|
 |
86baa9 |
From d868e27dfe7ab9955faebf0a08be3b41971bf816 Mon Sep 17 00:00:00 2001
|
|
|
86baa9 |
From: Fraser Tweedale <ftweedal@redhat.com>
|
|
|
86baa9 |
Date: Fri, 22 Mar 2019 15:22:21 +1100
|
|
|
86baa9 |
Subject: [PATCH] cainstance: add function to determine ca_renewal nickname
|
|
|
86baa9 |
|
|
|
86baa9 |
The ipa-cert-fix program needs to know where to put shared
|
|
|
86baa9 |
certificates. Extract the logic that computes the nickname from
|
|
|
86baa9 |
dogtag-ipa-ca-renew-agent to new subroutine
|
|
|
86baa9 |
cainstance.get_ca_renewal_nickname().
|
|
|
86baa9 |
|
|
|
86baa9 |
Part of: https://pagure.io/freeipa/issue/7885
|
|
|
86baa9 |
|
|
|
86baa9 |
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
86baa9 |
---
|
|
|
86baa9 |
.../dogtag-ipa-ca-renew-agent-submit | 16 ++----------
|
|
|
86baa9 |
ipaserver/install/cainstance.py | 26 +++++++++++++++++++
|
|
|
86baa9 |
2 files changed, 28 insertions(+), 14 deletions(-)
|
|
|
86baa9 |
|
|
|
86baa9 |
diff --git a/install/certmonger/dogtag-ipa-ca-renew-agent-submit b/install/certmonger/dogtag-ipa-ca-renew-agent-submit
|
|
|
86baa9 |
index c2ba9cb842ba835948925a8e415d1e25fe8ee139..31b4a1b7fc23567e91f8aa9938ce4e0941a84a8c 100755
|
|
|
86baa9 |
--- a/install/certmonger/dogtag-ipa-ca-renew-agent-submit
|
|
|
86baa9 |
+++ b/install/certmonger/dogtag-ipa-ca-renew-agent-submit
|
|
|
86baa9 |
@@ -85,20 +85,8 @@ def get_nickname():
|
|
|
86baa9 |
|
|
|
86baa9 |
ca_subject_dn = ca.lookup_ca_subject(api, subject_base)
|
|
|
86baa9 |
|
|
|
86baa9 |
- nickname_by_subject_dn = {
|
|
|
86baa9 |
- DN(ca_subject_dn): 'caSigningCert cert-pki-ca',
|
|
|
86baa9 |
- DN('CN=CA Audit', subject_base): 'auditSigningCert cert-pki-ca',
|
|
|
86baa9 |
- DN('CN=OCSP Subsystem', subject_base): 'ocspSigningCert cert-pki-ca',
|
|
|
86baa9 |
- DN('CN=CA Subsystem', subject_base): 'subsystemCert cert-pki-ca',
|
|
|
86baa9 |
- DN('CN=KRA Audit', subject_base): 'auditSigningCert cert-pki-kra',
|
|
|
86baa9 |
- DN('CN=KRA Transport Certificate', subject_base):
|
|
|
86baa9 |
- 'transportCert cert-pki-kra',
|
|
|
86baa9 |
- DN('CN=KRA Storage Certificate', subject_base):
|
|
|
86baa9 |
- 'storageCert cert-pki-kra',
|
|
|
86baa9 |
- DN('CN=IPA RA', subject_base): 'ipaCert',
|
|
|
86baa9 |
- }
|
|
|
86baa9 |
-
|
|
|
86baa9 |
- return nickname_by_subject_dn.get(DN(subject))
|
|
|
86baa9 |
+ return cainstance.get_ca_renewal_nickname(
|
|
|
86baa9 |
+ subject_base, ca_subject_dn, DN(subject))
|
|
|
86baa9 |
|
|
|
86baa9 |
|
|
|
86baa9 |
def is_replicated():
|
|
|
86baa9 |
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
|
|
|
86baa9 |
index 527ad0a1f492050d452336105cc5cf3c645af693..b4f6262b2c41e2da7992c403154a476aa3b82dd1 100644
|
|
|
86baa9 |
--- a/ipaserver/install/cainstance.py
|
|
|
86baa9 |
+++ b/ipaserver/install/cainstance.py
|
|
|
86baa9 |
@@ -1711,6 +1711,32 @@ def update_authority_entry(cert):
|
|
|
86baa9 |
return __update_entry_from_cert(make_filter, make_entry, cert)
|
|
|
86baa9 |
|
|
|
86baa9 |
|
|
|
86baa9 |
+def get_ca_renewal_nickname(subject_base, ca_subject_dn, sdn):
|
|
|
86baa9 |
+ """
|
|
|
86baa9 |
+ Get the nickname for storage in the cn_renewal container.
|
|
|
86baa9 |
+
|
|
|
86baa9 |
+ :param subject_base: Certificate subject base
|
|
|
86baa9 |
+ :param ca_subject_dn: IPA CA subject DN
|
|
|
86baa9 |
+ :param sdn: Subject DN
|
|
|
86baa9 |
+ :return: string, or None if nickname cannot be determined.
|
|
|
86baa9 |
+
|
|
|
86baa9 |
+ """
|
|
|
86baa9 |
+ assert isinstance(sdn, DN)
|
|
|
86baa9 |
+ nickname_by_subject_dn = {
|
|
|
86baa9 |
+ DN(ca_subject_dn): 'caSigningCert cert-pki-ca',
|
|
|
86baa9 |
+ DN('CN=CA Audit', subject_base): 'auditSigningCert cert-pki-ca',
|
|
|
86baa9 |
+ DN('CN=OCSP Subsystem', subject_base): 'ocspSigningCert cert-pki-ca',
|
|
|
86baa9 |
+ DN('CN=CA Subsystem', subject_base): 'subsystemCert cert-pki-ca',
|
|
|
86baa9 |
+ DN('CN=KRA Audit', subject_base): 'auditSigningCert cert-pki-kra',
|
|
|
86baa9 |
+ DN('CN=KRA Transport Certificate', subject_base):
|
|
|
86baa9 |
+ 'transportCert cert-pki-kra',
|
|
|
86baa9 |
+ DN('CN=KRA Storage Certificate', subject_base):
|
|
|
86baa9 |
+ 'storageCert cert-pki-kra',
|
|
|
86baa9 |
+ DN('CN=IPA RA', subject_base): 'ipaCert',
|
|
|
86baa9 |
+ }
|
|
|
86baa9 |
+ return nickname_by_subject_dn.get(sdn)
|
|
|
86baa9 |
+
|
|
|
86baa9 |
+
|
|
|
86baa9 |
def update_ca_renewal_entry(conn, nickname, cert):
|
|
|
86baa9 |
"""
|
|
|
86baa9 |
Update the ca_renewal entry for the given nickname.
|
|
|
86baa9 |
--
|
|
|
86baa9 |
2.20.1
|
|
|
86baa9 |
|