14.3. Upgrading the KRA database

To update the key recovery authority (KRA) database:
  1. Upgrade the database indexes: 
    # ldapmodify -D "cn=Directory Manager" -W -h server.example.com -p 389 -x
dn: cn=realm,cn=index,cn=KRA_database_name,cn=ldbm database,
 cn=plugins,cn=config
changetype: add
objectClass: top
objectClass: nsIndex
nsindexType: eq
nsindexType: pres
nsSystemindex: false
cn: realm
  2. Add the realm attribute: 
    # ldapmodify -D "cn=Directory Manager" -W -h server.example.com -p 389 -x
dn: cn=schema
changetype: modify
add: attributeTypes
attributeTypes: ( realm-oid NAME 'realm' DESC 'CMS defined attribute'
 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )

delete: objectClasses
objectClasses: ( request-oid NAME 'request' DESC 'CMS defined class'
 SUP top STRUCTURAL MUST cn MAY ( requestId $ dateOfCreate $
 dateOfModify $ requestState $ requestResult $ requestOwner $
 requestAgentGroup $ requestSourceId $ requestType $ requestFlag $
 requestError $ userMessages $ adminMessages ) X-ORIGIN 'user defined' )

add: objectClasses
 objectClasses: ( request-oid NAME 'request' DESC 'CMS defined class'
 SUP top STRUCTURAL MUST cn MAY ( requestId $ dateOfCreate $
 dateOfModify $ requestState $ requestResult $ requestOwner $
 requestAgentGroup $ requestSourceId $ requestType $ requestFlag $
 requestError $ userMessages $ adminMessages $ realm ) X-ORIGIN 'user
 defined' )

delete: objectClasses
objectClasses: ( keyRecord-oid NAME 'keyRecord' DESC 'CMS defined
 class' SUP top STRUCTURAL MUST cn MAY ( serialno $ dateOfCreate $
 dateOfModify $ keyState $ privateKeyData $ ownerName $ keySize $
 metaInfo $ dateOfArchival $ dateOfRecovery $ algorithm $
 publicKeyFormat $ publicKeyData $ archivedBy $ clientId $ dataType $
 status ) X-ORIGIN 'user defined' )

add: objectClasses
objectClasses: ( keyRecord-oid NAME 'keyRecord' DESC 'CMS defined
 class' SUP top STRUCTURAL MUST cn MAY ( serialno $ dateOfCreate $
 dateOfModify $ keyState $ privateKeyData $ ownerName $ keySize $
 metaInfo $ dateOfArchival $ dateOfRecovery $ algorithm $
 publicKeyFormat $ publicKeyData $ archivedBy $ clientId $ dataType $
 status $ realm ) X-ORIGIN 'user defined' )
  3. Update and re-index the virtual list views (VLV):
    1. Delete the existing indexes: 
      # pki-server kra-db-vlv-del -i CS_instance_name -D DS_bind_DN \
     -w DS_bind_password
    2. Add the new indexes: 
      # pki-server kra-db-vlv-add -i CS_instance_name -D DS_bind_DN \
     -w DS_bind_password
    3. Restart the Directory Server instance: 
      # systemctl restart dirsrv@DS_instance_name
    4. Re-index the database: 
      # pki-server kra-db-vlv-reindex -i CS_instance_name -D DS_bind_DN \
     -w DS_bind_password