From 4f4e2f96b022a056777fed59583f204edb797a2e Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Wed, 26 Jun 2019 13:52:20 +1000 Subject: [PATCH] upgrade: always add profile to tracking requests The profile for every Dogtag system cert tracking request is now explicitly specified. So remove the code that handled unspecified profiles. Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden --- ipaserver/install/dogtaginstance.py | 2 +- ipaserver/install/server/upgrade.py | 6 ++---- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/ipaserver/install/dogtaginstance.py b/ipaserver/install/dogtaginstance.py index 132ae3bd8..048017505 100644 --- a/ipaserver/install/dogtaginstance.py +++ b/ipaserver/install/dogtaginstance.py @@ -97,7 +97,7 @@ class DogtagInstance(service.Service): # Mapping of nicknames for tracking requests, and the profile to # use for that certificate. 'configure_renewal()' reads this - # dict and adds the profile if configured. + # dict. The profile MUST be specified. tracking_reqs = dict() # token for CA and subsystem certificates. For now, only internal token diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py index 056dba539..d95bc31ab 100644 --- a/ipaserver/install/server/upgrade.py +++ b/ipaserver/install/server/upgrade.py @@ -974,7 +974,7 @@ def certificate_renewal_update(ca, ds, http): requests = [] - for nick in cainstance.CAInstance.tracking_reqs: + for nick, profile in cainstance.CAInstance.tracking_reqs.items(): req = { 'cert-database': paths.PKI_TOMCAT_ALIAS_DIR, 'cert-nickname': nick, @@ -982,10 +982,8 @@ def certificate_renewal_update(ca, ds, http): 'cert-presave-command': template % 'stop_pkicad', 'cert-postsave-command': (template % 'renew_ca_cert "{}"'.format(nick)), + 'template-profile': profile, } - profile = cainstance.CAInstance.tracking_reqs.get(nick) - if profile: - req['template-profile'] = profile requests.append(req) requests.append(