Unfortunately my last patch was not properly tested with a dogtag installation and quite a few spots needed minor adjustments.
This patch passed my install tests with dogtag. Simo. -- Simo Sorce * Red Hat, Inc * New York
>From d06261a49b83a0d387bc395e84a2e6dc5556b30c Mon Sep 17 00:00:00 2001 From: Simo Sorce <[email protected]> Date: Fri, 10 Dec 2010 14:53:06 -0500 Subject: [PATCH 1/2] Fix Install using dogtag. The CA is installed before DS so we need to wait until DS is actually installed to be able to ldap_enable the CA instance. Fixes: https://fedorahosted.org/freeipa/ticket/612 --- install/tools/ipa-replica-install | 5 +++++ install/tools/ipa-server-install | 17 ++++++++++++----- ipaserver/install/cainstance.py | 12 ++++++++++-- ipaserver/install/dsinstance.py | 2 +- ipaserver/install/service.py | 8 ++++---- 5 files changed, 32 insertions(+), 12 deletions(-) diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install index 3d6f4743aaf5f39dc42ed1840a2d3eeefb1b2e76..c9df2dd43034678a0859fdfb6fa46a7f20562f91 100755 --- a/install/tools/ipa-replica-install +++ b/install/tools/ipa-replica-install @@ -391,6 +391,11 @@ def main(): # Configure dirsrv ds = install_replica_ds(config) + # We ned to ldap_enable the CA now that DS is up and running + if CA: + CA.ldap_enable('CA', host_name, dm_password, + util.realm_to_suffix(self.realm_name)) + install_krb(config, setup_pkinit=options.setup_pkinit) install_http(config) if CA: diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install index 7fa6c71df3ee6fe5e71696e33ffd3e8a5a22235b..0a1f1c56f022bea4b98d420cebbc9d05f303057e 100755 --- a/install/tools/ipa-server-install +++ b/install/tools/ipa-server-install @@ -697,7 +697,6 @@ def main(): ca = certs.CertDB(realm_name, host_name=host_name, subject_base=options.subject) ca.create_self_signed() - ca.publish_ca_cert("/etc/ipa/ca.crt") else: # Clean up any previous self-signed CA that may exist try: @@ -740,6 +739,9 @@ def main(): else: ca.configure_instance("pkiuser", host_name, dm_password, dm_password, cert_file=options.external_cert_file, cert_chain_file=options.external_ca_file, subject_base=options.subject) + # Now put the CA cert where other instances exepct it + ca.publish_ca_cert("/etc/ipa/ca.crt") + # Create a directory server instance ds = dsinstance.DsInstance() @@ -761,12 +763,17 @@ def main(): subject_base=options.subject, hbac_allow=not options.hbac_allow) - if options.pkinit_pin: - [pw_fd, pw_name] = tempfile.mkstemp() - os.write(pw_fd, options.dirsrv_pin) - os.close(pw_fd) + # We ned to ldap_enable the CA now that DS is up and running + if not options.selfsign: + ca.ldap_enable('CA', host_name, dm_password, + util.realm_to_suffix(realm_name)) # Create a kerberos instance + if options.pkinit_pin: + [pw_fd, pw_name] = tempfile.mkstemp() + os.write(pw_fd, options.dirsrv_pin) + os.close(pw_fd) + krb = krbinstance.KrbInstance(fstore) if options.pkinit_pkcs12: pkcs12_info = (options.pkinit_pkcs12, pw_name) diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index e03adfb9b161a5b6b0befe8d71814df85c2bea39..7cc8d50a3a682715ab5a496f4b7bd17a9f0c81ac 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -478,8 +478,8 @@ class CAInstance(service.Service): # We do not let the system start IPA components on its own, # Instead we reply on the IPA init script to start only enabled # components as found in our LDAP configuration tree - suffix = util.realm_to_suffix(self.realm) - self.ldap_enable('CA', self.fqdn, self.dm_password, suffix) + # We need to install DS before we can actually ldap_enable a service. + # so actual enablement is delayed. def __create_ca_user(self): user_exists = True @@ -996,6 +996,14 @@ class CAInstance(service.Service): except ipautil.CalledProcessError, e: logging.critical("failed to delete user %s" % e) + def publish_ca_cert(self, location): + args = ["-L", "-n", self.canickname, "-a"] + (cert, err, returncode) = self.__run_certutil(args) + fd = open(location, "w+") + fd.write(cert) + fd.close() + os.chmod(location, 0444) + if __name__ == "__main__": installutils.standard_logging_setup("install.log", False) cs = CADSInstance() diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py index 36bc51530bc28e7edf016954c853efb2f35ecf6e..735c885aacbeda85b47aa75f2217a4d1606987e5 100644 --- a/ipaserver/install/dsinstance.py +++ b/ipaserver/install/dsinstance.py @@ -46,7 +46,7 @@ from ipaserver.plugins.ldap2 import ldap2 SERVER_ROOT_64 = "/usr/lib64/dirsrv" SERVER_ROOT_32 = "/usr/lib/dirsrv" -CACERT="/erc/ipa/ca.crt" +CACERT="/etc/ipa/ca.crt" def find_server_root(): if ipautil.dir_exists(SERVER_ROOT_64): diff --git a/ipaserver/install/service.py b/ipaserver/install/service.py index 41b5455d308833005fe81239b3cdacd1d15a113f..281981d1c2f220ac1aac701940bdfbd6e6973ee0 100644 --- a/ipaserver/install/service.py +++ b/ipaserver/install/service.py @@ -34,7 +34,7 @@ SERVICE_LIST = { 'KPASSWD':('ipa_kpasswd', 20), 'DNS':('named', 30), 'HTTP':('httpd', 40), - 'CA':('pki_cad', 50) + 'CA':('pki-cad', 50) } def stop(service_name, instance_name=""): @@ -270,19 +270,19 @@ class Service: self.steps = [] - def __get_conn(self, dm_password): + def __get_conn(self, fqdn, dm_password): try: conn = ipaldap.IPAdmin("127.0.0.1") conn.simple_bind_s("cn=directory manager", dm_password) except Exception, e: - logging.critical("Could not connect to the Directory Server on %s: %s" % (self.fqdn, str(e))) + logging.critical("Could not connect to the Directory Server on %s: %s" % (fqdn, str(e))) raise e return conn def ldap_enable(self, name, fqdn, dm_password, ldap_suffix): self.chkconfig_off() - conn = self.__get_conn(dm_password) + conn = self.__get_conn(fqdn, dm_password) entry_name = "cn=%s,cn=%s,%s,%s" % (name, fqdn, "cn=masters,cn=ipa,cn=etc", -- 1.7.3.2
_______________________________________________ Freeipa-devel mailing list [email protected] https://www.redhat.com/mailman/listinfo/freeipa-devel
