- name: Sleep for a while to give time of any other instances to come up.
  shell: sleep 7s

- name: Install KRA master
  shell: pkispawn -s KRA -f /tmp/test_dir/kra.cfg

- name : Stopping KRA Subsystem
  shell: echo "Stopping Subsystem for enabling Audit logging"
  notify:
    - STOPKRA
    - INC_CONSTANTS

- meta: flush_handlers

- name: Enable SignedAudit
  shell: pki-server kra-audit-config-mod -i {{ variable.KRA_INSTANCE_NAME }} --logSigning True

- name: Enable OCSP for KRA
  replace: dest=/etc/pki/{{ topology }}-KRA/server.xml regexp='enableOCSP="false"' replace='enableOCSP="true"'

- name: Pointing KRA to correct OCSP port
  replace: dest=/etc/pki/{{ topology }}-KRA/server.xml regexp='([0-9]+)/ca/ocsp' replace={{ variable.CA_HTTP_PORT }}/ca/ocsp

- name: Set debug log level to 5
  shell: pki-server -i {{ topology }}-KRA kra-config-set debug.level 5
  when: debug == "true" or kra_debug == "true"

- name: Enable OCSP Policy to Native for tls as true
  block:
  - name: Checking for right CA certificate and picking default name
    shell: sed -i "s/ocspSigningCert cert-pki-ca/Directory Server CA certificate/g" /etc/pki/{{ topology }}-KRA/server.xml
  when: tls_ldap == "true"

- name: Enable OCSP Policy to Native for tls as false
  block:
  - name: Picking the password in run-time from password.conf of KRA
    shell: grep -i "internal=" /etc/pki/{{ topology }}-KRA/password.conf | awk -F"=" ' { print $2 } ' > /tmp/test_dir/certutil_password

  - name: Importing OCSP certificate in kra nssdb
    shell: certutil -A -d /etc/pki/{{ topology }}-KRA/alias -n "ocspSigningCert cert-pki-ca" -t "C,," -i  /tmp/test_dir/ocsp_signing.crt -f /tmp/test_dir/certutil_password

  - name: Removing file generated with password
    file:
      path: "{{ item }}"
      state: absent
    with_items:
      -  /tmp/test_dir/certutil_password
  when: tls_ldap == "false"

- name: Starting KRA Subsystem
  service:
    name: pki-tomcatd@{{ topology }}-KRA.service
    state: started

- name: KRA Clone Preparation
  block:
    - name: Export KRA subsystem certificates
      shell: pki-server kra-clone-prepare -i {{topology}}-KRA --pkcs12-file /tmp/kra_certs.p12 --pkcs12-password {{variable.CLIENT_PKCS12_PASSWORD}}

    - name: Get the KRA subsystem certificates to the local
      fetch: src=/tmp/kra_certs.p12 dest=/tmp/test_dir/clonecerts/ flat=yes
  when: clone == "true" or clone == "True"
