|
 |
979ee0 |
From 5aa15e551fe9b76c3e89862fe36b661825a807ce Mon Sep 17 00:00:00 2001
|
|
|
979ee0 |
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
979ee0 |
Date: Tue, 4 Sep 2018 14:15:50 +0200
|
|
|
979ee0 |
Subject: [PATCH] ipa-replica-install: fix pkinit setup
|
|
|
979ee0 |
|
|
|
979ee0 |
commit 7284097 (Delay enabling services until end of installer)
|
|
|
979ee0 |
introduced a regression in replica installation.
|
|
|
979ee0 |
When the replica requests a cert for PKINIT, a check is done
|
|
|
979ee0 |
to ensure that the hostname corresponds to a machine with a
|
|
|
979ee0 |
KDC service enabled (ipaconfigstring attribute of
|
|
|
979ee0 |
cn=KDC,cn=<hostname>,cn=masters,cn=ipa,cn=etc,$BASEDN must contain
|
|
|
979ee0 |
'enabledService').
|
|
|
979ee0 |
With the commit mentioned above, the service is set to enabled only
|
|
|
979ee0 |
at the end of the installation.
|
|
|
979ee0 |
|
|
|
979ee0 |
The fix makes a less strict check, ensuring that 'enabledService'
|
|
|
979ee0 |
or 'configuredService' is in ipaconfigstring.
|
|
|
979ee0 |
|
|
|
979ee0 |
Fixes: https://pagure.io/freeipa/issue/7566
|
|
|
979ee0 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
979ee0 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
979ee0 |
---
|
|
|
979ee0 |
ipaserver/plugins/cert.py | 3 ++-
|
|
|
979ee0 |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
979ee0 |
|
|
|
979ee0 |
diff --git a/ipaserver/plugins/cert.py b/ipaserver/plugins/cert.py
|
|
|
979ee0 |
index 501fc9015468c864215cfb604de37cdf6d805e52..60ad140da3b1483ffe5918239a489030ccc7fe96 100644
|
|
|
979ee0 |
--- a/ipaserver/plugins/cert.py
|
|
|
979ee0 |
+++ b/ipaserver/plugins/cert.py
|
|
|
979ee0 |
@@ -230,7 +230,8 @@ def ca_kdc_check(api_instance, hostname):
|
|
|
979ee0 |
|
|
|
979ee0 |
ipaconfigstring = {val.lower() for val in kdc_entry['ipaConfigString']}
|
|
|
979ee0 |
|
|
|
979ee0 |
- if 'enabledservice' not in ipaconfigstring:
|
|
|
979ee0 |
+ if 'enabledservice' not in ipaconfigstring \
|
|
|
979ee0 |
+ and 'configuredservice' not in ipaconfigstring:
|
|
|
979ee0 |
raise errors.NotFound()
|
|
|
979ee0 |
|
|
|
979ee0 |
except errors.NotFound:
|
|
|
979ee0 |
--
|
|
|
979ee0 |
2.17.1
|
|
|
979ee0 |
|