diff options
author | Ade Lee <alee@redhat.com> | 2012-09-19 23:35:42 -0400 |
---|---|---|
committer | Martin Kosek <mkosek@redhat.com> | 2012-11-23 12:19:19 +0100 |
commit | 18a210996dc47dbc9979e5ee0bb9f184c22eb173 (patch) | |
tree | 41a99a8d78e7f32a5372518f36415ff2f15ca466 /install/tools/ipa-ca-install | |
parent | 7960b5c67f0577e305d9fd86564b19957872d0e3 (diff) | |
download | freeipa-18a210996dc47dbc9979e5ee0bb9f184c22eb173.tar.gz freeipa-18a210996dc47dbc9979e5ee0bb9f184c22eb173.tar.xz freeipa-18a210996dc47dbc9979e5ee0bb9f184c22eb173.zip |
Changes to use a single database for dogtag and IPA
New servers that are installed with dogtag 10 instances will use
a single database instance for dogtag and IPA, albeit with different
suffixes. Dogtag will communicate with the instance through a
database user with permissions to modify the dogtag suffix only.
This user will authenticate using client auth using the subsystem cert
for the instance.
This patch includes changes to allow the creation of masters and clones
with single ds instances.
Diffstat (limited to 'install/tools/ipa-ca-install')
-rwxr-xr-x | install/tools/ipa-ca-install | 23 |
1 files changed, 19 insertions, 4 deletions
diff --git a/install/tools/ipa-ca-install b/install/tools/ipa-ca-install index 1c1b96a91..05dce8ae5 100755 --- a/install/tools/ipa-ca-install +++ b/install/tools/ipa-ca-install @@ -142,17 +142,32 @@ def main(): config.dir = dir config.setup_ca = True + portfile = config.dir + "/dogtag_directory_port.txt" + if not ipautil.file_exists(portfile): + dogtag_master_ds_port = str(dogtag.Dogtag9Constants.DS_PORT) + else: + with open(portfile) as fd: + dogtag_master_ds_port = fd.read() + if not options.skip_conncheck: - replica_conn_check(config.master_host_name, config.host_name, config.realm_name, True, options.admin_password) + replica_conn_check( + config.master_host_name, config.host_name, config.realm_name, True, + dogtag_master_ds_port, options.admin_password) # Configure the CA if necessary - (CA, cs) = cainstance.install_replica_ca(config, postinstall=True) + (CA, cs) = cainstance.install_replica_ca( + config, dogtag_master_ds_port, postinstall=True) # We need to ldap_enable the CA now that DS is up and running CA.ldap_enable('CA', config.host_name, config.dirman_password, ipautil.realm_to_suffix(config.realm_name)) - cs.add_simple_service('dogtagldap/%s@%s' % (config.host_name, config.realm_name)) - cs.add_cert_to_service() + if not dogtag.install_constants.SHARED_DB: + cs.add_simple_service('dogtagldap/%s@%s' % + (config.host_name, config.realm_name)) + cs.add_cert_to_service() + else: + CA.enable_client_auth_to_db() + CA.restart() # We need to restart apache as we drop a new config file in there ipaservices.knownservices.httpd.restart(capture_output=True) |