pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0182-server-upgrade-do-not-enable-PKINIT-by-default.patch

ac7d03
From 1ab5b1a4cdcab8b913f42488ae642a9f0ef77d92 Mon Sep 17 00:00:00 2001
ac7d03
From: Jan Cholasta <jcholast@redhat.com>
ac7d03
Date: Mon, 5 Jun 2017 12:42:52 +0000
ac7d03
Subject: [PATCH] server upgrade: do not enable PKINIT by default
ac7d03
ac7d03
Enabling PKINIT often fails during server upgrade when requesting the KDC
ac7d03
certificate.
ac7d03
ac7d03
Now that PKINIT can be enabled post-install using ipa-pkinit-manage, avoid
ac7d03
the upgrade failure by not enabling PKINIT by default.
ac7d03
ac7d03
https://pagure.io/freeipa/issue/7000
ac7d03
ac7d03
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
ac7d03
---
ac7d03
 ipaserver/install/server/upgrade.py | 10 ++--------
ac7d03
 1 file changed, 2 insertions(+), 8 deletions(-)
ac7d03
ac7d03
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
ac7d03
index db86353165809c57d1ac27bf762393721231fefd..b1f59d3e29d69bffc11935ec22d4b5f510293355 100644
ac7d03
--- a/ipaserver/install/server/upgrade.py
ac7d03
+++ b/ipaserver/install/server/upgrade.py
ac7d03
@@ -1519,14 +1519,8 @@ def add_default_caacl(ca):
ac7d03
 def setup_pkinit(krb):
ac7d03
     root_logger.info("[Setup PKINIT]")
ac7d03
 
ac7d03
-    pkinit_is_enabled = krbinstance.is_pkinit_enabled()
ac7d03
-    ca_is_enabled = api.Command.ca_is_enabled()['result']
ac7d03
-
ac7d03
-    if not pkinit_is_enabled:
ac7d03
-        if ca_is_enabled:
ac7d03
-            krb.issue_ipa_ca_signed_pkinit_certs()
ac7d03
-        else:
ac7d03
-            krb.issue_selfsigned_pkinit_certs()
ac7d03
+    if not krbinstance.is_pkinit_enabled():
ac7d03
+        krb.issue_selfsigned_pkinit_certs()
ac7d03
 
ac7d03
     aug = Augeas(flags=Augeas.NO_LOAD | Augeas.NO_MODL_AUTOLOAD,
ac7d03
                  loadpath=paths.USR_SHARE_IPA_DIR)
ac7d03
-- 
ac7d03
2.9.4
ac7d03