IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-01-26 16:16:31 -06:00
Code Issues Packages Projects Releases Wiki Activity

Move client certificate request after krb5.conf is created

Browse Source 
The creation of krb5.conf was moved to the end of the script
as part of maintaining server affinity during ipa-client-install.
If the installation is faster than replication then requests
against some IPA servers may fail because the client entry is
not yet present.

This is more difficult with certmonger as it will only use
/etc/krb5.conf. There is no way of knowing, even at the end
of the client installation, that replication has finished.

Certificate issuance may fail during ipa-client-install but
certmonger will re-try the request.

Fixes: https://pagure.io/freeipa/issue/9246

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>
This commit is contained in:
Rob Crittenden 2022-09-27 08:57:20 -04:00
parent 55ef0008b8
commit dbec885cb0
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ipaclient/install/client.py
View File

@ -3089,8 +3089,6 @@ def _install(options, tdict):
if not options.on_master:
client_dns(cli_server[0], hostname, options)
configure_certmonger(fstore, subject_base, cli_realm, hostname,
options, ca_enabled)
update_ssh_keys(hostname, paths.SSH_CONFIG_DIR, options.create_sshfp)
@ -3289,6 +3287,11 @@ def _install(options, tdict):
logger.info("Configured /etc/krb5.conf for IPA realm %s", cli_realm)
# Configure certmonger after krb5.conf is created and last
# to give higher chance that the new client is replicated.
configure_certmonger(fstore, subject_base, cli_realm, hostname,
options, ca_enabled)
statestore.delete_state('installation', 'complete')
statestore.backup_state('installation', 'complete', True)
logger.info('Client configuration complete.')