Changes to use a single database for dogtag and IPA

New servers that are installed with dogtag 10 instances will use a single database instance for dogtag and IPA, albeit with different suffixes. Dogtag will communicate with the instance through a database user with permissions to modify the dogtag suffix only. This user will authenticate using client auth using the subsystem cert for the instance. This patch includes changes to allow the creation of masters and clones with single ds instances.
2025-02-25 18:55:28 -06:00 · 2012-09-19 23:35:42 -04:00
parent 7960b5c67f
commit 18a210996d
14 changed files with 251 additions and 115 deletions
--- a/ipaserver/install/cainstance.py
+++ b/ipaserver/install/cainstance.py
@@ -60,10 +60,10 @@ from ipalib import util
 from ipapython.ipa_log_manager import *

 HTTPD_CONFD = "/etc/httpd/conf.d/"
-DEFAULT_DSPORT=7389
+DEFAULT_DSPORT = dogtag.install_constants.DS_PORT

 PKI_USER = "pkiuser"
-PKI_DS_USER = "pkisrv"
+PKI_DS_USER = dogtag.install_constants.DS_USER


 # We need to reset the template because the CA uses the regular boot
@@ -232,6 +232,17 @@ def get_crl_files(path=None):
        elif f.endswith(".der"):
            yield os.path.join(path, f)

+
+def is_step_one_done():
+    '''Read CS.cfg and determine if step one of an external CA install is done
+    '''
+    test = installutils.get_directive(
+        dogtag.install_constants.CS_CFG_PATH, 'preop.ca.type', '=')
+    if test == "otherca":
+        return True
+    return False
+
+
 class CADSInstance(service.Service):
    def __init__(self, host_name=None, realm_name=None, domain_name=None, dm_password=None, dogtag_constants=None):
        service.Service.__init__(self, "pkids",
@@ -518,6 +529,7 @@ class CAInstance(service.Service):
                           admin_password, ds_port=DEFAULT_DSPORT,
                           pkcs12_info=None, master_host=None, csr_file=None,
                           cert_file=None, cert_chain_file=None,
+                           master_replication_port=None,
                           subject_base=None):
        """Create a CA instance.

@@ -538,6 +550,7 @@ class CAInstance(service.Service):
        if self.pkcs12_info is not None:
            self.clone = True
        self.master_host = master_host
+        self.master_replication_port = master_replication_port
        if subject_base is None:
            self.subject_base = DN(('O', self.realm))
        else:
@@ -656,7 +669,11 @@ class CAInstance(service.Service):
                "pki_security_domain_user": "admin",
                "pki_security_domain_password": self.admin_password,
                "pki_clone_replication_security": "TLS",
-                "pki_clone_uri": \
+                "pki_clone_replication_master_port":
+                    str(self.master_replication_port),
+                "pki_clone_replication_clone_port":
+                    dogtag.install_constants.DS_PORT,
+                "pki_clone_uri":
                    "https://%s" % ipautil.format_netloc(self.master_host, 443)
            }
            replacevars.update(clone_vars)
@@ -839,6 +856,8 @@ class CAInstance(service.Service):
                args.append("admin")
                args.append("-sd_admin_password")
                args.append(self.admin_password)
+                args.append("-clone_master_port")
+                args.append(str(self.master_replication_port))
                args.append("-clone_start_tls")
                args.append("true")
                args.append("-clone_uri")
@@ -1275,6 +1294,43 @@ class CAInstance(service.Service):
                'OU=pki-ipa, O=IPA', str(self.subject_base)):
            print "Updating subject_base in CA template failed"

+    def enable_client_auth_to_db(self):
+        """
+        Enable client auth connection to the internal db.
+        """
+        caconfig = dogtag.install_constants.CS_CFG_PATH
+
+        # Enable file publishing, disable LDAP
+        installutils.set_directive(caconfig,
+            'authz.instance.DirAclAuthz.ldap.ldapauth.authtype',
+            'SslClientAuth', quotes=False, separator='=')
+        installutils.set_directive(caconfig,
+            'authz.instance.DirAclAuthz.ldap.ldapauth.bindDN',
+            'uid=pkidbuser,ou=people,o=ipa-ca', quotes=False, separator='=')
+        installutils.set_directive(caconfig,
+            'authz.instance.DirAclAuthz.ldap.ldapauth.clientCertNickname',
+            'subsystemCert cert-pki-ca', quotes=False, separator='=')
+        installutils.set_directive(caconfig,
+            'authz.instance.DirAclAuthz.ldap.ldapconn.port',
+            str(dogtag.install_constants.DS_SECURE_PORT),
+            quotes=False, separator='=')
+        installutils.set_directive(caconfig,
+            'authz.instance.DirAclAuthz.ldap.ldapconn.secureConn',
+            'true', quotes=False, separator='=')
+
+        installutils.set_directive(caconfig, 'internaldb.ldapauth.authtype',
+            'SslClientAuth', quotes=False, separator='=')
+        installutils.set_directive(caconfig, 'internaldb.ldapauth.bindDN',
+            'uid=pkidbuser,ou=people,o=ipa-ca', quotes=False, separator='=')
+        installutils.set_directive(caconfig,
+            'internaldb.ldapauth.clientCertNickname',
+            'subsystemCert cert-pki-ca', quotes=False, separator='=')
+        installutils.set_directive(caconfig, 'internaldb.ldapconn.port',
+            str(dogtag.install_constants.DS_SECURE_PORT),
+            quotes=False, separator='=')
+        installutils.set_directive(caconfig, 'internaldb.ldapconn.secureConn',
+            'true', quotes=False, separator='=')
+
    def uninstall(self):
        if self.is_configured():
            self.print_msg("Unconfiguring CA")
@@ -1501,7 +1557,7 @@ class CAInstance(service.Service):

        return master == 'New'

-def install_replica_ca(config, postinstall=False):
+def install_replica_ca(config, master_ds_port, postinstall=False):
    """
    Install a CA on a replica.

@@ -1539,13 +1595,18 @@ def install_replica_ca(config, postinstall=False):
    if ipautil.file_exists(config.dir + "/dogtagcert.p12"):
        pkcs12_info = (config.dir + "/dogtagcert.p12",
                       config.dir + "/dirsrv_pin.txt")
-    cs = CADSInstance(dogtag_constants=dogtag.install_constants)
-    cs.create_instance(config.realm_name, config.host_name,
-                       config.domain_name, config.dirman_password,
-                       pkcs12_info)
-    cs.load_pkcs12()
-    cs.enable_ssl()
-    cs.restart_instance()
+
+    if not dogtag.install_constants.SHARED_DB:
+        cs = CADSInstance(dogtag_constants=dogtag.install_constants)
+        cs.create_instance(config.realm_name, config.host_name,
+                           config.domain_name, config.dirman_password,
+                           pkcs12_info)
+        cs.load_pkcs12()
+        cs.enable_ssl()
+        cs.restart_instance()
+    else:
+        cs = None
+
    ca = CAInstance(config.realm_name, certs.NSS_DIR,
            dogtag_constants=dogtag.install_constants)
    if postinstall:
@@ -1555,6 +1616,7 @@ def install_replica_ca(config, postinstall=False):
    ca.configure_instance(config.host_name, config.dirman_password,
                          config.dirman_password, pkcs12_info=(cafile,),
                          master_host=config.master_host_name,
+                          master_replication_port=master_ds_port,
                          subject_base=config.subject_base)

    if postinstall:
@@ -1573,8 +1635,14 @@ def install_replica_ca(config, postinstall=False):

    service.print_msg("Restarting the directory and certificate servers")
    ca.stop(dogtag.install_constants.PKI_INSTANCE_NAME)
-    ipaservices.knownservices.dirsrv.stop("PKI-IPA")
-    ipaservices.knownservices.dirsrv.start("PKI-IPA")
+
+    if not dogtag.install_constants.SHARED_DB:
+        ds_name = dogtag.install_constants.DS_NAME
+        ipaservices.knownservices.dirsrv.stop(ds_name)
+        ipaservices.knownservices.dirsrv.start(ds_name)
+    else:
+        ipaservices.knownservices.dirsrv.restart()
+
    ca.start(dogtag.install_constants.PKI_INSTANCE_NAME)

    return (ca, cs)
@@ -1592,7 +1660,7 @@ def update_cert_config(nickname, cert):
                  'ocspSigningCert cert-pki-ca': 'ca.ocsp_signing.cert',
                  'caSigningCert cert-pki-ca': 'ca.signing.cert',
                  'subsystemCert cert-pki-ca': 'ca.subsystem.cert',
-                  'Server-Cert cert-pki-ca': 'ca.sslserver.cert' }
+                  'Server-Cert cert-pki-ca': 'ca.sslserver.cert'}

    installutils.set_directive(dogtag.configured_constants().CS_CFG_PATH,
                                directives[nickname],
@@ -1601,7 +1669,12 @@ def update_cert_config(nickname, cert):

 if __name__ == "__main__":
    standard_logging_setup("install.log")
-    cs = CADSInstance()
-    cs.create_instance("EXAMPLE.COM", "catest.example.com", "example.com", "password")
+    if not dogtag.install_constants.SHARED_DB:
+        cs = CADSInstance()
+        cs.create_instance(
+            "EXAMPLE.COM", "catest.example.com", "example.com", "password")
+    else:
+        ds = dsinstance.DsInstance()
+
    ca = CAInstance("EXAMPLE.COM", "/etc/httpd/alias")
    ca.configure_instance("catest.example.com", "password", "password")
--- a/ipaserver/install/dsinstance.py
+++ b/ipaserver/install/dsinstance.py
@@ -31,6 +31,7 @@ import tempfile
 from ipapython import ipautil
 from ipapython import sysrestore
 from ipapython import services as ipaservices
+from ipapython import dogtag

 import service
 import installutils
@@ -166,6 +167,8 @@ class DsInstance(service.Service):
            ldapi=False,
            autobind=service.DISABLED
            )
+        self.nickname = 'Server-Cert'
+        self.dm_password = dm_password
        self.realm_name = realm_name
        self.sub_dict = None
        self.domain = domain_name
@@ -192,7 +195,7 @@ class DsInstance(service.Service):

    subject_base = ipautil.dn_attribute_property('_subject_base')

-    def __common_setup(self):
+    def __common_setup(self, enable_ssl=False):

        self.step("creating directory server user", self.__create_ds_user)
        self.step("creating directory server instance", self.__create_instance)
@@ -209,7 +212,8 @@ class DsInstance(service.Service):
        self.step("configuring lockout plugin", self.__config_lockout_module)
        self.step("creating indices", self.__create_indices)
        self.step("enabling referential integrity plugin", self.__add_referint_module)
-        self.step("configuring ssl for ds instance", self.__enable_ssl)
+        if not dogtag.install_constants.SHARED_DB or enable_ssl:
+            self.step("configuring ssl for ds instance", self.enable_ssl)
        self.step("configuring certmap.conf", self.__certmap_conf)
        self.step("configure autobind for root", self.__root_autobind)
        self.step("configure new location for managed entries", self.__repoint_managed_entries)
@@ -284,7 +288,7 @@ class DsInstance(service.Service):
        self.idmax = 1100

        self.__setup_sub_dict()
-        self.__common_setup()
+        self.__common_setup(True)

        self.step("setting up initial replication", self.__setup_replica)
        self.step("adding replication acis", self.__add_replication_acis)
@@ -525,7 +529,7 @@ class DsInstance(service.Service):
    def generate_random(self):
        return ipautil.ipa_generate_password()

-    def __enable_ssl(self):
+    def enable_ssl(self):
        dirname = config_dirname(self.serverid)
        dsdb = certs.CertDB(self.realm_name, nssdir=dirname, subject_base=self.subject_base)
        if self.pkcs12_info:
@@ -601,6 +605,8 @@ class DsInstance(service.Service):
    def __certmap_conf(self):
        shutil.copyfile(ipautil.SHARE_DIR + "certmap.conf.template",
                        config_dirname(self.serverid) + "certmap.conf")
+        installutils.update_file(config_dirname(self.serverid) + "certmap.conf",
+                                 'domain_name', self.realm_name)

    def __enable_ldapi(self):
        self._ldap_mod("ldapi.ldif", self.sub_dict)
--- a/ipaserver/install/installutils.py
+++ b/ipaserver/install/installutils.py
@@ -38,7 +38,7 @@ from dns import resolver, rdatatype
 from dns.exception import DNSException
 import ldap

-from ipapython import ipautil, sysrestore, admintool
+from ipapython import ipautil, sysrestore, admintool, dogtag
 from ipapython.admintool import ScriptError
 from ipapython.ipa_log_manager import *
 from ipalib.util import validate_hostname
@@ -48,8 +48,11 @@ from ipapython.dn import DN

 # Used to determine install status
 IPA_MODULES = [
-    'httpd', 'kadmin', 'dirsrv', 'pki-cad', 'pki-tomcatd', 'pkids', 'install',
+    'httpd', 'kadmin', 'dirsrv', 'pki-cad', 'pki-tomcatd', 'install',
    'krb5kdc', 'ntpd', 'named', 'ipa_memcached']
+if not dogtag.install_constants.SHARED_DB:
+    IPA_MODULES.append('pkids')
+

 class BadHostError(Exception):
    pass
--- a/ipaserver/install/replication.py
+++ b/ipaserver/install/replication.py
@@ -27,7 +27,7 @@ from ipaserver import ipaldap
 from ipapython import services as ipaservices
 from ldap import modlist
 from ipalib import api, util, errors
-from ipapython import ipautil
+from ipapython import ipautil, dogtag
 from ipapython.dn import DN

 CACERT = "/etc/ipa/ca.crt"
@@ -59,7 +59,7 @@ STRIP_ATTRS = ('modifiersName',


 def replica_conn_check(master_host, host_name, realm, check_ca,
-                       admin_password=None):
+                       dogtag_master_ds_port, admin_password=None):
    """
    Check the ports used by the replica both locally and remotely to be sure
    that replication will work.
@@ -77,10 +77,10 @@ def replica_conn_check(master_host, host_name, realm, check_ca,
        args.extend(["--password", admin_password])
        nolog=(admin_password,)

-    if check_ca:
+    if check_ca and dogtag_master_ds_port == dogtag.Dogtag9Constants.DS_PORT:
        args.append('--check-ca')
-    (stdin, stderr, returncode) = ipautil.run(args,raiseonerr=False,capture_output=False,
-                                              nolog=nolog)
+    (stdin, stderr, returncode) = ipautil.run(
+        args, raiseonerr=False, capture_output=False, nolog=nolog)

    if returncode != 0:
        sys.exit("Connection check failed!" +
@@ -958,10 +958,12 @@ class ReplicationManager(object):

        newschedule = '2358-2359 0'

-        filter = '(&(nsDS5ReplicaHost=%s)' \
-                   '(|(objectclass=nsDSWindowsReplicationAgreement)' \
-                     '(objectclass=nsds5ReplicationAgreement)))' % hostname
-        entries = conn.getList(DN(('cn', 'config')), ldap.SCOPE_SUBTREE, filter)
+        filter = ('(&(nsDS5ReplicaHost=%s)'
+                   '(&(!(nsDS5ReplicaRoot=o=ipaca))'
+                    '(|(objectclass=nsDSWindowsReplicationAgreement)'
+                     '(objectclass=nsds5ReplicationAgreement))))' % hostname)
+        entries = conn.getList(
+            DN(('cn', 'config')), ldap.SCOPE_SUBTREE, filter)
        if len(entries) == 0:
            root_logger.error("Unable to find replication agreement for %s" %
                          (hostname))