|
 |
590d18 |
From d644d5533a7ccf61cc557f8fe8a5ee1d93bc19fd Mon Sep 17 00:00:00 2001
|
|
|
590d18 |
From: Jan Cholasta <jcholast@redhat.com>
|
|
|
590d18 |
Date: Wed, 16 Sep 2015 09:05:20 +0200
|
|
|
590d18 |
Subject: [PATCH] install: always export KRA agent PEM file
|
|
|
590d18 |
|
|
|
590d18 |
Export the file even when KRA is not installed locally so that vault commands
|
|
|
590d18 |
work on all IPA replicas.
|
|
|
590d18 |
|
|
|
590d18 |
https://fedorahosted.org/freeipa/ticket/5302
|
|
|
590d18 |
|
|
|
590d18 |
Reviewed-By: Martin Basti <mbasti@redhat.com>
|
|
|
590d18 |
---
|
|
|
590d18 |
install/restart_scripts/renew_ra_cert | 3 +--
|
|
|
590d18 |
ipaserver/install/cainstance.py | 8 ++++++--
|
|
|
590d18 |
ipaserver/install/krainstance.py | 2 --
|
|
|
590d18 |
ipaserver/install/server/upgrade.py | 5 ++---
|
|
|
590d18 |
4 files changed, 9 insertions(+), 9 deletions(-)
|
|
|
590d18 |
|
|
|
590d18 |
diff --git a/install/restart_scripts/renew_ra_cert b/install/restart_scripts/renew_ra_cert
|
|
|
590d18 |
index 8a6bf3f7c1081db9710cf29e0f8e5f705d920b72..3a36f739ae53391e502356f7b6b4fd96a536c3a6 100644
|
|
|
590d18 |
--- a/install/restart_scripts/renew_ra_cert
|
|
|
590d18 |
+++ b/install/restart_scripts/renew_ra_cert
|
|
|
590d18 |
@@ -61,8 +61,7 @@ def _main():
|
|
|
590d18 |
# Load it into dogtag
|
|
|
590d18 |
cainstance.update_people_entry(dercert)
|
|
|
590d18 |
|
|
|
590d18 |
- kra = krainstance.KRAInstance(api.env.realm)
|
|
|
590d18 |
- if kra.is_installed():
|
|
|
590d18 |
+ if api.Command.kra_is_enabled()['result']:
|
|
|
590d18 |
krainstance.export_kra_agent_pem()
|
|
|
590d18 |
finally:
|
|
|
590d18 |
shutil.rmtree(tmpdir)
|
|
|
590d18 |
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
|
|
|
590d18 |
index a4504a35a42b8c8ea2a96738c82c546ebebf569f..dfe023c08c9b8d1b28f1659b7c5a6395f3afe879 100644
|
|
|
590d18 |
--- a/ipaserver/install/cainstance.py
|
|
|
590d18 |
+++ b/ipaserver/install/cainstance.py
|
|
|
590d18 |
@@ -62,8 +62,8 @@ from ipaserver.install import certs
|
|
|
590d18 |
from ipaserver.install import dsinstance
|
|
|
590d18 |
from ipaserver.install import installutils
|
|
|
590d18 |
from ipaserver.install import service
|
|
|
590d18 |
-from ipaserver.install.dogtaginstance import DogtagInstance
|
|
|
590d18 |
-from ipaserver.install.dogtaginstance import PKI_USER, DEFAULT_DSPORT
|
|
|
590d18 |
+from ipaserver.install.dogtaginstance import (
|
|
|
590d18 |
+ DEFAULT_DSPORT, PKI_USER, export_kra_agent_pem, DogtagInstance)
|
|
|
590d18 |
from ipaserver.plugins import ldap2
|
|
|
590d18 |
|
|
|
590d18 |
|
|
|
590d18 |
@@ -885,6 +885,8 @@ class CAInstance(DogtagInstance):
|
|
|
590d18 |
finally:
|
|
|
590d18 |
os.remove(agent_name)
|
|
|
590d18 |
|
|
|
590d18 |
+ export_kra_agent_pem()
|
|
|
590d18 |
+
|
|
|
590d18 |
def import_ra_cert(self, rafile):
|
|
|
590d18 |
"""
|
|
|
590d18 |
Cloned RAs will use the same RA agent cert as the master so we
|
|
|
590d18 |
@@ -903,6 +905,8 @@ class CAInstance(DogtagInstance):
|
|
|
590d18 |
|
|
|
590d18 |
self.configure_agent_renewal()
|
|
|
590d18 |
|
|
|
590d18 |
+ export_kra_agent_pem()
|
|
|
590d18 |
+
|
|
|
590d18 |
def __create_ca_agent(self):
|
|
|
590d18 |
"""
|
|
|
590d18 |
Create CA agent, assign a certificate, and add the user to
|
|
|
590d18 |
diff --git a/ipaserver/install/krainstance.py b/ipaserver/install/krainstance.py
|
|
|
590d18 |
index 0000192745b6d7f9f402267e435f7223f1bf8849..69fe636732e6d3a8c1e0c460b641f061e519df92 100644
|
|
|
590d18 |
--- a/ipaserver/install/krainstance.py
|
|
|
590d18 |
+++ b/ipaserver/install/krainstance.py
|
|
|
590d18 |
@@ -262,8 +262,6 @@ class KRAInstance(DogtagInstance):
|
|
|
590d18 |
|
|
|
590d18 |
shutil.move(paths.KRA_BACKUP_KEYS_P12, paths.KRACERT_P12)
|
|
|
590d18 |
|
|
|
590d18 |
- export_kra_agent_pem()
|
|
|
590d18 |
-
|
|
|
590d18 |
self.log.debug("completed creating KRA instance")
|
|
|
590d18 |
|
|
|
590d18 |
def __create_kra_agent(self):
|
|
|
590d18 |
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
|
|
|
590d18 |
index ab08c62352c0e5cf145f299e7727886b2f295037..51a2dd3d0e3693c12f11579a84175c7719651da9 100644
|
|
|
590d18 |
--- a/ipaserver/install/server/upgrade.py
|
|
|
590d18 |
+++ b/ipaserver/install/server/upgrade.py
|
|
|
590d18 |
@@ -1252,9 +1252,8 @@ def export_kra_agent_pem():
|
|
|
590d18 |
root_logger.info("KRA agent PEM file already exported")
|
|
|
590d18 |
return
|
|
|
590d18 |
|
|
|
590d18 |
- kra = krainstance.KRAInstance(api.env.realm)
|
|
|
590d18 |
- if not kra.is_installed():
|
|
|
590d18 |
- root_logger.info("KRA is not installed")
|
|
|
590d18 |
+ if not api.Command.kra_is_enabled()['result']:
|
|
|
590d18 |
+ root_logger.info("KRA is not enabled")
|
|
|
590d18 |
return
|
|
|
590d18 |
|
|
|
590d18 |
krainstance.export_kra_agent_pem()
|
|
|
590d18 |
--
|
|
|
590d18 |
2.4.3
|
|
|
590d18 |
|