freeipa/ipalib/install
Florence Blanc-Renaud 69bda6b440 Fix ipa-server-upgrade: This entry already exists
ipa-server-upgrade fails when running the ipaload_cacrt plugin. The plugin
finds all CA certificates in /etc/httpd/alias and uploads them in LDAP
below cn=certificates,cn=ipa,cn=etc,$BASEDN.
The issue happens because there is already an entry in LDAP for IPA CA, but
with a different DN. The nickname in /etc/httpd/alias can differ from
$DOMAIN IPA CA.

To avoid the issue:
1/ during upgrade, run a new plugin that removes duplicates and restarts ldap
(to make sure that uniqueness attr plugin is working after the new plugin)
2/ modify upload_cacert plugin so that it is using $DOMAIN IPA CA instead of
cn=$nickname,cn=ipa,cn=etc,$BASEDN when uploading IPA CA.

https://pagure.io/freeipa/issue/7125

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-08-30 12:47:53 +02:00
..
__init__.py install: introduce installer class hierarchy 2016-11-11 12:17:25 +01:00
certmonger.py Include the CA basic constraint in CSRs when renewing a CA 2017-08-22 11:05:37 +02:00
certstore.py Fix ipa-server-upgrade: This entry already exists 2017-08-30 12:47:53 +02:00
hostname.py Only warn when specified server IP addresses don't match intf 2017-06-06 18:10:33 +02:00
kinit.py logging: do not log into the root logger 2017-07-14 15:55:59 +02:00
service.py install: re-introduce option groups 2017-03-13 10:12:40 +01:00
sysrestore.py logging: do not log into the root logger 2017-07-14 15:55:59 +02:00