mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-13 09:41:55 -06:00
0f31564b35
During ipa-replica-install, http installation first creates a service principal for http/hostname (locally on the soon-to-be-replica), then waits for this entry to be replicated on the master picked for the install. In a later step, the installer requests a certificate for HTTPd. The local certmonger first tries the master defined in xmlrpc_uri (which is pointing to the soon-to-be-replica), but fails because the service is not up yet. Then certmonger tries to find a master by using the DNS and looking for a ldap service. This step can pick a different master, where the principal entry has not always be replicated yet. As the certificate request adds the principal if it does not exist, we can end by re-creating the principal and have a replication conflict. The replication conflict later causes kerberos issues, preventing from installing a new replica. The proposed fix forces xmlrpc_uri to point to the same master as the one picked for the installation, in order to make sure that the master already contains the principal entry. https://pagure.io/freeipa/issue/7041 Reviewed-By: Rob Crittenden <rcritten@redhat.com> |
||
|---|---|---|
| .. | ||
| plugins | ||
| server | ||
| __init__.py | ||
| adtrust.py | ||
| adtrustinstance.py | ||
| bindinstance.py | ||
| ca.py | ||
| cainstance.py | ||
| certs.py | ||
| conncheck.py | ||
| custodiainstance.py | ||
| dns.py | ||
| dnskeysyncinstance.py | ||
| dogtag.py | ||
| dogtaginstance.py | ||
| dsinstance.py | ||
| httpinstance.py | ||
| installutils.py | ||
| ipa_backup.py | ||
| ipa_cacert_manage.py | ||
| ipa_kra_install.py | ||
| ipa_ldap_updater.py | ||
| ipa_otptoken_import.py | ||
| ipa_pkinit_manage.py | ||
| ipa_replica_install.py | ||
| ipa_replica_prepare.py | ||
| ipa_restore.py | ||
| ipa_server_certinstall.py | ||
| ipa_server_install.py | ||
| ipa_server_upgrade.py | ||
| ipa_winsync_migrate.py | ||
| kra.py | ||
| krainstance.py | ||
| krbinstance.py | ||
| ldapupdate.py | ||
| ntpinstance.py | ||
| odsexporterinstance.py | ||
| opendnssecinstance.py | ||
| otpdinstance.py | ||
| replication.py | ||
| schemaupdate.py | ||
| service.py | ||
| sysupgrade.py | ||
| upgradeinstance.py | ||