Trying to understand upgradeprovision

[Andrew Bartlett]

On Fri, 2013-02-15 at 21:02 +1100, Andrew Bartlett wrote:
> On Fri, 2013-02-15 at 00:50 -0800, Matthieu Patou wrote:

> The tests I did to understand the behaviour here were against alpha13,
> but the version I'm most concerned about upgrading from is 4.0.0 (and
> versions prior to that with identical/similar templates).  If we expect
> that the behaviour of the two versions will be quite different, then
> I'll add another expanded tree to the repository. 

I've now don that, in my upgradeprovision branch

> > The initial idea is that --full does *everything* that is needed, no 
> > options was more lightweight, you add also a bunch of options for the 
> > ntacls that maybe should be removed as they seems not very clear and we 
> > have a script to do it now separately, so adding --fixdsacl whould be 
> > for: do nothing but fixing the acls in the DS part.
> 
> This would be very valuable, and perhaps we might make that a dbcheck
> option?  
> 
> For clarity (and in conjunction with the question I ask above), you you
> spell out what would the difference then be between this and the
> current, default upgradeprovision behaviour?
> 
> > >>> Anyway, I include the output from those commands, in the hope that you
> > >>> can shed some light.  To reproduce, on my branch first run 'make test
> > >>> TESTS=alpha13' and the directories will be produced.
> > >> Well the results for the --full looks pretty good, just one object is
> > >> not ok (maybe a bug ?)
> > >>
> > >> Comparing:
> > >> 'CN=ARES,OU=Domain Controllers,DC=alpha13,DC=samba,DC=corp'
> > >> [st/provision/alpha13_upgrade_full/private/sam.ldb]
> > >> 'CN=ARES,OU=Domain Controllers,DC=alpha13,DC=samba,DC=corp'
> > >> [st/provision/alpha13_upgrade_reference/private/sam.ldb]
> > >>       ACEs found only in st/provision/alpha13_upgrade_full/private/sam.ldb:
> > >>           (OA;;SW;DNS-Host-Name-Attributes;;DA)
> > >>           (OA;;SW;DNS-Host-Name-Attributes;;PS)
> > >>       ACEs found only in
> > >> st/provision/alpha13_upgrade_reference/private/sam.ldb:
> > >>           (OA;;SW;Validated-DNS-Host-Name;;DA)
> > >>           (OA;;SW;Validated-DNS-Host-Name;;PS)
> > >>       FAILED
> > > Yes, the --full mode does very well, and if you re-run the tests without
> > > the --sd argument, you will see that there are only a few objects that
> > > are incorrectly upgraded from alpha13.  (in the test, we filter out the
> > > attributes so I could have a test that passed for all other objects).
> > Well It means ihmo that we have a bug in the recalculation function as 
> > if we ask the function to recalculate the SD it should do it.
> 
> I know you are busy, but are you able to look into it and fix it?

I also need you to look into the output of the expanded
samba4.blackbox.upgradeprovision.py test.  Running on a current
provision, the ldapcmp shows differences in the SD that make no sense -
no change is needed here!

* Comparing [DNSDOMAIN] context...

* Objects to be compared: 36

Comparing:
'DC=@,DC=RootDNSServers,CN=MicrosoftDNS,DC=DomainDnsZones,DC=foo,DC=example,DC=com' [tdb://./st/provision/upgradeprovision_full/private/sam.ldb]
'DC=@,DC=RootDNSServers,CN=MicrosoftDNS,DC=DomainDnsZones,DC=foo,DC=example,DC=com' [tdb://./st/provision/upgradeprovision_reference/private/sam.ldb]
    ACEs found only in
tdb://./st/provision/upgradeprovision_reference/private/sam.ldb:
        (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;LA)
    FAILED

Any thoughts on how this could happen?

Thanks,

Andrew Bartlett
-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org