Rob Crittenden 2a95a05f9e Server affinity: Retain user-requested remote server ...

We want to avoid splitting a replica server installation between
two hosts where possible so if a CA or KRA is requested then
we only try to install against a remote server that also provides
those capabilities. This avoids race conditions.

If a CA or KRA is not requested and the user has provided a
server to install against then use that instead of overriding it.

Extend the logic of picking the remote Custodia mode
(KRA, CA, *MASTER*) to include considering whether the
CA and KRA services are requested. If the service(s) are
not requested the the associated hostname may not be
reliable.

Fixes: https://pagure.io/freeipa/issue/9491
Related: https://pagure.io/freeipa/issue/9289

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>

2024-01-11 17:15:53 +01:00

..

plugins

Replace subsystem.select with CAInstance.is_crlgen_enabled()

2023-10-19 07:44:27 +02:00

server

Server affinity: Retain user-requested remote server

2024-01-11 17:15:53 +01:00

__init__.py

Remove __all__ specifications in ipaclient and ipaserver.install

2013-09-06 15:42:33 +02:00

adtrust.py

adtrust install: define constants for rid bases

2021-11-02 10:11:28 +01:00

adtrustinstance.py

Ignore empty modification error in case cifs/.. principal already added

2023-04-05 14:55:22 -04:00

bindinstance.py

LDAP autobind authenticateAsDN for BIND named

2021-06-15 14:13:16 +03:00

ca.py

Uninstaller: uninstall PKI before shutting down services

2023-06-21 21:08:17 +02:00

cainstance.py

Enable LWCA monitor explicitly

2023-10-19 07:42:28 +02:00

certs.py

pylint: fix errors

2024-01-09 08:40:47 +01:00

conncheck.py

install: introduce installer class hierarchy

2016-11-11 12:17:25 +01:00

custodiainstance.py

pylint: Fix unused-private-member

2022-03-11 13:37:08 -05:00

dns.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

dnskeysyncinstance.py

dnskeysyncinstance: use late binding for UID/GID resolution

2020-12-22 14:05:13 +02:00

dogtag.py

Verify pki ini override early

2019-04-10 13:43:23 +02:00

dogtaginstance.py

Detection of PKI subsystem

2023-06-21 21:08:17 +02:00

dsinstance.py

BDB tuning should be applied only when BDB backend is used

2023-09-01 13:16:15 -04:00

httpinstance.py

pylint: Replace deprecated pipes

2023-01-10 08:30:58 +01:00

installutils.py

pylint: Fix used-before-assignment

2023-01-10 08:30:58 +01:00

ipa_acme_manage.py

ACME: Don't treat pki-server ca-config-show failures as fatal

2024-01-10 13:35:51 -05:00

ipa_backup.py

BIND: Setup logging

2021-05-25 10:45:49 +03:00

ipa_cacert_manage.py

Use datetime.timezone.utc instead of newer datetime.UTC alias

2023-09-29 15:06:33 -04:00

ipa_cert_fix.py

Use datetime.timezone.utc instead of newer datetime.UTC alias

2023-09-29 15:06:33 -04:00

ipa_crlgen_manage.py

CRL generation master: new utility to enable|disable

2019-03-14 09:39:55 +01:00

ipa_kra_install.py

Change FreeIPA references to IPA and Identity Management

2021-01-21 13:51:45 +01:00

ipa_ldap_updater.py

Remove -s option from ipa-ldap-updater usage

2021-05-20 14:45:27 -04:00

ipa_otptoken_import.py

pylint: Fix useless-object-inheritance

2023-01-10 08:30:58 +01:00

ipa_pkinit_manage.py

Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server

2021-06-17 17:28:48 -04:00

ipa_replica_install.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

ipa_restore.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

ipa_server_certinstall.py

Require an ipa-ca SAN on 3rd party certs if ACME is enabled

2020-11-02 14:01:05 -05:00

ipa_server_install.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

ipa_server_upgrade.py

ipa commands: print 'IPA is not configured' when ipa is not setup

2018-08-23 12:08:45 +02:00

ipa_subids.py

pylint: Fix arguments-renamed

2022-03-11 13:37:08 -05:00

ipa_trust_enable_agent.py

ipa-adtrust-install: run remote configuration for new agents

2020-03-05 14:40:58 +01:00

ipa_winsync_migrate.py

ipa commands: print 'IPA is not configured' when ipa is not setup

2018-08-23 12:08:45 +02:00

ipactl.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

kra.py

Uninstaller: uninstall PKI before shutting down services

2023-06-21 21:08:17 +02:00

krainstance.py

Explicitly use legacy ID generators by default

2022-11-03 15:18:30 -04:00

krbinstance.py

Tolerate absence of PAC ticket signature depending of server capabilities

2023-05-24 13:20:38 +02:00

ldapupdate.py

pylint: remove useless suppression

2023-01-10 08:30:58 +01:00

odsexporterinstance.py

odsexporterinstance: use late binding for UID/GID resolution

2020-12-22 14:05:13 +02:00

opendnssecinstance.py

opendnssecinstance: use late binding for UID/GID resolution

2020-12-22 14:05:13 +02:00

otpdinstance.py

Enable pylint missing-final-newline check

2015-12-23 07:59:22 +01:00

replication.py

check_repl_update: in progress is a boolean

2022-08-16 08:39:06 +02:00

schemaupdate.py

Unify access to FQDN

2020-10-26 17:11:19 +11:00

service.py

LDAP autobind authenticateAsDN for BIND named

2021-06-15 14:13:16 +03:00

sysupgrade.py

Add absolute_import future imports

2018-04-20 09:43:37 +02:00

upgradeinstance.py

Use get_replication_plugin_name in LDAP updater

2021-06-21 10:58:02 +02:00