Setup lightweight CA key retrieval on install/upgrade

Add the ipa-pki-retrieve-key helper program and configure
lightweight CA key replication on installation and upgrade.  The
specific configuration steps are:

- Add the 'dogtag/$HOSTNAME' service principal
- Create the pricipal's Custodia keys
- Retrieve the principal's keytab
- Configure Dogtag's CS.cfg to use ExternalProcessKeyRetriever
  to invoke ipa-pki-retrieve-key for key retrieval

Also bump the minimum version of Dogtag to 10.3.2.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>

1 files changed, 32 insertions, 0 deletions

diff --git a/install/tools/ipa-pki-retrieve-key b/install/tools/ipa-pki-retrieve-key
new file mode 100755
index 000000000..740e799d2
--- /dev/null
+++ b/install/tools/ipa-pki-retrieve-key
@@ -0,0 +1,32 @@
+#!/usr/bin/python2
+
+from __future__ import print_function
+
+import os
+import sys
+
+from ipalib import constants
+from ipalib.config import Env
+from ipaplatform.paths import paths
+from ipapython.secrets.client import CustodiaClient
+
+env = Env()
+env._finalize()
+
+keyname = "ca_wrapped/" + sys.argv[1]
+servername = sys.argv[2]
+
+service = constants.PKI_GSSAPI_SERVICE_NAME
+client_keyfile = os.path.join(paths.PKI_TOMCAT, service + '.keys')
+client_keytab = os.path.join(paths.PKI_TOMCAT, service + '.keytab')
+
+# pylint: disable=no-member
+client = CustodiaClient(
+    client_service='%s@%s' % (service, env.host), server=servername,
+    realm=env.realm, ldap_uri="ldaps://" + env.host,
+    keyfile=client_keyfile, keytab=client_keytab,
+    )
+
+# Print the response JSON to stdout; it is already in the format
+# that Dogtag's ExternalProcessKeyRetriever expects
+print(client.fetch_key(keyname, store=False))