|
 |
483b06 |
From 60b57639295ab94949986ec59de3c8e6c92bee7d Mon Sep 17 00:00:00 2001
|
|
|
483b06 |
From: Stanislav Laznicka <slaznick@redhat.com>
|
|
|
483b06 |
Date: Wed, 22 Mar 2017 17:26:51 +0100
|
|
|
483b06 |
Subject: [PATCH] Don't allow setting pkinit-related options on DL0
|
|
|
483b06 |
|
|
|
483b06 |
pkinit is not supported on DL0, remove options that allow to set it
|
|
|
483b06 |
from ipa-{server,replica}-install.
|
|
|
483b06 |
|
|
|
483b06 |
https://pagure.io/freeipa/issue/6801
|
|
|
483b06 |
|
|
|
483b06 |
Reviewed-By: Martin Basti <mbasti@redhat.com>
|
|
|
483b06 |
---
|
|
|
483b06 |
install/tools/man/ipa-replica-install.1 | 2 +-
|
|
|
483b06 |
install/tools/man/ipa-server-install.1 | 2 +-
|
|
|
483b06 |
ipaserver/install/server/__init__.py | 21 +++++++++++++++++++++
|
|
|
483b06 |
3 files changed, 23 insertions(+), 2 deletions(-)
|
|
|
483b06 |
|
|
|
483b06 |
diff --git a/install/tools/man/ipa-replica-install.1 b/install/tools/man/ipa-replica-install.1
|
|
|
483b06 |
index d63912c7018bd09a8567688a1f8d4db0c698ac3f..7d241324818dd3a5294da5e84b67a19d0d9a31b6 100644
|
|
|
483b06 |
--- a/install/tools/man/ipa-replica-install.1
|
|
|
483b06 |
+++ b/install/tools/man/ipa-replica-install.1
|
|
|
483b06 |
@@ -114,7 +114,7 @@ Install and configure a CA on this replica. If a CA is not configured then
|
|
|
483b06 |
certificate operations will be forwarded to a master with a CA installed.
|
|
|
483b06 |
.TP
|
|
|
483b06 |
\fB\-\-no\-pkinit\fR
|
|
|
483b06 |
-Disables pkinit setup steps
|
|
|
483b06 |
+Disables pkinit setup steps. This is the default and only allowed behavior on domain level 0.
|
|
|
483b06 |
.TP
|
|
|
483b06 |
\fB\-\-dirsrv\-cert\-file\fR=FILE
|
|
|
483b06 |
File containing the Directory Server SSL certificate and private key
|
|
|
483b06 |
diff --git a/install/tools/man/ipa-server-install.1 b/install/tools/man/ipa-server-install.1
|
|
|
483b06 |
index c48bdae7485a34d72381188191d6423ca2d16044..d5d28df8e72295296a9ac321623ead49fe4692a3 100644
|
|
|
483b06 |
--- a/install/tools/man/ipa-server-install.1
|
|
|
483b06 |
+++ b/install/tools/man/ipa-server-install.1
|
|
|
483b06 |
@@ -93,7 +93,7 @@ Type of the external CA. Possible values are "generic", "ms-cs". Default value i
|
|
|
483b06 |
File containing the IPA CA certificate and the external CA certificate chain. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times.
|
|
|
483b06 |
.TP
|
|
|
483b06 |
\fB\-\-no\-pkinit\fR
|
|
|
483b06 |
-Disables pkinit setup steps
|
|
|
483b06 |
+Disables pkinit setup steps. This is the default and only allowed behavior on domain level 0.
|
|
|
483b06 |
.TP
|
|
|
483b06 |
\fB\-\-dirsrv\-cert\-file\fR=\fIFILE\fR
|
|
|
483b06 |
File containing the Directory Server SSL certificate and private key. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. This option may be used multiple times.
|
|
|
483b06 |
diff --git a/ipaserver/install/server/__init__.py b/ipaserver/install/server/__init__.py
|
|
|
483b06 |
index 117f51c4ebfaeba51d3c85625cda0d0eee305696..096cb0142fc7fe70fdc3d2ad1e5caedf0f65b643 100644
|
|
|
483b06 |
--- a/ipaserver/install/server/__init__.py
|
|
|
483b06 |
+++ b/ipaserver/install/server/__init__.py
|
|
|
483b06 |
@@ -332,9 +332,24 @@ class ServerInstallInterface(ServerCertificateInstallInterface,
|
|
|
483b06 |
if not os.path.exists(value):
|
|
|
483b06 |
raise ValueError("File %s does not exist." % value)
|
|
|
483b06 |
|
|
|
483b06 |
+ def _is_promote(self):
|
|
|
483b06 |
+ """
|
|
|
483b06 |
+ :returns: True if domain level options correspond to domain level > 0
|
|
|
483b06 |
+ """
|
|
|
483b06 |
+ raise NotImplementedError()
|
|
|
483b06 |
+
|
|
|
483b06 |
def __init__(self, **kwargs):
|
|
|
483b06 |
super(ServerInstallInterface, self).__init__(**kwargs)
|
|
|
483b06 |
|
|
|
483b06 |
+ # pkinit is not supported on DL0, don't allow related options
|
|
|
483b06 |
+ if not self._is_promote():
|
|
|
483b06 |
+ if (self.no_pkinit or self.pkinit_cert_files is not None or
|
|
|
483b06 |
+ self.pkinit_pin is not None):
|
|
|
483b06 |
+ raise RuntimeError(
|
|
|
483b06 |
+ "pkinit on domain level 0 is not supported. Please "
|
|
|
483b06 |
+ "don't use any pkinit-related options.")
|
|
|
483b06 |
+ self.no_pkinit = True
|
|
|
483b06 |
+
|
|
|
483b06 |
# If any of the key file options are selected, all are required.
|
|
|
483b06 |
cert_file_req = (self.dirsrv_cert_files, self.http_cert_files)
|
|
|
483b06 |
cert_file_opt = (self.pkinit_cert_files,)
|
|
|
483b06 |
@@ -557,6 +572,9 @@ class ServerMasterInstall(ServerMasterInstallInterface):
|
|
|
483b06 |
add_sids = True
|
|
|
483b06 |
add_agents = False
|
|
|
483b06 |
|
|
|
483b06 |
+ def _is_promote(self):
|
|
|
483b06 |
+ return self.domain_level > constants.DOMAIN_LEVEL_0
|
|
|
483b06 |
+
|
|
|
483b06 |
def __init__(self, **kwargs):
|
|
|
483b06 |
super(ServerMasterInstall, self).__init__(**kwargs)
|
|
|
483b06 |
master_init(self)
|
|
|
483b06 |
@@ -590,6 +608,9 @@ class ServerReplicaInstall(ServerReplicaInstallInterface):
|
|
|
483b06 |
description="Kerberos password for the specified admin principal",
|
|
|
483b06 |
)
|
|
|
483b06 |
|
|
|
483b06 |
+ def _is_promote(self):
|
|
|
483b06 |
+ return self.replica_file is None
|
|
|
483b06 |
+
|
|
|
483b06 |
def __init__(self, **kwargs):
|
|
|
483b06 |
super(ServerReplicaInstall, self).__init__(**kwargs)
|
|
|
483b06 |
replica_init(self)
|
|
|
483b06 |
--
|
|
|
483b06 |
2.12.2
|
|
|
483b06 |
|