IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-07-29 15:55:47 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix KRA replica installation from CA master

Browse Source 
ipa-replica-install --kra-install can fail when the topology already has
a KRA, but replica is installed from a master with just CA. In that
case, Custodia may pick a machine that doesn't have the KRA auditing and
signing certs in its NSSDB.

Example:
 * master with CA
 * replica1 with CA and KRA
 * new replica gets installed from master

The replica installer now always picks a KRA peer.

The change fixes test scenario TestInstallWithCA1::()::test_replica2_ipa_dns_install

Fixes: https://pagure.io/freeipa/issue/7518
See: https://pagure.io/freeipa/issue/7008
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Christian Heimes
2018-07-19 15:44:46 +02:00
parent d473278621
commit 530da69ead
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ipaserver/install/server/replicainstall.py
+4 -1
View File
@@ -1485,7 +1485,10 @@ def install(installer):
otpd.create_instance('OTPD', config.host_name, otpd.create_instance('OTPD', config.host_name,
ipautil.realm_to_suffix(config.realm_name)) ipautil.realm_to_suffix(config.realm_name))
if ca_enabled: if kra_enabled:
# A KRA peer always provides a CA, too.
mode = custodiainstance.CustodiaModes.KRA_PEER
elif ca_enabled:
mode = custodiainstance.CustodiaModes.CA_PEER mode = custodiainstance.CustodiaModes.CA_PEER
else: else:
mode = custodiainstance.CustodiaModes.MASTER_PEER mode = custodiainstance.CustodiaModes.MASTER_PEER