IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-01-26 16:16:31 -06:00
Code Issues Packages Projects Releases Wiki Activity

Make the path to CS.cfg a class variable

Browse Source 
Rather than passing around the path to CS.cfg for the CA and KRA
set it at object creation and use everywhere.

Make update_cert_config() a real class method instead of a static
method. It wasn't being called that way in any case and makes it
possible to use the class config file.

Related: https://pagure.io/freeipa/issue/6703

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
This commit is contained in:
Rob Crittenden 2017-11-08 13:21:22 -05:00 committed by Christian Heimes
parent 1059a24d2a
commit 10a847b682
5 changed files with 45 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ipaserver/install/ca.py
View File

@ -336,7 +336,7 @@ def install_step_1(standalone, replica_config, options):
ca.stop('pki-tomcat')
# This is done within stopped_service context, which restarts CA
ca.enable_client_auth_to_db(paths.CA_CS_CFG_PATH)
ca.enable_client_auth_to_db()
# Lightweight CA key retrieval is configured in step 1 instead
# of CAInstance.configure_instance (which is invoked from step

17
ipaserver/install/cainstance.py
View File

@ -304,6 +304,7 @@ class CAInstance(DogtagInstance):
service_desc="certificate server",
host_name=host_name,
service_prefix=ipalib.constants.PKI_GSSAPI_SERVICE_NAME,
config=paths.CA_CS_CFG_PATH,
)
# for external CAs
@ -677,12 +678,12 @@ class CAInstance(DogtagInstance):
def __disable_nonce(self):
# Turn off Nonces
update_result = installutils.update_file(
paths.CA_CS_CFG_PATH, 'ca.enableNonces=true',
self.config, 'ca.enableNonces=true',
'ca.enableNonces=false')
if update_result != 0:
raise RuntimeError("Disabling nonces failed")
pent = pwd.getpwnam(self.service_user)
os.chown(paths.CA_CS_CFG_PATH, pent.pw_uid, pent.pw_gid)
os.chown(self.config, pent.pw_uid, pent.pw_gid)
def enable_pkix(self):
installutils.set_directive(paths.SYSCONFIG_PKI_TOMCAT,
@ -928,8 +929,7 @@ class CAInstance(DogtagInstance):
https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Certificate_System/8.0/html/Admin_Guide/Setting_up_Publishing.html
"""
with installutils.DirectiveSetter(paths.CA_CS_CFG_PATH,
with installutils.DirectiveSetter(self.config,
quotes=False, separator='=') as ds:
# Enable file publishing, disable LDAP
@ -1160,8 +1160,7 @@ class CAInstance(DogtagInstance):
master_entry['ipaConfigString'].append('caRenewalMaster')
api.Backend.ldap2.update_entry(master_entry)
@staticmethod
def update_cert_config(nickname, cert):
def update_cert_config(self, nickname, cert):
"""
When renewing a CA subsystem certificate the configuration file
needs to get the new certificate as well.
@ -1183,8 +1182,8 @@ class CAInstance(DogtagInstance):
syslog.syslog(syslog.LOG_ERR, "Failed to backup CS.cfg: %s" % e)
if nickname in directives:
DogtagInstance.update_cert_cs_cfg(
directives[nickname], cert, paths.CA_CS_CFG_PATH)
super(CAInstance, self).update_cert_cs_cfg(
directives[nickname], cert)
def __create_ds_db(self):
'''
@ -1251,7 +1250,7 @@ class CAInstance(DogtagInstance):
]
for k, v in directives:
installutils.set_directive(
paths.CA_CS_CFG_PATH, k, v, quotes=False, separator='=')
self.config, k, v, quotes=False, separator='=')
sysupgrade.set_upgrade_state('dogtag', 'setup_lwca_key_retieval', True)

32
ipaserver/install/dogtaginstance.py
View File

@ -89,7 +89,8 @@ class DogtagInstance(service.Service):
server_cert_name = None
def __init__(self, realm, subsystem, service_desc, host_name=None,
nss_db=paths.PKI_TOMCAT_ALIAS_DIR, service_prefix=None):
nss_db=paths.PKI_TOMCAT_ALIAS_DIR, service_prefix=None,
config=None):
"""Initializer"""
super(DogtagInstance, self).__init__(
@ -118,6 +119,7 @@ class DogtagInstance(service.Service):
self.master_replication_port = None
self.subject_base = None
self.nss_db = nss_db
self.config = config # Path to CS.cfg
def is_installed(self):
"""
@ -172,44 +174,43 @@ class DogtagInstance(service.Service):
"Failed to stop the Dogtag instance."
"See the installation log for details.")
def enable_client_auth_to_db(self, config):
def enable_client_auth_to_db(self):
"""
Enable client auth connection to the internal db.
Path to CS.cfg config file passed in.
"""
with stopped_service('pki-tomcatd', 'pki-tomcat'):
installutils.set_directive(
config,
self.config,
'authz.instance.DirAclAuthz.ldap.ldapauth.authtype',
'SslClientAuth', quotes=False, separator='=')
installutils.set_directive(
config,
self.config,
'authz.instance.DirAclAuthz.ldap.ldapauth.clientCertNickname',
'subsystemCert cert-pki-ca', quotes=False, separator='=')
installutils.set_directive(
config,
self.config,
'authz.instance.DirAclAuthz.ldap.ldapconn.port', '636',
quotes=False, separator='=')
installutils.set_directive(
config,
self.config,
'authz.instance.DirAclAuthz.ldap.ldapconn.secureConn',
'true', quotes=False, separator='=')
installutils.set_directive(
config,
self.config,
'internaldb.ldapauth.authtype',
'SslClientAuth', quotes=False, separator='=')
installutils.set_directive(
config,
self.config,
'internaldb.ldapauth.clientCertNickname',
'subsystemCert cert-pki-ca', quotes=False, separator='=')
installutils.set_directive(
config,
self.config,
'internaldb.ldapconn.port', '636', quotes=False, separator='=')
installutils.set_directive(
config,
self.config,
'internaldb.ldapconn.secureConn', 'true', quotes=False,
separator='=')
# Remove internaldb password as is not needed anymore
@ -338,8 +339,7 @@ class DogtagInstance(service.Service):
if stop_certmonger:
cmonger.stop()
@staticmethod
def update_cert_cs_cfg(directive, cert, cs_cfg):
def update_cert_cs_cfg(self, directive, cert):
"""
When renewing a Dogtag subsystem certificate the configuration file
needs to get the new certificate as well.
@ -351,7 +351,7 @@ class DogtagInstance(service.Service):
with stopped_service('pki-tomcatd', 'pki-tomcat'):
installutils.set_directive(
cs_cfg,
self.config,
directive,
# the cert must be only the base64 string without headers
(base64.b64encode(cert.public_bytes(x509.Encoding.DER))
@ -455,6 +455,10 @@ class DogtagInstance(service.Service):
api.Backend.ldap2.delete_entry(self.admin_dn)
def _use_ldaps_during_spawn(self, config, ds_cacert=paths.IPA_CA_CRT):
"""
config is a RawConfigParser object
cs_cacert is path to a PEM CA certificate
"""
config.set(self.subsystem, "pki_ds_ldaps_port", "636")
config.set(self.subsystem, "pki_ds_secure_connection", "True")
config.set(self.subsystem, "pki_ds_secure_connection_ca_pem_file",

2
ipaserver/install/kra.py
View File

@ -125,7 +125,7 @@ def install(api, replica_config, options):
_service.print_msg("Restarting the directory server")
ds = dsinstance.DsInstance()
ds.restart()
kra.enable_client_auth_to_db(paths.KRA_CS_CFG_PATH)
kra.enable_client_auth_to_db()
# Restart apache for new proxy config file
services.knownservices.httpd.restart(capture_output=True)

21
ipaserver/install/krainstance.py
View File

@ -71,6 +71,7 @@ class KRAInstance(DogtagInstance):
realm=realm,
subsystem="KRA",
service_desc="KRA server",
config=paths.KRA_CS_CFG_PATH,
)
self.basedn = DN(('o', 'kra'), ('o', 'ipaca'))
@ -352,8 +353,20 @@ class KRAInstance(DogtagInstance):
sub_dict=sub_dict)
ld.update([os.path.join(paths.UPDATES_DIR, '40-vault.update')])
@staticmethod
def update_cert_config(nickname, cert):
def enable_ephemeral(self):
"""
Enable ephemeral KRA requests to reduce the number of LDAP
write operations.
"""
with installutils.stopped_service('pki-tomcatd', 'pki-tomcat'):
installutils.set_directive(
self.config,
'kra.ephemeralRequests',
'true', quotes=False, separator='=')
# A restart is required
def update_cert_config(self, nickname, cert):
"""
When renewing a KRA subsystem certificate the configuration file
needs to get the new certificate as well.
@ -371,8 +384,8 @@ class KRAInstance(DogtagInstance):
'Server-Cert cert-pki-ca': 'kra.sslserver.cert'}
if nickname in directives:
DogtagInstance.update_cert_cs_cfg(
directives[nickname], cert, paths.KRA_CS_CFG_PATH)
super(KRAInstance, self).update_cert_cs_cfg(
directives[nickname], cert)
def __enable_instance(self):
self.ldap_enable('KRA', self.fqdn, None, self.suffix)