From 2c471b529c4701b2d8b1e88a8186d0cda641fa90 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Jun 21 2018 13:35:02 +0000 Subject: Always set ca_host when installing replica ipa-replica-install only set ca_host in its temporary /etc/ipa/default.conf, when it wasn't installing a replica with CA. As a consequence, the replica installer was picking a random CA server from LDAP. Always set the replication peer as ca_host. This will ensure that the installer uses the same replication peer for CA. In case the replication peer is not a CA master, the installer will automatically pick another host later. See: https://pagure.io/freeipa/issue/7566 Signed-off-by: Christian Heimes Reviewed-By: Fraser Tweedale --- diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py index b9cd518..ac23e23 100644 --- a/ipaserver/install/server/replicainstall.py +++ b/ipaserver/install/server/replicainstall.py @@ -236,11 +236,9 @@ def create_ipa_conf(fstore, config, ca_enabled, master=None): gopts.extend([ ipaconf.setOption('enable_ra', 'True'), ipaconf.setOption('ra_plugin', 'dogtag'), - ipaconf.setOption('dogtag_version', '10') + ipaconf.setOption('dogtag_version', '10'), + ipaconf.setOption('ca_host', config.ca_host_name) ]) - - if not config.setup_ca: - gopts.append(ipaconf.setOption('ca_host', config.ca_host_name)) else: gopts.extend([ ipaconf.setOption('enable_ra', 'False'),