Imported Upstream version 4.6.2

install/tools/ipa-pki-retrieve-key

@@ -0,0 +1,42 @@
+#!/usr/bin/python2
+
+from __future__ import print_function
+
+import os
+import sys
+import traceback
+
+from ipalib import constants
+from ipalib.config import Env
+from ipaplatform.paths import paths
+from ipaserver.secrets.client import CustodiaClient
+
+
+def main():
+    env = Env()
+    env._finalize()
+
+    keyname = "ca_wrapped/" + sys.argv[1]
+    servername = sys.argv[2]
+
+    service = constants.PKI_GSSAPI_SERVICE_NAME
+    client_keyfile = os.path.join(paths.PKI_TOMCAT, service + '.keys')
+    client_keytab = os.path.join(paths.PKI_TOMCAT, service + '.keytab')
+
+    # pylint: disable=no-member
+    client = CustodiaClient(
+        client_service='%s@%s' % (service, env.host), server=servername,
+        realm=env.realm, ldap_uri="ldaps://" + env.host,
+        keyfile=client_keyfile, keytab=client_keytab,
+        )
+
+    # Print the response JSON to stdout; it is already in the format
+    # that Dogtag's ExternalProcessKeyRetriever expects
+    print(client.fetch_key(keyname, store=False))
+
+
+try:
+    main()
+except BaseException:
+    traceback.print_exc()
+    sys.exit(1)