In order to generate the private key for a a LWCA (subca)
on an HSM the name of the subca needs to be the HSM token
name : name_of_subca, e.g. ipa_token:test.
This works fine now without any code changes but it requires
that admins always remember to include the prefix which is
unlikely (everyone makes mistakes). So do it for them if
an HSM is present and a token is not provided. We only support
one token at a time in IPA so for now this is sufficient.
One can also mix-and-match including the token and not.
For example you can run:
$ ipa ca-add test --subject cn=test
$ ipa ca-show ipa_token:test
It shouldn't be an issue if a lwca name contains a colon.
Fixes: https://pagure.io/freeipa/issue/9865
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Rob Crittenden
3b5caf9dbd