IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

server upgrade: always fix certmonger tracking request

Browse Source 
Fix certmonger tracking requests on every run of ipa-server-upgrade rather
than only when the tracking configuration has changed and the requests have
not yet been updated.

This allows fixing broken tracking requests just by re-running
ipa-server-upgrade.

https://pagure.io/freeipa/issue/5799

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
This commit is contained in:
Jan Cholasta
2017-02-28 10:55:54 +00:00
committed by David Kupka
parent ce9eefe53b
commit 5abd9bb996
1 changed files with 7 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
ipaserver/install/server/upgrade.py
View File

@@ -905,8 +905,6 @@ def certificate_renewal_update(ca, ds, http):
template = paths.CERTMONGER_COMMAND_TEMPLATE template = paths.CERTMONGER_COMMAND_TEMPLATE
serverid = installutils.realm_to_serverid(api.env.realm) serverid = installutils.realm_to_serverid(api.env.realm)
# bump version when requests is changed
version = 6
requests = [ requests = [
{ {
'cert-database': paths.PKI_TOMCAT_ALIAS_DIR, 'cert-database': paths.PKI_TOMCAT_ALIAS_DIR,
@@ -971,25 +969,17 @@ def certificate_renewal_update(ca, ds, http):
} }
] ]
root_logger.info("[Update certmonger certificate renewal configuration to " root_logger.info("[Update certmonger certificate renewal configuration]")
"version %d]" % version)
if not ca.is_configured(): if not ca.is_configured():
root_logger.info('CA is not configured') root_logger.info('CA is not configured')
return False return False
state = 'certificate_renewal_update_%d' % version
if sysupgrade.get_upgrade_state('dogtag', state):
return False
# State not set, lets see if we are already configured # State not set, lets see if we are already configured
for request in requests: for request in requests:
request_id = certmonger.get_request_id(request) request_id = certmonger.get_request_id(request)
if request_id is None: if request_id is None:
break break
else: else:
sysupgrade.set_upgrade_state('dogtag', state, True)
root_logger.info("Certmonger certificate renewal configuration is "
"already at version %d" % version)
return False return False
# Ok, now we need to stop tracking, then we can start tracking them # Ok, now we need to stop tracking, then we can start tracking them
@@ -998,13 +988,11 @@ def certificate_renewal_update(ca, ds, http):
ds.stop_tracking_certificates(serverid) ds.stop_tracking_certificates(serverid)
http.stop_tracking_certificates() http.stop_tracking_certificates()
if not sysupgrade.get_upgrade_state('dogtag', filename = paths.CERTMONGER_CAS_CA_RENEWAL
'certificate_renewal_update_1'): if os.path.exists(filename):
filename = paths.CERTMONGER_CAS_CA_RENEWAL with installutils.stopped_service('certmonger'):
if os.path.exists(filename): root_logger.info("Removing %s" % filename)
with installutils.stopped_service('certmonger'): installutils.remove_file(filename)
root_logger.info("Removing %s" % filename)
installutils.remove_file(filename)
ca.configure_certmonger_renewal() ca.configure_certmonger_renewal()
ca.configure_renewal() ca.configure_renewal()
@@ -1013,9 +1001,7 @@ def certificate_renewal_update(ca, ds, http):
ds.start_tracking_certificates(serverid) ds.start_tracking_certificates(serverid)
http.start_tracking_certificates() http.start_tracking_certificates()
sysupgrade.set_upgrade_state('dogtag', state, True) root_logger.info("Certmonger certificate renewal configuration updated")
root_logger.info("Certmonger certificate renewal configuration updated to "
"version %d" % version)
return True return True
def copy_crl_file(old_path, new_path=None): def copy_crl_file(old_path, new_path=None):