diff --git a/client/man/default.conf.5 b/client/man/default.conf.5 index 177a11065..4c440530b 100644 --- a/client/man/default.conf.5 +++ b/client/man/default.conf.5 @@ -78,7 +78,7 @@ Specifies the insecure CA end user port. The default is 8080. The time to wait for a certmonger request to complete during installation. The default value is 300 seconds. .TP .B context -Specifies the context that IPA is being executed in. IPA may operate differently depending on the context. The current defined contexts are cli and server. Additionally this value is used to load /etc/ipa/\fBcontext\fR.conf to provide context\-specific configuration. For example, if you want to always perform client requests in verbose mode but do not want to have verbose enabled on the server, add the verbose option to \fI/etc/ipa/cli.conf\fR. +Specifies the context that IPA is being executed in. IPA may operate differently depending on the context. The current defined contexts are cli, server and dns. Additionally this value is used to load /etc/ipa/\fBcontext\fR.conf to provide context\-specific configuration. For example, if you want to always perform client requests in verbose mode but do not want to have verbose enabled on the server, add the verbose option to \fI/etc/ipa/cli.conf\fR. .TP .B debug When True provides detailed information. Specifically this set the global log level to "debug". Default is False. @@ -250,12 +250,20 @@ system\-wide IPA configuration file .I $HOME/.ipa/default.conf user IPA configuration file .TP -It is also possible to define context\-specific configuration files. The \fBcontext\fR is set when the IPA api is initialized. The two currently defined contexts in IPA are \fBcli\fR and \fBserver\fR. This is helpful, for example, if you only want \fBdebug\fR enabled on the server and not in the client. If this is set to True in \fIdefault.conf\fR it will affect both the ipa client tool and the IPA server. If it is only set in \fIserver.conf\fR then only the server will have \fBdebug\fR set. These files will be loaded if they exist: +It is also possible to define context\-specific configuration files. The \fBcontext\fR is set when the IPA api is initialized. The currently defined contexts in IPA are \fBcli\fR, \fBserver\fR and \fBdns\fR. This is helpful, for example, if you only want \fBdebug\fR enabled on the server and not in the client. If this is set to True in \fIdefault.conf\fR it will affect both the ipa client tool and the IPA server. If it is only set in \fIserver.conf\fR then only the server will have \fBdebug\fR set. These files will be loaded if they exist: .TP .I /etc/ipa/cli.conf system\-wide IPA client configuration file .TP .I /etc/ipa/server.conf system\-wide IPA server configuration file +.SH "EXAMPLES" +.TP +An example of a context-specific configuration file is \fB/etc/ipa/dns.conf\fR to be used to increase debug output of the IPA DNSSEC daemons. +.TP +.RS L +[global] +debug = True +.RE .SH "SEE ALSO" .BR ipa (1) diff --git a/daemons/dnssec/ipa-dnskeysync-replica.in b/daemons/dnssec/ipa-dnskeysync-replica.in index c5364a497..6e84b433c 100644 --- a/daemons/dnssec/ipa-dnskeysync-replica.in +++ b/daemons/dnssec/ipa-dnskeysync-replica.in @@ -19,6 +19,7 @@ from ipalib.constants import SOFTHSM_DNSSEC_TOKEN_LABEL from ipalib.install.kinit import kinit_keytab from ipapython.dn import DN from ipapython.ipa_log_manager import standard_logging_setup +from ipapython.ipautil import get_config_debug from ipapython import ipaldap from ipaplatform.paths import paths from ipaserver.dnssec.abshsm import (sync_pkcs11_metadata, @@ -145,7 +146,11 @@ def ldap2replica_zone_keys_sync(ldapkeydb, localhsm): # IPA framework initialization -standard_logging_setup(debug=True) +debug = get_config_debug('dns') +standard_logging_setup(debug=debug, verbose=True) +if not debug: + logger.info("To increase debugging set debug=True in dns.conf " + "See default.conf(5) for details") ipalib.api.bootstrap(context='dns', confdir=paths.ETC_IPA, in_server=True) ipalib.api.finalize() diff --git a/daemons/dnssec/ipa-dnskeysyncd.in b/daemons/dnssec/ipa-dnskeysyncd.in index 6023abdbe..91e0e43ce 100644 --- a/daemons/dnssec/ipa-dnskeysyncd.in +++ b/daemons/dnssec/ipa-dnskeysyncd.in @@ -16,6 +16,7 @@ from ipalib.install.kinit import kinit_keytab from ipapython.dn import DN from ipapython.ipa_log_manager import standard_logging_setup from ipapython import ipaldap +from ipapython.ipautil import get_config_debug from ipaplatform.paths import paths from ipaserver.dnssec.keysyncer import KeySyncer @@ -35,7 +36,11 @@ def fixup_dnssec_utils(self): fixup_dnssec_utils(paths) # IPA framework initialization -standard_logging_setup(debug=True) +debug = get_config_debug('dns') +standard_logging_setup(debug=debug, verbose=True) +if not debug: + logger.info("To increase debugging set debug=True in dns.conf " + "See default.conf(5) for details") api.bootstrap(context='dns', confdir=paths.ETC_IPA, in_server=True) api.finalize() diff --git a/daemons/dnssec/ipa-ods-exporter.in b/daemons/dnssec/ipa-ods-exporter.in index 83d17a62c..bd1704402 100644 --- a/daemons/dnssec/ipa-ods-exporter.in +++ b/daemons/dnssec/ipa-ods-exporter.in @@ -36,6 +36,7 @@ from ipalib.install.kinit import kinit_keytab from ipapython.dn import DN from ipapython.ipa_log_manager import standard_logging_setup from ipapython import ipaldap +from ipapython.ipautil import get_config_debug from ipaplatform.paths import paths from ipaserver import p11helper from ipaserver.dnssec.abshsm import sync_pkcs11_metadata, wrappingmech_name2id @@ -675,7 +676,11 @@ def cleanup_ldap_zone(ldap, dns_dn, zone_name): # IPA framework initialization -standard_logging_setup(debug=True) +debug = get_config_debug('dns') +standard_logging_setup(debug=debug, verbose=True) +if not debug: + logger.info("To increase debugging set debug=True in dns.conf " + "See default.conf(5) for details") ipalib.api.bootstrap(context='dns', confdir=paths.ETC_IPA, in_server=True) ipalib.api.finalize() diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py index b1c2c1815..3456fdc8e 100644 --- a/ipapython/ipautil.py +++ b/ipapython/ipautil.py @@ -39,6 +39,7 @@ import time import textwrap import io from contextlib import contextmanager +from configparser import RawConfigParser, ParsingError import locale import collections import urllib @@ -1757,3 +1758,41 @@ class Sleeper: dur = min(self.deadline - now, self.sleep) time.sleep(dur) return True + + +def get_config_debug(context): + """A simplified version of ipalib/config in order to determine if the + API should be bootstrapped in debug mode or not. + + A number of daemons setup logging, then bootstrap the API in order + to capture the startup. This presents a chicken-and-egg problem + over debug output. + + Debug is rather spammy and probably shouldn't be enabled by default + but if some problem is occuring during startup we want a way to + see that. + + So use this limited function to pluck out the debug value out of + the system context config file (in_tree is not supported, another + chicken-and-egg). + + This isn't more generalized for two reasons: + 1. There is currently only a need for 'debug' + 2. Type conversion. They will all be strings. + """ + CONFIG_SECTION = 'global' # duplicated from ipalib.constants + config_file = os.path.join('/', 'etc', 'ipa', '%s.conf' % context) + + parser = RawConfigParser() + try: + parser.read(config_file) + except ParsingError: + return False + + if not parser.has_section(CONFIG_SECTION): + return False + + if not parser.has_option(CONFIG_SECTION, 'debug'): + return False + + return parser.get(CONFIG_SECTION, 'debug').lower() == 'true'