IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

install: request service certs after host keytab is set up

Browse Source 
The certmonger renew agent and restart scripts use host keytab for
authentication. When they are executed during a certmonger request before
the host keytab is set up, the authentication will fail.

Make sure all certmonger requests in the installer are done after the host
keytab is set up.

https://pagure.io/freeipa/issue/6757

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
This commit is contained in:
Jan Cholasta
2017-04-07 07:44:21 +02:00
committed by Martin Babinsky
parent ec52332229
commit 181cb94e74
3 changed files with 16 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
ipaserver/install/server/install.py
View File

@@ -770,6 +770,13 @@ def install(installer):
realm_name, host_name, domain_name, dm_password,
options.subject_base, options.ca_subject, 1101, 1100, None)
krb = krbinstance.KrbInstance(fstore)
krb.create_instance(realm_name, host_name, domain_name,
dm_password, master_password,
setup_pkinit=not options.no_pkinit,
pkcs12_info=pkinit_pkcs12_info,
subject_base=options.subject_base)
if setup_ca:
if not options.external_cert_files and options.external_ca:
# stage 1 of external CA installation
@@ -793,17 +800,6 @@ def install(installer):
# we now need to enable ssl on the ds
ds.enable_ssl()
krb = krbinstance.KrbInstance(fstore)
krb.create_instance(realm_name, host_name, domain_name,
dm_password, master_password,
setup_pkinit=not options.no_pkinit,
pkcs12_info=pkinit_pkcs12_info,
subject_base=options.subject_base)
# restart DS to enable ipa-pwd-extop plugin
print("Restarting directory server to enable password extension plugin")
ds.restart()
if setup_ca:
ca.install_step_1(False, None, options)