14.3. Upgrading the KRA database

To update the key recovery authority (KRA) database:
  1. Upgrade the database indexes:
    # ldapmodify -D "cn=Directory Manager" -W -h server.example.com -p 389 -x
    dn: cn=realm,cn=index,cn=KRA_database_name,cn=ldbm database,
     cn=plugins,cn=config
    changetype: add
    objectClass: top
    objectClass: nsIndex
    nsindexType: eq
    nsindexType: pres
    nsSystemindex: false
    cn: realm
  2. Add the realm attribute:
    # ldapmodify -D "cn=Directory Manager" -W -h server.example.com -p 389 -x
    dn: cn=schema
    changetype: modify
    add: attributeTypes
    attributeTypes: ( realm-oid NAME 'realm' DESC 'CMS defined attribute'
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
    
    delete: objectClasses
    objectClasses: ( request-oid NAME 'request' DESC 'CMS defined class'
     SUP top STRUCTURAL MUST cn MAY ( requestId $ dateOfCreate $
     dateOfModify $ requestState $ requestResult $ requestOwner $
     requestAgentGroup $ requestSourceId $ requestType $ requestFlag $
     requestError $ userMessages $ adminMessages ) X-ORIGIN 'user defined' )
    
    add: objectClasses
     objectClasses: ( request-oid NAME 'request' DESC 'CMS defined class'
     SUP top STRUCTURAL MUST cn MAY ( requestId $ dateOfCreate $
     dateOfModify $ requestState $ requestResult $ requestOwner $
     requestAgentGroup $ requestSourceId $ requestType $ requestFlag $
     requestError $ userMessages $ adminMessages $ realm ) X-ORIGIN 'user
     defined' )
    
    delete: objectClasses
    objectClasses: ( keyRecord-oid NAME 'keyRecord' DESC 'CMS defined
     class' SUP top STRUCTURAL MUST cn MAY ( serialno $ dateOfCreate $
     dateOfModify $ keyState $ privateKeyData $ ownerName $ keySize $
     metaInfo $ dateOfArchival $ dateOfRecovery $ algorithm $
     publicKeyFormat $ publicKeyData $ archivedBy $ clientId $ dataType $
     status ) X-ORIGIN 'user defined' )
    
    add: objectClasses
    objectClasses: ( keyRecord-oid NAME 'keyRecord' DESC 'CMS defined
     class' SUP top STRUCTURAL MUST cn MAY ( serialno $ dateOfCreate $
     dateOfModify $ keyState $ privateKeyData $ ownerName $ keySize $
     metaInfo $ dateOfArchival $ dateOfRecovery $ algorithm $
     publicKeyFormat $ publicKeyData $ archivedBy $ clientId $ dataType $
     status $ realm ) X-ORIGIN 'user defined' )
  3. Update and re-index the virtual list views (VLV):
    1. Delete the existing indexes:
      # pki-server kra-db-vlv-del -i CS_instance_name -D DS_bind_DN \
           -w DS_bind_password
    2. Add the new indexes:
      # pki-server kra-db-vlv-add -i CS_instance_name -D DS_bind_DN \
           -w DS_bind_password
    3. Restart the Directory Server instance:
      # systemctl restart dirsrv@DS_instance_name
    4. Re-index the database:
      # pki-server kra-db-vlv-reindex -i CS_instance_name -D DS_bind_DN \
           -w DS_bind_password