22 Jan
2016
22 Jan
'16
5:10 p.m.
Module: check_mk
Branch: master
Commit: 77c71adb65c268ca28981cd4d846e09a5f419d19
URL:
http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=77c71adb65c268…
Author: Lars Michelsen <lm(a)mathias-kettner.de>
Date: Fri Jan 22 17:10:30 2016 +0100
#2947 FIX LDAP: Simplified automatic sync logic
By default once an LDAP connection has been configured the LDAP synchronization
was performed automatically in background in different situations:
<ul>
<li>During regular page processing (every 5 minutes)</li>
<li>When opening the users configuration page</li>
<li>Before activating the changed configuration</li>
<li>On a remote site, when it receives a new configuration</li>
</ul>
This was configuable using the config option <i>Automatic User
Synchronization</i>.
One problem with the default configuration was that it enabled the
sync also for slave sites in distributed environments. Having the
sync enabled on a slave site a change in LDAP would trigger a change
on the slave site which is then preventing further activating of
changes from the master. One had to drop this change entry manually
to solve this situation.
Another problem was that such LDAP sync was executed in some kind
of random way when any HTTP request could trigger it. This felt odd
in cases where the LDAP sync could take a longer time when for example
saving of a view took 50 seconds instead of less than one second.
The sync during activating of the configuration was slowing down the
workflow when the sync took longer.
So we decided to change the automatic user synchronization to work
this way now:
It is now scheduled by the generic multisite cron job which is executed
once a minute. The LDAP sync then triggered and starts when the previous
synchronization has finished more than 5 minutes before. This interval
can still be configured for each LDAP connection.
The new default configuration is that the automatic LDAP synchronization
is performed only on the master site in distributed setups. But you can
change the option <i>Automatic User Synchronization</i> to either <i>On
all sites</i> to make it be executed on all your sites or completely
disable the automatic synchronization.
You have the option to change this setting for individual sites using
the site specific global settings.
Once at least one LDAP connection is configured the <i>Sync Users</i>
button is shown on the users page. It can be used to trigger the
user synchronization manually.
---
.werks/2947 | 56 ++++++++++++++++
ChangeLog | 1 +
web/htdocs/index.py | 10 +--
web/htdocs/userdb.py | 71 ++++++++++++++++++---
web/htdocs/wato.py | 20 +++---
web/plugins/config/builtin.py | 2 +-
web/plugins/{wato/userdb.py => cron/user_sync.py} | 14 +---
web/plugins/userdb/ldap.py | 4 +-
web/plugins/wato/check_mk_configuration.py | 31 ++++-----
9 files changed, 148 insertions(+), 61 deletions(-)
Diff:
http://git.mathias-kettner.de/git/?p=check_mk.git;a=commitdiff;h=77c71adb65…