freeipa

#8245 ipa-kra-install should exit if ca_host is overriden.
Closed: fixed by antorres. Opened by fcami.

Closed: fixed
Reopen Issue

Request for enhancement

As admin, I want ipa-kra-install to exit if /etc/ipa/default.conf contains a ca_host line to avoid unintended and undesired behavior.

Issue

Currently, ipa-kra-install will accept to "install" the KRA on a replica where ca_host is overriden and points to another host in the cluster.
Not only the installation "succeeds", but the resulting KRA is not properly configured: ipa-kra-install will instead contact the other host's DogTag to "configure" it.

Steps to Reproduce

  1. Have a 2-node ipa0/ipa1 IPA cluster without KRA but with 2xCA and default FirewallD profiles for IPA
  2. Set ipa1 to hidden
  3. Install KRA on ipa1
  4. Add a ca_host entry in /etc/ipa/default.conf on ipa0 and set it to ipa1's FQDN
  5. Launch ipa-kra-install on ipa0. It should fail early, as ipa1:8443 is not reachable.
  6. Open tcp/8443 on ipa1's firewall
  7. Launch ipa-kra-install on ipa0. It should succeed.
  8. Try to use the KRA.

Actual behavior

The resulting KRA configuration is not working properly, which is not surprising as ipa0's DogTag is now misconfigured while ipa0 is listed as having the "KRA server" role.
This is even more visible if ipa1 is hidden.

Expected behavior

ipa-kra-install exits early if ca_host is overriden.

https://github.com/freeipa/freeipa/pull/5613

Metadata Update from @antorres:
- Issue assigned to antorres

master:

  • 718099af5bf702683b0195d1cea4a674bb47207f ipa-kra-install: exit if ca_host is overriden
  • 42447c4540d1483ac435ad230e6c554caa6a2b01 ipatests: test if KRA install fails when ca_host is overriden

Metadata Update from @antorres:
- Custom field affects_doc adjusted to on
- Custom field knownissue adjusted to on
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-9:

  • ab4720d9c2bae059e8f622cd4a331510fefe27ae ipa-kra-install: exit if ca_host is overriden
  • a4e13a33247fb14145c632fb53b4480fc5fb10ea ipatests: test if KRA install fails when ca_host is overriden
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.