IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

ipa-replica-install: fix pkinit setup

Browse Source 
commit 7284097 (Delay enabling services until end of installer)
introduced a regression in replica installation.
When the replica requests a cert for PKINIT, a check is done
to ensure that the hostname corresponds to a machine with a
KDC service enabled (ipaconfigstring attribute of
cn=KDC,cn=<hostname>,cn=masters,cn=ipa,cn=etc,$BASEDN must contain
'enabledService').
With the commit mentioned above, the service is set to enabled only
at the end of the installation.

The fix makes a less strict check, ensuring that 'enabledService'
or 'configuredService' is in ipaconfigstring.

Fixes: https://pagure.io/freeipa/issue/7566
Reviewed-By: Christian Heimes <cheimes@redhat.com>
This commit is contained in:
Florence Blanc-Renaud 2018-09-04 14:15:50 +02:00
parent 1857dc9db0
commit 2a227c240f
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ipaserver/plugins/cert.py
View File

@ -300,9 +300,11 @@ def ca_kdc_check(api_instance, hostname):
ipaconfigstring = {val.lower() for val in kdc_entry['ipaConfigString']}
if 'enabledservice' not in ipaconfigstring:
if 'enabledservice' not in ipaconfigstring \
and 'configuredservice' not in ipaconfigstring:
raise errors.NotFound(
reason=_("enabledService not in ipaConfigString kdc entry"))
reason=_("enabledService/configuredService not in "
"ipaConfigString kdc entry"))
except errors.NotFound:
raise errors.ACIError(