diff options
| author | Fraser Tweedale <ftweedal@redhat.com> | 2016-11-16 20:49:36 +1000 |
|---|---|---|
| committer | Jan Cholasta <jcholast@redhat.com> | 2017-01-11 15:26:20 +0100 |
| commit | 3d01ec14c6e36fa962d0c54b2e08df0ecd401bd6 (patch) | |
| tree | 7aa59616dbb3b5a420d8e4509bb108ae314794c5 /ipaserver/install/server/__init__.py | |
| parent | 09a65df6842411d42966111e50924df3de0b7031 (diff) | |
| download | freeipa-3d01ec14c6e36fa962d0c54b2e08df0ecd401bd6.tar.gz freeipa-3d01ec14c6e36fa962d0c54b2e08df0ecd401bd6.tar.xz freeipa-3d01ec14c6e36fa962d0c54b2e08df0ecd401bd6.zip | |
Allow full customisability of IPA CA subject DN
Currently only the "subject base" of the IPA CA subject DN can be
customised, via the installer's --subject-base option. The RDN
"CN=Certificate Authority" is appended to form the subject DN, and
this composition is widely assumed.
Some administrators need more control over the CA subject DN,
especially to satisfy expectations of external CAs when the IPA CA
is to be externally signed.
This patch adds full customisability of the CA subject DN.
Specifically:
- Add the --ca-subject option for specifying the full IPA CA subject
DN. Defaults to "CN=Certificate Authority, O=$SUBJECT_BASE".
- ipa-ca-install, when installing a CA in a previous CA-less
topology, updates DS certmap.conf with the new new CA subject DN.
- DsInstance.find_subject_base no longer looks in certmap.conf,
because the CA subject DN can be unrelated to the subject base.
Fixes: https://fedorahosted.org/freeipa/ticket/2614
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Diffstat (limited to 'ipaserver/install/server/__init__.py')
| -rw-r--r-- | ipaserver/install/server/__init__.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/ipaserver/install/server/__init__.py b/ipaserver/install/server/__init__.py index 28cdd066a..86cb4a9ef 100644 --- a/ipaserver/install/server/__init__.py +++ b/ipaserver/install/server/__init__.py @@ -573,7 +573,8 @@ class ServerReplicaInstall(ServerReplicaInstallInterface): Server replica installer """ - subject = None + subject_base = None + ca_subject = None admin_password = knob( bases=ServerReplicaInstallInterface.admin_password, |