Re: [Pki-devel] [PATCH] PKI Deployment Framework PKI TRAC issues (08/09/2012)

The patch works. I was able to get a KRA installed. Comments: 1. The logic in pkijython for determining whether to send the issuing CA information is incorrect. Specifically, all clones still need to contact a CA to generate their server cert. 2. The same logic applies to the code in pkiparser.py. In fact, I think we can simplify the logic there significantly. There is no need to distinguish in the subsystem name whether the server is a clone or subordinate or external. Just use "{subsystem_type} {hostname} {port}" for all subsystems (apache and tomcat). Its very difficult to follow the logic in that section. For the parameters in that section the logic should be: # for all subsystems set_default(subsystem_name, "{subsystem_type} {hostname} {port}") if (root ca) { security_domain_type = "new" set_default(security_domain_name, "{dnsname} Security Domain") } else { security_domain_type = "existing" set_default(security_domain_host, "{pki_hostname}") set_default(security_domain_uri, "https:// {security_domain_host}:{security)_domain_port}") } where set_default() is defined as : set_default(x, y) { if not len (master_dict[x]) { master_dict[x] = y } } I need to think about the conditional a bit to decide when we can say we need a new vs. existing security domain. Ade On Thu, 2012-08-09 at 17:29 -0700, Matthew Harmsen wrote: