>From b242dbae34050011cfb51cebc2e6ec108a362e63 Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Thu, 26 Mar 2015 23:24:10 -0400 Subject: [PATCH] Add pkispawn config option for ldap profiles Add the `pki_profiles_in_ldap' pkispawn config to control whether profiles are stored on the filesystem (old behaviour) or LDAP (new behaviour). The default is file-based profiles. --- base/ca/shared/conf/CS.cfg.in | 2 +- base/server/config/pkislots.cfg | 1 + base/server/etc/default.cfg | 1 + base/server/python/pki/server/deployment/pkiparser.py | 6 ++++++ 4 files changed, 9 insertions(+), 1 deletion(-) diff --git a/base/ca/shared/conf/CS.cfg.in b/base/ca/shared/conf/CS.cfg.in index 5b9f66680d14bbcc9f38133fd032bf2400e75ecc..8353edee13c4d008e8303b2f6e5c086422b9442a 100644 --- a/base/ca/shared/conf/CS.cfg.in +++ b/base/ca/shared/conf/CS.cfg.in @@ -1137,7 +1137,7 @@ smtp.host=localhost smtp.port=25 subsystem.0.class=com.netscape.ca.CertificateAuthority subsystem.0.id=ca -subsystem.1.class=com.netscape.cmscore.profile.ProfileSubsystem +subsystem.1.class=com.netscape.cmscore.profile.[PKI_PROFILE_SUBSYSTEM] subsystem.1.id=profile subsystem.1.enabled=false subsystem.2.class=com.netscape.cmscore.selftests.SelfTestSubsystem diff --git a/base/server/config/pkislots.cfg b/base/server/config/pkislots.cfg index fffaab853b62d3c5e3427a20ccb70871633c794d..8ee93964ead2c12a1682bd7b3fcc32c3142f147d 100644 --- a/base/server/config/pkislots.cfg +++ b/base/server/config/pkislots.cfg @@ -41,6 +41,7 @@ PKI_OPEN_SEPARATE_PORTS_WEB_COMMENT_SLOT=[PKI_OPEN_SEPARATE_PORTS_WEB_COMMENT] PKI_OPEN_STANDALONE_COMMENT_SLOT=[PKI_OPEN_STANDALONE_COMMENT] PKI_OPEN_TOMCAT_ACCESS_LOG_COMMENT_SLOT=[PKI_OPEN_TOMCAT_ACCESS_LOG_COMMENT] PKI_PIDDIR_SLOT=[PKI_PIDDIR] +PKI_PROFILE_SUBSYSTEM_SLOT=[PKI_PROFILE_SUBSYSTEM] PKI_PROXY_SECURE_PORT_SLOT=[PKI_PROXY_SECURE_PORT] PKI_PROXY_UNSECURE_PORT_SLOT=[PKI_PROXY_UNSECURE_PORT] PKI_RANDOM_NUMBER_SLOT=[PKI_RANDOM_NUMBER] diff --git a/base/server/etc/default.cfg b/base/server/etc/default.cfg index 5b22b33d70800f0e708b39ed67ba8d17bf855504..8771c09b0e0f2ab87c06b616859591f3f231711b 100644 --- a/base/server/etc/default.cfg +++ b/base/server/etc/default.cfg @@ -361,6 +361,7 @@ pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s CA pki_ocsp_signing_signing_algorithm=SHA256withRSA pki_ocsp_signing_subject_dn=cn=CA OCSP Signing Certificate,o=%(pki_security_domain_name)s pki_ocsp_signing_token=Internal Key Storage Token +pki_profiles_in_ldap=False pki_random_serial_numbers_enable=False pki_subordinate=False pki_subordinate_create_new_security_domain=False diff --git a/base/server/python/pki/server/deployment/pkiparser.py b/base/server/python/pki/server/deployment/pkiparser.py index 6fb9e987dc9e339713c5066b0c726973480d74d3..e37b0e4a563030145a39cd911064830926f79dc3 100644 --- a/base/server/python/pki/server/deployment/pkiparser.py +++ b/base/server/python/pki/server/deployment/pkiparser.py @@ -1227,6 +1227,12 @@ class PKIConfigParser: "restart" + " " + \ "pki-tomcatd" + "@" + \ self.mdict['pki_instance_name'] + "." + "service" + + if config.str2bool(self.mdict['pki_profiles_in_ldap']): + self.mdict['PKI_PROFILE_SUBSYSTEM_SLOT'] = 'LDAPProfileSubsystem' + else: + self.mdict['PKI_PROFILE_SUBSYSTEM_SLOT'] = 'ProfileSubsystem' + except OSError as exc: config.pki_log.error(log.PKI_OSERROR_1, exc, extra=config.PKI_INDENTATION_LEVEL_2) -- 2.1.0