pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0127-renew-agent-respect-CA-renewal-master-setting.patch

ac7d03
From 55e779b19714532744c8b22e514e9e49563350e3 Mon Sep 17 00:00:00 2001
ac7d03
From: Jan Cholasta <jcholast@redhat.com>
ac7d03
Date: Mon, 24 Apr 2017 05:24:24 +0000
ac7d03
Subject: [PATCH] renew agent: respect CA renewal master setting
ac7d03
ac7d03
Do not bypass the renewal master check when a non-virtual profile is used
ac7d03
in dogtag-ipa-ca-renew-agent-submit.
ac7d03
ac7d03
This fixes dogtag-ipa-ca-renew-agent not respecting the CA renewal master
ac7d03
setting for certificates tracked with a real profile. (Note that there
ac7d03
currently aren't any such certificates tracked by us.)
ac7d03
ac7d03
Request the RA certificate using dogtag-submit rather than
ac7d03
dogtag-ipa-ca-renew-agent-submit as the CA renewal master setting is not
ac7d03
available so early in the install process.
ac7d03
ac7d03
https://pagure.io/freeipa/issue/5799
ac7d03
ac7d03
Reviewed-By: David Kupka <dkupka@redhat.com>
ac7d03
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
ac7d03
---
ac7d03
 install/certmonger/dogtag-ipa-ca-renew-agent-submit | 2 +-
ac7d03
 ipaserver/install/cainstance.py                     | 2 +-
ac7d03
 2 files changed, 2 insertions(+), 2 deletions(-)
ac7d03
ac7d03
diff --git a/install/certmonger/dogtag-ipa-ca-renew-agent-submit b/install/certmonger/dogtag-ipa-ca-renew-agent-submit
ac7d03
index 7a3d9551884c0fe43566dd9012699211a39294eb..f253fd9587ac1ef3ece712ca9999c1ea4f3d55d8 100755
ac7d03
--- a/install/certmonger/dogtag-ipa-ca-renew-agent-submit
ac7d03
+++ b/install/certmonger/dogtag-ipa-ca-renew-agent-submit
ac7d03
@@ -535,7 +535,7 @@ def main():
ac7d03
 
ac7d03
         profile = os.environ.get('CERTMONGER_CA_PROFILE')
ac7d03
         if is_replicated():
ac7d03
-            if profile or is_renewal_master():
ac7d03
+            if is_renewal_master():
ac7d03
                 handler = request_and_store_cert
ac7d03
             else:
ac7d03
                 handler = retrieve_cert_continuous
ac7d03
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
ac7d03
index d72feb884964ecf49fe0166cbfeb3cb2c10737fe..97baa606c960806376e025b5654eea816da207ed 100644
ac7d03
--- a/ipaserver/install/cainstance.py
ac7d03
+++ b/ipaserver/install/cainstance.py
ac7d03
@@ -822,7 +822,7 @@ class CAInstance(DogtagInstance):
ac7d03
              "-out", chain_file.name,
ac7d03
              ], stdin=data, capture_output=False)
ac7d03
 
ac7d03
-        agent_args = [paths.DOGTAG_IPA_CA_RENEW_AGENT_SUBMIT,
ac7d03
+        agent_args = [paths.CERTMONGER_DOGTAG_SUBMIT,
ac7d03
                       "--dbdir", self.tmp_agent_db,
ac7d03
                       "--nickname", "ipa-ca-agent",
ac7d03
                       "--cafile", chain_file.name,
ac7d03
-- 
ac7d03
2.9.3
ac7d03