Fix Bug 1809273 - CRL generation performs an unindexed search.

[jmagne]

Implemented with a modification to a CLI command, also calls this command from pkispawn to take care of new instances:

Example use of standalone command:

Which will work if the indexes in question have not been created already.

pki-server ca-db-upgrade --verbose --action update-vlv-indexes --vlv-file crlcaissuer.ldif --vlv-tasks-file crlcaissuertasks.ldif --issuer-dn "CN=CA Signing Certificate,OU=pki-tomcat,O=localhost.localdomain Security Domain"

[edewata]

@frasertweedale You might want to take a look at this as well since this is related to LWCA in PKI 10.9.

[edewata]

I think it's good that we can get this working as a standalone CLI (instead of as part of installation). However, I just remembered we already have something similar for KRA and TPS:

• https://www.dogtagpki.org/wiki/PKI_Server_KRA_CLI
• https://www.dogtagpki.org/wiki/PKI_Server_TPS_CLI

So KRA and TPS have several general purpose CLIs that can also be used to upgrade the database:

• pki-server kra/tps-db-vlv-find for listing existing VLVs
• pki-server kra/tps-db-vlv-add for creating VLVs defined in a file
• pki-server kra/tps-db-vlv-reindex for running the VLV reindex task
• pki-server kra/tps-db-vlv-del for deleting existing VLVs

The problem is they are currently broken since Python OpenLDAP library does not support NSS anymore so they need to be rewritten in Java.

I think it would be better if we break apart the current patch into a set of CA CLIs like above instead of adding everything into pki-server ca-db-upgrade. Later we probably can reuse the code to replace the broken KRA/TPS CLIs above.

[edewata]

This should be --issuer-dn.

[cipherboy]

So... I think we need something more general. I don't fully know what all vlv indices do -- but I think we need something more extensive than just vlv indices.

I think it is in two parts:

• Check if migration needs to happen
• Code to do the migration

Not every migration will be cheap (computationally, ...) -- I agree Java would be a good idea. Mine is really easy, we're just adding a new object if it doesn't already exist. But we might in the future want something more advanced like scanning certs in the database and adding them to a new index. Maybe that can be done with VLV indices, idk.

I think we also want to be able to run some as part of server startup (add TPS auditor group should be really cheap) and others we want to be run manually... Using ldapjdk (if possible) I think would be best -- then we can use the existing LDAP credentials when possible.

shrugs