IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-25 08:21:05 -06:00
Code Issues Packages Projects Releases Wiki Activity

ipa-replica-install: properly use the file store

Browse Source 
In ipa-replica-install, many components use their own instance
of the FileStore to backup configuration files to the pre-install
state. This causes issues when the calls are mixed, like for
instance:
ds.do_task1_that_backups_file (using ds.filestore)
http.do_task2_that_backups_file (using http.filestore)
ds.do_task3_that_backups_file (using ds.filestore)

because the list of files managed by ds.filestore does not include
the files managed by http.filestore, and the 3rd call would remove
any file added on 2nd call.

The symptom of this bug is that ipa-replica-install does not save
/etc/httpd/conf.d/ssl.conf and subsequent uninstallation does not
restore the file, leading to a line referring to ipa-rewrite.conf
that prevents httpd startup.

The installer should consistently use the same filestore.

Fixes https://pagure.io/freeipa/issue/7684

Reviewed-By: Christian Heimes <cheimes@redhat.com>
This commit is contained in:
Florence Blanc-Renaud 2018-09-05 17:36:16 +02:00 committed by Christian Heimes
parent c7064494e5
commit 6ad11d86d8
1 changed files with 18 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
ipaserver/install/server/replicainstall.py
View File

@ -79,7 +79,7 @@ def make_pkcs12_info(directory, cert_name, password_name):
def install_replica_ds(config, options, ca_is_configured, remote_api, def install_replica_ds(config, options, ca_is_configured, remote_api,
ca_file, promote=False, pkcs12_info=None): ca_file, promote=False, pkcs12_info=None, fstore=None):
dsinstance.check_ports() dsinstance.check_ports()
# if we have a pkcs12 file, create the cert db from # if we have a pkcs12 file, create the cert db from
@ -95,7 +95,8 @@ def install_replica_ds(config, options, ca_is_configured, remote_api,
ca_subject = installutils.default_ca_subject_dn(config.subject_base) ca_subject = installutils.default_ca_subject_dn(config.subject_base)
ds = dsinstance.DsInstance( ds = dsinstance.DsInstance(
config_ldif=options.dirsrv_config_file) config_ldif=options.dirsrv_config_file,
fstore=fstore)
ds.create_replica( ds.create_replica(
realm_name=config.realm_name, realm_name=config.realm_name,
master_fqdn=config.master_host_name, master_fqdn=config.master_host_name,
@ -115,8 +116,9 @@ def install_replica_ds(config, options, ca_is_configured, remote_api,
return ds return ds
def install_krb(config, setup_pkinit=False, pkcs12_info=None, promote=False): def install_krb(config, setup_pkinit=False, pkcs12_info=None, promote=False,
krb = krbinstance.KrbInstance() fstore=None):
krb = krbinstance.KrbInstance(fstore=fstore)
# pkinit files # pkinit files
if pkcs12_info is None: if pkcs12_info is None:
@ -153,7 +155,8 @@ def install_ca_cert(ldap, base_dn, realm, cafile, destfile=paths.IPA_CA_CRT):
def install_http(config, auto_redirect, ca_is_configured, ca_file, def install_http(config, auto_redirect, ca_is_configured, ca_file,
promote=False, promote=False,
pkcs12_info=None): pkcs12_info=None,
fstore=None):
# if we have a pkcs12 file, create the cert db from # if we have a pkcs12 file, create the cert db from
# that. Otherwise the ds setup will create the CA # that. Otherwise the ds setup will create the CA
# cert # cert
@ -161,8 +164,7 @@ def install_http(config, auto_redirect, ca_is_configured, ca_file,
pkcs12_info = make_pkcs12_info(config.dir, "httpcert.p12", pkcs12_info = make_pkcs12_info(config.dir, "httpcert.p12",
"http_pin.txt") "http_pin.txt")
http = httpinstance.HTTPInstance(fstore=fstore)
http = httpinstance.HTTPInstance()
http.create_instance( http.create_instance(
config.realm_name, config.host_name, config.domain_name, config.realm_name, config.host_name, config.domain_name,
config.dirman_password, pkcs12_info, config.dirman_password, pkcs12_info,
@ -173,14 +175,14 @@ def install_http(config, auto_redirect, ca_is_configured, ca_file,
return http return http
def install_dns_records(config, options, remote_api): def install_dns_records(config, options, remote_api, fstore=None):
if not bindinstance.dns_container_exists( if not bindinstance.dns_container_exists(
ipautil.realm_to_suffix(config.realm_name)): ipautil.realm_to_suffix(config.realm_name)):
return return
try: try:
bind = bindinstance.BindInstance(api=remote_api) bind = bindinstance.BindInstance(api=remote_api, fstore=fstore)
for ip in config.ips: for ip in config.ips:
reverse_zone = bindinstance.find_reverse_zone(ip, remote_api) reverse_zone = bindinstance.find_reverse_zone(ip, remote_api)
@ -1431,10 +1433,11 @@ def install(installer):
remote_api, remote_api,
ca_file=cafile, ca_file=cafile,
promote=promote, promote=promote,
pkcs12_info=dirsrv_pkcs12_info) pkcs12_info=dirsrv_pkcs12_info,
fstore=fstore)
# Always try to install DNS records # Always try to install DNS records
install_dns_records(config, options, remote_api) install_dns_records(config, options, remote_api, fstore=fstore)
finally: finally:
if conn.isconnected(): if conn.isconnected():
@ -1453,7 +1456,8 @@ def install(installer):
config, config,
setup_pkinit=not options.no_pkinit, setup_pkinit=not options.no_pkinit,
pkcs12_info=pkinit_pkcs12_info, pkcs12_info=pkinit_pkcs12_info,
promote=promote) promote=promote,
fstore=fstore)
if promote: if promote:
# We need to point to the master when certmonger asks for # We need to point to the master when certmonger asks for
@ -1483,7 +1487,8 @@ def install(installer):
promote=promote, promote=promote,
pkcs12_info=http_pkcs12_info, pkcs12_info=http_pkcs12_info,
ca_is_configured=ca_enabled, ca_is_configured=ca_enabled,
ca_file=cafile) ca_file=cafile,
fstore=fstore)
if promote: if promote:
# Need to point back to ourself after the cert for HTTP is obtained # Need to point back to ourself after the cert for HTTP is obtained