Florence Blanc-Renaud 0f31564b35 ipa-replica-install: make sure that certmonger picks the right master ...

During ipa-replica-install, http installation first creates a service
principal for http/hostname (locally on the soon-to-be-replica), then
waits for this entry to be replicated on the master picked for the
install.
In a later step, the installer requests a certificate for HTTPd. The local
certmonger first tries the master defined in xmlrpc_uri (which is
pointing to the soon-to-be-replica), but fails because the service is not
up yet. Then certmonger tries to find a master by using the DNS and looking
for a ldap service. This step can pick a different master, where the
principal entry has not always be replicated yet.
As the certificate request adds the principal if it does not exist, we can
end by re-creating the principal and have a replication conflict.

The replication conflict later causes kerberos issues, preventing
from installing a new replica.

The proposed fix forces xmlrpc_uri to point to the same master as the one
picked for the installation, in order to make sure that the master already
contains the principal entry.

https://pagure.io/freeipa/issue/7041

Reviewed-By: Rob Crittenden <rcritten@redhat.com>

2018-03-21 09:35:56 +01:00

..

__init__.py

Use os.path.isfile() and isdir()

2017-10-20 12:27:19 +02:00

install.py

Instrument installer to profile steps

2018-03-16 07:33:58 +01:00

replicainstall.py

ipa-replica-install: make sure that certmonger picks the right master

2018-03-21 09:35:56 +01:00

upgrade.py

upgrade: remove fix_trust_flags procedure

2018-03-07 12:31:04 +01:00