Enable LDAPS in replica promotion #29
Conversation
|
LDAPS is not enabled during replica promotion because of this condition in DS setup: https://github.com/freeipa/freeipa/blob/master/ipaserver/install/dsinstance.py#L391 Maybe we can remove the condition rather than add |
tkrizek
force-pushed
the
t6226
branch
2 times, most recently
from
2ddf255
to
7ccf6dc
Compare
|
@jcholast I'm not certain that enabling the LDAPS before replica promotion finishes won't have some unintended side effects. |
|
@jcholast we can't enable ssl there as the cert is not available yet, look a few lines later: |
|
That said we should probably enable_ssl righ tafter we get the cert and restart DS, and not in replicainstall.py |
With CA-less master and CA-less replica, attempting to install CA on replica would fail. LDAPS has to be enabled during replica promotion, because it is required by Dogtag. https://fedorahosted.org/freeipa/ticket/6226
|
I've updated the PR based on the comments, please review. |
|
LGTM |
HonzaCholasta
added
ack
|
Fixed upstream |
With CA-less master and CA-less replica, attempting to install CA on replica
would fail. LDAPS has to be enabled during replica promotion, because it is
required by Dogtag.
https://fedorahosted.org/freeipa/ticket/6226