diff options
| author | Jan Cholasta <jcholast@redhat.com> | 2014-06-10 14:07:35 +0200 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-07-30 16:04:21 +0200 |
| commit | 586373cf077f3761004414c3809785dfbcb6ef46 (patch) | |
| tree | 2d08c859e827dd79079a844c5047dd29c4e8d7ab /ipaserver/install/replication.py | |
| parent | fd80cc1c590a0ca977473ea71ff94e66b6c13f33 (diff) | |
| download | freeipa-586373cf077f3761004414c3809785dfbcb6ef46.tar.gz freeipa-586373cf077f3761004414c3809785dfbcb6ef46.tar.xz freeipa-586373cf077f3761004414c3809785dfbcb6ef46.zip | |
Add permissions for certificate store.
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Diffstat (limited to 'ipaserver/install/replication.py')
| -rw-r--r-- | ipaserver/install/replication.py | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/ipaserver/install/replication.py b/ipaserver/install/replication.py index f1e70a1d4..5778cab03 100644 --- a/ipaserver/install/replication.py +++ b/ipaserver/install/replication.py @@ -1283,6 +1283,36 @@ class ReplicationManager(object): err = e try: + entry = self.conn.get_entry( + DN(('cn', 'certificates'), ('cn', 'ipa'), ('cn', 'etc'), + self.suffix), + ['aci']) + + sub = {'suffix': self.suffix, 'fqdn': replica} + try: + entry.raw['aci'].remove( + '(targetfilter = "(&(objectClass=ipaCertificate)' + '(ipaConfigString=ipaCA))")(targetattr = ' + '"ipaCertIssuerSerial || cACertificate")(version 3.0; acl ' + '"Modify CA Certificate Store Entry"; allow (write) ' + 'userdn = "ldap:///fqdn=%(fqdn)s,cn=computers,cn=accounts,' + '%(suffix)s";)' % sub) + except ValueError: + pass + + try: + self.conn.update_entry(entry) + except errors.EmptyModlist: + pass + except errors.NotFound: + pass + except Exception, e: + if not force: + raise e + elif not err: + err = e + + try: basedn = DN(('cn', 'etc'), self.suffix) filter = '(dnaHostname=%s)' % replica entries = self.conn.get_entries( |