mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-10-24 22:27:41 -05:00
Rob Crittenden
3b5caf9dbd
In order to generate the private key for a a LWCA (subca) on an HSM the name of the subca needs to be the HSM token name : name_of_subca, e.g. ipa_token:test. This works fine now without any code changes but it requires that admins always remember to include the prefix which is unlikely (everyone makes mistakes). So do it for them if an HSM is present and a token is not provided. We only support one token at a time in IPA so for now this is sufficient. One can also mix-and-match including the token and not. For example you can run: $ ipa ca-add test --subject cn=test $ ipa ca-show ipa_token:test It shouldn't be an issue if a lwca name contains a colon. Fixes: https://pagure.io/freeipa/issue/9865 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Ground rules on adding new schema Brand new schema, particularly when written specifically for IPA, should be added in share/*.ldif. Any new files need to be explicitly loaded in ipaserver/install/dsinstance.py. These simply get copied directly into the new instance schema directory. Existing schema (e.g. in an LDAP draft) may either be added as a separate ldif in share or as an update in the updates directory. The advantage of adding the schema as an update is if 389-ds ever adds the schema then the installation won't fail due to existing schema failing to load during bootstrap. If the new schema requires a new container then this should be added to install/bootstrap-template.ldif.