freeipa/ipaserver
Rob Crittenden 8c241869dd Don't always override the port in import_included_profiles
I can only guess to the original purpose of this override. I
believe it was because this is called in the installer prior
to Apache being set up. The expectation was that this would
only be called locally. It predates the RestClient class.

RestClient will attempt to find an available service. In this
case, during a CA installation, the local server is not
considered available because it lacks an entry in
cn=masters. So it will never be returned as an option.

So by overriding the port to 8443 the remote connection will
likely fail because we don't require that the port be open.

So instead, instantiate a RestClient and see what happens.

There are several use-cases:

1. Installing an initial server. The RestClient connection
   should fail, so we will fall back to the override port and
   use the local server. If Apache happens to be running with
   a globally-issued certificate then the RestClient will
   succeed. In this case if the connected host and the local
   hostname are the same, override in that case as well.

2. Installing as a replica. In this case the local server should
   be ignored in all cases and a remote CA will be picked with
   no override done.

3. Switching from CA-less to CA-ful. The web server will be
   trusted but the RestClient login will fail with a 404. Fall
   back to the override port in this case.

The motivation for this is trying to install an EL 8.x replica
against an EL 7.9 server. 8.5+ includes the ACME service and
a new profile is needed which doesn't exist in 7. This was
failing because the RestClient determined that the local server
wasn't running a CA so tried the remote one (7.9) on the override
port 8443. Since this port isn't open: failure.

Chances are that adding the profile is still going to fail
because again, 7.9 lacks ACME capabilities, but it will fail in
a way that allows the installation to continue.

I suspect that all of the overrides can similarly handled, or
handled directly within the RestClient class, but for the sake
of "do no harm" I'm only changing this instance for now.

https://pagure.io/freeipa/issue/9100

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2022-02-03 13:36:18 -05:00
..
advise ipa-advise: Define the domain used when looking up ipa-ca 2021-08-03 11:05:15 -04:00
custodia Also drop Custodia client and forwarder 2021-06-16 10:28:17 -04:00
dnssec freeipa.spec: depend on bind-dnssec-utils 2021-11-25 16:49:00 +01:00
install Don't always override the port in import_included_profiles 2022-02-03 13:36:18 -05:00
plugins Config plugin: return EmptyModlist when no change is applied 2022-01-13 14:20:59 -05:00
secrets Custodia: use a stronger encryption algo when exporting keys 2022-01-31 10:08:43 +01:00
__init__.py Change FreeIPA license to GPLv3+ 2010-12-20 17:19:53 -05:00
dcerpc_common.py Py3: Replace six.text_type with str 2018-09-27 16:11:18 +02:00
dcerpc.py trust-fetch-domains: use custom krb5.conf overlay for all trust operations 2021-01-22 12:21:33 -05:00
dns_data_management.py Add URI system records for KDC 2021-08-31 18:28:27 -04:00
Makefile.am Build: Makefiles for Python packages 2016-11-09 13:08:32 +01:00
masters.py Add hidden replica feature 2019-03-28 17:57:58 +01:00
p11helper.py Grammar: whitespace is a word 2020-06-23 10:16:29 +02:00
rpcserver.py ipa config: add --enable-sid option 2021-11-02 10:11:28 +01:00
servroles.py Use api.env.container_sysaccounts 2020-04-28 11:28:29 +02:00
setup.cfg Port all setup.py to setuptools 2016-10-20 18:43:37 +02:00
setup.py Also drop Custodia client and forwarder 2021-06-16 10:28:17 -04:00
topology.py Py3: Remove subclassing from object 2018-09-27 11:49:04 +02:00
wsgi.py Improve wsgi app loading 2021-04-07 11:43:23 +03:00