From 95768de06fbef78169329af12b29e4d65e4bf157 Mon Sep 17 00:00:00 2001 From: Martin Babinsky Date: Tue, 14 Mar 2017 09:56:07 +0100 Subject: Make PKINIT certificate request logic consistent with other installers The certmonger request handling code during pkinit setup actually never correctly handled situations when certificate request was rejected by the CA or CA was unreachable. This led to subtle errors caused by broken anonymous pkinit (e.g. failing WebUI logins) which are hard to debug. The code should behave as other service installers, e. g. use `request_and_wait_for_cert` method which raises hard error when request times out or is not granted by CA. On master contact Dogtag CA endpoint directly as is done in DS installation. https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti Reviewed-By: Alexander Bokovoy --- ipaserver/install/krbinstance.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/ipaserver/install/krbinstance.py b/ipaserver/install/krbinstance.py index 08d39e243..c74fe40fa 100644 --- a/ipaserver/install/krbinstance.py +++ b/ipaserver/install/krbinstance.py @@ -357,10 +357,15 @@ class KrbInstance(service.Service): subject = str(DN(('cn', self.fqdn), self.subject_base)) krbtgt = "krbtgt/" + self.realm + "@" + self.realm certpath = (paths.KDC_CERT, paths.KDC_KEY) + try: - reqid = certmonger.request_cert(certpath, subject, krbtgt, - dns=self.fqdn, storage='FILE', - profile='KDCs_PKINIT_Certs') + certmonger.request_and_wait_for_cert( + certpath, + subject, + krbtgt, + dns=self.fqdn, + storage='FILE', + profile='KDCs_PKINIT_Certs') except dbus.DBusException as e: # if the certificate is already tracked, ignore the error name = e.get_dbus_name() @@ -368,11 +373,6 @@ class KrbInstance(service.Service): root_logger.error("Failed to initiate the request: %s", e) return - try: - certmonger.wait_for_request(reqid) - except RuntimeError as e: - root_logger.error("Failed to wait for request: %s", e) - # Finally copy the cacert in the krb directory so we don't # have any selinux issues with the file context shutil.copyfile(paths.IPA_CA_CRT, paths.CACERT_PEM) -- cgit