freeipa

#9056 Don't use deprecated PKI configuration parameters in the default CA templates
Closed: fixed by frenaud. Opened by abbra.

Closed: fixed
Reopen Issue

pki-core renamed bunch of parameters in 2017 with 1f9b5c918ac9dc5378034541cb0147b480500932. Using old names causes a warning to be displayed. In order to get rid of these warnings, new name should be used.

The whole list of currently used is available in the https://github.com/dogtagpki/pki/blob/master/base/server/python/pki/server/deployment/pkiparser.py#L55-L147

Most of the parameters were renamed in 2017 and are part of DEPRECATED_PARAMS constant.

>>> from pki.server.deployment import pkiparser
>>> '|'.join([x[1] for x in pkiparser.PKIConfigParser.DEPRECATED_PARAMS])
'pki_admin_keysize|pki_external_ca_cert_path|pki_external_ca_cert_chain_path|pki_external_ca_cert_chain_nickname|pki_ssl_server_key_algorithm|pki_ssl_server_key_size|pki_ssl_server_key_type|pki_ssl_server_nickname|pki_ssl_server_subject_dn|pki_ssl_server_token|pki_database_path|pki_pin|pki_ajp_host|pki_external_csr_path|pki_external_admin_csr_path|pki_external_audit_signing_csr_path|pki_external_sslserver_csr_path|pki_external_storage_csr_path|pki_external_subsystem_csr_path|pki_external_transport_csr_path|pki_external_admin_cert_path|pki_external_audit_signing_cert_path|pki_external_sslserver_cert_path|pki_external_storage_cert_path|pki_external_subsystem_cert_path|pki_external_transport_cert_path|pki_external_admin_csr_path|pki_external_audit_signing_csr_path|pki_external_signing_csr_path|pki_external_sslserver_csr_path|pki_external_subsystem_csr_path|pki_external_admin_cert_path|pki_external_audit_signing_cert_path|pki_external_signing_cert_path|pki_external_sslserver_cert_path|pki_external_subsystem_cert_path'
$ git grep -E '(pki_admin_keysize|pki_external_ca_cert_path|pki_external_ca_cert_chain_path|pki_external_ca_cert_chain_nickname|pki_ssl_server_key_algorithm|pki_ssl_server_key_size|pki_ssl_server_key_type|pki_ssl_server_nickname|pki_ssl_server_subject_dn|pki_ssl_server_token|pki_database_path|pki_pin|pki_ajp_host|pki_external_csr_path|pki_external_admin_csr_path|pki_external_audit_signing_csr_path|pki_external_sslserver_csr_path|pki_external_storage_csr_path|pki_external_subsystem_csr_path|pki_external_transport_csr_path|pki_external_admin_cert_path|pki_external_audit_signing_cert_path|pki_external_sslserver_cert_path|pki_external_storage_cert_path|pki_external_subsystem_cert_path|pki_external_transport_cert_path|pki_external_admin_csr_path|pki_external_audit_signing_csr_path|pki_external_signing_csr_path|pki_external_sslserver_csr_path|pki_external_subsystem_csr_path|pki_external_admin_cert_path|pki_external_audit_signing_cert_path|pki_external_signing_cert_path|pki_external_sslserver_cert_path|pki_external_subsystem_cert_path)'
install/share/ipaca_default.ini:pki_ssl_server_token=%(pki_sslserver_token)s
ipaserver/install/cainstance.py:            pki_pin = ipautil.ipa_generate_password()
ipaserver/install/cainstance.py:            cfg['pki_server_database_password'] = pki_pin
ipaserver/install/cainstance.py:            pki_pin = None
ipaserver/install/cainstance.py:        cfg['pki_ajp_host_ipv4'] = "127.0.0.1"
ipaserver/install/cainstance.py:        cfg['pki_ajp_host_ipv6'] = "::1"
ipaserver/install/cainstance.py:        nolog_list = [self.dm_password, self.admin_password, pki_pin]
ipaserver/install/krainstance.py:            pki_pin = ipautil.ipa_generate_password()
ipaserver/install/krainstance.py:            cfg['pki_server_database_password'] = pki_pin
ipaserver/install/krainstance.py:            pki_pin = None
ipaserver/install/krainstance.py:            self.dm_password, self.admin_password, pki_pin, tmp_agent_pwd

The matches above are all "false positives".
pki_pin matches only the python variable with that name - no pki parameter.
pki_ajp_host matches the new parameter pki_ajp_host_ipv4 which we already use.

So with the newly pushed commit this ticket can be closed IMHO.

master:

  • a137eee81599443f1263598c5758dc1a88e946d1 Remove deprecation warning when installing a CA replica

ipa-4-9:

  • e11cf7f489d34adeca990a5f58d9c6d247b33ec1 Remove deprecation warning when installing a CA replica

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.