The installation steps of replica installation on DL0 and
DL1 don't differ too much and should be merged. When
host enrollment on DL0 is finished, most of the code will
be the same.
https://fedorahosted.org/freeipa/ticket/6392
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
pki-tomcat would have been restarted in install and replicainstall
for backward compatibility reasons. As Dogtag 9 is not supported
anymore, we can move this restart only for DL0 replica installation.
https://fedorahosted.org/freeipa/ticket/6392
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Web service needs restarting after bindinstance is created
to pick up changes done to /etc/resolv.conf. This change should
be included anytime DNS is installed therefore it makes sense
to move it to the common code.
https://fedorahosted.org/freeipa/ticket/6392
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Since commit 0914a3aeb7, ipa config file is
created before DS certificate is requested, which makes certmonger request
the certificate from the local system rather than the remote master. This
causes the request to fail, as local httpd is not yet configured at the
time of the request.
Move ipa config file creation to its original place to fix the issue.
https://fedorahosted.org/freeipa/ticket/6392
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
In domain level 0, the default.conf file was created using just
file operations. Unified this with domain level 1 where IPAChangeConf
is used.
Also moved the creation of the file to promote_check in DL1.
https://fedorahosted.org/freeipa/ticket/6392
Reviewed-By: Martin Basti <mbasti@redhat.com>
Python has builtin exceptions which can be used very well to handling
errors in python instead of returning error states (C style)
Exception will allow better client-server integration in future
https://fedorahosted.org/freeipa/ticket/6392
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
There should not be mixed statestore as global variable and as local
function parameter. This commit fixes usage of sysrestore and statestore
as local variables only. In future we may need to change default
statestore and fstore depending on where the functions are called and
this change makes it easier and less error prone.
https://fedorahosted.org/freeipa/ticket/6392
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
In order to unify domain-level specific replica installers to a single
workflow some kind of host enrollment must be done also in domain level 0
replica installation.
Here the enrollment is done by directory manager using
one-time password and only krb5.conf is configured to point to master KDC.
Since host keytab is fetched during enrollment KDC installer no longer needs
to request it during replica install.
https://fedorahosted.org/freeipa/ticket/6434
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
`CertDB.request_service_cert` could re-create NSSDB files if the supplied CA
certificate was not found in database. This could cause subtle bugs since the
files were recreated with wrong permissions. This behavior was removed so that
there are no destructive operations performed by the method.
https://fedorahosted.org/freeipa/ticket/6429
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
In order to reduce coupling between httpinstance and other service installers,
the HTTP installer is now tasked with initialization of /etc/httpd/alias (RA
agent database) in the beginning of server/replica installation
Part of https://fedorahosted.org/freeipa/ticket/6429
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
`create_from_pkcs12` method of CertDB was re-creating NSS database files
during PKCS#12 bundle import. This may cause bugs because the file permissions
could be re-set to wrong values causing subtle bugs. Modify the class API so
that the server cert chain can be imported while preserving existing FS
attributes.
https://fedorahosted.org/freeipa/ticket/6429
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
To make the code more general, moved the update_dna_shared_config
among other update plugins.
Bugfix: DNA shared config connection protocol was compared to a
method string which would result in a try to always update it
even if there was no need to.
https://fedorahosted.org/389/ticket/48373 causes that two
shared DNA config entries are created instead of one.
https://fedorahosted.org/freeipa/ticket/6392
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Python setuptools started to warn about forward incompatibility.
Now we are following PEP440 so it should not cause any problems
with future versions of setuptools.
https://fedorahosted.org/freeipa/ticket/6418
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Stanislav Laznicka
Jan Cholasta
Martin Basti
Martin Babinsky
Petr Spacek