From 1ab5b1a4cdcab8b913f42488ae642a9f0ef77d92 Mon Sep 17 00:00:00 2001 From: Jan Cholasta Date: Mon, 5 Jun 2017 12:42:52 +0000 Subject: [PATCH] server upgrade: do not enable PKINIT by default Enabling PKINIT often fails during server upgrade when requesting the KDC certificate. Now that PKINIT can be enabled post-install using ipa-pkinit-manage, avoid the upgrade failure by not enabling PKINIT by default. https://pagure.io/freeipa/issue/7000 Reviewed-By: Martin Babinsky --- ipaserver/install/server/upgrade.py | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py index db86353165809c57d1ac27bf762393721231fefd..b1f59d3e29d69bffc11935ec22d4b5f510293355 100644 --- a/ipaserver/install/server/upgrade.py +++ b/ipaserver/install/server/upgrade.py @@ -1519,14 +1519,8 @@ def add_default_caacl(ca): def setup_pkinit(krb): root_logger.info("[Setup PKINIT]") - pkinit_is_enabled = krbinstance.is_pkinit_enabled() - ca_is_enabled = api.Command.ca_is_enabled()['result'] - - if not pkinit_is_enabled: - if ca_is_enabled: - krb.issue_ipa_ca_signed_pkinit_certs() - else: - krb.issue_selfsigned_pkinit_certs() + if not krbinstance.is_pkinit_enabled(): + krb.issue_selfsigned_pkinit_certs() aug = Augeas(flags=Augeas.NO_LOAD | Augeas.NO_MODL_AUTOLOAD, loadpath=paths.USR_SHARE_IPA_DIR) -- 2.9.4