pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0052-Ensure-KDC-is-propery-configured-after-upgrade.patch

ac7d03
From 73ed5d59d0777329450cb8d6dce78f8ee862068b Mon Sep 17 00:00:00 2001
ac7d03
From: Martin Babinsky <mbabinsk@redhat.com>
ac7d03
Date: Wed, 22 Mar 2017 11:56:18 +0100
ac7d03
Subject: [PATCH] Ensure KDC is propery configured after upgrade
ac7d03
ac7d03
https://pagure.io/freeipa/issue/6792
ac7d03
ac7d03
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
ac7d03
---
ac7d03
 ipaserver/install/server/upgrade.py | 10 +++++-----
ac7d03
 1 file changed, 5 insertions(+), 5 deletions(-)
ac7d03
ac7d03
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
ac7d03
index be07d78585d4772eb6dd0aaa8fb4ccb588c42c65..0db764cb80f6d0fb22f00719dadf1f921f97bf62 100644
ac7d03
--- a/ipaserver/install/server/upgrade.py
ac7d03
+++ b/ipaserver/install/server/upgrade.py
ac7d03
@@ -1499,15 +1499,14 @@ def enable_anonymous_principal(krb):
ac7d03
 def setup_pkinit(krb):
ac7d03
     root_logger.info("[Setup PKINIT]")
ac7d03
 
ac7d03
-    if os.path.exists(paths.KDC_CERT):
ac7d03
-        root_logger.info("PKINIT already set up")
ac7d03
-        return
ac7d03
-
ac7d03
     if not api.Command.ca_is_enabled()['result']:
ac7d03
         root_logger.info("CA is not enabled")
ac7d03
         return
ac7d03
 
ac7d03
-    krb.setup_pkinit()
ac7d03
+    if not os.path.exists(paths.KDC_CERT):
ac7d03
+        root_logger.info("Requesting PKINIT certificate")
ac7d03
+        krb.setup_pkinit()
ac7d03
+
ac7d03
     replacevars = dict()
ac7d03
     replacevars['pkinit_identity'] = 'FILE:{},{}'.format(
ac7d03
         paths.KDC_CERT,paths.KDC_KEY)
ac7d03
@@ -1519,6 +1518,7 @@ def setup_pkinit(krb):
ac7d03
     if krb.is_running():
ac7d03
         krb.stop()
ac7d03
     krb.start()
ac7d03
+    krb.test_anonymous_pkinit()
ac7d03
 
ac7d03
 
ac7d03
 def disable_httpd_system_trust(http):
ac7d03
-- 
ac7d03
2.12.2
ac7d03