From d1470a8a5d2f39b57d8d66e8d0d7e8437fcd2ae4 Mon Sep 17 00:00:00 2001

From: Martin Babinsky <mbabinsk@redhat.com>

Date: Wed, 2 Dec 2015 12:22:45 +0100

Subject: [PATCH] replica install: improvements in the handling of CA-related

 IPA config entries

When a CA-less replica is installed, its IPA config file should be updated so

that ca_host points to nearest CA master and all certificate requests are

forwarded to it. A subsequent installation of CA subsystem on the replica

should clear this entry from the config so that all certificate requests are

handled by freshly installed local CA.

https://fedorahosted.org/freeipa/ticket/5506

Reviewed-By: Martin Basti <mbasti@redhat.com>

---

 ipaserver/install/ca.py                    | 16 ----------------

 ipaserver/install/cainstance.py            | 18 ++++++++++++++++++

 ipaserver/install/server/replicainstall.py |  3 +++

 3 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/ipaserver/install/ca.py b/ipaserver/install/ca.py

index d2fb5feeaf96e8450eddb1bc4e65ef3316b05b38..b4db8dcbfad9d482e7106cd06b3d497ccf8954f0 100644

--- a/ipaserver/install/ca.py

+++ b/ipaserver/install/ca.py

@@ -12,7 +12,6 @@ from ipaplatform.paths import paths

 from ipaserver.install import installutils, certs

 from ipaserver.install.replication import replica_conn_check

 from ipalib import api, certstore, x509

-from ConfigParser import RawConfigParser

 from ipapython.dn import DN

 from ipapython.ipa_log_manager import root_logger

@@ -240,21 +239,6 @@ def install_step_1(standalone, replica_config, options):

     if standalone:

         ca.start(ca.dogtag_constants.PKI_INSTANCE_NAME)

-        # Update config file

-        try:

-            parser = RawConfigParser()

-            parser.read(paths.IPA_DEFAULT_CONF)

-            parser.set('global', 'enable_ra', 'True')

-            parser.set('global', 'ra_plugin', 'dogtag')

-            parser.set('global', 'dogtag_version',

-                       str(dogtag_constants.DOGTAG_VERSION))

-            with open(paths.IPA_DEFAULT_CONF, 'w') as f:

-                parser.write(f)

-        except IOError, e:

-            print "Failed to update /etc/ipa/default.conf"

-            root_logger.error(str(e))

-            sys.exit(1)

-

         # We need to restart apache as we drop a new config file in there

         services.knownservices.httpd.restart(capture_output=True)

diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py

index 1a98c438786ae7dad208212fff23e3a760c95b3c..b06760308865aa42afac79d6750f4a422a5c8f95 100644

--- a/ipaserver/install/cainstance.py

+++ b/ipaserver/install/cainstance.py

@@ -482,6 +482,8 @@ class CAInstance(DogtagInstance):

             self.step("importing IPA certificate profiles",

                       import_included_profiles)

             self.step("adding default CA ACL", ensure_default_caacl)

+            self.step("updating IPA configuration",

+                      lambda: update_ipa_conf(self.dogtag_constants))

         self.start_creation(runtime=210)

@@ -1880,6 +1882,22 @@ def ensure_default_caacl():

         api.Backend.ldap2.disconnect()

+def update_ipa_conf(dogtag_constants):

+    """

+    Update IPA configuration file to ensure that RA plugins are enabled and

+    that CA host points to localhost

+    """

+    parser = ConfigParser.RawConfigParser()

+    parser.read(paths.IPA_DEFAULT_CONF)

+    parser.set('global', 'enable_ra', 'True')

+    parser.set('global', 'ra_plugin', 'dogtag')

+    parser.set('global', 'dogtag_version',

+               str(dogtag_constants.DOGTAG_VERSION))

+    parser.remove_option('global', 'ca_host')

+    with open(paths.IPA_DEFAULT_CONF, 'w') as f:

+        parser.write(f)

+

+

 if __name__ == "__main__":

     standard_logging_setup("install.log")

     ds = dsinstance.DsInstance()

diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py

index 317eda92dd4322542f035c2df4dba919a5898cc7..2ab95add90d33eb191d4e75b62cb4eceac40551b 100644

--- a/ipaserver/install/server/replicainstall.py

+++ b/ipaserver/install/server/replicainstall.py

@@ -378,6 +378,9 @@ def install_check(installer):

             fd.write("ra_plugin=dogtag\n")

             fd.write("dogtag_version=%s\n" %

                      dogtag.install_constants.DOGTAG_VERSION)

+

+            if not config.setup_ca:

+                fd.write("ca_host={0}\n".format(config.master_host_name))

         else:

             fd.write("enable_ra=False\n")

             fd.write("ra_plugin=none\n")

-- 

2.5.0