diff options
| author | felipe <fbarreto@localhost.localdomain> | 2017-03-21 09:05:56 -0300 |
|---|---|---|
| committer | Tomas Krizek <tkrizek@redhat.com> | 2017-03-22 15:31:40 +0100 |
| commit | 772d4e3d4e9a2756e6a34e265a1219599688cde3 (patch) | |
| tree | 712f344a989da4b18c5849e335468bef4d5f5349 | |
| parent | fe17d187f9f2cbac28fe369cbcdd697d85105481 (diff) | |
| download | freeipa-772d4e3d4e9a2756e6a34e265a1219599688cde3.tar.gz freeipa-772d4e3d4e9a2756e6a34e265a1219599688cde3.tar.xz freeipa-772d4e3d4e9a2756e6a34e265a1219599688cde3.zip | |
Fixing replica install: fix ldap connection in domlvl 0
Now, at the domain level 0, the replica install always uses
Directory Manager credentials to create the LDAP connection.
Since ACIs permitting hosts to manage their own services were
added in 4.2 release, the old master denies this operations.
https://pagure.io/freeipa/issue/6549
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
| -rw-r--r-- | ipaserver/install/server/replicainstall.py | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py index b4463fd40..f489e6919 100644 --- a/ipaserver/install/server/replicainstall.py +++ b/ipaserver/install/server/replicainstall.py @@ -1391,7 +1391,16 @@ def install(installer): dsinstance.create_ds_user() try: - conn.connect(ccache=ccache) + if promote: + conn.connect(ccache=ccache) + else: + # dmlvl 0 replica install should always use DM credentials + # to create remote LDAP connection. Since ACIs permitting hosts + # to manage their own services were added in 4.2 release, + # the master denies this operations. + conn.connect(bind_dn=ipaldap.DIRMAN_DN, cacert=cafile, + bind_pw=config.dirman_password) + # Update and istall updated CA file cafile = install_ca_cert(conn, api.env.basedn, api.env.realm, cafile) |