IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

CA replica promotion: add proper CA DNS records

Browse Source 
Update 'ipa-ca' records with A/AAAA records of the newly added replica

https://fedorahosted.org/freeipa/ticket/5966

Reviewed-By: Petr Spacek <pspacek@redhat.com>
This commit is contained in:
Martin Basti 2016-06-22 12:20:09 +02:00
parent 104040cf36
commit 5693d19550
3 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ipalib/constants.py
View File

@ -272,3 +272,4 @@ DOMAIN_SUFFIX_NAME = 'domain'
CA_SUFFIX_NAME = 'ca' CA_SUFFIX_NAME = 'ca'
PKI_GSSAPI_SERVICE_NAME = 'dogtag' PKI_GSSAPI_SERVICE_NAME = 'dogtag'
IPA_CA_CN = u'ipa' IPA_CA_CN = u'ipa'
IPA_CA_RECORD = "ipa-ca"

2
ipaserver/install/bindinstance.py
View File

@ -37,7 +37,6 @@ from ipaserver.dns_data_management import (
from ipaserver.install import installutils from ipaserver.install import installutils
from ipaserver.install import service from ipaserver.install import service
from ipaserver.install import sysupgrade from ipaserver.install import sysupgrade
from ipaserver.install.cainstance import IPA_CA_RECORD
from ipapython import sysrestore, ipautil, ipaldap from ipapython import sysrestore, ipautil, ipaldap
from ipapython import dnsutil from ipapython import dnsutil
from ipapython.dnsutil import DNSName from ipapython.dnsutil import DNSName
@ -45,6 +44,7 @@ from ipapython.ipa_log_manager import root_logger
from ipapython.dn import DN from ipapython.dn import DN
import ipalib import ipalib
from ipalib import api, errors from ipalib import api, errors
from ipalib.constants import IPA_CA_RECORD
from ipaplatform import services from ipaplatform import services
from ipaplatform.constants import constants from ipaplatform.constants import constants
from ipaplatform.paths import paths from ipaplatform.paths import paths

16
ipaserver/install/cainstance.py
View File

@ -63,6 +63,7 @@ from ipapython.ipa_log_manager import log_mgr,\
from ipapython.secrets.kem import IPAKEMKeys from ipapython.secrets.kem import IPAKEMKeys
from ipaserver.install import certs from ipaserver.install import certs
from ipaserver.install import bindinstance
from ipaserver.install import dsinstance from ipaserver.install import dsinstance
from ipaserver.install import installutils from ipaserver.install import installutils
from ipaserver.install import ldapupdate from ipaserver.install import ldapupdate
@ -81,10 +82,6 @@ except ImportError:
import http.client as httplib import http.client as httplib
# When IPA is installed with DNS support, this CNAME should hold all IPA
# replicas with CA configured
IPA_CA_RECORD = "ipa-ca"
# We need to reset the template because the CA uses the regular boot # We need to reset the template because the CA uses the regular boot
# information # information
INF_TEMPLATE = """ INF_TEMPLATE = """
@ -1296,6 +1293,14 @@ class CAInstance(DogtagInstance):
basedn = ipautil.realm_to_suffix(self.realm) basedn = ipautil.realm_to_suffix(self.realm)
self.ldap_enable('CA', self.fqdn, None, basedn) self.ldap_enable('CA', self.fqdn, None, basedn)
def __update_ca_records(self):
# Install CA DNS records
if bindinstance.dns_container_exists(
api.env.host, api.env.basedn, ldapi=True, realm=api.env.realm
):
bind = bindinstance.BindInstance(ldapi=True)
bind.update_system_records()
def configure_replica(self, master_host, subject_base=None, def configure_replica(self, master_host, subject_base=None,
ca_cert_bundle=None, ca_signing_algorithm=None, ca_cert_bundle=None, ca_signing_algorithm=None,
ca_type=None): ca_type=None):
@ -1366,6 +1371,7 @@ class CAInstance(DogtagInstance):
self.__restart_http_instance) self.__restart_http_instance)
self.step("enabling CA instance", self.__enable_instance) self.step("enabling CA instance", self.__enable_instance)
self.step("Updating DNS CA records", self.__update_ca_records)
self.start_creation(runtime=210) self.start_creation(runtime=210)
@ -1722,7 +1728,7 @@ def __add_acls(new_rules):
def __get_profile_config(profile_id): def __get_profile_config(profile_id):
sub_dict = dict( sub_dict = dict(
DOMAIN=ipautil.format_netloc(api.env.domain), DOMAIN=ipautil.format_netloc(api.env.domain),
IPA_CA_RECORD=IPA_CA_RECORD, IPA_CA_RECORD=ipalib.constants.IPA_CA_RECORD,
CRL_ISSUER='CN=Certificate Authority,o=ipaca', CRL_ISSUER='CN=Certificate Authority,o=ipaca',
SUBJECT_DN_O=dsinstance.DsInstance().find_subject_base(), SUBJECT_DN_O=dsinstance.DsInstance().find_subject_base(),
) )