mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-11-02 20:30:26 -06:00
Rob Crittenden
3b5caf9dbd
In order to generate the private key for a a LWCA (subca) on an HSM the name of the subca needs to be the HSM token name : name_of_subca, e.g. ipa_token:test. This works fine now without any code changes but it requires that admins always remember to include the prefix which is unlikely (everyone makes mistakes). So do it for them if an HSM is present and a token is not provided. We only support one token at a time in IPA so for now this is sufficient. One can also mix-and-match including the token and not. For example you can run: $ ipa ca-add test --subject cn=test $ ipa ca-show ipa_token:test It shouldn't be an issue if a lwca name contains a colon. Fixes: https://pagure.io/freeipa/issue/9865 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>