Attachment 657525 Details for Bug 876307 – 1/4

[patch] 1/4

0110-Upload-CA-cert-in-the-directory-on-install.patch (text/plain), 2.75 KB, created by Simo Sorce on 2012-12-04 13:51:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Simo Sorce

Created: 2012-12-04 13:51:28 UTC

Size: 2.75 KB

patch

obsolete

>From ef61cae3c309a5e7eaf2e61611bea10c4e23bd48 Mon Sep 17 00:00:00 2001
>From: Simo Sorce <simo@redhat.com>
>Date: Mon, 12 Nov 2012 17:43:05 -0500
>Subject: [PATCH 110/113] Upload CA cert in the directory on install
>
>This will later allow clients to securely download the CA cert by
>performaing mutual auth using LDAP with GSSAPI
>---
> install/share/Makefile.am        |  1 +
> install/share/upload-cacert.ldif |  7 +++++++
> ipaserver/install/dsinstance.py  | 16 ++++++++++++++++
> 3 files changed, 24 insertions(+)
> create mode 100644 install/share/upload-cacert.ldif
>
>diff --git a/install/share/Makefile.am b/install/share/Makefile.am
>index ed3b95f..cf6f2de 100644
>--- a/install/share/Makefile.am
>+++ b/install/share/Makefile.am
>@@ -55,6 +55,7 @@ app_DATA =				\
> 	automember.ldif			\
> 	replica-automember.ldif		\
> 	replica-s4u2proxy.ldif		\
>+	upload-cacert.ldif		\
> 	$(NULL)
> 
> EXTRA_DIST =				\
>diff --git a/install/share/upload-cacert.ldif b/install/share/upload-cacert.ldif
>new file mode 100644
>index 0000000..d2087d8
>--- /dev/null
>+++ b/install/share/upload-cacert.ldif
>@@ -0,0 +1,7 @@
>+# add CA certificate to LDAP server
>+dn: cn=CAcert,cn=ipa,cn=etc,$SUFFIX
>+changetype: add
>+objectClass: nsContainer
>+objectClass: pkiCA
>+cn: CAcert
>+cACertificate;binary:: $CADERCERT
>diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py
>index 827f691..61896db 100644
>--- a/ipaserver/install/dsinstance.py
>+++ b/ipaserver/install/dsinstance.py
>@@ -43,6 +43,7 @@ from ipaserver.install import httpinstance
> from ipaserver.install import replication
> from ipalib import util, errors
> from ipaserver.plugins.ldap2 import ldap2
>+import base64
> 
> SERVER_ROOT_64 = "/usr/lib64/dirsrv"
> SERVER_ROOT_32 = "/usr/lib/dirsrv"
>@@ -243,6 +244,8 @@ class DsInstance(service.Service):
>         if hbac_allow:
>             self.step("creating default HBAC rule allow_all", self.add_hbac)
> 
>+        self.step("Upload CA cert to the directory", self.__upload_ca_cert)
>+
>         self.__common_post_setup()
> 
>         self.start_creation("Configuring directory server", 60)
>@@ -562,6 +565,19 @@ class DsInstance(service.Service):
>         # check for open secure port 636 from now on
>         self.open_ports.append(636)
> 
>+    def __upload_ca_cert(self):
>+        """
>+        Upload the CA certificate in DER form in the LDAP directory.
>+        """
>+
>+        dirname = config_dirname(self.serverid)
>+        certdb = certs.CertDB(self.realm_name, nssdir=dirname, subject_base=self.subject_base)
>+
>+        dercert = certdb.get_cert_from_db(certdb.cacert_name, pem=False)
>+        self.sub_dict['CADERCERT'] = base64.b64encode(dercert)
>+
>+        self._ldap_mod('upload-cacert.ldif', self.sub_dict)
>+
>     def __add_default_layout(self):
>         self._ldap_mod("bootstrap-template.ldif", self.sub_dict)
> 
>-- 
>1.7.11.7
>

Actions: View | Diff

Attachments on bug 876307: 657525 | 657526 | 657527 | 657528