Hello,
I was doing some rtfm for migration of an ipa ca-renewal master to a different system. I figured that the docs on migrating from rhel7 to rhel8 would be a nice help for me to migrate from one centos7 to another centos 7 system.
Something in the docs gave me pause.
In the doc in chapter 17.4 instruction 4
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm...
It states that on replicas at the bottom of the file /etc/httpd/conf.d/ipa-pki-proxy.conf you should uncomment the rewrite rule and ensure it points to the 'ca renewal master'
However on the centos 7 freeipa replica it points to the replica.
Is the configuration on the centos7 freeipa replica incorrect ? Or is the instruction from redhat in need of updates ?
If it's the first, then the installation packages of freeipa on centos need some attention, because I didn't configure that line as such.
Cheers Rob
On 7/30/19 10:00 AM, Rob Verduijn via FreeIPA-users wrote:
Hello,
I was doing some rtfm for migration of an ipa ca-renewal master to a different system. I figured that the docs on migrating from rhel7 to rhel8 would be a nice help for me to migrate from one centos7 to another centos 7 system.
Something in the docs gave me pause.
In the doc in chapter 17.4 instruction 4
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm...
It states that on replicas at the bottom of the file |/etc/httpd/conf.d/ipa-pki-proxy.conf you should uncomment the rewrite rule and ensure it points to the 'ca renewal master'
Hi, the doc is incorrect, could you please file a bug?
Whole explanation: to ensure that the CRL is consistent across all master/replicas, only one of them is generating the official CRL. This node is called the CRL generation master. It writes the CRL into 2 locations: a file in /var/lib/ipa/pki-ca/publish/ and also into LDAP below cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca (this part of the tree is replicated to all the replicas with a CA instance). On all the nodes, the CRL can be found at http://$hostname/ipa/crl/MasterCRL.bin.
On the CRL generation master, this URL corresponds to the file stored locally in /var/lib/ipa/pki-ca/publish/MasterCRL.bin (see the /etc/httpd/conf.d/ipa.conf file which defines Alias /ipa/crl "/var/lib/ipa/pki-ca/publish").
On the other replicas, the /etc/httpd/conf.d/ipa-pki-proxy.conf file configures a RewriteRule: ^/ipa/crl/MasterCRL.bin http://$hostname/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]
This means that when a http client accesses http://$hostname/ipa/crl/MasterCRL.bin, it gets redirected to http://$hostname/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL (on the same host). This URL is processed by Dogtag servlets, which perform an internal LDAP search on cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca (remember, this suffix is replicated, meaning it contains the same data in the replica and in the CRL generation master).
So it's completely normal that the RewriteRule points to the localhost and not to the CRL generation master.
Hope this clarifies, flo
| |However on the centos 7 freeipa replica it points to the replica.| | | |Is the configuration on the centos7 freeipa replica incorrect ?| |Or is the instruction from redhat in need of updates ?| | | |If it's the first, then the installation packages of freeipa on centos need some attention, because I didn't configure that line as such.| | | |Cheers| |Rob | | |
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Hi
Thanx for the answer, sadly i've experienced that filing a bug with Red hat can be a real challenge when you know your stuff.
Since I'm not very familiar with the rewrite rules in combination with freeipa I won't be able to answer any questions they have.
Rob
Op wo 31 jul. 2019 10:02 schreef Florence Blanc-Renaud via FreeIPA-users < freeipa-users@lists.fedorahosted.org>:
On 7/30/19 10:00 AM, Rob Verduijn via FreeIPA-users wrote:
Hello,
I was doing some rtfm for migration of an ipa ca-renewal master to a different system. I figured that the docs on migrating from rhel7 to rhel8 would be a nice help for me to migrate from one centos7 to another centos 7 system.
Something in the docs gave me pause.
In the doc in chapter 17.4 instruction 4
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm...
It states that on replicas at the bottom of the file |/etc/httpd/conf.d/ipa-pki-proxy.conf you should uncomment the rewrite rule and ensure it points to the 'ca renewal master'
Hi, the doc is incorrect, could you please file a bug?
Whole explanation: to ensure that the CRL is consistent across all master/replicas, only one of them is generating the official CRL. This node is called the CRL generation master. It writes the CRL into 2 locations: a file in /var/lib/ipa/pki-ca/publish/ and also into LDAP below cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca (this part of the tree is replicated to all the replicas with a CA instance). On all the nodes, the CRL can be found at http://$hostname/ipa/crl/MasterCRL.bin.
On the CRL generation master, this URL corresponds to the file stored locally in /var/lib/ipa/pki-ca/publish/MasterCRL.bin (see the /etc/httpd/conf.d/ipa.conf file which defines Alias /ipa/crl "/var/lib/ipa/pki-ca/publish").
On the other replicas, the /etc/httpd/conf.d/ipa-pki-proxy.conf file configures a RewriteRule: ^/ipa/crl/MasterCRL.bin http://$hostname/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]
This means that when a http client accesses http://$hostname/ipa/crl/MasterCRL.bin, it gets redirected to http://$hostname/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL (on the same host). This URL is processed by Dogtag servlets, which perform an internal LDAP search on cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca (remember, this suffix is replicated, meaning it contains the same data in the replica and in the CRL generation master).
So it's completely normal that the RewriteRule points to the localhost and not to the CRL generation master.
Hope this clarifies, flo
| |However on the centos 7 freeipa replica it points to the replica.| | | |Is the configuration on the centos7 freeipa replica incorrect ?| |Or is the instruction from redhat in need of updates ?| | | |If it's the first, then the installation packages of freeipa on centos need some attention, because I didn't configure that line as such.| | | |Cheers| |Rob | | |
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
On 7/31/19 3:42 PM, Rob Verduijn via FreeIPA-users wrote:
Hi
Thanx for the answer, sadly i've experienced that filing a bug with Red hat can be a real challenge when you know your stuff.
Since I'm not very familiar with the rewrite rules in combination with freeipa I won't be able to answer any questions they have.
OK, I opened the following BZs: for rhel 7.8 doc https://bugzilla.redhat.com/show_bug.cgi?id=1735692 for rhel 8 doc https://bugzilla.redhat.com/show_bug.cgi?id=1735696
flo
Rob
Op wo 31 jul. 2019 10:02 schreef Florence Blanc-Renaud via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org>:
On 7/30/19 10:00 AM, Rob Verduijn via FreeIPA-users wrote: > Hello, > > I was doing some rtfm for migration of an ipa ca-renewal master to a > different system. > I figured that the docs on migrating from rhel7 to rhel8 would be a nice > help for me to migrate from one centos7 to another centos 7 system. > > Something in the docs gave me pause. > > In the doc in chapter 17.4 instruction 4 > > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/installing_identity_management/migrate-7-to-8_migrating#stop-CRL-generation-7-redirect-to-8_migrate-7-to-8 > > It states that on replicas at the bottom of the file > |/etc/httpd/conf.d/ipa-pki-proxy.conf you should uncomment the rewrite > rule and ensure it points to the 'ca renewal master' > Hi, the doc is incorrect, could you please file a bug? Whole explanation: to ensure that the CRL is consistent across all master/replicas, only one of them is generating the official CRL. This node is called the CRL generation master. It writes the CRL into 2 locations: a file in /var/lib/ipa/pki-ca/publish/ and also into LDAP below cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca (this part of the tree is replicated to all the replicas with a CA instance). On all the nodes, the CRL can be found at http://$hostname/ipa/crl/MasterCRL.bin. On the CRL generation master, this URL corresponds to the file stored locally in /var/lib/ipa/pki-ca/publish/MasterCRL.bin (see the /etc/httpd/conf.d/ipa.conf file which defines Alias /ipa/crl "/var/lib/ipa/pki-ca/publish"). On the other replicas, the /etc/httpd/conf.d/ipa-pki-proxy.conf file configures a RewriteRule: ^/ipa/crl/MasterCRL.bin http://$hostname/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC] This means that when a http client accesses http://$hostname/ipa/crl/MasterCRL.bin, it gets redirected to http://$hostname/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL (on the same host). This URL is processed by Dogtag servlets, which perform an internal LDAP search on cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca (remember, this suffix is replicated, meaning it contains the same data in the replica and in the CRL generation master). So it's completely normal that the RewriteRule points to the localhost and not to the CRL generation master. Hope this clarifies, flo > | > |However on the centos 7 freeipa replica it points to the replica.| > | > | > |Is the configuration on the centos7 freeipa replica incorrect ?| > |Or is the instruction from redhat in need of updates ?| > | > | > |If it's the first, then the installation packages of freeipa on centos > need some attention, because I didn't configure that line as such.| > | > | > |Cheers| > |Rob > | > | > | > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> > To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org > _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Cool
Op do 1 aug. 2019 11:48 schreef Florence Blanc-Renaud flo@redhat.com:
On 7/31/19 3:42 PM, Rob Verduijn via FreeIPA-users wrote:
Hi
Thanx for the answer, sadly i've experienced that filing a bug with Red hat can be a real challenge when you know your stuff.
Since I'm not very familiar with the rewrite rules in combination with freeipa I won't be able to answer any questions they have.
OK, I opened the following BZs: for rhel 7.8 doc https://bugzilla.redhat.com/show_bug.cgi?id=1735692 for rhel 8 doc https://bugzilla.redhat.com/show_bug.cgi?id=1735696
flo
Rob
Op wo 31 jul. 2019 10:02 schreef Florence Blanc-Renaud via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org>:
On 7/30/19 10:00 AM, Rob Verduijn via FreeIPA-users wrote: > Hello, > > I was doing some rtfm for migration of an ipa ca-renewal master
to a
> different system. > I figured that the docs on migrating from rhel7 to rhel8 would be a nice > help for me to migrate from one centos7 to another centos 7
system.
> > Something in the docs gave me pause. > > In the doc in chapter 17.4 instruction 4 > >
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm...
> > It states that on replicas at the bottom of the file > |/etc/httpd/conf.d/ipa-pki-proxy.conf you should uncomment the rewrite > rule and ensure it points to the 'ca renewal master' > Hi, the doc is incorrect, could you please file a bug? Whole explanation: to ensure that the CRL is consistent across all master/replicas, only one of them is generating the official CRL. This node is called the
CRL
generation master. It writes the CRL into 2 locations: a file in /var/lib/ipa/pki-ca/publish/ and also into LDAP below cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca (this part of the tree is replicated to all the replicas with a CA instance). On all the nodes, the CRL can be found at http://$hostname/ipa/crl/MasterCRL.bin. On the CRL generation master, this URL corresponds to the file stored locally in /var/lib/ipa/pki-ca/publish/MasterCRL.bin (see the /etc/httpd/conf.d/ipa.conf file which defines Alias /ipa/crl "/var/lib/ipa/pki-ca/publish"). On the other replicas, the /etc/httpd/conf.d/ipa-pki-proxy.conf file configures a RewriteRule: ^/ipa/crl/MasterCRL.bin http://$hostname/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC] This means that when a http client accesses http://$hostname/ipa/crl/MasterCRL.bin, it gets redirected to http://$hostname/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL (on the same host). This URL is processed by Dogtag servlets, which
perform
an internal LDAP search on cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca (remember, this suffix is replicated, meaning it contains the same data in the replica and in
the
CRL generation master). So it's completely normal that the RewriteRule points to the
localhost
and not to the CRL generation master. Hope this clarifies, flo > | > |However on the centos 7 freeipa replica it points to the
replica.|
> | > | > |Is the configuration on the centos7 freeipa replica incorrect ?| > |Or is the instruction from redhat in need of updates ?| > | > | > |If it's the first, then the installation packages of freeipa on centos > need some attention, because I didn't configure that line as
such.|
> | > | > |Cheers| > |Rob > | > | > | > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> > To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
> _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
freeipa-users@lists.fedorahosted.org