IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

install: use ldaps for pkispawn in ipa-ca-install

Browse Source 
Commit 822e1bc82a undone the fix from commit
276d16775a, breaking ipa-ca-install on
servers with hardened DS configuration.

Put the fix back to make ipa-ca-install work on hardened DS configuration
again.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
This commit is contained in:
Jan Cholasta 2016-11-08 09:53:10 +01:00
parent 8cb315af62
commit 87c3c1abec
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ipaserver/install/ca.py
View File

@ -188,7 +188,8 @@ def install_step_0(standalone, replica_config, options):
master_replication_port=master_replication_port, master_replication_port=master_replication_port,
ra_p12=ra_p12, ra_p12=ra_p12,
ra_only=ra_only, ra_only=ra_only,
promote=promote) promote=promote,
use_ldaps=standalone)
def install_step_1(standalone, replica_config, options): def install_step_1(standalone, replica_config, options):

6
ipaserver/install/cainstance.py
View File

@ -330,7 +330,7 @@ class CAInstance(DogtagInstance):
master_replication_port=None, master_replication_port=None,
subject_base=None, ca_signing_algorithm=None, subject_base=None, ca_signing_algorithm=None,
ca_type=None, ra_p12=None, ra_only=False, ca_type=None, ra_p12=None, ra_only=False,
promote=False): promote=False, use_ldaps=False):
"""Create a CA instance. """Create a CA instance.
To create a clone, pass in pkcs12_info. To create a clone, pass in pkcs12_info.
@ -363,6 +363,7 @@ class CAInstance(DogtagInstance):
else: else:
self.ca_type = 'generic' self.ca_type = 'generic'
self.no_db_setup = promote self.no_db_setup = promote
self.use_ldaps = use_ldaps
# Determine if we are installing as an externally-signed CA and # Determine if we are installing as an externally-signed CA and
# what stage we're in. # what stage we're in.
@ -495,6 +496,9 @@ class CAInstance(DogtagInstance):
config.set("CA", "pki_ds_base_dn", self.basedn) config.set("CA", "pki_ds_base_dn", self.basedn)
config.set("CA", "pki_ds_database", "ipaca") config.set("CA", "pki_ds_database", "ipaca")
if self.use_ldaps:
self._use_ldaps_during_spawn(config)
# Certificate subject DN's # Certificate subject DN's
config.set("CA", "pki_subsystem_subject_dn", config.set("CA", "pki_subsystem_subject_dn",
str(DN(('cn', 'CA Subsystem'), self.subject_base))) str(DN(('cn', 'CA Subsystem'), self.subject_base)))