freeipa

#5459 Default CA ACL rule is not created during ipa-replica-install
Closed: Fixed Opened by mkosek.

Closed: Fixed
Reopen Issue

When FreeIPA 4.2+ replica is being created out of older server (FreeIPA on RHEL-6 in the reported case), the default CA ACL rule is not being created as there is a worry that administrator deliberately deleted it and it would be added again during replica installation.

This however means, that services and hosts cannot request certificates after such upgrade via migration.

I expect majority of admins will be happy with the default rule as is, especially after migration from RHEL-6 to FreeIPA 4.2+. If admins really do not want it and click "delete", they should get error message like "This rule is managed by FreeIPA and cannot be deleted. Please disable it to make it ineffective".

That should give better migration experience while at the same time allowing admins disable the rule in rare cases.

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283429

master:

  • 6fe0a898077a74924b6ccaf6dfbaf2d166175722 Do not erroneously reinit NSS in Dogtag interface
  • 620036d26e98fdcefff00168e9e5463a8257d49c Add profiles and default CA ACL on migration

ipa-4-2:

  • 3cb79337d971653b90bbc99e433e4b3d3ac37579 Do not erroneously reinit NSS in Dogtag interface
  • a2371f38e4fb027aeacaf0ab6f2b35ae49fa41ea Add profiles and default CA ACL on migration

master:

  • 341406d16540b1edc0d2792fe2cd9db75590f88e disconnect ldap2 backend after adding default CA ACL profiles

ipa-4-2:

  • 0f39612730448993190b07708ad4c4956b214a81 disconnect ldap2 backend after adding default CA ACL profiles

master:

  • ed830af693c596b286b30959eb3166b59cc030c6 do not disconnect when using existing connection to check default CA ACLs

ipa-4-2:

  • c5faaede276f3052517ddf86e64cb228e95dca2a do not disconnect when using existing connection to check default CA ACLs

Metadata Update from @mkosek:
- Issue assigned to ftweedal
- Issue set to the milestone: FreeIPA 4.2.4
Metadata
None
None
None
Low
defect
Upgrade
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.