Imported Debian patch 4.0.5-6~numeezy

install/restart_scripts/renew_ra_cert

@@ -21,69 +21,40 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import sys
-import os
 import syslog
-import tempfile
-import shutil
 import traceback
 
-from ipapython import ipautil
 from ipalib import api
-from ipaserver.install import certs, cainstance, krainstance
+from ipaserver.install import certs, cainstance
 from ipaplatform import services
-from ipaplatform.paths import paths
 
+nickname = 'ipaCert'
 
-def _main():
-    nickname = 'ipaCert'
-
+def main():
     api.bootstrap(context='restart')
     api.finalize()
 
-    tmpdir = tempfile.mkdtemp(prefix="tmp-")
-    try:
-        principal = str('host/%s@%s' % (api.env.host, api.env.realm))
-        ccache_filename = os.path.join(tmpdir, 'ccache')
-        ipautil.kinit_keytab(principal, paths.KRB5_KEYTAB,
-                             ccache_filename)
-        os.environ['KRB5CCNAME'] = ccache_filename
+    ca = cainstance.CAInstance(api.env.realm, certs.NSS_DIR)
+    if ca.is_renewal_master():
+        # Fetch the new certificate
+        db = certs.CertDB(api.env.realm)
+        dercert = db.get_cert_from_db(nickname, pem=False)
+        if not dercert:
+            syslog.syslog(syslog.LOG_ERR, 'No certificate %s found.' % nickname)
+            sys.exit(1)
 
-        ca = cainstance.CAInstance(host_name=api.env.host, ldapi=False)
-        if ca.is_renewal_master():
-            # Fetch the new certificate
-            db = certs.CertDB(api.env.realm)
-            dercert = db.get_cert_from_db(nickname, pem=False)
-            if not dercert:
-                syslog.syslog(
-                    syslog.LOG_ERR, "No certificate %s found." % nickname)
-                sys.exit(1)
-
-            # Load it into dogtag
-            cainstance.update_people_entry(dercert)
-
-        if api.Command.kra_is_enabled()['result']:
-            krainstance.export_kra_agent_pem()
-    finally:
-        shutil.rmtree(tmpdir)
+        # Load it into dogtag
+        cainstance.update_people_entry(dercert)
 
     # Now restart Apache so the new certificate is available
     syslog.syslog(syslog.LOG_NOTICE, "Restarting httpd")
     try:
         services.knownservices.httpd.restart()
-    except Exception as e:
+    except Exception, e:
         syslog.syslog(syslog.LOG_ERR, "Cannot restart httpd: %s" % e)
     else:
         syslog.syslog(syslog.LOG_NOTICE, "Restarted httpd")
 
-
-def main():
-    try:
-        _main()
-    finally:
-        # lock acquired in renew_ra_cert_pre
-        certs.renewal_lock.release('renew_ra_cert')
-
-
 try:
     main()
 except Exception: