From 5136cd6e4bd305d6f4b6bf22d22fb4abc365cfad Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Fri, 20 Nov 2015 15:59:11 +1100 Subject: [PATCH] Avoid race condition caused by profile delete and recreate When importing IPA-managed certificate profiles into Dogtag, profiles with the same name (usually caIPAserviceCert) are removed, then immediately recreated with the new profile data. This causes a race condition - Dogtag's LDAPProfileSystem profileChangeMonitor thread could observe and process the deletion after the profile was recreated, disappearing it again. Update the profile instead of deleting and recreating it to avoid this race condition. Fixes: https://fedorahosted.org/freeipa/ticket/5269 Reviewed-By: Jan Cholasta --- ipaserver/install/cainstance.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index 1cbc0d03b..448e42e2b 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -1970,8 +1970,7 @@ def _create_dogtag_profile(profile_id, profile_data): root_logger.debug( "Failed to disable profile '%s' " "(it is probably already disabled)") - profile_api.delete_profile(profile_id) - profile_api.create_profile(profile_data) + profile_api.update_profile(profile_id, profile_data) # enable the profile try: