mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-05-14 13:32:10 +00:00
ipaserver: Only use install checks in _prepare, not also in _test
The install checks have been done temporarily in _test and finally also in _prepare. This is not needed and also not done this way in the command line installers.
This commit is contained in:
Thomas Woerner
@@ -109,7 +109,7 @@ def main():
|
||||
forwarders=dict(required=False, type='list', default=[]),
|
||||
no_forwarders=dict(required=False, type='bool', default=False),
|
||||
auto_forwarders=dict(required=False, type='bool', default=False),
|
||||
forward_policy=dict(required=False),
|
||||
forward_policy=dict(default=None, choices=['first', 'only']),
|
||||
no_dnssec_validation=dict(required=False, type='bool',
|
||||
default=False),
|
||||
### ad trust ###
|
||||
@@ -181,6 +181,15 @@ def main():
|
||||
fstore = sysrestore.FileStore(paths.SYSRESTORE)
|
||||
sstore = sysrestore.StateFile(paths.SYSRESTORE)
|
||||
|
||||
# subject_base
|
||||
if not options.subject_base:
|
||||
options.subject_base = str(default_subject_base(options.realm_name))
|
||||
# set options.subject for old ipa releases
|
||||
options.subject = options.subject_base
|
||||
|
||||
if not options.ca_subject:
|
||||
options.ca_subject = str(default_ca_subject_dn(options.subject_base))
|
||||
|
||||
# Configuration for ipalib, we will bootstrap and finalize later, after
|
||||
# we are sure we have the configuration file ready.
|
||||
cfg = dict(
|
||||
@@ -268,7 +277,29 @@ def main():
|
||||
if _update_hosts_file:
|
||||
update_hosts_file(ip_addresses, options.host_name, fstore)
|
||||
|
||||
ansible_module.exit_json(changed=True)
|
||||
if hasattr(tasks, "configure_pkcs11_modules"):
|
||||
if tasks.configure_pkcs11_modules(fstore):
|
||||
ansible_log.info("Disabled p11-kit-proxy")
|
||||
|
||||
ansible_module.exit_json(changed=True,
|
||||
### basic ###
|
||||
ip_addresses=[ str(ip) for ip in ip_addresses ],
|
||||
### certificate system ###
|
||||
subject_base=options.subject_base,
|
||||
_subject_base=options._subject_base,
|
||||
ca_subject=options.ca_subject,
|
||||
_ca_subject=options._ca_subject,
|
||||
### dns ###
|
||||
reverse_zones=options.reverse_zones,
|
||||
forward_policy=options.forward_policy,
|
||||
forwarders=options.forwarders,
|
||||
no_dnssec_validation=options.no_dnssec_validation,
|
||||
### additional ###
|
||||
dns_ip_addresses=[ str(ip) for ip
|
||||
in dns.ip_addresses ],
|
||||
dns_reverse_zones=dns.reverse_zones,
|
||||
adtrust_netbios_name=adtrust.netbios_name,
|
||||
adtrust_reset_netbios_name=adtrust.reset_netbios_name)
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
||||
@@ -60,7 +60,6 @@ def main():
|
||||
dm_password=dict(required=True, no_log=True),
|
||||
password=dict(required=True, no_log=True),
|
||||
master_password=dict(required=False, no_log=True),
|
||||
ip_addresses=dict(required=False, type='list', default=[]),
|
||||
domain=dict(required=False),
|
||||
realm=dict(required=False),
|
||||
hostname=dict(required=False),
|
||||
@@ -658,101 +657,6 @@ def main():
|
||||
"Apache Server SSL certificate and PKINIT KDC "
|
||||
"certificate are not signed by the same CA certificate")
|
||||
|
||||
# subject_base
|
||||
if not options.subject_base:
|
||||
options.subject_base = str(default_subject_base(options.realm_name))
|
||||
# set options.subject for old ipa releases
|
||||
options.subject = options.subject_base
|
||||
|
||||
if not options.ca_subject:
|
||||
options.ca_subject = str(default_ca_subject_dn(options.subject_base))
|
||||
|
||||
# temporary ipa configuration ###########################################
|
||||
|
||||
ipa_tempdir = tempfile.mkdtemp(prefix="ipaconf")
|
||||
try:
|
||||
# Configuration for ipalib, we will bootstrap and finalize later, after
|
||||
# we are sure we have the configuration file ready.
|
||||
cfg = dict(
|
||||
context='installer',
|
||||
confdir=ipa_tempdir,
|
||||
in_server=True,
|
||||
# make sure host name specified by user is used instead of default
|
||||
host=options.host_name,
|
||||
)
|
||||
if options.setup_ca:
|
||||
# we have an IPA-integrated CA
|
||||
cfg['ca_host'] = options.host_name
|
||||
|
||||
# Create the management framework config file and finalize api
|
||||
target_fname = "%s/default.conf" % ipa_tempdir
|
||||
fd = open(target_fname, "w")
|
||||
fd.write("[global]\n")
|
||||
fd.write("host=%s\n" % options.host_name)
|
||||
fd.write("basedn=%s\n" % ipautil.realm_to_suffix(options.realm_name))
|
||||
fd.write("realm=%s\n" % options.realm_name)
|
||||
fd.write("domain=%s\n" % options.domain_name)
|
||||
fd.write("xmlrpc_uri=https://%s/ipa/xml\n" % ipautil.format_netloc(options.host_name))
|
||||
fd.write("ldap_uri=ldapi://%%2fvar%%2frun%%2fslapd-%s.socket\n" %
|
||||
installutils.realm_to_serverid(options.realm_name))
|
||||
if options.setup_ca:
|
||||
fd.write("enable_ra=True\n")
|
||||
fd.write("ra_plugin=dogtag\n")
|
||||
fd.write("dogtag_version=10\n")
|
||||
else:
|
||||
fd.write("enable_ra=False\n")
|
||||
fd.write("ra_plugin=none\n")
|
||||
fd.write("mode=production\n")
|
||||
fd.close()
|
||||
|
||||
# Must be readable for everyone
|
||||
os.chmod(target_fname, 0o644)
|
||||
|
||||
api.bootstrap(**cfg)
|
||||
api.finalize()
|
||||
|
||||
# install checks ####################################################
|
||||
|
||||
if options.setup_ca:
|
||||
ca.install_check(False, None, options)
|
||||
|
||||
if options.setup_kra:
|
||||
kra.install_check(api, None, options)
|
||||
|
||||
if options.setup_dns:
|
||||
with redirect_stdout(ansible_log):
|
||||
dns.install_check(False, api, False, options, options.host_name)
|
||||
ip_addresses = dns.ip_addresses
|
||||
else:
|
||||
ip_addresses = get_server_ip_address(options.host_name,
|
||||
False, False,
|
||||
options.ip_addresses)
|
||||
|
||||
# check addresses here, dns ansible_module is doing own check
|
||||
no_matching_interface_for_ip_address_warning(ip_addresses)
|
||||
|
||||
options.ip_addresses = ip_addresses
|
||||
options.reverse_zones = dns.reverse_zones
|
||||
instance_name = "-".join(options.realm_name.split("."))
|
||||
dirsrv = services.knownservices.dirsrv
|
||||
if (options.external_cert_files
|
||||
and dirsrv.is_installed(instance_name)
|
||||
and not dirsrv.is_running(instance_name)):
|
||||
logger.debug('Starting Directory Server')
|
||||
services.knownservices.dirsrv.start(instance_name)
|
||||
|
||||
if options.setup_adtrust:
|
||||
adtrust.install_check(False, options, api)
|
||||
|
||||
except (RuntimeError, ValueError, ScriptError) as e:
|
||||
ansible_module.fail_json(msg=str(e))
|
||||
|
||||
finally:
|
||||
try:
|
||||
shutil.rmtree(ipa_tempdir, ignore_errors=True)
|
||||
except OSError:
|
||||
ansible_module.fail_json(msg="Could not remove %s" % ipa_tempdir)
|
||||
|
||||
# Always set _host_name_overridden
|
||||
options._host_name_overridden = bool(options.host_name)
|
||||
|
||||
@@ -763,7 +667,6 @@ def main():
|
||||
### basic ###
|
||||
domain=options.domain_name,
|
||||
realm=options.realm_name,
|
||||
ip_addresses=[ str(ip) for ip in ip_addresses ],
|
||||
hostname=options.host_name,
|
||||
_hostname_overridden=options._host_name_overridden,
|
||||
no_host_dns=options.no_host_dns,
|
||||
@@ -784,27 +687,12 @@ def main():
|
||||
_pkinit_pkcs12_file=pkinit_pkcs12_file,
|
||||
_pkinit_pkcs12_info=pkinit_pkcs12_info,
|
||||
_pkinit_ca_cert=pkinit_ca_cert,
|
||||
### certificate system ###
|
||||
subject_base=options.subject_base,
|
||||
_subject_base=options._subject_base,
|
||||
ca_subject=options.ca_subject,
|
||||
_ca_subject=options._ca_subject,
|
||||
### dns ###
|
||||
reverse_zones=options.reverse_zones,
|
||||
forward_policy=options.forward_policy,
|
||||
forwarders=options.forwarders,
|
||||
no_dnssec_validation=options.no_dnssec_validation,
|
||||
### ad trust ###
|
||||
rid_base=options.rid_base,
|
||||
secondary_rid_base=options.secondary_rid_base,
|
||||
### additional ###
|
||||
_installation_cleanup=_installation_cleanup,
|
||||
domainlevel=options.domainlevel,
|
||||
dns_ip_addresses=[ str(ip) for ip
|
||||
in dns.ip_addresses ],
|
||||
dns_reverse_zones=dns.reverse_zones,
|
||||
adtrust_netbios_name=adtrust.netbios_name,
|
||||
adtrust_reset_netbios_name=adtrust.reset_netbios_name)
|
||||
domainlevel=options.domainlevel)
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
||||
Reference in New Issue
Block a user