1 files changed, 35 insertions, 0 deletions
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
index 245450701..5056f833e 100644
--- a/ipaserver/install/server/upgrade.py
+++ b/ipaserver/install/server/upgrade.py
@@ -47,6 +47,7 @@ from ipaserver.install import sysupgrade
 from ipaserver.install import dnskeysyncinstance
 from ipaserver.install import krainstance
 from ipaserver.install import dogtaginstance
+from ipaserver.install import krbinstance
 from ipaserver.install.upgradeinstance import IPAUpgrade
 from ipaserver.install.ldapupdate import BadSyntax
 
@@ -1492,6 +1493,20 @@ def add_default_caacl(ca):
     sysupgrade.set_upgrade_state('caacl', 'add_default_caacl', True)
 
 
+def enable_anonymous_principal(krb):
+    princ_realm = krb.get_anonymous_principal()
+    dn = DN(('krbprincipalname', princ_realm), krb.get_realm_suffix())
+    try:
+        _ = api.Backend.ldap2.get_entry(dn)  # pylint: disable=unused-variable
+    except ipalib.errors.NotFound:
+        installutils.kadmin_addprinc(princ_realm)
+
+    try:
+        api.Backend.ldap2.set_entry_active(dn, True)
+    except ipalib.errors.AlreadyActive:
+        pass
+
+
 def upgrade_configuration():
     """
     Execute configuration upgrade of the IPA services
@@ -1735,6 +1750,26 @@ def upgrade_configuration():
 
     set_sssd_domain_option('ipa_server_mode', 'True')
 
+    krb = krbinstance.KrbInstance(fstore)
+    krb.fqdn = fqdn
+    krb.realm = api.env.realm
+    krb.suffix = ipautil.realm_to_suffix(krb.realm)
+    krb.subject_base = subject_base
+    if not os.path.exists(paths.KDC_CERT):
+        krb.setup_pkinit()
+        enable_anonymous_principal(krb)
+        replacevars = dict()
+        replacevars['pkinit_identity'] = 'FILE:{},{}'.format(
+            paths.KDC_CERT,paths.KDC_KEY)
+        appendvars = {}
+        ipautil.backup_config_and_replace_variables(
+            fstore, paths.KRB5KDC_KDC_CONF, replacevars=replacevars,
+            appendvars=appendvars)
+        tasks.restore_context(paths.KRB5KDC_KDC_CONF)
+        if krb.is_running():
+            krb.stop()
+        krb.start()
+
     if not ds_running:
         ds.stop(ds_serverid)