Fix Install using dogtag.

The CA is installed before DS so we need to wait until DS is actually installed
to be able to ldap_enable the CA instance.

Fixes: https://fedorahosted.org/freeipa/ticket/612

3 files changed, 15 insertions, 7 deletions

diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
index e03adfb9..7cc8d50a 100644
--- a/ipaserver/install/cainstance.py
+++ b/ipaserver/install/cainstance.py
@@ -478,8 +478,8 @@ class CAInstance(service.Service):
         # We do not let the system start IPA components on its own,
         # Instead we reply on the IPA init script to start only enabled
         # components as found in our LDAP configuration tree
-        suffix = util.realm_to_suffix(self.realm)
-        self.ldap_enable('CA', self.fqdn, self.dm_password, suffix)
+        # We need to install DS before we can actually ldap_enable a service.
+        # so actual enablement is delayed.
 
     def __create_ca_user(self):
         user_exists = True
@@ -996,6 +996,14 @@ class CAInstance(service.Service):
             except ipautil.CalledProcessError, e:
                 logging.critical("failed to delete user %s" % e)
 
+    def publish_ca_cert(self, location):
+        args = ["-L", "-n", self.canickname, "-a"]
+        (cert, err, returncode) = self.__run_certutil(args)
+        fd = open(location, "w+")
+        fd.write(cert)
+        fd.close()
+        os.chmod(location, 0444)
+
 if __name__ == "__main__":
     installutils.standard_logging_setup("install.log", False)
     cs = CADSInstance()
diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py
index 36bc5153..735c885a 100644
--- a/ipaserver/install/dsinstance.py
+++ b/ipaserver/install/dsinstance.py
@@ -46,7 +46,7 @@ from ipaserver.plugins.ldap2 import ldap2
 
 SERVER_ROOT_64 = "/usr/lib64/dirsrv"
 SERVER_ROOT_32 = "/usr/lib/dirsrv"
-CACERT="/erc/ipa/ca.crt"
+CACERT="/etc/ipa/ca.crt"
 
 def find_server_root():
     if ipautil.dir_exists(SERVER_ROOT_64):
diff --git a/ipaserver/install/service.py b/ipaserver/install/service.py
index 41b5455d..281981d1 100644
--- a/ipaserver/install/service.py
+++ b/ipaserver/install/service.py
@@ -34,7 +34,7 @@ SERVICE_LIST = {
     'KPASSWD':('ipa_kpasswd', 20),
     'DNS':('named', 30),
     'HTTP':('httpd', 40),
-    'CA':('pki_cad', 50)
+    'CA':('pki-cad', 50)
 }
 
 def stop(service_name, instance_name=""):
@@ -270,19 +270,19 @@ class Service:
 
         self.steps = []
 
-    def __get_conn(self, dm_password):
+    def __get_conn(self, fqdn, dm_password):
         try:
             conn = ipaldap.IPAdmin("127.0.0.1")
             conn.simple_bind_s("cn=directory manager", dm_password)
         except Exception, e:
-            logging.critical("Could not connect to the Directory Server on %s: %s" % (self.fqdn, str(e)))
+            logging.critical("Could not connect to the Directory Server on %s: %s" % (fqdn, str(e)))
             raise e
 
         return conn
 
     def ldap_enable(self, name, fqdn, dm_password, ldap_suffix):
         self.chkconfig_off()
-        conn = self.__get_conn(dm_password)
+        conn = self.__get_conn(fqdn, dm_password)
 
         entry_name = "cn=%s,cn=%s,%s,%s" % (name, fqdn,
                                             "cn=masters,cn=ipa,cn=etc",