From 3acec1267ea3e1f4faa8757d384386d8035dd6cf Mon Sep 17 00:00:00 2001 From: Jan Cholasta Date: Tue, 2 Sep 2014 11:28:16 +0200 Subject: Use autobind when updating CA people entries during certificate renewal Requires fix for , bump selinux-policy in the spec file. https://fedorahosted.org/freeipa/ticket/4005 Reviewed-By: Petr Viktorin --- ipaserver/install/cainstance.py | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) (limited to 'ipaserver') diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index b6342a508..a18312227 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -1754,23 +1754,15 @@ def update_people_entry(dercert): issuer = x509.get_issuer(dercert, datatype=x509.DER) attempts = 0 - configured_constants = dogtag.configured_constants(api) - dogtag_uri = 'ldap://localhost:%d' % configured_constants.DS_PORT + server_id = dsinstance.realm_to_serverid(api.env.realm) + dogtag_uri = 'ldapi://%%2fvar%%2frun%%2fslapd-%s.socket' % server_id updated = False - try: - dm_password = certmonger.get_pin('internaldb') - except IOError, e: - syslog.syslog( - syslog.LOG_ERR, 'Unable to determine PIN for CA instance: %s' % e) - return False - while attempts < 10: conn = None try: conn = ldap2.ldap2(shared_instance=False, ldap_uri=dogtag_uri) - conn.connect( - bind_dn=DN(('cn', 'directory manager')), bind_pw=dm_password) + conn.connect(autobind=True) db_filter = conn.make_filter( {'description': ';%s;%s' % (issuer, subject)}, -- cgit