|
 |
9991ea |
From 2e031c9469f0313014dbe8c47d0be3fee370f287 Mon Sep 17 00:00:00 2001
|
|
|
9991ea |
From: Martin Kosek <mkosek@redhat.com>
|
|
|
9991ea |
Date: Thu, 13 Mar 2014 08:25:11 +0100
|
|
|
9991ea |
Subject: [PATCH] Update Dogtag 9 database during replica installation
|
|
|
9991ea |
|
|
|
9991ea |
When Dogtag 10 based FreeIPA replica is being installed for a Dogtag 9
|
|
|
9991ea |
based master, the PKI database is not updated and miss several ACLs
|
|
|
9991ea |
which prevent some of the PKI functions, e.g. an ability to create
|
|
|
9991ea |
other clones.
|
|
|
9991ea |
|
|
|
9991ea |
Add an update file to do the database update. Content is based on
|
|
|
9991ea |
recommendation from PKI team:
|
|
|
9991ea |
* https://bugzilla.redhat.com/show_bug.cgi?id=1075118#c9
|
|
|
9991ea |
|
|
|
9991ea |
This update file can be removed when Dogtag database upgrades are done
|
|
|
9991ea |
in PKI component. Upstream tickets:
|
|
|
9991ea |
* https://fedorahosted.org/pki/ticket/710 (database upgrade framework)
|
|
|
9991ea |
* https://fedorahosted.org/pki/ticket/906 (checking database version)
|
|
|
9991ea |
|
|
|
9991ea |
Also make sure that PKI service is restarted in the end of the installation
|
|
|
9991ea |
as the other services to make sure it picks changes done during LDAP
|
|
|
9991ea |
updates.
|
|
|
9991ea |
|
|
|
9991ea |
https://fedorahosted.org/freeipa/ticket/4243
|
|
|
9991ea |
---
|
|
|
9991ea |
install/tools/ipa-replica-install | 4 ++++
|
|
|
9991ea |
install/tools/ipa-server-install | 4 ++++
|
|
|
9991ea |
install/updates/50-dogtag10-migration.update | 18 ++++++++++++++++++
|
|
|
9991ea |
install/updates/Makefile.am | 1 +
|
|
|
9991ea |
4 files changed, 27 insertions(+)
|
|
|
9991ea |
create mode 100644 install/updates/50-dogtag10-migration.update
|
|
|
9991ea |
|
|
|
9991ea |
diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
|
|
|
9991ea |
index e039fd1e7cb213b3269d0a5d2305a96f68e36e29..4418b41784313121e73b560ee84715ddeba8bc54 100755
|
|
|
9991ea |
--- a/install/tools/ipa-replica-install
|
|
|
9991ea |
+++ b/install/tools/ipa-replica-install
|
|
|
9991ea |
@@ -704,6 +704,10 @@ def main():
|
|
|
9991ea |
service.print_msg("Restarting the KDC")
|
|
|
9991ea |
krb.restart()
|
|
|
9991ea |
|
|
|
9991ea |
+ if CA and config.setup_ca:
|
|
|
9991ea |
+ service.print_msg("Restarting the certificate server")
|
|
|
9991ea |
+ CA.restart(dogtag.configured_constants().PKI_INSTANCE_NAME)
|
|
|
9991ea |
+
|
|
|
9991ea |
if options.setup_dns:
|
|
|
9991ea |
install_bind(config, options)
|
|
|
9991ea |
|
|
|
9991ea |
diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
|
|
|
9991ea |
index 458ebba550d0fe7675bd874e23c7d730c53297e6..dfbbb91bf3bb8461333193b5a3e72c3ec06d4582 100755
|
|
|
9991ea |
--- a/install/tools/ipa-server-install
|
|
|
9991ea |
+++ b/install/tools/ipa-server-install
|
|
|
9991ea |
@@ -1186,6 +1186,10 @@ def main():
|
|
|
9991ea |
service.print_msg("Restarting the KDC")
|
|
|
9991ea |
krb.restart()
|
|
|
9991ea |
|
|
|
9991ea |
+ if setup_ca:
|
|
|
9991ea |
+ service.print_msg("Restarting the certificate server")
|
|
|
9991ea |
+ ca.restart(dogtag.configured_constants().PKI_INSTANCE_NAME)
|
|
|
9991ea |
+
|
|
|
9991ea |
# Create a BIND instance
|
|
|
9991ea |
bind = bindinstance.BindInstance(fstore, dm_password)
|
|
|
9991ea |
bind.setup(host_name, ip_address, realm_name, domain_name, dns_forwarders,
|
|
|
9991ea |
diff --git a/install/updates/50-dogtag10-migration.update b/install/updates/50-dogtag10-migration.update
|
|
|
9991ea |
new file mode 100644
|
|
|
9991ea |
index 0000000000000000000000000000000000000000..d718923544f0cb00f61b7b56940695e3891c4780
|
|
|
9991ea |
--- /dev/null
|
|
|
9991ea |
+++ b/install/updates/50-dogtag10-migration.update
|
|
|
9991ea |
@@ -0,0 +1,18 @@
|
|
|
9991ea |
+# PKI/Dogtag does not automatically upgrade it's database. When Dogtag 10
|
|
|
9991ea |
+# based replica is being installed from a Dogtag 9 based replica,
|
|
|
9991ea |
+# the database will miss ACLs added in Dogtag 10 resulting in limited
|
|
|
9991ea |
+# functionality.
|
|
|
9991ea |
+#
|
|
|
9991ea |
+# This update file can be removed when Dogtag database upgrades are done
|
|
|
9991ea |
+# in PKI component. Upstream tickets:
|
|
|
9991ea |
+# * https://fedorahosted.org/pki/ticket/710 (database upgrade framework)
|
|
|
9991ea |
+# * https://fedorahosted.org/pki/ticket/906 (checking database version)
|
|
|
9991ea |
+
|
|
|
9991ea |
+dn: cn=aclResources,o=ipaca
|
|
|
9991ea |
+addifexist:resourceACLS:'certServer.ca.account:login,logout:allow (login,logout) user="anybody":Anybody can login and logout'
|
|
|
9991ea |
+addifexist:resourceACLS:'certServer.ca.certrequests:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert request operations'
|
|
|
9991ea |
+addifexist:resourceACLS:'certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations'
|
|
|
9991ea |
+addifexist:resourceACLS:'certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations'
|
|
|
9991ea |
+addifexist:resourceACLS:'certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations'
|
|
|
9991ea |
+replace:resourceACLS:'certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group":Anybody is allowed to read domain.xml but only Subsystem group is allowed to modify the domain.xml::certServer.securitydomain.domainxml:read,modify:allow (read) user="anybody";allow (modify) group="Subsystem Group" || group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Anybody is allowed to read domain.xml but only Subsystem group and Enterprise Administrators are allowed to modify the domain.xml'
|
|
|
9991ea |
+replace:resourceACLS:'certServer.ca.connectorInfo:read,modify:allow (modify,read) group="Enterprise KRA Administrators":Only Enterprise Administrators are allowed to update the connector information::certServer.ca.connectorInfo:read,modify:allow (read) group="Enterprise KRA Administrators";allow (modify) group="Enterprise KRA Administrators" || group="Subsystem Group":Only Enterprise Administrators and Subsystem Group are allowed to update the connector information'
|
|
|
9991ea |
diff --git a/install/updates/Makefile.am b/install/updates/Makefile.am
|
|
|
9991ea |
index 40c3b3c8916faa267254a29d0f458ca53201950c..fb73c410dbcd1978c3a5deeb184dc10cdba866ae 100644
|
|
|
9991ea |
--- a/install/updates/Makefile.am
|
|
|
9991ea |
+++ b/install/updates/Makefile.am
|
|
|
9991ea |
@@ -36,6 +36,7 @@ app_DATA = \
|
|
|
9991ea |
40-otp.update \
|
|
|
9991ea |
45-roles.update \
|
|
|
9991ea |
50-7_bit_check.update \
|
|
|
9991ea |
+ 50-dogtag10-migration.update \
|
|
|
9991ea |
50-lockout-policy.update \
|
|
|
9991ea |
50-groupuuid.update \
|
|
|
9991ea |
50-hbacservice.update \
|
|
|
9991ea |
--
|
|
|
9991ea |
1.8.5.3
|
|
|
9991ea |
|