From 95c4b894f93619ed2867d1a769ed3c9f512b890c Mon Sep 17 00:00:00 2001
From: Simo Sorce <ssorce@redhat.com>
Date: Fri, 10 Dec 2010 14:53:06 -0500
Subject: Fix Install using dogtag.

The CA is installed before DS so we need to wait until DS is actually installed
to be able to ldap_enable the CA instance.

Fixes: https://fedorahosted.org/freeipa/ticket/612
---
 install/tools/ipa-replica-install |  5 +++++
 install/tools/ipa-server-install  | 11 +++++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

(limited to 'install/tools')

diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index 3d6f4743a..c9df2dd43 100755
--- a/install/tools/ipa-replica-install
+++ b/install/tools/ipa-replica-install
@@ -391,6 +391,11 @@ def main():
     # Configure dirsrv
     ds = install_replica_ds(config)
 
+    # We ned to ldap_enable the CA now that DS is up and running
+    if CA:
+        CA.ldap_enable('CA', host_name, dm_password,
+                       util.realm_to_suffix(self.realm_name))
+
     install_krb(config, setup_pkinit=options.setup_pkinit)
     install_http(config)
     if CA:
diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
index 7fa6c71df..0a1f1c56f 100755
--- a/install/tools/ipa-server-install
+++ b/install/tools/ipa-server-install
@@ -697,7 +697,6 @@ def main():
         ca = certs.CertDB(realm_name, host_name=host_name,
                           subject_base=options.subject)
         ca.create_self_signed()
-        ca.publish_ca_cert("/etc/ipa/ca.crt")
     else:
         # Clean up any previous self-signed CA that may exist
         try:
@@ -740,6 +739,9 @@ def main():
         else:
             ca.configure_instance("pkiuser", host_name, dm_password, dm_password, cert_file=options.external_cert_file, cert_chain_file=options.external_ca_file, subject_base=options.subject)
 
+    # Now put the CA cert where other instances exepct it
+    ca.publish_ca_cert("/etc/ipa/ca.crt")
+
     # Create a directory server instance
     ds = dsinstance.DsInstance()
 
@@ -761,12 +763,17 @@ def main():
                            subject_base=options.subject,
                            hbac_allow=not options.hbac_allow)
 
+    # We ned to ldap_enable the CA now that DS is up and running
+    if not options.selfsign:
+        ca.ldap_enable('CA', host_name, dm_password,
+                       util.realm_to_suffix(realm_name))
+
+    # Create a kerberos instance
     if options.pkinit_pin:
         [pw_fd, pw_name] = tempfile.mkstemp()
         os.write(pw_fd, options.dirsrv_pin)
         os.close(pw_fd)
 
-    # Create a kerberos instance
     krb = krbinstance.KrbInstance(fstore)
     if options.pkinit_pkcs12:
         pkcs12_info = (options.pkinit_pkcs12, pw_name)
-- 
cgit