diff options
| author | Fraser Tweedale <ftweedal@redhat.com> | 2015-11-23 12:09:32 +1100 |
|---|---|---|
| committer | Jan Cholasta <jcholast@redhat.com> | 2015-11-24 10:12:24 +0100 |
| commit | 620036d26e98fdcefff00168e9e5463a8257d49c (patch) | |
| tree | 5f06b9eb125370d9dcdee938e18c31d1d8a3fe5d /ipalib | |
| parent | 6fe0a898077a74924b6ccaf6dfbaf2d166175722 (diff) | |
| download | freeipa-620036d26e98fdcefff00168e9e5463a8257d49c.tar.gz freeipa-620036d26e98fdcefff00168e9e5463a8257d49c.tar.xz freeipa-620036d26e98fdcefff00168e9e5463a8257d49c.zip | |
Add profiles and default CA ACL on migration
Profiles and the default CA ACL were not being added during replica
install from pre-4.2 servers. Update ipa-replica-install to add
these if they are missing.
Also update the caacl plugin to prevent deletion of the default CA
ACL and instruct the administrator to disable it instead.
To ensure that the cainstance installation can add profiles, supply
the RA certificate as part of the instance configuration.
Certmonger renewal setup is avoided at this point because the NSSDB
gets reinitialised later in installation procedure.
Also move the addition of the default CA ACL from dsinstance
installation to cainstance installation.
Fixes: https://fedorahosted.org/freeipa/ticket/5459
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Diffstat (limited to 'ipalib')
| -rw-r--r-- | ipalib/plugins/caacl.py | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/ipalib/plugins/caacl.py b/ipalib/plugins/caacl.py index 247d6df14..64dbec16e 100644 --- a/ipalib/plugins/caacl.py +++ b/ipalib/plugins/caacl.py @@ -307,6 +307,14 @@ class caacl_del(LDAPDelete): msg_summary = _('Deleted CA ACL "%(value)s"') + def pre_callback(self, ldap, dn, *keys, **options): + if keys[0] == 'hosts_services_caIPAserviceCert': + raise errors.ProtectedEntryError( + label=_("CA ACL"), + key=keys[0], + reason=_("default CA ACL can be only disabled")) + return dn + @register() class caacl_mod(LDAPUpdate): |