IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

dsinstance: extract function for writing certmap.conf

Browse Source 
For full customisability of the IPA CA subject DN, we will need the
ability to update DS `certmap.conf' when upgrading a deployment from
CA-less to CA-ful.

Extract the existing behaviour, which is private to DsInstance, to
the `write_certmap_conf' top-level function.

Also update `certmap.conf.template' for substition of the whole CA
subject DN (not just the subject base).

Part of: https://fedorahosted.org/freeipa/ticket/2614

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
This commit is contained in:
Fraser Tweedale 2016-12-14 13:23:11 +10:00 committed by Jan Cholasta
parent 46bf0e89ae
commit f54df62aba
2 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
install/share/certmap.conf.template
View File

@ -41,6 +41,6 @@ certmap default default
#default:InitFn <Init function's name>
default:DNComps
default:FilterComps uid
certmap ipaca CN=Certificate Authority,$SUBJECT_BASE
certmap ipaca $ISSUER_DN
ipaca:CmapLdapAttr seeAlso
ipaca:verifycert on

18
ipaserver/install/dsinstance.py
View File

@ -920,11 +920,8 @@ class DsInstance(service.Service):
self._ldap_mod("indices.ldif")
def __certmap_conf(self):
shutil.copyfile(
os.path.join(paths.USR_SHARE_IPA_DIR, "certmap.conf.template"),
os.path.join(config_dirname(self.serverid), "certmap.conf"))
installutils.update_file(config_dirname(self.serverid) + "certmap.conf",
'$SUBJECT_BASE', str(self.subject_base))
ca_subject = 'CN=Certificate Authority,' + str(self.subject_base)
write_certmap_conf(self.realm, ca_subject)
sysupgrade.set_upgrade_state(
'certmap.conf',
'subject_base',
@ -1286,3 +1283,14 @@ class DsInstance(service.Service):
# check for open secure port 636 from now on
self.open_ports.append(636)
def write_certmap_conf(realm, ca_subject):
"""(Re)write certmap.conf with given CA subject DN."""
serverid = installutils.realm_to_serverid(realm)
ds_dirname = config_dirname(serverid)
certmap_filename = os.path.join(ds_dirname, "certmap.conf")
shutil.copyfile(
os.path.join(paths.USR_SHARE_IPA_DIR, "certmap.conf.template"),
certmap_filename)
installutils.update_file(certmap_filename, '$ISSUER_DN', str(ca_subject))