Commit - freeipa - f769045f0ae9c5fdc651e03c0c96af9cdec8f298

    server install: fix KDC PKINIT configuration
    
    Set `pkinit_pool` in `kdc.conf` to a CA certificate bundle of all CAs known
    to IPA.
    
    Make sure `cacert.pem` is exported in all installation code paths.
    
    Use the KDC certificate itself as a PKINIT anchor in `login_password`.
    
    https://pagure.io/freeipa/issue/6831
    
    Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
    Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>

install/restart_scripts/Makefile.am

file modified

+1 -0

install/restart_scripts/renew_kdc_cert

file added

+31

install/share/kdc.conf.template

file modified

+2 -0

ipaclient/install/ipa_certupdate.py

file modified

+1 -0

ipalib/install/kinit.py

file modified

+4 -3

ipaserver/install/krbinstance.py

file modified

+16 -11

ipaserver/install/server/upgrade.py

file modified

+44 -13

ipaserver/rpcserver.py

file modified

+4 -1

freeipa

Source Code

f769045 server install: fix KDC PKINIT configuration

8 files Authored by jcholast 7 years ago, Committed by mbasti 7 years ago,

`f769045` server install: fix KDC PKINIT configuration