3 Commits

Author	SHA1	Message	Date
Fraser Tweedale	09f746f568	ipa-pki-retrieve-key: ensure we do not crash ... If ipa-pki-retrieve-key fails for some reason (which may be a "legitimate" reason, e.g. the server it is attempting to contact being offline), the program terminates with an uncaught exception, resulting in crash report. Catch all exceptions; if an exception gets raised, report the traceback and exit with nonzero status. Fixes: https://pagure.io/freeipa/issue/7115 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>	2017-09-13 13:56:59 +02:00
Jan Cholasta	a1f260d021	ipapython: move dnssec, p11helper and secrets to ipaserver ... The dnssec and secrets subpackages and the p11helper module depend on ipaplatform. Move them to ipaserver as they are used only on the server. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>	2016-11-29 14:50:51 +01:00
Fraser Tweedale	b0d9a4728f	Setup lightweight CA key retrieval on install/upgrade ... Add the ipa-pki-retrieve-key helper program and configure lightweight CA key replication on installation and upgrade. The specific configuration steps are: - Add the 'dogtag/$HOSTNAME' service principal - Create the pricipal's Custodia keys - Retrieve the principal's keytab - Configure Dogtag's CS.cfg to use ExternalProcessKeyRetriever to invoke ipa-pki-retrieve-key for key retrieval Also bump the minimum version of Dogtag to 10.3.2. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>	2016-06-09 09:04:27 +02:00