From 18a210996dc47dbc9979e5ee0bb9f184c22eb173 Mon Sep 17 00:00:00 2001 From: Ade Lee Date: Wed, 19 Sep 2012 23:35:42 -0400 Subject: Changes to use a single database for dogtag and IPA New servers that are installed with dogtag 10 instances will use a single database instance for dogtag and IPA, albeit with different suffixes. Dogtag will communicate with the instance through a database user with permissions to modify the dogtag suffix only. This user will authenticate using client auth using the subsystem cert for the instance. This patch includes changes to allow the creation of masters and clones with single ds instances. --- install/tools/ipa-replica-install | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) (limited to 'install/tools/ipa-replica-install') diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install index e39698914..b7870fbe8 100755 --- a/install/tools/ipa-replica-install +++ b/install/tools/ipa-replica-install @@ -479,9 +479,19 @@ def main(): installutils.verify_fqdn(config.master_host_name, options.no_host_dns) + portfile = config.dir + "/dogtag_directory_port.txt" + if not ipautil.file_exists(portfile): + dogtag_master_ds_port = str(dogtag.Dogtag9Constants.DS_PORT) + else: + with open(portfile) as fd: + dogtag_master_ds_port = fd.read() + # check connection if not options.skip_conncheck: - replica_conn_check(config.master_host_name, config.host_name, config.realm_name, options.setup_ca, options.admin_password) + replica_conn_check( + config.master_host_name, config.host_name, config.realm_name, + options.setup_ca, dogtag_master_ds_port, options.admin_password) + # check replica host IP resolution config.ip = installutils.get_server_ip_address(config.host_name, fstore, True, options) @@ -597,21 +607,26 @@ def main(): ntp = ntpinstance.NTPInstance() ntp.create_instance() + # Configure dirsrv + ds = install_replica_ds(config) + # Configure the CA if necessary - (CA, cs) = cainstance.install_replica_ca(config) + (CA, cs) = cainstance.install_replica_ca(config, dogtag_master_ds_port) # Always try to install DNS records install_dns_records(config, options) - # Configure dirsrv - ds = install_replica_ds(config) - # We need to ldap_enable the CA now that DS is up and running if CA and config.setup_ca: CA.ldap_enable('CA', config.host_name, config.dirman_password, ipautil.realm_to_suffix(config.realm_name)) - cs.add_simple_service('dogtagldap/%s@%s' % (config.host_name, config.realm_name)) - cs.add_cert_to_service() + if not dogtag.install_constants.SHARED_DB: + cs.add_simple_service('dogtagldap/%s@%s' % + (config.host_name, config.realm_name)) + cs.add_cert_to_service() + else: + CA.enable_client_auth_to_db() + CA.restart() krb = install_krb(config, setup_pkinit=options.setup_pkinit) http = install_http(config, auto_redirect=options.ui_redirect) -- cgit