diff options
| author | Martin Kosek <mkosek@redhat.com> | 2012-02-24 16:23:52 +0100 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2012-02-27 18:04:19 +0100 |
| commit | 7fe63f823388648c671389e7146b91c2fec7b2ca (patch) | |
| tree | 927b223822fe4648296309a57f7aef639aff92c4 /ipaserver/install/bindinstance.py | |
| parent | dc47f77dc1f7df8aafa09ed6d9baa7f209016f35 (diff) | |
| download | freeipa-7fe63f823388648c671389e7146b91c2fec7b2ca.tar.gz freeipa-7fe63f823388648c671389e7146b91c2fec7b2ca.tar.xz freeipa-7fe63f823388648c671389e7146b91c2fec7b2ca.zip | |
Add SSHFP update policy for existing zones
SSH public key support includes a feature to automatically add/update
client SSH fingerprints in SSHFP records. However, the update won't
work for zones created before this support was added as they don't
allow clients to update SSHFP records in their update policies.
This patch lets dns upgrade module extend the original policy
to allow the SSHFP dynamic updates. It updates only original
policy, we don't want it to overwrite custom user policies.
https://fedorahosted.org/freeipa/ticket/2394
Diffstat (limited to 'ipaserver/install/bindinstance.py')
| -rw-r--r-- | ipaserver/install/bindinstance.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ipaserver/install/bindinstance.py b/ipaserver/install/bindinstance.py index 9dc12e276..a37a29303 100644 --- a/ipaserver/install/bindinstance.py +++ b/ipaserver/install/bindinstance.py @@ -32,7 +32,7 @@ from ipapython import sysrestore from ipapython import ipautil from ipalib.constants import DNS_ZONE_REFRESH from ipalib.parameters import IA5Str -from ipalib.util import validate_zonemgr, normalize_zonemgr +from ipalib.util import validate_zonemgr, normalize_zonemgr, gen_dns_update_policy from ipapython.ipa_log_manager import * import ipalib @@ -185,7 +185,7 @@ def read_reverse_zone(default, ip_address): def add_zone(name, zonemgr=None, dns_backup=None, ns_hostname=None, ns_ip_address=None, update_policy=None): if update_policy is None: - update_policy = "grant %(realm)s krb5-self * A; grant %(realm)s krb5-self * AAAA; grant %(realm)s krb5-self * SSHFP;" % dict(realm=api.env.realm) + update_policy = gen_dns_update_policy(api.env.realm) if zonemgr is None: zonemgr = 'hostmaster.%s' % name |