From 12124fcb8c908d208d8863c00cf19a511bd54d1c Mon Sep 17 00:00:00 2001

From: Antonio Torres <antorres@redhat.com>

Date: Fri, 11 Jun 2021 14:00:08 +0200

Subject: [PATCH] Allow PKINIT to be enabled when updating from a pre-PKINIT

 IPA CA server

When upgrading from a server with IPA CA before PKINIT was introduced

(4.5), PKINIT would not be enabled and there wasn't any way to enable it

since upgrade code only issues self-signed certificates when

certificates are missing. With these change there is a way to enable

PKINIT when coming from a IPA server with a pre-PKINIT version (4.4 and

before).

Fixes: https://pagure.io/freeipa/issue/8532

Signed-off-by: Antonio Torres <antorres@redhat.com>

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

---

 ipaserver/install/ipa_pkinit_manage.py | 2 ++

 1 file changed, 2 insertions(+)

diff --git a/ipaserver/install/ipa_pkinit_manage.py b/ipaserver/install/ipa_pkinit_manage.py

index 86bd1baf00178a629864b210ca9f4786668149df..bf5875d4f3f35465e6a9ff708d19c25bc3f95063 100644

--- a/ipaserver/install/ipa_pkinit_manage.py

+++ b/ipaserver/install/ipa_pkinit_manage.py

@@ -78,6 +78,8 @@ class PKINITManage(AdminTool):

             krb.enable_ssl()

         if setup_pkinit:

+            if not is_pkinit_enabled():

+                krb.setup_pkinit()

             krb.pkinit_enable()

         else:

             krb.pkinit_disable()

-- 

2.26.3