Re: [Freeipa-devel] [RFE] CA certificate renewal

2013-10-08 Thread Petr Spacek
On 7.10.2013 20:20, Jan Cholasta wrote: Automatic renewal of IPA CA certificate. certmonger currently has no notification capabilities. How will anyone know that the renewal has failed unless they happen to run getcert list? Unfortunately I don't really have an answer. An MTA is looking more

Re: [Freeipa-devel] [RFE] CA certificate renewal

2013-10-08 Thread Jan Cholasta
On 8.10.2013 08:37, Petr Spacek wrote: On 7.10.2013 20:20, Jan Cholasta wrote: Automatic renewal of IPA CA certificate. certmonger currently has no notification capabilities. How will anyone know that the renewal has failed unless they happen to run getcert list? Unfortunately I don't really

Re: [Freeipa-devel] [PATCH 0024] Add OTP support to ipalib CLI

2013-10-08 Thread Jan Cholasta
On 7.10.2013 23:34, Nathaniel McCallum wrote: On Fri, 2013-10-04 at 16:16 -0400, Nathaniel McCallum wrote: This patch supersedes my patch 0017 and requires patches 0020-0023. I believe I have solved all of the outstanding issues from the review of patch 0017, unless otherwise noted: 1. I'm not

Re: [Freeipa-devel] [PATCH] Use the right attribute with ipapwd_entry_checks for MaigcRegen

2013-10-08 Thread Martin Kosek
On 10/07/2013 06:29 PM, Alexander Bokovoy wrote: On Mon, 07 Oct 2013, Sumit Bose wrote: Hi, this issue was found by Steeve, he tried to validate a trust manually from AD and was repeatedly ask for the admin password without any progress. It turned out that the ipaNTHash was not set through

Re: [Freeipa-devel] [DOC] what was the meaning?

2013-10-08 Thread Martin Kosek
On 10/07/2013 10:43 PM, Jérôme Fenal wrote: Hi all, Found in SelinuxMap.xml: As with adding a user to a ion value identifies the host-based access control rule to use for mapping. The access control rule must specify both users and hosts appropriately so that the

Re: [Freeipa-devel] [RFE] CA certificate renewal

2013-10-08 Thread Jakub Hrozek
On Tue, Oct 08, 2013 at 09:21:10AM +0200, Petr Spacek wrote: On 8.10.2013 09:16, Jan Cholasta wrote: On 8.10.2013 08:37, Petr Spacek wrote: On 7.10.2013 20:20, Jan Cholasta wrote: Automatic renewal of IPA CA certificate. certmonger currently has no notification capabilities. How will anyone

Re: [Freeipa-devel] [PATCH 0186-0191] Replace LDAP cache with RBTDB

2013-10-08 Thread Tomas Hozza
On 10/02/2013 12:57 PM, Petr Spacek wrote: On 13.9.2013 15:31, Petr Spacek wrote: On 14.8.2013 16:42, Petr Spacek wrote: On 14.8.2013 16:25, Petr Spacek wrote: On 1.8.2013 15:57, Petr Spacek wrote: Hello, attached monster patches replace our internal cache/database with RBTDB

Re: [Freeipa-devel] [PATCH 0021] Don't special case the Password class in Param.__init__()

2013-10-08 Thread Petr Viktorin
On 10/07/2013 11:28 PM, Nathaniel McCallum wrote: On Mon, 2013-10-07 at 13:47 +0200, Petr Viktorin wrote: On 10/04/2013 07:34 PM, Nathaniel McCallum wrote: This patch is preparatory for the OTP CLI patch. Thanks for the patch; it needs some work. From

Re: [Freeipa-devel] Handling of multiple krbPrincipalNames and of krbCanonicalNames

2013-10-08 Thread Martin Kosek
On 10/07/2013 09:53 PM, Nalin Dahyabhai wrote: Comparing master's ipa-kdb's handling of krbPrincipalName and krbCanonicalName attributes with that of the upstream kldap driver, there are a few differences which I'm thinking are bugs. * If an entry has multiple krbPrincipalName values, the

Re: [Freeipa-devel] [PATCH 0024] Add OTP support to ipalib CLI

2013-10-08 Thread Nathaniel McCallum
On Tue, 2013-10-08 at 09:19 +0200, Jan Cholasta wrote: On 7.10.2013 23:34, Nathaniel McCallum wrote: On Fri, 2013-10-04 at 16:16 -0400, Nathaniel McCallum wrote: This patch supersedes my patch 0017 and requires patches 0020-0023. I believe I have solved all of the outstanding issues from

Re: [Freeipa-devel] [PATCH 0023] Add optional_create flag

2013-10-08 Thread Petr Viktorin
On 10/07/2013 11:30 PM, Nathaniel McCallum wrote: On Mon, 2013-10-07 at 14:26 +0200, Petr Viktorin wrote: On 10/04/2013 10:01 PM, Nathaniel McCallum wrote: On Fri, 2013-10-04 at 13:37 -0400, Nathaniel McCallum wrote: This patch is preparatory for the OTP CLI patch. I'm not quite sure why,

Re: [Freeipa-devel] [PATCH 0020] Add IntEnum parameter to ipalib

2013-10-08 Thread Petr Viktorin
On 10/07/2013 11:28 PM, Nathaniel McCallum wrote: On Mon, 2013-10-07 at 13:22 +0200, Petr Viktorin wrote: On 10/04/2013 07:33 PM, Nathaniel McCallum wrote: This patch is preparatory for the OTP CLI patch. +def _convert_scalar(self, value, index=None): +return

Re: [Freeipa-devel] [PATCH 0020] Add IntEnum parameter to ipalib

2013-10-08 Thread Nathaniel McCallum
On Tue, 2013-10-08 at 18:29 +0200, Petr Viktorin wrote: On 10/07/2013 11:28 PM, Nathaniel McCallum wrote: On Mon, 2013-10-07 at 13:22 +0200, Petr Viktorin wrote: On 10/04/2013 07:33 PM, Nathaniel McCallum wrote: This patch is preparatory for the OTP CLI patch. +def