From 51cb631db39361918add4b5100d2bfaa90ab9b23 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Wed, 10 Jun 2020 13:49:23 +0200 Subject: [PATCH] ipa-replica-install: --setup-ca and *-cert-file are mutually exclusive ipa-replica-install currently accepts both --setup-ca and *-cert-file even though the options should be mutually exclusive (either install CA-less with *-cert-file options or with a CA). Add a check enforcing the options are mutually exclusive. Fixes: https://pagure.io/freeipa/issue/8366 Reviewed-By: Rob Crittenden --- ipaserver/install/server/replicainstall.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py index 52c00f1af..fa791c77d 100644 --- a/ipaserver/install/server/replicainstall.py +++ b/ipaserver/install/server/replicainstall.py @@ -776,6 +776,12 @@ def promote_check(installer): # check selinux status, http and DS ports, NTP conflicting services common_check(options.no_ntp) + if options.setup_ca and any([options.dirsrv_cert_files, + options.http_cert_files, + options.pkinit_cert_files]): + raise ScriptError("--setup-ca and --*-cert-file options are " + "mutually exclusive") + client_fstore = sysrestore.FileStore(paths.IPA_CLIENT_SYSRESTORE) if not client_fstore.has_files(): # One-step replica installation