[freeipa PR#5256][opened] Handle multiple AJP adapters during upgrade

[cipherboy]

   URL: https://github.com/freeipa/freeipa/pull/5256
Author: cipherboy
 Title: #5256: Handle multiple AJP adapters during upgrade
Action: opened

PR body:
"""
In this patch, we ensure we upgrade all AJP adapters with the same
secret value if any are missing. This ensures that both IPv4 and IPv6
adapters have the same secret value, so whichever httpd connects to
will be in sync. This is consistent with what Dogtag does when
provisioning them.

Notably missing from this patch is handling of multiple unrelated AJP
adapters. In an IPA scenario (and default PKI scenario) this shouldn't
be necessary. However, with external load balancing, this might happen.

This patch benefits IPA in the scenario when:

 1. `pkispawn` runs on an older PKI version (pre-AJP secret, so ~8.2?)
 2. pki gets upgraded to 10.10.1 before IPA can provision a secret,
    resulting in split IPv4/IPv6 adapters -- this would only happen
    on a direct migration from 8.2 -> 8.4
 3. ipa upgrade script then runs to provision an AJP secret value for
    use with both Dogtag and IPA.

Without this patch, only the first (IPv4) adapter would have a secret
value provisioned in the above scenario.

`Signed-off-by: Alexander Scheel <ascheel(a)redhat.com&gt;`


---


Is this scenario likely? Or will IPA have provisioned a secret anyway on older PKI
versions? I do not know. 
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5256/head:pr5256
git checkout pr5256

[freeipa PR#5256][closed] Handle multiple AJP adapters during upgrade

[flo-renaud]

   URL: https://github.com/freeipa/freeipa/pull/5256
Author: cipherboy
 Title: #5256: Handle multiple AJP adapters during upgrade
Action: closed

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5256/head:pr5256
git checkout pr5256