summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSimo Sorce <ssorce@redhat.com>2010-12-10 14:53:06 -0500
committerRob Crittenden <rcritten@redhat.com>2010-12-10 23:09:41 -0500
commit95c4b894f93619ed2867d1a769ed3c9f512b890c (patch)
treea5115e46865a35372e5a0be0c01b4d1737ae7f40
parent8fd288df08d8f01893ad9637adc8987032af1886 (diff)
downloadfreeipa-95c4b894f93619ed2867d1a769ed3c9f512b890c.tar.gz
freeipa-95c4b894f93619ed2867d1a769ed3c9f512b890c.tar.xz
freeipa-95c4b894f93619ed2867d1a769ed3c9f512b890c.zip
Fix Install using dogtag.
The CA is installed before DS so we need to wait until DS is actually installed to be able to ldap_enable the CA instance. Fixes: https://fedorahosted.org/freeipa/ticket/612
-rwxr-xr-xinstall/tools/ipa-replica-install5
-rwxr-xr-xinstall/tools/ipa-server-install11
-rw-r--r--ipaserver/install/cainstance.py12
-rw-r--r--ipaserver/install/dsinstance.py2
-rw-r--r--ipaserver/install/service.py8
5 files changed, 29 insertions, 9 deletions
diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index 3d6f4743a..c9df2dd43 100755
--- a/install/tools/ipa-replica-install
+++ b/install/tools/ipa-replica-install
@@ -391,6 +391,11 @@ def main():
# Configure dirsrv
ds = install_replica_ds(config)
+ # We ned to ldap_enable the CA now that DS is up and running
+ if CA:
+ CA.ldap_enable('CA', host_name, dm_password,
+ util.realm_to_suffix(self.realm_name))
+
install_krb(config, setup_pkinit=options.setup_pkinit)
install_http(config)
if CA:
diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
index 7fa6c71df..0a1f1c56f 100755
--- a/install/tools/ipa-server-install
+++ b/install/tools/ipa-server-install
@@ -697,7 +697,6 @@ def main():
ca = certs.CertDB(realm_name, host_name=host_name,
subject_base=options.subject)
ca.create_self_signed()
- ca.publish_ca_cert("/etc/ipa/ca.crt")
else:
# Clean up any previous self-signed CA that may exist
try:
@@ -740,6 +739,9 @@ def main():
else:
ca.configure_instance("pkiuser", host_name, dm_password, dm_password, cert_file=options.external_cert_file, cert_chain_file=options.external_ca_file, subject_base=options.subject)
+ # Now put the CA cert where other instances exepct it
+ ca.publish_ca_cert("/etc/ipa/ca.crt")
+
# Create a directory server instance
ds = dsinstance.DsInstance()
@@ -761,12 +763,17 @@ def main():
subject_base=options.subject,
hbac_allow=not options.hbac_allow)
+ # We ned to ldap_enable the CA now that DS is up and running
+ if not options.selfsign:
+ ca.ldap_enable('CA', host_name, dm_password,
+ util.realm_to_suffix(realm_name))
+
+ # Create a kerberos instance
if options.pkinit_pin:
[pw_fd, pw_name] = tempfile.mkstemp()
os.write(pw_fd, options.dirsrv_pin)
os.close(pw_fd)
- # Create a kerberos instance
krb = krbinstance.KrbInstance(fstore)
if options.pkinit_pkcs12:
pkcs12_info = (options.pkinit_pkcs12, pw_name)
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
index e03adfb9b..7cc8d50a3 100644
--- a/ipaserver/install/cainstance.py
+++ b/ipaserver/install/cainstance.py
@@ -478,8 +478,8 @@ class CAInstance(service.Service):
# We do not let the system start IPA components on its own,
# Instead we reply on the IPA init script to start only enabled
# components as found in our LDAP configuration tree
- suffix = util.realm_to_suffix(self.realm)
- self.ldap_enable('CA', self.fqdn, self.dm_password, suffix)
+ # We need to install DS before we can actually ldap_enable a service.
+ # so actual enablement is delayed.
def __create_ca_user(self):
user_exists = True
@@ -996,6 +996,14 @@ class CAInstance(service.Service):
except ipautil.CalledProcessError, e:
logging.critical("failed to delete user %s" % e)
+ def publish_ca_cert(self, location):
+ args = ["-L", "-n", self.canickname, "-a"]
+ (cert, err, returncode) = self.__run_certutil(args)
+ fd = open(location, "w+")
+ fd.write(cert)
+ fd.close()
+ os.chmod(location, 0444)
+
if __name__ == "__main__":
installutils.standard_logging_setup("install.log", False)
cs = CADSInstance()
diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py
index 36bc51530..735c885aa 100644
--- a/ipaserver/install/dsinstance.py
+++ b/ipaserver/install/dsinstance.py
@@ -46,7 +46,7 @@ from ipaserver.plugins.ldap2 import ldap2
SERVER_ROOT_64 = "/usr/lib64/dirsrv"
SERVER_ROOT_32 = "/usr/lib/dirsrv"
-CACERT="/erc/ipa/ca.crt"
+CACERT="/etc/ipa/ca.crt"
def find_server_root():
if ipautil.dir_exists(SERVER_ROOT_64):
diff --git a/ipaserver/install/service.py b/ipaserver/install/service.py
index 41b5455d3..281981d1c 100644
--- a/ipaserver/install/service.py
+++ b/ipaserver/install/service.py
@@ -34,7 +34,7 @@ SERVICE_LIST = {
'KPASSWD':('ipa_kpasswd', 20),
'DNS':('named', 30),
'HTTP':('httpd', 40),
- 'CA':('pki_cad', 50)
+ 'CA':('pki-cad', 50)
}
def stop(service_name, instance_name=""):
@@ -270,19 +270,19 @@ class Service:
self.steps = []
- def __get_conn(self, dm_password):
+ def __get_conn(self, fqdn, dm_password):
try:
conn = ipaldap.IPAdmin("127.0.0.1")
conn.simple_bind_s("cn=directory manager", dm_password)
except Exception, e:
- logging.critical("Could not connect to the Directory Server on %s: %s" % (self.fqdn, str(e)))
+ logging.critical("Could not connect to the Directory Server on %s: %s" % (fqdn, str(e)))
raise e
return conn
def ldap_enable(self, name, fqdn, dm_password, ldap_suffix):
self.chkconfig_off()
- conn = self.__get_conn(dm_password)
+ conn = self.__get_conn(fqdn, dm_password)
entry_name = "cn=%s,cn=%s,%s,%s" % (name, fqdn,
"cn=masters,cn=ipa,cn=etc",