diff options
| author | Martin Babinsky <mbabinsk@redhat.com> | 2016-02-25 09:09:35 +0100 |
|---|---|---|
| committer | Tomas Babej <tbabej@redhat.com> | 2016-03-01 13:44:09 +0100 |
| commit | 276d16775a4ce8af5d39ca8a7bf5bcd638df343f (patch) | |
| tree | 4be057a7885db419fb3ba53dab6483d76555e83e /ipaserver | |
| parent | 02d3ea106214c7e170cb9bf051e4085ade440134 (diff) | |
| download | freeipa-276d16775a4ce8af5d39ca8a7bf5bcd638df343f.tar.gz freeipa-276d16775a4ce8af5d39ca8a7bf5bcd638df343f.tar.xz freeipa-276d16775a4ce8af5d39ca8a7bf5bcd638df343f.zip | |
use LDAPS during standalone CA/KRA subsystem deployment
The deployment descriptor used during CA/KRA install was modified to use LDAPS
to communicate with DS backend. This will enable standalone CA/KRA
installation on top of hardened directory server configuration.
https://fedorahosted.org/freeipa/ticket/5570
Reviewed-By: Tomas Babej <tbabej@redhat.com>
Diffstat (limited to 'ipaserver')
| -rw-r--r-- | ipaserver/install/cainstance.py | 3 | ||||
| -rw-r--r-- | ipaserver/install/dogtaginstance.py | 6 | ||||
| -rw-r--r-- | ipaserver/install/krainstance.py | 2 |
3 files changed, 11 insertions, 0 deletions
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index b72255f1a..d94520166 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -480,6 +480,9 @@ class CAInstance(DogtagInstance): config.set("CA", "pki_ds_base_dn", self.basedn) config.set("CA", "pki_ds_database", "ipaca") + if not self.create_ra_agent_db and not self.clone: + self._use_ldaps_during_spawn(config) + # Certificate subject DN's config.set("CA", "pki_subsystem_subject_dn", str(DN(('cn', 'CA Subsystem'), self.subject_base))) diff --git a/ipaserver/install/dogtaginstance.py b/ipaserver/install/dogtaginstance.py index 5c2b28202..f5e5649f9 100644 --- a/ipaserver/install/dogtaginstance.py +++ b/ipaserver/install/dogtaginstance.py @@ -500,3 +500,9 @@ class DogtagInstance(service.Service): for group in self.admin_groups: self.__remove_admin_from_group(group) self.admin_conn.delete_entry(self.admin_dn) + + def _use_ldaps_during_spawn(self, config, ds_cacert=paths.IPA_CA_CRT): + config.set(self.subsystem, "pki_ds_ldaps_port", "636") + config.set(self.subsystem, "pki_ds_secure_connection", "True") + config.set(self.subsystem, "pki_ds_secure_connection_ca_pem_file", + ds_cacert) diff --git a/ipaserver/install/krainstance.py b/ipaserver/install/krainstance.py index 6589bb54e..a354d3748 100644 --- a/ipaserver/install/krainstance.py +++ b/ipaserver/install/krainstance.py @@ -182,6 +182,8 @@ class KRAInstance(DogtagInstance): config.set("KRA", "pki_ds_database", "ipaca") config.set("KRA", "pki_ds_create_new_db", "False") + self._use_ldaps_during_spawn(config) + # Certificate subject DNs config.set("KRA", "pki_subsystem_subject_dn", str(DN(('cn', 'CA Subsystem'), self.subject_base))) |