle_enable_updates.ksh test 
    99110        $HOME/local/ldap/scripts/oracle_enable_updates.ksh prep 
    100111        $HOME/local/ldap/scripts/oracle_enable_updates.ksh prod 
     112}}} 
    101113 
     114''NOTE:'' 
    102115The oracle_[en|dis]able_updates.ksh script differ from the [en|dis]able_updates.ksh scripts in  
    103116that the oracle scripts will **NOT** enable updates if the disable was performed by some process  
    … …  
    106119file must removed manually or by running the enable_updates.ksh script. 
    107120 
    108 ####################### 
    109 DOCUMENT CHANGE HISTORY 
     121########################################################[[br]] 
     122LEGACY CHANGE HISTORY - NOTE: All subsequent changes are recorded in TracWiki[[br]] 
     123########################################################[[br]] 
    110124 
    111 20081028 elm    Expanded on processes for disabling updates particularly since change that  
    112                 allows userPassword, uakSecQuestion and uakSecResponse updates to bypass the  
    113                 registry. 
     12520081028 elm    Expanded on processes for disabling updates particularly since change that allows userPassword, uakSecQuestion and uakSecResponse updates to bypass the registry.[[br]] 
    11412620081031 elm    corrected typos