|
 |
483b06 |
From 71061059a6c56bad818cb379070ef742bbe517a3 Mon Sep 17 00:00:00 2001
|
|
|
483b06 |
From: Stanislav Laznicka <slaznick@redhat.com>
|
|
|
483b06 |
Date: Mon, 3 Apr 2017 14:08:46 +0200
|
|
|
483b06 |
Subject: [PATCH] Add pki_pin only when needed
|
|
|
483b06 |
|
|
|
483b06 |
If both the pki-tomcat NSS database and its password.conf have been
|
|
|
483b06 |
created, don't try to override the password.conf file.
|
|
|
483b06 |
|
|
|
483b06 |
https://pagure.io/freeipa/issue/6839
|
|
|
483b06 |
|
|
|
483b06 |
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
|
|
|
483b06 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
483b06 |
---
|
|
|
483b06 |
ipaserver/install/cainstance.py | 10 +++++++---
|
|
|
483b06 |
ipaserver/install/krainstance.py | 10 +++++++---
|
|
|
483b06 |
2 files changed, 14 insertions(+), 6 deletions(-)
|
|
|
483b06 |
|
|
|
483b06 |
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
|
|
|
483b06 |
index 92bb760d39d23fedb40b7e3c5bea53381f1c87ad..3980e412603437b0db5804623f6626d11e52c009 100644
|
|
|
483b06 |
--- a/ipaserver/install/cainstance.py
|
|
|
483b06 |
+++ b/ipaserver/install/cainstance.py
|
|
|
483b06 |
@@ -541,9 +541,13 @@ class CAInstance(DogtagInstance):
|
|
|
483b06 |
# CA key algorithm
|
|
|
483b06 |
config.set("CA", "pki_ca_signing_key_algorithm", self.ca_signing_algorithm)
|
|
|
483b06 |
|
|
|
483b06 |
- # generate pin which we know can be used for FIPS NSS database
|
|
|
483b06 |
- pki_pin = ipautil.ipa_generate_password()
|
|
|
483b06 |
- config.set("CA", "pki_pin", pki_pin)
|
|
|
483b06 |
+ if not (os.path.isdir(paths.PKI_TOMCAT_ALIAS_DIR) and
|
|
|
483b06 |
+ os.path.isfile(paths.PKI_TOMCAT_PASSWORD_CONF)):
|
|
|
483b06 |
+ # generate pin which we know can be used for FIPS NSS database
|
|
|
483b06 |
+ pki_pin = ipautil.ipa_generate_password()
|
|
|
483b06 |
+ config.set("CA", "pki_pin", pki_pin)
|
|
|
483b06 |
+ else:
|
|
|
483b06 |
+ pki_pin = None
|
|
|
483b06 |
|
|
|
483b06 |
if self.clone:
|
|
|
483b06 |
|
|
|
483b06 |
diff --git a/ipaserver/install/krainstance.py b/ipaserver/install/krainstance.py
|
|
|
483b06 |
index 34d667857a8055752e258a591af983190f33daa5..fc25ac72b0dc593f06a8b070b67b5d54a0ab8bce 100644
|
|
|
483b06 |
--- a/ipaserver/install/krainstance.py
|
|
|
483b06 |
+++ b/ipaserver/install/krainstance.py
|
|
|
483b06 |
@@ -235,9 +235,13 @@ class KRAInstance(DogtagInstance):
|
|
|
483b06 |
"KRA", "pki_share_dbuser_dn",
|
|
|
483b06 |
str(DN(('uid', 'pkidbuser'), ('ou', 'people'), ('o', 'ipaca'))))
|
|
|
483b06 |
|
|
|
483b06 |
- # generate pin which we know can be used for FIPS NSS database
|
|
|
483b06 |
- pki_pin = ipautil.ipa_generate_password()
|
|
|
483b06 |
- config.set("KRA", "pki_pin", pki_pin)
|
|
|
483b06 |
+ if not (os.path.isdir(paths.PKI_TOMCAT_ALIAS_DIR) and
|
|
|
483b06 |
+ os.path.isfile(paths.PKI_TOMCAT_PASSWORD_CONF)):
|
|
|
483b06 |
+ # generate pin which we know can be used for FIPS NSS database
|
|
|
483b06 |
+ pki_pin = ipautil.ipa_generate_password()
|
|
|
483b06 |
+ config.set("KRA", "pki_pin", pki_pin)
|
|
|
483b06 |
+ else:
|
|
|
483b06 |
+ pki_pin = None
|
|
|
483b06 |
|
|
|
483b06 |
_p12_tmpfile_handle, p12_tmpfile_name = tempfile.mkstemp(dir=paths.TMP)
|
|
|
483b06 |
|
|
|
483b06 |
--
|
|
|
483b06 |
2.9.3
|
|
|
483b06 |
|