Simplify and consolidate ipaca.ini

Fixes: https://pagure.io/freeipa/issue/5608
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

install/share/ipaca_customize.ini

@@ -12,7 +12,6 @@
 #
 # Predefined variables
 #  - ipa_ca_subject
-#  - ipa_ds_base_dn
 #  - ipa_fqdn
 #  - ipa_subject_base
 #  - pki_admin_password

install/share/ipaca_default.ini

@@ -8,15 +8,10 @@
 #
 
 [DEFAULT]
-# hard-coded IPA default settings
-ipa_security_domain_name=IPA
-ipa_ds_database=ipaca
-ipa_admin_nickname=ipa-ca-agent
 ipa_ca_pem_file=/etc/ipa/ca.crt
 
 ## dynamic values
 # ipa_ca_subject=
-# ipa_ds_base_dn=
 # ipa_subject_base=
 # ipa_fqdn=
 # ipa_ocsp_uri=
@@ -36,8 +31,8 @@ pki_admin_cert_file=%(pki_client_dir)s/ca_admin.cert
 pki_admin_cert_request_type=pkcs10
 pki_admin_dualkey=False
 pki_admin_name=%(ipa_admin_user)s
-pki_admin_nickname=%(ipa_admin_nickname)s
-pki_admin_subject_dn=cn=%(ipa_admin_nickname)s,%(ipa_subject_base)s
+pki_admin_nickname=ipa-ca-agent
+pki_admin_subject_dn=cn=ipa-ca-agent,%(ipa_subject_base)s
 pki_admin_uid=%(ipa_admin_user)s
 
 pki_ca_hostname=%(pki_security_domain_hostname)s
@@ -55,6 +50,10 @@ pki_client_pkcs12_password=%(pki_admin_password)s
 pki_ds_bind_dn=cn=Directory Manager
 pki_ds_ldap_port=389
 pki_ds_ldaps_port=636
+# CA: o=ipaca, KRA: o=kra,o=ipaca
+pki_ds_base_dn=o=ipaca
+pki_ds_database=ipaca
+pki_ds_hostname=%(ipa_fqdn)s
 pki_ds_remove_data=True
 pki_ds_secure_connection=False
 pki_ds_secure_connection_ca_nickname=Directory Server CA certificate
@@ -70,7 +69,7 @@ pki_enable_proxy=True
 pki_restart_configured_instance=False
 pki_security_domain_hostname=%(ipa_fqdn)s
 pki_security_domain_https_port=443
-pki_security_domain_name=%(ipa_security_domain_name)s
+pki_security_domain_name=IPA
 pki_security_domain_password=%(pki_admin_password)s
 pki_security_domain_user=%(ipa_admin_user)s
 pki_self_signed_token=internal
@@ -81,6 +80,7 @@ pki_skip_installation=False
 pki_skip_sd_verify=False
 
 pki_sslserver_token=internal
+pki_ssl_server_token=%(pki_sslserver_token)s
 pki_sslserver_nickname=Server-Cert cert-pki-ca
 pki_sslserver_subject_dn=cn=%(ipa_fqdn)s,%(ipa_subject_base)s
 
@@ -101,28 +101,16 @@ pki_cert_chain_nickname=caSigningCert External CA
 pki_pkcs12_path=
 pki_pkcs12_password=
 
-pki_ds_base_dn=%(ipa_ds_base_dn)s
-pki_ds_database=%(ipa_ds_database)s
-pki_ds_hostname=%(ipa_fqdn)s
-
 
 [CA]
+pki_ds_base_dn=o=ipaca
+
 pki_ca_signing_record_create=True
 pki_ca_signing_serial_number=1
 pki_ca_signing_subject_dn=%(ipa_ca_subject)s
 
 pki_ca_signing_csr_path=/root/ipa.csr
 
-# pki_ocsp_signing_csr_path=
-# pki_audit_signing_csr_path=
-# pki_sslserver_csr_path=
-# pki_subsystem_csr_path=
-
-# pki_ocsp_signing_cert_path=
-# pki_audit_signing_cert_path=
-# pki_sslserver_cert_path=
-# pki_subsystem_cert_path=
-
 pki_ca_starting_crl_number=0
 
 pki_external=False
@@ -139,7 +127,6 @@ pki_ocsp_signing_subject_dn=cn=OCSP Subsystem,%(ipa_subject_base)s
 pki_profiles_in_ldap=True
 pki_subordinate=False
 pki_subordinate_create_new_security_domain=False
-### pki_subordinate_security_domain_name=%(pki_dns_domainname)s Subordinate Security Domain
 
 pki_audit_signing_nickname=auditSigningCert cert-pki-ca
 pki_audit_signing_subject_dn=cn=CA Audit,%(ipa_subject_base)s
@@ -158,26 +145,15 @@ pki_replica_number_range_end=100
 
 
 [KRA]
+pki_ds_base_dn=o=kra,o=ipaca
+pki_ds_create_new_db=False
+pki_ds_secure_connection=True
+
 pki_import_admin_cert=True
 pki_standalone=False
-pki_ds_create_new_db=False
-
-# pki_admin_csr_path=
-# pki_audit_signing_csr_path=
-# pki_sslserver_csr_path=
-# pki_storage_csr_path=
-# pki_subsystem_csr_path=
-# pki_transport_csr_path=
 
 pki_external_step_two=False
 
-# pki_admin_cert_path=
-# pki_audit_signing_cert_path=
-# pki_sslserver_cert_path=
-# pki_storage_cert_path=
-# pki_subsystem_cert_path=
-# pki_transport_cert_path=
-
 pki_storage_nickname=storageCert cert-pki-kra
 pki_storage_subject_dn=cn=KRA Storage Certificate,%(ipa_subject_base)s
 
@@ -190,4 +166,4 @@ pki_audit_signing_subject_dn=cn=KRA Audit,%(ipa_subject_base)s
 # Needed because CA and KRA share the same database
 # We will use the dbuser created for the CA.
 pki_share_db=True
-pki_share_dbuser_dn=uid=pkidbuser,ou=people,o=%(ipa_ds_database)s
+pki_share_dbuser_dn=uid=pkidbuser,ou=people,o=ipaca