Make CS.cfg edits with CA instance stopped

This patch makes sure that all edits to CS.cfg configuration file
are performed while pki-tomcatd service is stopped.

Introduces a new contextmanager stopped_service for handling
a general problem of performing a task that needs certain service
being stopped.

https://fedorahosted.org/freeipa/ticket/3804

3 files changed, 5 insertions, 3 deletions

diff --git a/install/tools/ipa-ca-install b/install/tools/ipa-ca-install
index 636f63da3..4edd26d33 100755
--- a/install/tools/ipa-ca-install
+++ b/install/tools/ipa-ca-install
@@ -189,8 +189,8 @@ def main():
     CA.ldap_enable('CA', config.host_name, config.dirman_password,
                    ipautil.realm_to_suffix(config.realm_name))
 
+    # This is done within stopped_service context, which restarts CA
     CA.enable_client_auth_to_db()
-    CA.restart()
 
     # Install CA DNS records
     install_dns_records(config, options)
diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index c6d69fca6..947c51f6f 100755
--- a/install/tools/ipa-replica-install
+++ b/install/tools/ipa-replica-install
@@ -675,8 +675,9 @@ def main():
     if CA and config.setup_ca:
         CA.ldap_enable('CA', config.host_name, config.dirman_password,
                        ipautil.realm_to_suffix(config.realm_name))
+
+        # This is done within stopped_service context, which restarts CA
         CA.enable_client_auth_to_db()
-        CA.restart()
 
     krb = install_krb(config, setup_pkinit=options.setup_pkinit)
     http = install_http(config, auto_redirect=options.ui_redirect)
diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
index 06e99134e..86ca3447b 100755
--- a/install/tools/ipa-server-install
+++ b/install/tools/ipa-server-install
@@ -1054,8 +1054,9 @@ def main():
         # We need to ldap_enable the CA now that DS is up and running
         ca.ldap_enable('CA', host_name, dm_password,
                        ipautil.realm_to_suffix(realm_name))
+
+        # This is done within stopped_service context, which restarts CA
         ca.enable_client_auth_to_db()
-        ca.restart()
 
         # Upload the CA cert to the directory
         ds.upload_ca_cert()