Backup CA cert from kerberos folder

[stlaz]

I have no idea how I missed this file in previous backup fixing attempts.

https://pagure.io/freeipa/issue/6748

[MartinBasti]

ACK, however webUI is still not working after restore

[MartinBasti]

 mod_wsgi (pid=4398): Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'.
 Traceback (most recent call last):
   File "/usr/share/ipa/wsgi.py", line 51, in application
     return api.Backend.wsgi_dispatch(environ, start_response)
   File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 262, in __call__
     return self.route(environ, start_response)
   File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 274, in route
     return app(environ, start_response)
   File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 913, in __call__
     self.kinit(user_principal, password, ipa_ccache_name)
   File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 947, in kinit
     kinit_armor(armor_path)
   File "/usr/lib/python2.7/site-packages/ipalib/install/kinit.py", line 125, in kinit_armor
     run(args, env=env, raiseonerr=True, capture_error=True)
   File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 495, in run
     raise CalledProcessError(p.returncode, arg_string, str(output))
 CalledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_4398' returned non-zero exit status 1

[stlaz]

That's weird, I think it worked for me, I will check once more.

[stlaz]

Yes, it indeed works for me.

[MartinBasti]

I tried with DL0:

• it may be different bug with DL0
• backup/restore is broken only with DL0

[stlaz]

This seems like a pkinit-related issue, since pkinit is not finished (although released) and should be only avaialable on domain levels > 0, I don't think this should stop us from pushing this, I will investigate the issue nonetheless.

[stlaz]

Works for me on DL0 as well, you might have had a broken installation.

[MartinBasti]

Yeah and I found where, it fails with #640

This PR can be pushed and ticket closed

[tkrizek]

master:

• dc13703 Backup CA cert from kerberos folder
  ipa-4-5:

• 9fdc27b Backup CA cert from kerberos folder