IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity

Use only one URL for OCSP and CRL in IPA certificate profile.

Browse Source 
https://fedorahosted.org/freeipa/ticket/3552
This commit is contained in:
Jan Cholasta
2013-04-11 13:50:35 +02:00
committed by Martin Kosek
parent 74abb432fb
commit b25080bbca
1 changed files with 14 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ipaserver/install/cainstance.py
+14 -45
View File
@@ -1271,17 +1271,18 @@ class CAInstance(service.Service):
changed = False changed = False
# OCSP extension # OCSP extension
ocsp_url = 'http://%s.%s/ca/ocsp' % (IPA_CA_CNAME, ipautil.format_netloc(domain))
ocsp_location_0 = installutils.get_directive( ocsp_location_0 = installutils.get_directive(
self.dogtag_constants.IPA_SERVICE_PROFILE, self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0', 'policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0',
separator='=') separator='=')
if not ocsp_location_0: if ocsp_location_0 != ocsp_url:
# Set the first OCSP URI # Set the first OCSP URI
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE, installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0', 'policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0',
'https://%s.%s/ca/ocsp' % (IPA_CA_CNAME, ipautil.format_netloc(domain)), ocsp_url, quotes=False, separator='=')
quotes=False, separator='=')
changed = True changed = True
ocsp_profile_count = installutils.get_directive( ocsp_profile_count = installutils.get_directive(
@@ -1289,34 +1290,22 @@ class CAInstance(service.Service):
'policyset.serverCertSet.5.default.params.authInfoAccessNumADs', 'policyset.serverCertSet.5.default.params.authInfoAccessNumADs',
separator='=') separator='=')
if ocsp_profile_count == '1': if ocsp_profile_count != '1':
# add the second OCSP URI
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.5.default.params.authInfoAccessADEnable_1',
'true', quotes=False, separator='=')
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.5.default.params.authInfoAccessADLocationType_1',
'URIName', quotes=False, separator='=')
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.5.default.params.authInfoAccessADLocation_1',
'http://%s/ca/ocsp' % ipautil.format_netloc(fqdn),
quotes=False, separator='=')
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.5.default.params.authInfoAccessADMethod_1',
'1.3.6.1.5.5.7.48.1', quotes=False, separator='=')
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE, installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.5.default.params.authInfoAccessNumADs', 'policyset.serverCertSet.5.default.params.authInfoAccessNumADs',
'2', quotes=False, separator='=') '1', quotes=False, separator='=')
changed = True changed = True
# CRL extension # CRL extension
crl_issuer_0 = installutils.get_directive( crl_url = 'http://%s.%s/ipa/crl/MasterCRL.bin'% (IPA_CA_CNAME, ipautil.format_netloc(domain))
crl_point_0 = installutils.get_directive(
self.dogtag_constants.IPA_SERVICE_PROFILE, self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.9.default.params.crlDistPointsIssuerName_0', 'policyset.serverCertSet.9.default.params.crlDistPointsPointName_0',
separator='=') separator='=')
if not crl_issuer_0: if crl_point_0 != crl_url:
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE, installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.9.default.params.crlDistPointsIssuerName_0', 'policyset.serverCertSet.9.default.params.crlDistPointsIssuerName_0',
'CN=Certificate Authority,o=ipaca', quotes=False, separator='=') 'CN=Certificate Authority,o=ipaca', quotes=False, separator='=')
@@ -1325,8 +1314,7 @@ class CAInstance(service.Service):
'DirectoryName', quotes=False, separator='=') 'DirectoryName', quotes=False, separator='=')
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE, installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.9.default.params.crlDistPointsPointName_0', 'policyset.serverCertSet.9.default.params.crlDistPointsPointName_0',
'https://%s.%s/ipa/crl/MasterCRL.bin'% (IPA_CA_CNAME, ipautil.format_netloc(domain)), crl_url, quotes=False, separator='=')
quotes=False, separator='=')
changed = True changed = True
crl_profile_count = installutils.get_directive( crl_profile_count = installutils.get_directive(
@@ -1334,29 +1322,10 @@ class CAInstance(service.Service):
'policyset.serverCertSet.9.default.params.crlDistPointsNum', 'policyset.serverCertSet.9.default.params.crlDistPointsNum',
separator='=') separator='=')
if crl_profile_count == '1': if crl_profile_count != '1':
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.9.default.params.crlDistPointsEnable_1',
'true', quotes=False, separator='=')
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.9.default.params.crlDistPointsIssuerName_1',
'CN=Certificate Authority,o=ipaca', quotes=False, separator='=')
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.9.default.params.crlDistPointsIssuerType_1',
'DirectoryName', quotes=False, separator='=')
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.9.default.params.crlDistPointsPointName_1',
'https://%s/ipa/crl/MasterCRL.bin' % ipautil.format_netloc(fqdn),
quotes=False, separator='=')
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.9.default.params.crlDistPointsPointType_1',
'URIName', quotes=False, separator='=')
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.9.default.params.crlDistPointsReasons_1',
'', quotes=False, separator='=')
installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE, installutils.set_directive(self.dogtag_constants.IPA_SERVICE_PROFILE,
'policyset.serverCertSet.9.default.params.crlDistPointsNum', 'policyset.serverCertSet.9.default.params.crlDistPointsNum',
'2', quotes=False, separator='=') '1', quotes=False, separator='=')
changed = True changed = True
# CRL extension is not enabled by default # CRL extension is not enabled by default