Re: [Freeipa-devel] Re: Certificate enrollment, principal names

2009-11-04 Thread Dmitri Pal
Andrew Wnuk wrote: > On 11/04/09 16:16, Nalin Dahyabhai wrote: >> On Wed, Nov 04, 2009 at 04:39:40PM -0500, Rob Crittenden wrote: >> >>> Alternatively you can specify which host(s) can request a >>> certificate for a given service. Use the service-add-member command >>> to add hosts that can req

Re: [Freeipa-devel] GeneralizedTime v.s datetime.datetime in XMLRPC

2009-11-04 Thread Dmitri Pal
Rob, is it a big problem to do it right? It seems like we are cutting corners a bit and I understand why but my general experience tells me that these things are just time bombs waiting to explode. Do we really want to leave them there or we should clean it up before we release? I know it is more w

Re: [Freeipa-devel] Re: Certificate enrollment, principal names

2009-11-04 Thread Andrew Wnuk
On 11/04/09 16:16, Nalin Dahyabhai wrote: On Wed, Nov 04, 2009 at 04:39:40PM -0500, Rob Crittenden wrote: Alternatively you can specify which host(s) can request a certificate for a given service. Use the service-add-member command to add hosts that can request certs for it. That soun

[Freeipa-devel] Re: Certificate enrollment, principal names

2009-11-04 Thread Nalin Dahyabhai
On Wed, Nov 04, 2009 at 04:39:40PM -0500, Rob Crittenden wrote: > Alternatively you can specify which host(s) can request a > certificate for a given service. Use the service-add-member command > to add hosts that can request certs for it. That sounds reasonable. Is this new post-1.9.0? I can ad

Re: [Freeipa-devel] GeneralizedTime v.s datetime.datetime in XMLRPC

2009-11-04 Thread John Dennis
On 11/04/2009 03:52 PM, Rob Crittenden wrote: John Dennis wrote: In parameters.py we define a GeneralizedTime object to be used as an XMLRPC parameter. Why? GeneralizedTime isn't defined as an XML-RPC paramter, just an IPA one and XML-RPC just comes along for the ride. We only needed support f

[Freeipa-devel] Re: Certificate enrollment, principal names

2009-11-04 Thread Rob Crittenden
Nalin Dahyabhai wrote: I think I'm getting closer to having certmonger (the provider of the ipa-getcert command) be useful enough to throw certificate enrollment requests at the IPA server, and I've got a couple of questions about how the server decides what it will issue and what it puts in the

[Freeipa-devel] [PATCH] 308 manage arbitrary attributes

2009-11-04 Thread Rob Crittenden
This adds 2 new parameters, --setattr and --addattr and lets you manage whatever attribute you want (within the given set of objectclasses). Both take a name/value pair. --setattr sets the attribute to the given value --addattr adds the value to an attribute. Can be used to manage multi-valued

Re: [Freeipa-devel] GeneralizedTime v.s datetime.datetime in XMLRPC

2009-11-04 Thread Rob Crittenden
John Dennis wrote: In parameters.py we define a GeneralizedTime object to be used as an XMLRPC parameter. Why? GeneralizedTime isn't defined as an XML-RPC paramter, just an IPA one and XML-RPC just comes along for the ride. We only needed support for RFC 4517. * XMLRPC defines the dateTime.

[Freeipa-devel] GeneralizedTime v.s datetime.datetime in XMLRPC

2009-11-04 Thread John Dennis
In parameters.py we define a GeneralizedTime object to be used as an XMLRPC parameter. Why? * XMLRPC defines the dateTime.iso8601 parameter value type for passing date/time information * Python has good support for date/time processing in it's datetime module * Python's xmlrpclib supports bo

[Freeipa-devel] [PATCH] 307 enforce scalar

2009-11-04 Thread Rob Crittenden
_convert_scalar() should not handle tuples/lists (by definition). A parameter may be mutivalued but even then _convert_scalar() gets the values one at a time. rob >From 14748971b251b833b5f996c49e1fc065e8962959 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Wed, 4 Nov 2009 09:41:48 -0500 S

Re: [Freeipa-devel] [PATCH] 306 selinux policy for assets

2009-11-04 Thread Jason Gerard DeRose
On Tue, 2009-11-03 at 15:29 -0500, Rob Crittenden wrote: > This adds some SELinux policy for /var/cache/ipa/assets and > /var/cache/ipa/sessions. > > I've also disabled Indexing on /ipa-assets and removed the deprecated > IPADebug option. > > This effectively removes ipa_webgui too. I've left t