diff options
| author | David Kupka <dkupka@redhat.com> | 2017-04-11 11:43:40 +0200 |
|---|---|---|
| committer | Pavel Vomacka <pvomacka@redhat.com> | 2017-04-11 17:51:49 +0200 |
| commit | a726e98f034347227765d7303a033a0538f5d8a1 (patch) | |
| tree | 24a7ae04c0e0dcd2d73bc9cf0b1a4b45e96a56e9 /ipaserver/install/installutils.py | |
| parent | 157831a287c64106eed4da4ace5228d7e369ae2f (diff) | |
| download | freeipa-a726e98f034347227765d7303a033a0538f5d8a1.tar.gz freeipa-a726e98f034347227765d7303a033a0538f5d8a1.tar.xz freeipa-a726e98f034347227765d7303a033a0538f5d8a1.zip | |
Create system users for FreeIPA services during package installation
Previously system users needed by FreeIPA server services was created during
ipa-server-install. This led to problem when DBus policy was configured during
package installation but the user specified in the policy didn't exist yet
(and potentionally similar ones). Now the users will be created in package %pre
section so all users freeipa-server package needs exist before any installation
or configuration begins.
Another possibility would be using systemd-sysusers(8) for this purpose but
given that systemd is not available during container build the traditional
approach is superior.
Also dirsrv and pkiuser users are no longer created by FreeIPA instead it
depends on 389ds and dogtag to create those users.
https://pagure.io/freeipa/issue/6743
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Diffstat (limited to 'ipaserver/install/installutils.py')
| -rw-r--r-- | ipaserver/install/installutils.py | 13 |
1 files changed, 0 insertions, 13 deletions
diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py index ef6a399ad..9230e7005 100644 --- a/ipaserver/install/installutils.py +++ b/ipaserver/install/installutils.py @@ -44,7 +44,6 @@ import six from six.moves.configparser import SafeConfigParser, NoOptionError # pylint: enable=import-error -from ipalib.constants import IPAAPI_USER, IPAAPI_GROUP from ipalib.install import sysrestore from ipalib.install.kinit import kinit_password import ipaplatform @@ -56,7 +55,6 @@ from ipalib import api, errors, x509 from ipapython.dn import DN from ipaserver.install import certs, service, sysupgrade from ipaplatform import services -from ipaplatform.constants import constants from ipaplatform.paths import paths from ipaplatform.tasks import tasks @@ -1515,14 +1513,3 @@ def default_subject_base(realm_name): def default_ca_subject_dn(subject_base): return DN(('CN', 'Certificate Authority'), subject_base) - - -def create_ipaapi_user(): - """Create IPA API user/group if it doesn't exist yet.""" - tasks.create_system_user( - name=IPAAPI_USER, - group=IPAAPI_GROUP, - homedir=paths.VAR_LIB, - shell=paths.NOLOGIN - ) - tasks.add_user_to_group(constants.HTTPD_USER, IPAAPI_GROUP) |