This patch is required for the installer ref@#$%&ing work (https://fedorahosted.org/freeipa/ticket/4468).

It required quite a bit of hacking to get it work as expected, but I hope that it's not so bad.


Requires PATCH 0035 "do not check for directory manager password during KRA uninstall" to apply.

--
Martin^3 Babinsky
From 9d6fceb2c869d2939edf714eda02f90de0cf88f7 Mon Sep 17 00:00:00 2001
From: Martin Babinsky <mbabi...@redhat.com>
Date: Fri, 15 May 2015 19:02:22 +0200
Subject: [PATCH] merge KRA installation machinery to a single module

This is a prerequisite to further refactoring of KRA install/uninstall
functionality in all IPA install scripts.

https://fedorahosted.org/freeipa/ticket/4468
---
 install/tools/ipa-replica-install    |  21 +++----
 install/tools/ipa-server-install     |  26 +++-----
 ipaserver/install/ipa_kra_install.py | 118 ++++++++---------------------------
 ipaserver/install/kra.py             | 116 ++++++++++++++++++++++++++++++++++
 4 files changed, 158 insertions(+), 123 deletions(-)
 create mode 100644 ipaserver/install/kra.py

diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index f68cc8cf4722264ecea2f1f50de3aa245be24ef9..d0c4a28fcf0bf0a2693ffef10626a8f99a69c8bc 100755
--- a/install/tools/ipa-replica-install
+++ b/install/tools/ipa-replica-install
@@ -37,10 +37,10 @@ from ipaserver.install import memcacheinstance, dnskeysyncinstance
 from ipaserver.install import otpdinstance
 from ipaserver.install.replication import replica_conn_check, ReplicationManager
 from ipaserver.install.installutils import (
-    create_replica_config, read_replica_info_kra_enabled, private_ccache)
+    create_replica_config, private_ccache)
 from ipaserver.plugins.ldap2 import ldap2
 from ipaserver.install import cainstance
-from ipaserver.install import krainstance
+from ipaserver.install import kra
 from ipaserver.install import dns as dns_installer
 from ipalib import api, create_api, errors, util, certstore, x509
 from ipalib.constants import CACERT
@@ -473,12 +473,12 @@ def main():
 
     config.setup_kra = options.setup_kra
     if config.setup_kra:
-        if not config.setup_ca:
-            print "CA must be installed with the KRA"
-            sys.exit(1)
-        if not read_replica_info_kra_enabled(config.dir):
-            print "KRA is not installed on the master system"
-            sys.exit(1)
+        try:
+            kra.check_install(options, dirman_password,
+                              config.setup_ca, filename)
+        except RuntimeError as e:
+            print str(e)
+            exit(1)
 
     installutils.verify_fqdn(config.master_host_name, options.no_host_dns)
 
@@ -660,10 +660,7 @@ def main():
     ds.apply_updates()
 
     if options.setup_kra:
-        kra = krainstance.install_replica_kra(config)
-        service.print_msg("Restarting the directory server")
-        ds.restart()
-        kra.enable_client_auth_to_db(kra.dogtag_constants.KRA_CS_CFG_PATH)
+        kra.install(options, dirman_password, replica_file=filename)
     else:
         service.print_msg("Restarting the directory server")
         ds.restart()
diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
index cb6e1abe2016c0f8cefc35b1d685373f05b3ef89..f4ef71d84d30d79f70f164c30f274d8769b3e319 100755
--- a/install/tools/ipa-server-install
+++ b/install/tools/ipa-server-install
@@ -53,13 +53,13 @@ from ipaserver.install import httpinstance
 from ipaserver.install import ntpinstance
 from ipaserver.install import certs
 from ipaserver.install import cainstance
-from ipaserver.install import krainstance
 from ipaserver.install import memcacheinstance
 from ipaserver.install import otpdinstance
 from ipaserver.install import sysupgrade
 from ipaserver.install import replication
 from ipaserver.install import dns as dns_installer
 from ipaserver.install import service, installutils
+from ipaserver.install import kra
 from ipapython import version
 from ipapython import certmonger
 from ipapython import ipaldap
@@ -577,11 +577,12 @@ def uninstall():
         if cads_instance.is_configured():
             cads_instance.uninstall()
 
-    kra_instance = krainstance.KRAInstance(
-        api.env.realm, dogtag_constants=dogtag_constants)
-    kra_instance.stop_tracking_certificates()
-    if kra_instance.is_installed():
-        kra_instance.uninstall()
+    try:
+        kra.check_uninstall()
+    except RuntimeError:
+        pass
+    else:
+        kra.uninstall()
 
     ca_instance = cainstance.CAInstance(
         api.env.realm, certs.NSS_DIR, dogtag_constants=dogtag_constants)
@@ -1290,18 +1291,7 @@ def main():
     http.restart()
 
     if setup_kra:
-        kra = krainstance.KRAInstance(realm_name,
-            dogtag_constants=dogtag.install_constants)
-        kra.configure_instance(host_name, domain_name, dm_password,
-                               dm_password, subject_base=options.subject)
-
-        # This is done within stopped_service context, which restarts KRA
-        service.print_msg("Restarting the directory server")
-        ds.restart()
-
-        service.print_msg("Enabling KRA to authenticate with the database "
-                          "using client certificates")
-        kra.enable_client_auth_to_db(kra.dogtag_constants.KRA_CS_CFG_PATH)
+        kra.install(options, dm_password)
 
     # Set the admin user kerberos password
     ds.change_admin_password(admin_password)
diff --git a/ipaserver/install/ipa_kra_install.py b/ipaserver/install/ipa_kra_install.py
index 08b4331f4d1741b6970c676283401abf0d861673..8d7f82f6c062277e4cb0d4e23fe8ffd2924cafe7 100644
--- a/ipaserver/install/ipa_kra_install.py
+++ b/ipaserver/install/ipa_kra_install.py
@@ -18,22 +18,14 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 
-from ConfigParser import RawConfigParser
 from textwrap import dedent
 from ipalib import api
-from ipaplatform import services
 from ipaplatform.paths import paths
 from ipapython import admintool
-from ipapython import dogtag
 from ipapython import ipautil
-from ipaserver.install import cainstance
-from ipaserver.install import dogtaginstance
-from ipaserver.install import krainstance
-from ipaserver.install import dsinstance
 from ipaserver.install import installutils
-from ipaserver.install import service
-from ipaserver.install.installutils import (
-    read_replica_info_kra_enabled, create_replica_config)
+from ipaserver.install import dogtaginstance
+import kra
 
 
 class KRAInstall(admintool.AdminTool):
@@ -93,29 +85,14 @@ class KRAUninstaller(KRAInstall):
 
         if self.args:
             self.option_parser.error("Too many parameters provided.")
-
-        if not api.env.enable_kra:
-            self.option_parser.error(
-                "Cannot uninstall.  There is no KRA installed on this system."
-            )
+        try:
+            kra.check_uninstall()
+        except RuntimeError as e:
+            self.option_parser.error(str(e))
 
     def run(self):
         super(KRAUninstaller, self).run()
-        dogtag_constants = dogtag.configured_constants()
-
-        kra_instance = krainstance.KRAInstance(
-            api.env.realm, dogtag_constants=dogtag_constants)
-        kra_instance.stop_tracking_certificates()
-        if kra_instance.is_installed():
-            kra_instance.uninstall()
-
-        # Update config file
-        parser = RawConfigParser()
-        parser.read(paths.IPA_DEFAULT_CONF)
-        parser.set('global', 'enable_kra', 'False')
-
-        with open(paths.IPA_DEFAULT_CONF, 'w') as f:
-            parser.write(f)
+        kra.uninstall()
 
 
 class KRAInstaller(KRAInstall):
@@ -136,31 +113,14 @@ class KRAInstaller(KRAInstall):
         super(KRAInstaller, self).validate_options(needs_root=True)
 
         if self.options.unattended and self.options.password is None:
-            self.option_parser.error(
-                "Directory Manager password must be specified using -p"
-                " in unattended mode"
-            )
-
-        dogtag_version = int(api.env.dogtag_version)
-        enable_kra = api.env.enable_kra
-
-        if enable_kra:
-            self.option_parser.error("KRA is already installed.")
-
-        ca_installed = cainstance.is_ca_installed_locally()
-
-        if ca_installed:
-            if dogtag_version >= 10:
-                # correct dogtag version of CA installed
-                pass
-            else:
-                self.option_parser.error(
-                    "Dogtag must be version 10.2 or above to install KRA")
-        else:
-            self.option_parser.error(
-                "Dogtag CA is not installed.  Please install the CA first")
+             self.option_parser.error(
+                 "Directory Manager password must be specified using -p"
+                 " in unattended mode"
+             )
 
         self.installing_replica = dogtaginstance.is_installing_replica("KRA")
+        self.replica_file = None
+
         if self.installing_replica:
             if not self.args:
                 self.option_parser.error("A replica file is required.")
@@ -177,7 +137,7 @@ class KRAInstaller(KRAInstall):
                                          "No replica file is required.")
 
     def ask_for_options(self):
-        super(KRAInstall, self).ask_for_options()
+        super(KRAInstaller, self).ask_for_options()
 
         if not self.options.unattended and self.options.password is None:
             self.options.password = installutils.read_password(
@@ -188,48 +148,20 @@ class KRAInstaller(KRAInstall):
                     "Directory Manager password required")
 
     def _run(self):
+        # installation check has to be done after validating options and asking
+        # for missing ones, because we need dirman password for
+        # `read_replica_info_kra_enabled`
+        try:
+            kra.check_install(self.options, self.options.password, False,
+                              self.replica_file)
+        except RuntimeError as e:
+            self.option_parser.error(str(e))
+
         super(KRAInstaller, self).run()
         print dedent(self.INSTALLER_START_MESSAGE)
 
-        subject = dsinstance.DsInstance().find_subject_base()
-        if not self.installing_replica:
-            kra = krainstance.KRAInstance(
-                api.env.realm,
-                dogtag_constants=dogtag.install_constants)
-
-            kra.configure_instance(
-                api.env.host, api.env.domain, self.options.password,
-                self.options.password, subject_base=subject)
-        else:
-            replica_config = create_replica_config(
-                self.options.password,
-                self.replica_file,
-                self.options)
-
-            if not read_replica_info_kra_enabled(replica_config.dir):
-                raise admintool.ScriptError(
-                    "Either KRA is not installed on the master system or "
-                    "your replica file is out of date"
-                )
-
-            kra = krainstance.install_replica_kra(replica_config)
-            service.print_msg("Restarting the directory server")
-
-            ds = dsinstance.DsInstance()
-            ds.restart()
-
-        kra.enable_client_auth_to_db(kra.dogtag_constants.KRA_CS_CFG_PATH)
-
-        # Restart apache for new proxy config file
-        services.knownservices.httpd.restart(capture_output=True)
-
-        # Update config file
-        parser = RawConfigParser()
-        parser.read(paths.IPA_DEFAULT_CONF)
-        parser.set('global', 'enable_kra', 'True')
-
-        with open(paths.IPA_DEFAULT_CONF, 'w') as f:
-            parser.write(f)
+        kra.install(self.options, self.options.password,
+                    self.replica_file)
 
     def run(self):
         try:
diff --git a/ipaserver/install/kra.py b/ipaserver/install/kra.py
new file mode 100644
index 0000000000000000000000000000000000000000..c98b989a8a19e0d8858119935bd257f271ad33aa
--- /dev/null
+++ b/ipaserver/install/kra.py
@@ -0,0 +1,116 @@
+#
+# Copyright (C) 2015  FreeIPA Contributors see COPYING for license
+#
+
+import os
+from ConfigParser import RawConfigParser
+from ipalib import api
+from ipaplatform import services
+from ipaplatform.paths import paths
+from ipapython import dogtag
+from ipaserver.install import cainstance
+from ipaserver.install import krainstance
+from ipaserver.install import dsinstance
+from ipaserver.install import service
+from ipaserver.install.installutils import (
+    read_replica_info_kra_enabled, create_replica_config)
+
+
+def install(options, dm_password, replica_file=None):
+    subject = dsinstance.DsInstance().find_subject_base()
+    if replica_file is None:
+        kra = krainstance.KRAInstance(
+            api.env.realm,
+            dogtag_constants=dogtag.install_constants)
+
+        kra.configure_instance(
+            api.env.host, api.env.domain, dm_password,
+            dm_password, subject_base=subject)
+    else:
+        replica_config = create_replica_config(
+            dm_password,
+            replica_file,
+            options)
+
+        kra = krainstance.install_replica_kra(replica_config)
+        service.print_msg("Restarting the directory server")
+
+        ds = dsinstance.DsInstance()
+        ds.restart()
+
+    kra.enable_client_auth_to_db(kra.dogtag_constants.KRA_CS_CFG_PATH)
+
+    # Restart apache for new proxy config file
+    services.knownservices.httpd.restart(capture_output=True)
+
+    # Update config file
+    if os.path.exists(paths.IPA_DEFAULT_CONF):
+        parser = RawConfigParser()
+        parser.read(paths.IPA_DEFAULT_CONF)
+        parser.set('global', 'enable_kra', 'True')
+
+        with open(paths.IPA_DEFAULT_CONF, 'w') as f:
+            parser.write(f)
+
+
+def uninstall():
+    dogtag_constants = dogtag.configured_constants()
+
+    kra_instance = krainstance.KRAInstance(
+        api.env.realm, dogtag_constants=dogtag_constants)
+    kra_instance.stop_tracking_certificates()
+    if kra_instance.is_installed():
+        kra_instance.uninstall()
+
+    # Update config file
+    if os.path.exists(paths.IPA_DEFAULT_CONF):
+        parser = RawConfigParser()
+        parser.read(paths.IPA_DEFAULT_CONF)
+        parser.set('global', 'enable_kra', 'False')
+
+        with open(paths.IPA_DEFAULT_CONF, 'w') as f:
+            parser.write(f)
+
+
+def check_install(options, dm_password, setup_ca=False, replica_file=None):
+    enable_kra = False
+    dogtag_version = dogtag.install_constants.DOGTAG_VERSION
+
+    if hasattr(api.env, 'enable_kra'):
+        enable_kra = api.env.enable_kra
+    if hasattr(api.env, 'dogtag_version'):
+        dogtag_version = int(api.env.dogtag_version)
+
+    if enable_kra:
+        raise RuntimeError("KRA is already installed.")
+
+    if not setup_ca:
+        if cainstance.is_ca_installed_locally():
+            if dogtag_version >= 10:
+                # correct dogtag version of CA installed
+                pass
+            else:
+                raise RuntimeError(
+                    "Dogtag must be version 10.2 or above to install KRA")
+        else:
+            raise RuntimeError(
+                "Dogtag CA is not installed.  Please install the CA first")
+
+    if replica_file is not None:
+        replica_config = create_replica_config(
+            dm_password,
+            replica_file,
+            options)
+
+        if not read_replica_info_kra_enabled(replica_config.dir):
+            raise RuntimeError(
+                "Either KRA is not installed on the master system or "
+                "your replica file is out of date"
+            )
+
+
+def check_uninstall():
+    if hasattr(api.env, 'enable_kra') and not api.env.enable_kra:
+        raise RuntimeError(
+            "Cannot uninstall.  There is no KRA installed on this system."
+        )
-- 
2.1.0

-- 
Manage your subscription for the Freeipa-devel mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-devel
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Reply via email to