Re: [Freeipa-devel] [PATCH] 0042-0048 AD trusts support (master)

2012-06-07 Thread Martin Kosek
On Wed, 2012-06-06 at 12:50 +0300, Alexander Bokovoy wrote: > On Mon, 04 Jun 2012, Martin Kosek wrote: > >2) Unit tests need to be updated, currently there is about a dozen test > >case errors, e.g. extra ipakrbprincipalalias attribute in services or > >new ipakrbprincipal objectclass for hosts > I

Re: [Freeipa-devel] [PATCH] 0042-0048 AD trusts support (master)

2012-06-07 Thread Alexander Bokovoy
On Thu, 07 Jun 2012, Martin Kosek wrote: It may have been an issue on my side. I will open a ticket if I hit a unit test error again. I did a next round of review for your patches, I did not find any show-stopper why not to push your patches. Lets get them grilled also by other team members :-)I

[Freeipa-devel] [PATCH] 156 Action panel for service provisioning

2012-06-07 Thread Petr Vobornik
Service provisioning status widget was modified only to display the has_keytab status. Button for 'delete key,unprovision' was moved as action to newly created action panel in the same section. This required to moved the creation of the unprovisioning dialog from that widget to new separate dia

Re: [Freeipa-devel] [PATCH] 0042-0048 AD trusts support (master)

2012-06-07 Thread Petr Viktorin
On 06/07/2012 09:48 AM, Martin Kosek wrote: On Wed, 2012-06-06 at 12:50 +0300, Alexander Bokovoy wrote: On Mon, 04 Jun 2012, Martin Kosek wrote: 2) Unit tests need to be updated, currently there is about a dozen test case errors, e.g. extra ipakrbprincipalalias attribute in services or new ipak

Re: [Freeipa-devel] [PATCH] 0050 Fail on unknown Command options

2012-06-07 Thread Petr Vobornik
On 05/28/2012 04:16 PM, Martin Kosek wrote: On Mon, 2012-05-28 at 15:46 +0200, Petr Vobornik wrote: On 05/25/2012 09:20 AM, Petr Vobornik wrote: On 05/16/2012 02:11 PM, Martin Kosek wrote: On Wed, 2012-05-16 at 10:37 +0200, Petr Viktorin wrote: On 05/16/2012 09:58 AM, Martin Kosek wrote: On

Re: [Freeipa-devel] [PATCH] 0042-0048 AD trusts support (master)

2012-06-07 Thread Martin Kosek
On Thu, 2012-06-07 at 11:31 +0200, Petr Viktorin wrote: > On 06/07/2012 09:48 AM, Martin Kosek wrote: > > On Wed, 2012-06-06 at 12:50 +0300, Alexander Bokovoy wrote: > >> On Mon, 04 Jun 2012, Martin Kosek wrote: > >>> 2) Unit tests need to be updated, currently there is about a dozen test > >>> cas

[Freeipa-devel] [PATCH] 275 Do not crash in Decimal parameter conversion

2012-06-07 Thread Martin Kosek
When invalid data is passed, an unhandled decimal exception could be raised in Decimal number conversion. Handle the exception more gracefully and report proper ipalib.errors.ConversionError. https://fedorahosted.org/freeipa/ticket/2705 >From 6f2204609c25df15c1debcfffbee29846aa380b9 Mon Sep 17 00

[Freeipa-devel] [PATCH] 19-21 Use exop instead of kadmin.local

2012-06-07 Thread Sumit Bose
Hi, this patch fixes https://fedorahosted.org/freeipa/ticket/2513 and as a consequence makes https://fedorahosted.org/freeipa/ticket/2516 obsolete. This first patch is just a minor cleanup which is not related to the ticket. The second make create_keys() a public function so the it can be called

Re: [Freeipa-devel] [PATCH] 19-21 Use exop instead of kadmin.local

2012-06-07 Thread Sumit Bose
now with patches :-) On Thu, Jun 07, 2012 at 12:07:13PM +0200, Sumit Bose wrote: > Hi, > > this patch fixes https://fedorahosted.org/freeipa/ticket/2513 and as a > consequence makes https://fedorahosted.org/freeipa/ticket/2516 obsolete. > > This first patch is just a minor cleanup which is not re

[Freeipa-devel] [PATCH] 0021 Fix crash on reload with persistent search enabled

2012-06-07 Thread Petr Spacek
Hello, this patch fixes https://fedorahosted.org/bind-dyndb-ldap/ticket/78: Crash on reload with persistent search enabled. Petr^2 Spacek From ea1119e533a5171586ef8a3bddf66138ccb88b7e Mon Sep 17 00:00:00 2001 From: Petr Spacek Date: Thu, 7 Jun 2012 14:42:40 +0200 Subject: [PATCH] Fix crash du

Re: [Freeipa-devel] Allowing existing IPA hosts to be used for installing a replica

2012-06-07 Thread Simo Sorce
On Wed, 2012-06-06 at 23:08 -0400, Rob Crittenden wrote: > Scott Poore wrote: > > Running this by the mailing list to see if I should open an RFE. > > > > Should we have the ability to install replicas where the host entries > > already exist in IPA? > > > > So, we could in theory do a host-add be

Re: [Freeipa-devel] [PATCH] 0042-0048 AD trusts support (master)

2012-06-07 Thread Simo Sorce
On Thu, 2012-06-07 at 10:56 +0300, Alexander Bokovoy wrote: > On Thu, 07 Jun 2012, Martin Kosek wrote: > >It may have been an issue on my side. I will open a ticket if I hit a > >unit test error again. > > > >I did a next round of review for your patches, I did not find any > >show-stopper why not

Re: [Freeipa-devel] Allowing existing IPA hosts to be used for installing a replica

2012-06-07 Thread Rob Crittenden
Simo Sorce wrote: On Wed, 2012-06-06 at 23:08 -0400, Rob Crittenden wrote: Scott Poore wrote: Running this by the mailing list to see if I should open an RFE. Should we have the ability to install replicas where the host entries already exist in IPA? So, we could in theory do a host-add befo

Re: [Freeipa-devel] Allowing existing IPA hosts to be used for installing a replica

2012-06-07 Thread Simo Sorce
On Thu, 2012-06-07 at 09:16 -0400, Rob Crittenden wrote: > Simo Sorce wrote: > > On Wed, 2012-06-06 at 23:08 -0400, Rob Crittenden wrote: > >> Scott Poore wrote: > >>> Running this by the mailing list to see if I should open an RFE. > >>> > >>> Should we have the ability to install replicas where t

[Freeipa-devel] [PATCH 0022] fix crash during zone unload when NS is not resolvable

2012-06-07 Thread Petr Spacek
Hello, this patch fixes https://fedorahosted.org/bind-dyndb-ldap/ticket/77: bind-dyndb-ldap crashes during zone unload when NS is not resolvable. During investigation I found other two suspicious places. This patch adds only comment near to them. Any changes (as necessary) will be in separate

Re: [Freeipa-devel] [PATCH] 262-265 Enable psearch by default

2012-06-07 Thread Petr Spacek
On 06/05/2012 09:32 AM, Martin Kosek wrote: Thanks for digging out the traceback, I already reported this error to bind-dyndb-ldap: https://bugzilla.redhat.com/show_bug.cgi?id=827401 Petr, what's the status of this bug? I guess we cannot push this set of patches to enable the psearch by default

Re: [Freeipa-devel] [PATCH 0022] fix crash during zone unload when NS is not resolvable

2012-06-07 Thread Martin Kosek
On Thu, 2012-06-07 at 15:33 +0200, Petr Spacek wrote: > Hello, > > this patch fixes https://fedorahosted.org/bind-dyndb-ldap/ticket/77: > bind-dyndb-ldap crashes during zone unload when NS is not resolvable. > > During investigation I found other two suspicious places. This patch adds > only >

Re: [Freeipa-devel] [PATCH] 0021 Fix crash on reload with persistent search enabled

2012-06-07 Thread Adam Tkac
On Thu, Jun 07, 2012 at 02:46:56PM +0200, Petr Spacek wrote: > Hello, > > this patch fixes https://fedorahosted.org/bind-dyndb-ldap/ticket/78: > Crash on reload with persistent search enabled. Thanks, pushed to master. > From ea1119e533a5171586ef8a3bddf66138ccb88b7e Mon Sep 17 00:00:00 2001 > Fr

Re: [Freeipa-devel] [PATCH 0022] fix crash during zone unload when NS is not resolvable

2012-06-07 Thread Adam Tkac
On Thu, Jun 07, 2012 at 03:33:18PM +0200, Petr Spacek wrote: > Hello, > > this patch fixes https://fedorahosted.org/bind-dyndb-ldap/ticket/77: > bind-dyndb-ldap crashes during zone unload when NS is not > resolvable. > > During investigation I found other two suspicious places. This patch > adds

Re: [Freeipa-devel] [PATCH] 1023 tool for configuring automount

2012-06-07 Thread Rob Crittenden
Rob Crittenden wrote: Here is a tool that can be used to configure automount in an IPA client. It can use either SSSD or autofs for automount. It also configures NFSv4 on the client so secure maps will work. rebased patch >From b4bc62c59e073f72c8abb45550d092953820a954 Mon Sep 17 00:00:00 2001

Re: [Freeipa-devel] [PATCH 0022] fix crash during zone unload when NS is not resolvable

2012-06-07 Thread Adam Tkac
On Thu, Jun 07, 2012 at 04:03:46PM +0200, Martin Kosek wrote: > On Thu, 2012-06-07 at 15:33 +0200, Petr Spacek wrote: > > Hello, > > > > this patch fixes https://fedorahosted.org/bind-dyndb-ldap/ticket/77: > > bind-dyndb-ldap crashes during zone unload when NS is not resolvable. > > > > During i

[Freeipa-devel] [PATCH] 1024 add client session support

2012-06-07 Thread Rob Crittenden
This adds client session support. The session key is stored in the kernel key ring. Your first request should go to /ipa/session/xml where it should be rejected with a 401. The next will go to /ipa/xml which will be accepted. This should all be invisible to the client. Subsequent requests sh

Re: [Freeipa-devel] [PATCH] 1024 add client session support

2012-06-07 Thread Rob Crittenden
Rob Crittenden wrote: This adds client session support. The session key is stored in the kernel key ring. Your first request should go to /ipa/session/xml where it should be rejected with a 401. The next will go to /ipa/xml which will be accepted. This should all be invisible to the client. Sub

Re: [Freeipa-devel] [PATCH] 0058 Prevent deletion of the last admin

2012-06-07 Thread Rob Crittenden
Petr Viktorin wrote: On 06/05/2012 11:43 PM, Rob Crittenden wrote: Petr Viktorin wrote: Raise an error when trying to delete the last user from the 'admins' group The 'admin' group name seems like something that shouldn't be hardcoded, but that's how it's done in the webui and some of our ACIs

Re: [Freeipa-devel] [PATCH] 492 Add options to reduce writes from KDC

2012-06-07 Thread Rob Crittenden
Simo Sorce wrote: On Mon, 2012-06-04 at 22:59 -0400, Rob Crittenden wrote: Simo Sorce wrote: The original ldap driver we used up to 2.2 had 2 options admins could set to limit the amount of writes to the database on certain auditing related operations. In particular disable_last_success is real

Re: [Freeipa-devel] [PATCH] 492 Add options to reduce writes from KDC

2012-06-07 Thread Rob Crittenden
Petr Vobornik wrote: On 05/26/2012 12:36 AM, Simo Sorce wrote: The original ldap driver we used up to 2.2 had 2 options admins could set to limit the amount of writes to the database on certain auditing related operations. In particular disable_last_success is really important to reduce the load

Re: [Freeipa-devel] Allowing existing IPA hosts to be used for installing a replica

2012-06-07 Thread Dmitri Pal
On 06/07/2012 09:20 AM, Simo Sorce wrote: > On Thu, 2012-06-07 at 09:16 -0400, Rob Crittenden wrote: >> Simo Sorce wrote: >>> On Wed, 2012-06-06 at 23:08 -0400, Rob Crittenden wrote: Scott Poore wrote: > Running this by the mailing list to see if I should open an RFE. > > Should we

Re: [Freeipa-devel] Allowing existing IPA hosts to be used for installing a replica

2012-06-07 Thread Rob Crittenden
Dmitri Pal wrote: On 06/07/2012 09:20 AM, Simo Sorce wrote: On Thu, 2012-06-07 at 09:16 -0400, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2012-06-06 at 23:08 -0400, Rob Crittenden wrote: Scott Poore wrote: Running this by the mailing list to see if I should open an RFE. Should we have

Re: [Freeipa-devel] [PATCH] 0057 Only allow root to run update plugins

2012-06-07 Thread Rob Crittenden
Petr Viktorin wrote: On 06/05/2012 06:53 PM, Petr Viktorin wrote: On 06/05/2012 04:18 PM, Rob Crittenden wrote: Petr Viktorin wrote: On 06/05/2012 03:00 PM, Rob Crittenden wrote: Petr Viktorin wrote: On 06/05/2012 10:06 AM, Martin Kosek wrote: On Mon, 2012-06-04 at 11:51 -0400, Simo Sorce w

Re: [Freeipa-devel] [PATCH] 274 Password change capability for form-based auth

2012-06-07 Thread Rob Crittenden
Martin Kosek wrote: You can use the attached script (changepw.py) to test the PW change interface from command line (on IPA server). --- IPA server web form-based authentication allows logins for users which for some reason cannot use Kerberos authentication. However, when a password for such u

Re: [Freeipa-devel] [PATCH] 275 Do not crash in Decimal parameter conversion

2012-06-07 Thread Rob Crittenden
Martin Kosek wrote: When invalid data is passed, an unhandled decimal exception could be raised in Decimal number conversion. Handle the exception more gracefully and report proper ipalib.errors.ConversionError. https://fedorahosted.org/freeipa/ticket/2705 I'm being pedantic but I think the De

Re: [Freeipa-devel] [PATCH] 0059 Fix update plugin order

2012-06-07 Thread Rob Crittenden
Petr Viktorin wrote: While messing with the ipa-ldap-updater, I found the order method was using an algorithm that could give incorrect results. I'm submitting a fix in an extra patch, as it's largely unrelated and shouldn't be so controversial. Can you open a ticket on this? We like to have a

Re: [Freeipa-devel] [PATCH] 1024 add client session support

2012-06-07 Thread Rob Crittenden
Rob Crittenden wrote: Rob Crittenden wrote: This adds client session support. The session key is stored in the kernel key ring. Your first request should go to /ipa/session/xml where it should be rejected with a 401. The next will go to /ipa/xml which will be accepted. This should all be invisi

Re: [Freeipa-devel] [PATCH] 274 Password change capability for form-based auth

2012-06-07 Thread Simo Sorce
On Thu, 2012-06-07 at 22:28 -0400, Rob Crittenden wrote: > Martin Kosek wrote: > > You can use the attached script (changepw.py) to test the PW change > > interface from command line (on IPA server). > > > > --- > > > > IPA server web form-based authentication allows logins for users > > which for