|
 |
483b06 |
From 58a9bd7ec98de555db23159e614b2021ec91b2e3 Mon Sep 17 00:00:00 2001
|
|
|
483b06 |
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
483b06 |
Date: Thu, 11 May 2017 14:53:09 +0200
|
|
|
483b06 |
Subject: [PATCH] ipa-kra-install: fix pkispawn setting for
|
|
|
483b06 |
pki_security_domain_hostname
|
|
|
483b06 |
|
|
|
483b06 |
During ipa-kra-install, the installer prepares a configuration file
|
|
|
483b06 |
provided to pkispawn. This configuration file defines
|
|
|
483b06 |
pki_security_domain_hostname=(first master)
|
|
|
483b06 |
|
|
|
483b06 |
but when we are installing a clone, it should be set to the local hostname
|
|
|
483b06 |
instead, see man page pki_default.cfg:
|
|
|
483b06 |
pki_security_domain_hostname, pki_security_domain_https_port
|
|
|
483b06 |
Location of the security domain. Required for KRA, OCSP, TKS,
|
|
|
483b06 |
and TPS subsystems and for CA subsystems joining a security
|
|
|
483b06 |
domain. Defaults to the location of the CA subsystem within the
|
|
|
483b06 |
same instance.
|
|
|
483b06 |
|
|
|
483b06 |
When pki_security_domain_hostname points to the 1st master, and this first
|
|
|
483b06 |
master is decommissioned, ipa-kra-install fails on new replicas because pkispawn
|
|
|
483b06 |
tries to connect to this (non-existing) host.
|
|
|
483b06 |
|
|
|
483b06 |
https://pagure.io/freeipa/issue/6895
|
|
|
483b06 |
|
|
|
483b06 |
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
|
|
|
483b06 |
---
|
|
|
483b06 |
ipaserver/install/krainstance.py | 2 +-
|
|
|
483b06 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
483b06 |
|
|
|
483b06 |
diff --git a/ipaserver/install/krainstance.py b/ipaserver/install/krainstance.py
|
|
|
483b06 |
index abb81897a404613e20be10d348096402ef08624b..cdd25b9d05bcb1a30260475cc2341a258a3cf93c 100644
|
|
|
483b06 |
--- a/ipaserver/install/krainstance.py
|
|
|
483b06 |
+++ b/ipaserver/install/krainstance.py
|
|
|
483b06 |
@@ -252,7 +252,7 @@ class KRAInstance(DogtagInstance):
|
|
|
483b06 |
os.chown(p12_tmpfile_name, pent.pw_uid, pent.pw_gid)
|
|
|
483b06 |
|
|
|
483b06 |
# Security domain registration
|
|
|
483b06 |
- config.set("KRA", "pki_security_domain_hostname", self.master_host)
|
|
|
483b06 |
+ config.set("KRA", "pki_security_domain_hostname", self.fqdn)
|
|
|
483b06 |
config.set("KRA", "pki_security_domain_https_port", "443")
|
|
|
483b06 |
config.set("KRA", "pki_security_domain_user", self.admin_user)
|
|
|
483b06 |
config.set("KRA", "pki_security_domain_password",
|
|
|
483b06 |
--
|
|
|
483b06 |
2.9.4
|
|
|
483b06 |
|