From e16d2623aee089f07854ffc32b976e45d17c03ff Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Fri, 11 Apr 2014 10:35:51 +0200
Subject: Remove master ACIs when deleting a replica.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
---
 ipaserver/install/replication.py | 43 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

(limited to 'ipaserver')

diff --git a/ipaserver/install/replication.py b/ipaserver/install/replication.py
index fbbad5e6c..168f7ceee 100644
--- a/ipaserver/install/replication.py
+++ b/ipaserver/install/replication.py
@@ -1201,6 +1201,49 @@ class ReplicationManager(object):
             elif not err:
                 err = e
 
+        try:
+            entry = self.conn.get_entry(
+                DN(('cn', 'ipa'), ('cn', 'etc'), self.suffix), ['aci'])
+
+            sub = {'suffix': self.suffix, 'fqdn': replica}
+            try:
+                entry.raw['aci'].remove(
+                    '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,'
+                    '%(suffix)s")(version 3.0; acl "Add CA Certificates for '
+                    'renewals"; allow(add) userdn = "ldap:///fqdn=%(fqdn)s,'
+                    'cn=computers,cn=accounts,%(suffix)s";)' % sub)
+            except ValueError:
+                pass
+            try:
+                entry.raw['aci'].remove(
+                    '(target = "ldap:///cn=*,cn=ca_renewal,cn=ipa,cn=etc,'
+                    '%(suffix)s")(targetattr = "userCertificate")'
+                    '(version 3.0; acl "Modify CA Certificates for renewals"; '
+                    'allow(write) userdn = "ldap:///fqdn=%(fqdn)s,'
+                    'cn=computers,cn=accounts,%(suffix)s";)' % sub)
+            except ValueError:
+                pass
+            try:
+                entry.raw['aci'].remove(
+                    '(target = "ldap:///cn=CAcert,cn=ipa,cn=etc,%(suffix)s")'
+                    '(targetattr = cACertificate)(version 3.0; acl "Modify CA '
+                    'Certificate"; allow (write) userdn = "ldap:///fqdn='
+                    '%(fqdn)s,cn=computers,cn=accounts,%(suffix)s";)' % sub)
+            except ValueError:
+                pass
+
+            try:
+                self.conn.update_entry(entry)
+            except errors.EmptyModlist:
+                pass
+        except errors.NotFound:
+            pass
+        except Exception, e:
+            if not force:
+                raise e
+            elif not err:
+                err = e
+
         try:
             basedn = DN(('cn', 'etc'), self.suffix)
             filter = '(dnaHostname=%s)' % replica
-- 
cgit