IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Execute pki proxy setup when server is upgraded if needed

Browse Source
This commit is contained in:
Adam Young 2011-10-06 20:37:18 -04:00 committed by Rob Crittenden
parent f3ca0618c2
commit 12cc78caf6
1 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
install/tools/ipa-upgradeconfig
View File

@ -25,7 +25,10 @@ Upgrade configuration files to a newer template.
import sys import sys
try: try:
from ipapython import ipautil from ipapython import ipautil, sysrestore
from ipaserver.install import installutils
from ipaserver.install import dsinstance
from ipaserver.install import httpinstance
import krbV import krbV
import re import re
import os import os
@ -135,6 +138,22 @@ def check_certs():
print "Missing Certification Authority file." print "Missing Certification Authority file."
print "You should place a copy of the CA certificate in /usr/share/ipa/html/ca.crt" print "You should place a copy of the CA certificate in /usr/share/ipa/html/ca.crt"
def upgrade_pki():
"""
Update/add the dogtag proxy configuration. The IPA side of this is
handled in ipa-pki-proxy.conf.
This requires enabling SSL renegotiation.
"""
fstore = sysrestore.FileStore('/var/lib/ipa/sysrestore')
http = httpinstance.HTTPInstance(fstore)
http.enable_mod_nss_renegotiate()
if not installutils.get_directive('/etc/pki-ca/CS.cfg',
'proxy.securePort', '=') and \
os.path.exists('/usr/bin/pki-setup-proxy'):
ipautil.run(['/usr/bin/pki-setup-proxy', '-pki_instance_root=/var/lib'
,'-pki_instance_name=pki-ca','-subsystem_type=ca'])
def main(): def main():
""" """
Get some basics about the system. If getting those basics fail then Get some basics about the system. If getting those basics fail then
@ -162,7 +181,7 @@ def main():
upgrade(sub_dict, "/etc/httpd/conf.d/ipa.conf", ipautil.SHARE_DIR + "ipa.conf") upgrade(sub_dict, "/etc/httpd/conf.d/ipa.conf", ipautil.SHARE_DIR + "ipa.conf")
upgrade(sub_dict, "/etc/httpd/conf.d/ipa-rewrite.conf", ipautil.SHARE_DIR + "ipa-rewrite.conf") upgrade(sub_dict, "/etc/httpd/conf.d/ipa-rewrite.conf", ipautil.SHARE_DIR + "ipa-rewrite.conf")
upgrade(sub_dict, "/etc/httpd/conf.d/ipa-pki-proxy.conf", ipautil.SHARE_DIR + "ipa-pki-proxy.conf", add=True) upgrade(sub_dict, "/etc/httpd/conf.d/ipa-pki-proxy.conf", ipautil.SHARE_DIR + "ipa-pki-proxy.conf", add=True)
upgrade_pki()
try: try:
if __name__ == "__main__": if __name__ == "__main__":
sys.exit(main()) sys.exit(main())