Suppose two PKI subsystems are deployed using a shared DS backend, the LDAP entries of the second subsystem may be created in the wrong backend. The indexes, however, are still created in the correct backend, meaning the LDAP entries of the second subsystem are not indexed.

Steps to reproduce:

1. Create DS instance with suffix dc=example,dc=com. By default the suffix is mapped to userRoot backend.

2. Deploy CA with the following parameters:

pki_ds_base_dn=dc=ca,dc=example,dc=com
pki_ds_database=shared
pki_ds_create_new_db=True

1. Deploy KRA with the following parameters:

pki_ds_base_dn=dc=kra,dc=example,dc=com
pki_ds_database=shared
pki_ds_create_new_db=False

1. Check the mapping entries in the DS:

$ ldapsearch -x -D "cn=Directory Manager" -w Secret123 -b "cn=mapping tree,cn=config" -s one

Actual result: There are only 2 mapping entries:

• dc=ca,dc=example,dc=com -> shared
• dc=example,dc=com -> userRoot

This means the dc=kra,dc=example,dc=com entries are stored in userRoot.

Expected result: There should be an additional mapping entry:

• dc=kra,dc=example,dc=com -> shared

Proposed solution: The installation tool needs to be fixed such that it creates a mapping entry for the second subsystem sharing the same backend. There should be a database upgrade script/procedure to move the LDAP entries to the correct backend.