From 95c4b894f93619ed2867d1a769ed3c9f512b890c Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Fri, 10 Dec 2010 14:53:06 -0500 Subject: Fix Install using dogtag. The CA is installed before DS so we need to wait until DS is actually installed to be able to ldap_enable the CA instance. Fixes: https://fedorahosted.org/freeipa/ticket/612 --- install/tools/ipa-replica-install | 5 +++++ install/tools/ipa-server-install | 11 +++++++++-- ipaserver/install/cainstance.py | 12 ++++++++++-- ipaserver/install/dsinstance.py | 2 +- ipaserver/install/service.py | 8 ++++---- 5 files changed, 29 insertions(+), 9 deletions(-) diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install index 3d6f4743a..c9df2dd43 100755 --- a/install/tools/ipa-replica-install +++ b/install/tools/ipa-replica-install @@ -391,6 +391,11 @@ def main(): # Configure dirsrv ds = install_replica_ds(config) + # We ned to ldap_enable the CA now that DS is up and running + if CA: + CA.ldap_enable('CA', host_name, dm_password, + util.realm_to_suffix(self.realm_name)) + install_krb(config, setup_pkinit=options.setup_pkinit) install_http(config) if CA: diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install index 7fa6c71df..0a1f1c56f 100755 --- a/install/tools/ipa-server-install +++ b/install/tools/ipa-server-install @@ -697,7 +697,6 @@ def main(): ca = certs.CertDB(realm_name, host_name=host_name, subject_base=options.subject) ca.create_self_signed() - ca.publish_ca_cert("/etc/ipa/ca.crt") else: # Clean up any previous self-signed CA that may exist try: @@ -740,6 +739,9 @@ def main(): else: ca.configure_instance("pkiuser", host_name, dm_password, dm_password, cert_file=options.external_cert_file, cert_chain_file=options.external_ca_file, subject_base=options.subject) + # Now put the CA cert where other instances exepct it + ca.publish_ca_cert("/etc/ipa/ca.crt") + # Create a directory server instance ds = dsinstance.DsInstance() @@ -761,12 +763,17 @@ def main(): subject_base=options.subject, hbac_allow=not options.hbac_allow) + # We ned to ldap_enable the CA now that DS is up and running + if not options.selfsign: + ca.ldap_enable('CA', host_name, dm_password, + util.realm_to_suffix(realm_name)) + + # Create a kerberos instance if options.pkinit_pin: [pw_fd, pw_name] = tempfile.mkstemp() os.write(pw_fd, options.dirsrv_pin) os.close(pw_fd) - # Create a kerberos instance krb = krbinstance.KrbInstance(fstore) if options.pkinit_pkcs12: pkcs12_info = (options.pkinit_pkcs12, pw_name) diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index e03adfb9b..7cc8d50a3 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -478,8 +478,8 @@ class CAInstance(service.Service): # We do not let the system start IPA components on its own, # Instead we reply on the IPA init script to start only enabled # components as found in our LDAP configuration tree - suffix = util.realm_to_suffix(self.realm) - self.ldap_enable('CA', self.fqdn, self.dm_password, suffix) + # We need to install DS before we can actually ldap_enable a service. + # so actual enablement is delayed. def __create_ca_user(self): user_exists = True @@ -996,6 +996,14 @@ class CAInstance(service.Service): except ipautil.CalledProcessError, e: logging.critical("failed to delete user %s" % e) + def publish_ca_cert(self, location): + args = ["-L", "-n", self.canickname, "-a"] + (cert, err, returncode) = self.__run_certutil(args) + fd = open(location, "w+") + fd.write(cert) + fd.close() + os.chmod(location, 0444) + if __name__ == "__main__": installutils.standard_logging_setup("install.log", False) cs = CADSInstance() diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py index 36bc51530..735c885aa 100644 --- a/ipaserver/install/dsinstance.py +++ b/ipaserver/install/dsinstance.py @@ -46,7 +46,7 @@ from ipaserver.plugins.ldap2 import ldap2 SERVER_ROOT_64 = "/usr/lib64/dirsrv" SERVER_ROOT_32 = "/usr/lib/dirsrv" -CACERT="/erc/ipa/ca.crt" +CACERT="/etc/ipa/ca.crt" def find_server_root(): if ipautil.dir_exists(SERVER_ROOT_64): diff --git a/ipaserver/install/service.py b/ipaserver/install/service.py index 41b5455d3..281981d1c 100644 --- a/ipaserver/install/service.py +++ b/ipaserver/install/service.py @@ -34,7 +34,7 @@ SERVICE_LIST = { 'KPASSWD':('ipa_kpasswd', 20), 'DNS':('named', 30), 'HTTP':('httpd', 40), - 'CA':('pki_cad', 50) + 'CA':('pki-cad', 50) } def stop(service_name, instance_name=""): @@ -270,19 +270,19 @@ class Service: self.steps = [] - def __get_conn(self, dm_password): + def __get_conn(self, fqdn, dm_password): try: conn = ipaldap.IPAdmin("127.0.0.1") conn.simple_bind_s("cn=directory manager", dm_password) except Exception, e: - logging.critical("Could not connect to the Directory Server on %s: %s" % (self.fqdn, str(e))) + logging.critical("Could not connect to the Directory Server on %s: %s" % (fqdn, str(e))) raise e return conn def ldap_enable(self, name, fqdn, dm_password, ldap_suffix): self.chkconfig_off() - conn = self.__get_conn(dm_password) + conn = self.__get_conn(fqdn, dm_password) entry_name = "cn=%s,cn=%s,%s,%s" % (name, fqdn, "cn=masters,cn=ipa,cn=etc", -- cgit