IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

ipa-restore must stop tracking PKINIT cert in the preparation phase

Browse Source 
ipa-restore calls certmonger to stop tracking the PKI certs, HTTP and DS certs.
It must also stop tracking the newly introduced PKINIT cert (stored in
/var/kerberos/krb5kdc/kdc.crt).

Otherwise the restore operation ends up with PKINIT cert tracked twice and
uninstallation fails.

https://fedorahosted.org/freeipa/ticket/6570

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
This commit is contained in:
Florence Blanc-Renaud
2017-01-20 08:33:22 +01:00
committed by Martin Babinsky
parent 26630db9d0
commit ceec512b09
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ipaserver/install/ipa_restore.py
View File

@@ -41,7 +41,7 @@ from ipaserver.install.cainstance import create_ca_user
from ipaserver.install.replication import (wait_for_task, ReplicationManager, from ipaserver.install.replication import (wait_for_task, ReplicationManager,
get_cs_replication_manager) get_cs_replication_manager)
from ipaserver.install import installutils from ipaserver.install import installutils
from ipaserver.install import dsinstance, httpinstance, cainstance from ipaserver.install import dsinstance, httpinstance, cainstance, krbinstance
from ipapython import ipaldap from ipapython import ipaldap
import ipapython.errors import ipapython.errors
from ipaplatform.constants import constants from ipaplatform.constants import constants
@@ -821,6 +821,8 @@ class Restore(admintool.AdminTool):
# When IPA is not installed, DS NSS DB does not exist # When IPA is not installed, DS NSS DB does not exist
pass pass
krbinstance.KrbInstance().stop_tracking_certs()
for basename in ('cert8.db', 'key3.db', 'secmod.db', 'pwdfile.txt'): for basename in ('cert8.db', 'key3.db', 'secmod.db', 'pwdfile.txt'):
filename = os.path.join(paths.IPA_NSSDB_DIR, basename) filename = os.path.join(paths.IPA_NSSDB_DIR, basename)
try: try: