freeipa

#6854 CA less setup is broken
Closed: fixed Opened by mbasti.

Closed: fixed
Reopen Issue

CA-less inteegration test suite reports many errors related to installation

>       assert stderr_text in result.stderr_text, result.stderr_text
E       AssertionError: Usage: ipa-server-install [options]
E       
E       ipa-server-install: error: --dirsrv-cert-file, --http-cert-file, and --pkinit-cert-file or --no-pkinit are required if any key file options are used.
E       ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR    The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

Please inspect if tests should be updtaed or there is error in checking options

The cause of this failure is that new required options for CA-less were added. These are either --pkinit-cert-file along with --pkinit-pin or the --no-pkinit option. I believe both scenarios should be tested.
Please note that generating the certificate for pkinit is not so simple as it is for the DS and HTTPD certificates since some more certificate extensions are required, along with adding SANs. I do not know which exactly, @simo, @abbra, @jcholast or @mbabinsk will know.

Metadata Update from @stlaz:
- Issue tagged with: tests

Metadata Update from @mreznik:
- Issue assigned to mreznik

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to 0
- Issue priority set to: major
- Issue set to the milestone: FreeIPA 4.5.1

master:

  • f7c4039e415af2db51ae132ec15456f57eed161a test_caless: add pkinit option and test it
  • d5e84d70650a8b3430c11583876e5f604560c74e test_caless: mark TestCertinstall intermediate CA tests as xfail

ipa-4-5:

  • cea42421bc17317f69143061173e8b9a5c0e153e test_caless: add pkinit option and test it
  • f9bf76e1f3b39495a9ad61513d842844b89201dc test_caless: mark TestCertinstall intermediate CA tests as xfail

Metadata Update from @mbasti:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

tests

None
None
Normal
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.