gpo: Print getcert message to debug

Otherwise re-running gpupdate to enforce policy
displays 'already exists' messages, which
confusingly appear to be a failure, but are
actually intentional behavior.

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Aug 13 20:06:31 UTC 2021 on sn-devel-184

diff --git a/python/samba/gp_cert_auto_enroll_ext.py b/python/samba/gp_cert_auto_enroll_ext.py
index ea6591a00c02c4a3ed3ab263886b67bde460d2f6..60927709eaa605762586a97e9d9a367b9b36f9d1 100644 (file)
--- a/python/samba/gp_cert_auto_enroll_ext.py
+++ b/python/samba/gp_cert_auto_enroll_ext.py
@@ -135,8 +135,13 @@ def cert_enroll(ca, trust_dir, private_dir, logger):
     getcert = which('getcert')
     cepces_submit = find_cepces_submit()
     if getcert is not None and os.path.exists(cepces_submit):
-        Popen([getcert, 'add-ca', '-c', ca['cn'][0], '-e',
-               '%s --server=%s' % (cepces_submit, ca['dNSHostName'][0])]).wait()
+        p = Popen([getcert, 'add-ca', '-c', ca['cn'][0], '-e',
+                  '%s --server=%s' % (cepces_submit, ca['dNSHostName'][0])],
+                  stdout=PIPE, stderr=PIPE)
+        out, err = p.communicate()
+        logger.debug(out.decode())
+        if p.returncode != 0:
+            logger.debug(err.decode())
         supported_templates = get_supported_templates(ca['dNSHostName'][0],
                                                       logger)
         for template, attrs in ca['certificateTemplates'].items():
@@ -145,10 +150,15 @@ def cert_enroll(ca, trust_dir, private_dir, logger):
             nickname = '%s.%s' % (ca['cn'][0], template.decode())
             keyfile = os.path.join(private_dir, '%s.key' % nickname)
             certfile = os.path.join(trust_dir, '%s.crt' % nickname)
-            Popen([getcert, 'request', '-c', ca['cn'][0],
-                   '-T', template.decode(),
-                   '-I', nickname, '-k', keyfile, '-f', certfile,
-                   '-g', attrs['msPKI-Minimal-Key-Size'][0]]).wait()
+            p = Popen([getcert, 'request', '-c', ca['cn'][0],
+                       '-T', template.decode(),
+                       '-I', nickname, '-k', keyfile, '-f', certfile,
+                       '-g', attrs['msPKI-Minimal-Key-Size'][0]],
+                       stdout=PIPE, stderr=PIPE)
+            out, err = p.communicate()
+            logger.debug(out.decode())
+            if p.returncode != 0:
+                logger.debug(err.decode())
             data['files'].extend([keyfile, certfile])
             data['templates'].append(nickname)
         if update is not None: