Problem description

When a replica is installed, a new set of Custodia keys are create locally. The public keys are uploaded to the local 389-DS instance. Then Custodia waits until it sees the keys on its replication peer. For busy systems, replication can talk a while. In worst case, the installer runs into a timeout.

Further more, the installer creates multiple instances of the Custodia client object. In the replica promotion case with CA setup, some parts talk to a Custodia instance on replica master, other instances to Custodia instance on the CA replica master. Replica and CA replica can be different hosts.

Fix

Installers now pass a single CustodiaInstance object around, instead of creating new instances on demand. In case of replica promotion with CA, the instance gets all secrets from a master with CA present. Before, an installer created multiple instances and may have requested CA key material from a different machine than DM password hash.

In case of Domain Level 1 and replica promotion, the CustodiaInstance no longer adds the keys to the local instance and waits for replication to other replica. Instead the installer directly uploads the new public keys to the remote 389-DS instance.

Without promotion, new Custodia public keys are still added to local 389-DS over LDAPI.