f65af0
From 7fe3cba3d4cbe62c23e0e74f6bf3c44c50feb985 Mon Sep 17 00:00:00 2001
979ee0
From: Florence Blanc-Renaud <flo@redhat.com>
979ee0
Date: Tue, 4 Sep 2018 14:15:50 +0200
979ee0
Subject: [PATCH] ipa-replica-install: fix pkinit setup
979ee0
979ee0
commit 7284097 (Delay enabling services until end of installer)
979ee0
introduced a regression in replica installation.
979ee0
When the replica requests a cert for PKINIT, a check is done
979ee0
to ensure that the hostname corresponds to a machine with a
979ee0
KDC service enabled (ipaconfigstring attribute of
979ee0
cn=KDC,cn=<hostname>,cn=masters,cn=ipa,cn=etc,$BASEDN must contain
979ee0
'enabledService').
979ee0
With the commit mentioned above, the service is set to enabled only
979ee0
at the end of the installation.
979ee0
979ee0
The fix makes a less strict check, ensuring that 'enabledService'
979ee0
or 'configuredService' is in ipaconfigstring.
979ee0
979ee0
Fixes: https://pagure.io/freeipa/issue/7566
979ee0
Reviewed-By: Christian Heimes <cheimes@redhat.com>
979ee0
Reviewed-By: Christian Heimes <cheimes@redhat.com>
979ee0
---
f65af0
 ipaserver/plugins/cert.py | 6 ++++--
f65af0
 1 file changed, 4 insertions(+), 2 deletions(-)
979ee0
979ee0
diff --git a/ipaserver/plugins/cert.py b/ipaserver/plugins/cert.py
f65af0
index 0663272c9b4fd73225f63fe52d8d31157d5cc690..ed78388c8b8b4688873a5b047fb1b67e417a8a6d 100644
979ee0
--- a/ipaserver/plugins/cert.py
979ee0
+++ b/ipaserver/plugins/cert.py
f65af0
@@ -300,9 +300,11 @@ def ca_kdc_check(api_instance, hostname):
979ee0
 
979ee0
         ipaconfigstring = {val.lower() for val in kdc_entry['ipaConfigString']}
979ee0
 
979ee0
-        if 'enabledservice' not in ipaconfigstring:
979ee0
+        if 'enabledservice' not in ipaconfigstring \
979ee0
+                and 'configuredservice' not in ipaconfigstring:
f65af0
             raise errors.NotFound(
f65af0
-                reason=_("enabledService not in ipaConfigString kdc entry"))
f65af0
+                reason=_("enabledService/configuredService not in "
f65af0
+                         "ipaConfigString kdc entry"))
979ee0
 
979ee0
     except errors.NotFound:
f65af0
         raise errors.ACIError(
979ee0
-- 
979ee0
2.17.1
979ee0