diff options
| author | Simo Sorce <simo@redhat.com> | 2016-12-13 10:32:32 -0500 |
|---|---|---|
| committer | Jan Cholasta <jcholast@redhat.com> | 2017-02-15 07:13:37 +0100 |
| commit | d124e307f3b7d88bca53784f030ed6043b224432 (patch) | |
| tree | 775fca61a10a7b2b2d0af42cf5ae9290fa6103ec /ipaserver/plugins | |
| parent | d2f5fc304f1938d23171ae330fa20b213ceed54e (diff) | |
| download | freeipa-d124e307f3b7d88bca53784f030ed6043b224432.tar.gz freeipa-d124e307f3b7d88bca53784f030ed6043b224432.tar.xz freeipa-d124e307f3b7d88bca53784f030ed6043b224432.zip | |
Separate RA cert store from the HTTP cert store
This is in preparation for separating out the user under which the
ipa api framework runs as.
This commit also removes certs.NSS_DIR to avoid confusion and replaces
it where appropriate with the correct NSS DB directory, either the old
HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is
removed altogether as it was simply not necessary.
https://fedorahosted.org/freeipa/ticket/5959
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Diffstat (limited to 'ipaserver/plugins')
| -rw-r--r-- | ipaserver/plugins/dogtag.py | 8 | ||||
| -rw-r--r-- | ipaserver/plugins/rabase.py | 4 |
2 files changed, 6 insertions, 6 deletions
diff --git a/ipaserver/plugins/dogtag.py b/ipaserver/plugins/dogtag.py index 2f9fd4b37..6ff6d292c 100644 --- a/ipaserver/plugins/dogtag.py +++ b/ipaserver/plugins/dogtag.py @@ -1242,8 +1242,8 @@ class RestClient(Backend): self.sec_dir = api.env.dot_ipa + os.sep + 'alias' self.pwd_file = self.sec_dir + os.sep + '.pwd' else: - self.sec_dir = paths.HTTPD_ALIAS_DIR - self.pwd_file = paths.ALIAS_PWDFILE_TXT + self.sec_dir = paths.IPA_RADB_DIR + self.pwd_file = os.path.join(paths.IPA_RADB_DIR, 'pwdfile.txt') self.noise_file = self.sec_dir + os.sep + '.noise' self.ipa_key_size = "2048" self.ipa_certificate_nickname = "ipaCert" @@ -2015,8 +2015,8 @@ class kra(Backend): raise RuntimeError('KRA service is not enabled') crypto = cryptoutil.NSSCryptoProvider( - paths.HTTPD_ALIAS_DIR, - password_file=paths.ALIAS_PWDFILE_TXT) + paths.IPA_RADB_DIR, + password_file=os.path.join(paths.IPA_RADB_DIR, 'pwdfile.txt')) # TODO: obtain KRA host & port from IPA service list or point to KRA load balancer # https://fedorahosted.org/freeipa/ticket/4557 diff --git a/ipaserver/plugins/rabase.py b/ipaserver/plugins/rabase.py index 736c16698..8f2c8c388 100644 --- a/ipaserver/plugins/rabase.py +++ b/ipaserver/plugins/rabase.py @@ -44,8 +44,8 @@ class rabase(Backend): self.sec_dir = api.env.dot_ipa + os.sep + 'alias' self.pwd_file = self.sec_dir + os.sep + '.pwd' else: - self.sec_dir = paths.HTTPD_ALIAS_DIR - self.pwd_file = paths.ALIAS_PWDFILE_TXT + self.sec_dir = paths.IPA_RADB_DIR + self.pwd_file = os.path.join(paths.IPA_RADB_DIR, 'pwdfile.txt') super(rabase, self).__init__(api) |