From 778521053336a4ba09923b4b1f9cac0dff72f634 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Thu, 20 Dec 2018 08:56:56 +0100 Subject: [PATCH] pkinit enable: use local dogtag only if host has CA ipa-pkinit-manage enable is failing if called on a master that does not have a CA instance, because it is trying to contact dogtag on the localhost. The command should rather use certmonger in this case, and let certmonger contact the right master to request the KDC certificate. Fixes: https://pagure.io/freeipa/issue/7795 Reviewed-By: Francois Cami --- ipaserver/install/krbinstance.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ipaserver/install/krbinstance.py b/ipaserver/install/krbinstance.py index 850946afb..8ac125fa3 100644 --- a/ipaserver/install/krbinstance.py +++ b/ipaserver/install/krbinstance.py @@ -45,6 +45,7 @@ from ipaserver.install import replication from ipaserver.install import ldapupdate from ipaserver.install import certs +from ipaserver.masters import find_providing_servers from ipaplatform.constants import constants from ipaplatform.tasks import tasks from ipaplatform.paths import paths @@ -428,10 +429,13 @@ class KrbInstance(service.Service): prev_helper = None # on the first CA-ful master without '--no-pkinit', we issue the # certificate by contacting Dogtag directly + localhost_has_ca = self.fqdn in find_providing_servers( + 'CA', conn=self.api.Backend.ldap2, api=self.api) use_dogtag_submit = all( [self.master_fqdn is None, self.pkcs12_info is None, - self.config_pkinit]) + self.config_pkinit, + localhost_has_ca]) if use_dogtag_submit: ca_args = [