Re: [Freeipa-devel] OTP Design

2013-01-31 Thread Petr Spacek
On 30.1.2013 05:35, Dmitri Pal wrote: Hello, We started to shape a page for the OTP prototyping work we are doing. It is work in progress but it has enough information to share and discuss. http://freeipa.org/page/V3/OTP Comments welcome! I gave it a quick look. Generally, the core seems corr

Re: [Freeipa-devel] [PATCHES] 146-164 LDAP code refactoring (Part 4)

2013-01-31 Thread Petr Viktorin
On 01/30/2013 10:53 AM, Petr Viktorin wrote: On 01/29/2013 04:39 PM, Petr Viktorin wrote: On 01/28/2013 04:09 PM, Petr Viktorin wrote: On 01/28/2013 09:34 AM, Jan Cholasta wrote: On 25.1.2013 14:54, Petr Viktorin wrote: On 01/24/2013 03:06 PM, Petr Viktorin wrote: On 01/24/2013 10:43 AM, Pet

Re: [Freeipa-devel] [PATCHES] 94-96 Remove Entry and Entity classes

2013-01-31 Thread Jan Cholasta
On 22.1.2013 15:32, Jan Cholasta wrote: Hi, these patches remove the Entry and Entity classes and move instantiation of LDAPEntry objects to LDAPConnection.make_entry factory method. Apply on top of Petr Viktorin's LDAP code refactoring (part 1 & 2) patches. Honza Slightly changed patch 95

[Freeipa-devel] [PATCH 0028] Prevent backtrace in ipa-replica-prepare

2013-01-31 Thread Tomas Babej
Hi, This was a regression due to change from DatabaseError to NetworkError when LDAP server is down. https://fedorahosted.org/freeipa/ticket/2939 Tomas ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/fr

Re: [Freeipa-devel] [PATCH 0028] Prevent backtrace in ipa-replica-prepare

2013-01-31 Thread Tomas Babej
On 01/31/2013 12:03 PM, Tomas Babej wrote: Hi, This was a regression due to change from DatabaseError to NetworkError when LDAP server is down. https://fedorahosted.org/freeipa/ticket/2939 Tomas ___ Freeipa-devel mailing list Freeipa-devel@redhat.co

[Freeipa-devel] [PATCH] 360 Add autodiscovery section in ipa-client-install man pages

2013-01-31 Thread Martin Kosek
Explain how autodiscovery and failover works and which options are important for these elements. https://fedorahosted.org/freeipa/ticket/3383 From ac0502ca82e5f15dbc3161257b91362c2552 Mon Sep 17 00:00:00 2001 From: Martin Kosek Date: Thu, 31 Jan 2013 13:16:29 +0100 Subject: [PATCH] Add autodi

Re: [Freeipa-devel] [PATCH 0028] Prevent backtrace in ipa-replica-prepare

2013-01-31 Thread Martin Kosek
On 01/31/2013 12:05 PM, Tomas Babej wrote: > On 01/31/2013 12:03 PM, Tomas Babej wrote: >> Hi, >> >> This was a regression due to change from DatabaseError to NetworkError >> when LDAP server is down. >> >> https://fedorahosted.org/freeipa/ticket/2939 >> >> Tomas >> >> _

[Freeipa-devel] [PATCH 0029] Fix a typo in ipa-adtrust-install help

2013-01-31 Thread Tomas Babej
Hi, this is a fix for a benign typo in ipa-adtrust-install --help description. Tomas >From 785cd2df77874c524a36eab24257cdaff14a374b Mon Sep 17 00:00:00 2001 From: Tomas Babej Date: Thu, 31 Jan 2013 07:58:48 -0500 Subject: [PATCH] Fix a typo in ipa-adtrust-install help "Add SIDs for existing us

Re: [Freeipa-devel] [PATCH 0029] Fix a typo in ipa-adtrust-install help

2013-01-31 Thread Martin Kosek
On 01/31/2013 02:07 PM, Tomas Babej wrote: > Hi, > > this is a fix for a benign typo in ipa-adtrust-install --help description. > > Tomas > ACK. Pushed to master, ipa-3-1. Martin ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.re

Re: [Freeipa-devel] [PATCH 0029] Fix a typo in ipa-adtrust-install help

2013-01-31 Thread Sumit Bose
On Thu, Jan 31, 2013 at 02:07:22PM +0100, Tomas Babej wrote: > Hi, > > this is a fix for a benign typo in ipa-adtrust-install --help description. > > Tomas thanks for catching this. Usually I prefer to add the space at the end truncated line instead at the beginning of the new line. Do we/the py

Re: [Freeipa-devel] [PATCH 0027] Add checks for SELinux in install scripts

2013-01-31 Thread Tomas Babej
On 01/30/2013 05:58 PM, Tomas Babej wrote: On 01/30/2013 05:12 PM, Tomas Babej wrote: Hi, The checks make sure that SELinux is: - installed and enabled (on server install) - installed and enabled OR not installed (on client install) Please note that client installs with SELinux not install

Re: [Freeipa-devel] [PATCH 0028] Prevent backtrace in ipa-replica-prepare

2013-01-31 Thread Petr Viktorin
On 01/31/2013 01:35 PM, Martin Kosek wrote: On 01/31/2013 12:05 PM, Tomas Babej wrote: On 01/31/2013 12:03 PM, Tomas Babej wrote: Hi, This was a regression due to change from DatabaseError to NetworkError when LDAP server is down. https://fedorahosted.org/freeipa/ticket/2939 I don't think

Re: [Freeipa-devel] [PATCH 0029] Fix a typo in ipa-adtrust-install help

2013-01-31 Thread Petr Viktorin
On 01/31/2013 02:15 PM, Sumit Bose wrote: On Thu, Jan 31, 2013 at 02:07:22PM +0100, Tomas Babej wrote: Hi, this is a fix for a benign typo in ipa-adtrust-install --help description. Tomas thanks for catching this. Usually I prefer to add the space at the end truncated line instead at the beg

Re: [Freeipa-devel] [PATCH] 360 Add autodiscovery section in ipa-client-install man pages

2013-01-31 Thread Petr Spacek
On 31.1.2013 13:18, Martin Kosek wrote: Explain how autodiscovery and failover works and which options are important for these elements. https://fedorahosted.org/freeipa/ticket/3383 Could you add some note about "how ipa-client installer will be confused by AD"? One paragraph with some explan

[Freeipa-devel] [PATCH] 361 ipa-adtrust-install should ask for SID generation

2013-01-31 Thread Martin Kosek
When ipa-adtrust-install is run, check if there are any objects that need to have SID generated. If yes, interactively ask the user if the sidgen task should be run. https://fedorahosted.org/freeipa/ticket/3195 From bd6512628d83d1f4bdfc9f414689c8a67bd01c7c Mon Sep 17 00:00:00 2001 From: Martin Kos

[Freeipa-devel] [PATCHES] 98-101 Preserve case of LDAP attribute names

2013-01-31 Thread Jan Cholasta
Hi, these patches implement attribute name case preservation in LDAPEntry. Apply on top of Petr Viktorin's LDAP code refactoring patchset (up to part 5). Honza -- Jan Cholasta >From 8778f668591e28d78741df55dc2bca98917073e5 Mon Sep 17 00:00:00 2001 From: Jan Cholasta Date: Thu, 31 Jan 2013 1

Re: [Freeipa-devel] [PATCH] 361 ipa-adtrust-install should ask for SID generation

2013-01-31 Thread Alexander Bokovoy
On Thu, 31 Jan 2013, Martin Kosek wrote: When ipa-adtrust-install is run, check if there are any objects that need to have SID generated. If yes, interactively ask the user if the sidgen task should be run. https://fedorahosted.org/freeipa/ticket/3195 From bd6512628d83d1f4bdfc9f414689c8a67bd0

Re: [Freeipa-devel] [PATCH] 360 Add autodiscovery section in ipa-client-install man pages

2013-01-31 Thread Martin Kosek
On 01/31/2013 02:44 PM, Petr Spacek wrote: > On 31.1.2013 13:18, Martin Kosek wrote: >> Explain how autodiscovery and failover works and which options >> are important for these elements. >> >> https://fedorahosted.org/freeipa/ticket/3383 > > Could you add some note about "how ipa-client installer

Re: [Freeipa-devel] [PATCHES] 0117-0118 Port ipa-replica-prepare to the admintool framework

2013-01-31 Thread Rob Crittenden
Petr Viktorin wrote: On 01/28/2013 04:36 PM, Petr Viktorin wrote: On 01/04/2013 02:43 PM, Petr Viktorin wrote: On 01/03/2013 02:56 PM, John Dennis wrote: On 01/03/2013 08:00 AM, Petr Viktorin wrote: Hello, The first patch implements logging-related changes to the admintool framework and ipa-

Re: [Freeipa-devel] [PATCH] 361 ipa-adtrust-install should ask for SID generation

2013-01-31 Thread Martin Kosek
On 01/31/2013 04:29 PM, Alexander Bokovoy wrote: > On Thu, 31 Jan 2013, Martin Kosek wrote: >> When ipa-adtrust-install is run, check if there are any objects >> that need to have SID generated. If yes, interactively ask the user >> if the sidgen task should be run. >> >> https://fedorahosted.org/f

Re: [Freeipa-devel] [PATCH] 357 Use fully qualified CCACHE names

2013-01-31 Thread Alexander Bokovoy
On Wed, 30 Jan 2013, Martin Kosek wrote: Some parts of install scripts used only ccache name as returned by krbV.CCache.name attribute. However, when this name is used again to initialize krbV.CCache object or when it is used in KRB5CCNAME environmental variable, it fails for new DIR type of CCAC

Re: [Freeipa-devel] [PATCH] 360 Add autodiscovery section in ipa-client-install man pages

2013-01-31 Thread Martin Kosek
On 01/31/2013 04:41 PM, Martin Kosek wrote: > On 01/31/2013 02:44 PM, Petr Spacek wrote: >> On 31.1.2013 13:18, Martin Kosek wrote: >>> Explain how autodiscovery and failover works and which options >>> are important for these elements. >>> >>> https://fedorahosted.org/freeipa/ticket/3383 >> >> Cou

Re: [Freeipa-devel] [PATCH 0005] Clarified error message with ipa-client-automount

2013-01-31 Thread Rob Crittenden
Lynn Root wrote: On Mon 03 Dec 2012 05:20:32 AM PST, Lynn Root wrote: On 11/30/2012 10:35 PM, Rob Crittenden wrote: Lynn Root wrote: Returns a clearer hint when user is running ipa-client-automount with possible firewall up and blocking need ports. Not sure if this patch is worded correctly i

Re: [Freeipa-devel] [PATCH] 357 Use fully qualified CCACHE names

2013-01-31 Thread Martin Kosek
On 01/31/2013 05:01 PM, Alexander Bokovoy wrote: > On Wed, 30 Jan 2013, Martin Kosek wrote: >> Some parts of install scripts used only ccache name as returned by >> krbV.CCache.name attribute. However, when this name is used again >> to initialize krbV.CCache object or when it is used in KRB5CCNAME

Re: [Freeipa-devel] [PATCHES] 146-164 LDAP code refactoring (Part 4)

2013-01-31 Thread Jan Cholasta
On 31.1.2013 11:00, Petr Viktorin wrote: On 01/30/2013 10:53 AM, Petr Viktorin wrote: On 01/29/2013 04:39 PM, Petr Viktorin wrote: On 01/28/2013 04:09 PM, Petr Viktorin wrote: On 01/28/2013 09:34 AM, Jan Cholasta wrote: On 25.1.2013 14:54, Petr Viktorin wrote: On 01/24/2013 03:06 PM, Petr Vi

Re: [Freeipa-devel] [PATCH] 361 ipa-adtrust-install should ask for SID generation

2013-01-31 Thread Alexander Bokovoy
On Thu, 31 Jan 2013, Martin Kosek wrote: On 01/31/2013 04:29 PM, Alexander Bokovoy wrote: On Thu, 31 Jan 2013, Martin Kosek wrote: When ipa-adtrust-install is run, check if there are any objects that need to have SID generated. If yes, interactively ask the user if the sidgen task should be run

Re: [Freeipa-devel] [PATCH] 357 Use fully qualified CCACHE names

2013-01-31 Thread Alexander Bokovoy
On Thu, 31 Jan 2013, Martin Kosek wrote: On 01/31/2013 05:01 PM, Alexander Bokovoy wrote: On Wed, 30 Jan 2013, Martin Kosek wrote: Some parts of install scripts used only ccache name as returned by krbV.CCache.name attribute. However, when this name is used again to initialize krbV.CCache objec

Re: [Freeipa-devel] [PATCHES] 0107-0114 Fix Confusing ipa tool online help organization

2013-01-31 Thread Rob Crittenden
Petr Viktorin wrote: On 12/14/2012 01:46 AM, Dmitri Pal wrote: On 12/13/2012 10:21 AM, Petr Viktorin wrote: https://fedorahosted.org/freeipa/ticket/3060 Here is a collection of smallish fixes to `ipa help` and `ipa --help`. This should address most of Nikolai's proposal. Additionally, it's no

Re: [Freeipa-devel] OTP Design

2013-01-31 Thread Dmitri Pal
On 01/31/2013 04:34 AM, Petr Spacek wrote: > On 30.1.2013 05:35, Dmitri Pal wrote: >> Hello, >> >> We started to shape a page for the OTP prototyping work we are doing. >> It is work in progress but it has enough information to share and >> discuss. >> http://freeipa.org/page/V3/OTP >> >> Comments

Re: [Freeipa-devel] [PATCHES] 91-92 Add support for RFC 6594 SSHFP DNS records

2013-01-31 Thread Rob Crittenden
Jan Cholasta wrote: On 23.1.2013 23:45, Rob Crittenden wrote: Jan Cholasta wrote: On 10.1.2013 05:56, Jan Cholasta wrote: Hi, Patch 91 removes module ipapython.compat. The code that uses it doesn't work with ancient Python versions anyway, so there's no need to keep it around. Patch 92 adds

Re: [Freeipa-devel] [PATCH] 358-359 Fix openldap migration errors

2013-01-31 Thread Rob Crittenden
Martin Kosek wrote: These 2 attached patches were generated based on my debugging session with "tsunamie" and helping him dealing with migration from his openldap DS. With these applied, migrate-ds command no longer crashes with an error. I can lend my openldap instance I used when developing th

Re: [Freeipa-devel] [PATCH] 358-359 Fix openldap migration errors

2013-01-31 Thread Rob Crittenden
Martin Kosek wrote: On 01/31/2013 08:36 PM, Rob Crittenden wrote: Martin Kosek wrote: These 2 attached patches were generated based on my debugging session with "tsunamie" and helping him dealing with migration from his openldap DS. With these applied, migrate-ds command no longer crashes with

Re: [Freeipa-devel] [PATCH] 358-359 Fix openldap migration errors

2013-01-31 Thread Martin Kosek
On 01/31/2013 08:36 PM, Rob Crittenden wrote: Martin Kosek wrote: These 2 attached patches were generated based on my debugging session with "tsunamie" and helping him dealing with migration from his openldap DS. With these applied, migrate-ds command no longer crashes with an error. I can lend

[Freeipa-devel] More types of replicas in FreeIPA

2013-01-31 Thread Ondrej Hamada
Hello, I'm starting to work on my thesis about 'More types of replicas in FreeIPA' again. One of the main problems is the way how should the read-only replicas deal with KDC because they're not supposed to posses the Kerberos (krb) master key. The task was to investigate how is this solved in

Re: [Freeipa-devel] [PATCH] 358-359 Fix openldap migration errors

2013-01-31 Thread Martin Kosek
On 01/31/2013 09:35 PM, Rob Crittenden wrote: > Martin Kosek wrote: >> On 01/31/2013 08:36 PM, Rob Crittenden wrote: >>> Martin Kosek wrote: These 2 attached patches were generated based on my debugging session with "tsunamie" and helping him dealing with migration from his openldap

Re: [Freeipa-devel] [PATCH] 357 Use fully qualified CCACHE names

2013-01-31 Thread Martin Kosek
On 01/31/2013 07:07 PM, Alexander Bokovoy wrote: > On Thu, 31 Jan 2013, Martin Kosek wrote: >> On 01/31/2013 05:01 PM, Alexander Bokovoy wrote: >>> On Wed, 30 Jan 2013, Martin Kosek wrote: Some parts of install scripts used only ccache name as returned by krbV.CCache.name attribute. Howev

Re: [Freeipa-devel] [PATCH] 361 ipa-adtrust-install should ask for SID generation

2013-01-31 Thread Martin Kosek
On 01/31/2013 07:06 PM, Alexander Bokovoy wrote: > On Thu, 31 Jan 2013, Martin Kosek wrote: >> On 01/31/2013 04:29 PM, Alexander Bokovoy wrote: >>> On Thu, 31 Jan 2013, Martin Kosek wrote: When ipa-adtrust-install is run, check if there are any objects that need to have SID generated. If