Re: [Freeipa-devel] [PATCHES] 172-196 Refactor certificate renewal code

2014-03-12 Thread Petr Viktorin
On 03/10/2014 01:03 PM, Jan Cholasta wrote: On 17.10.2013 18:59, Jan Cholasta wrote: On 17.10.2013 18:01, Petr Viktorin wrote: On 10/17/2013 02:21 PM, Jan Cholasta wrote: Hi, this patchset contains refactoring of the certificate renewal code, which will be the base for CA certificate renewal.

Re: [Freeipa-devel] [PATCH] 1106 IPA REST smart proxy

2014-03-12 Thread Rob Crittenden
Petr Viktorin wrote: On 03/10/2014 08:55 PM, Rob Crittenden wrote: Rob Crittenden wrote: Petr Viktorin wrote: On 02/27/2014 10:18 PM, Rob Crittenden wrote: Rob Crittenden wrote: Updated patch based on feedback from Foreman team. I added a new URI, /features, which Foreman uses to determine wh

Re: [Freeipa-devel] DNSSEC: LDAP schema requirements

2014-03-12 Thread Ludwig Krispenz
On 03/12/2014 06:08 PM, Petr Spacek wrote: On 12.3.2014 16:54, Ludwig Krispenz wrote: On 03/12/2014 04:28 PM, Petr Spacek wrote: On 12.3.2014 14:07, Ludwig Krispenz wrote: On 03/12/2014 01:09 PM, Petr Spacek wrote: On 12.3.2014 12:12, Ludwig Krispenz wrote: On 03/11/2014 11:33 AM, Petr Sp

Re: [Freeipa-devel] [PATCH] 0150: make sure SID is always returned as unicode from dcerpc.py

2014-03-12 Thread Martin Kosek
On 03/12/2014 06:13 PM, Alexander Bokovoy wrote: > On Wed, 12 Mar 2014, Martin Kosek wrote: >> On 03/12/2014 04:56 PM, Alexander Bokovoy wrote: >>> Hi, >>> >>> Trusted domain SID could be obtained through different means. When it is >>> fetched from the AD DC via LDAP, it needs to be extracted from

Re: [Freeipa-devel] [PATCH] 0150: make sure SID is always returned as unicode from dcerpc.py

2014-03-12 Thread Alexander Bokovoy
On Wed, 12 Mar 2014, Martin Kosek wrote: On 03/12/2014 04:56 PM, Alexander Bokovoy wrote: Hi, Trusted domain SID could be obtained through different means. When it is fetched from the AD DC via LDAP, it needs to be extracted from a default context and explicitly converted to unicode. https://f

Re: [Freeipa-devel] DNSSEC: LDAP schema requirements

2014-03-12 Thread Petr Spacek
On 12.3.2014 16:54, Ludwig Krispenz wrote: On 03/12/2014 04:28 PM, Petr Spacek wrote: On 12.3.2014 14:07, Ludwig Krispenz wrote: On 03/12/2014 01:09 PM, Petr Spacek wrote: On 12.3.2014 12:12, Ludwig Krispenz wrote: On 03/11/2014 11:33 AM, Petr Spacek wrote: On 10.3.2014 12:08, Martin Kosek

Re: [Freeipa-devel] [PATCH] 549 webui: use unique ids for checkboxes

2014-03-12 Thread Misnyovszki Adam
On Tue, 25 Feb 2014 18:12:20 +0100 Petr Vobornik wrote: > This is a minor fix. Please don't close ticket 3904 yet if committed. > > Checkboxes have not used unique ids across the whole UI. It broke > checking by clicking on label for later displayed instances. It > became serious problem when r

Re: [Freeipa-devel] [PATCH] 0150: make sure SID is always returned as unicode from dcerpc.py

2014-03-12 Thread Martin Kosek
On 03/12/2014 04:56 PM, Alexander Bokovoy wrote: > Hi, > > Trusted domain SID could be obtained through different means. When it is > fetched from the AD DC via LDAP, it needs to be extracted from a default > context and explicitly converted to unicode. > > https://fedorahosted.org/freeipa/ticket

Re: [Freeipa-devel] [PATCH] 531-541 OTP UI

2014-03-12 Thread Petr Viktorin
On 03/12/2014 05:23 PM, Misnyovszki Adam wrote: On Wed, 12 Mar 2014 15:41:31 +0100 Petr Vobornik wrote: On 7.3.2014 18:10, Petr Vobornik wrote: Attaching new version of 537 which adds combobox control for owner attribute instead of textbox. All other patches are attached as well to reduce co

Re: [Freeipa-devel] [PATCH] 531-541 OTP UI

2014-03-12 Thread Misnyovszki Adam
On Wed, 12 Mar 2014 15:41:31 +0100 Petr Vobornik wrote: > On 7.3.2014 18:10, Petr Vobornik wrote: > > Attaching new version of 537 which adds combobox control for owner > > attribute instead of textbox. > > > > All other patches are attached as well to reduce confusion in case > > of ACK :). > >

[Freeipa-devel] [PATCH] 0150: make sure SID is always returned as unicode from dcerpc.py

2014-03-12 Thread Alexander Bokovoy
Hi, Trusted domain SID could be obtained through different means. When it is fetched from the AD DC via LDAP, it needs to be extracted from a default context and explicitly converted to unicode. https://fedorahosted.org/freeipa/ticket/4246 -- / Alexander Bokovoy >From 8fa83d284052de5e4bc66efbfe

Re: [Freeipa-devel] DNSSEC: upgrade path to Vault

2014-03-12 Thread Ludwig Krispenz
On 03/12/2014 04:28 PM, Petr Spacek wrote: On 12.3.2014 14:07, Ludwig Krispenz wrote: On 03/12/2014 01:09 PM, Petr Spacek wrote: On 12.3.2014 12:12, Ludwig Krispenz wrote: On 03/11/2014 11:33 AM, Petr Spacek wrote: On 10.3.2014 12:08, Martin Kosek wrote: On 03/10/2014 11:49 AM, Petr Spacek

Re: [Freeipa-devel] LDAP schema for PKCS#11

2014-03-12 Thread Jan Cholasta
On 12.3.2014 16:14, Stef Walter wrote: On 05.03.2014 18:02, Jan Cholasta wrote: On 5.3.2014 13:20, Stef Walter wrote: On 03.03.2014 15:24, Jan Cholasta wrote: On 3.3.2014 15:07, Stef Walter wrote: On 03.03.2014 15:03, Jan Cholasta wrote: If you plug a PKCS#11 module into p11-kit, will p11-ki

Re: [Freeipa-devel] DNSSEC: upgrade path to Vault

2014-03-12 Thread Petr Spacek
On 12.3.2014 14:07, Ludwig Krispenz wrote: On 03/12/2014 01:09 PM, Petr Spacek wrote: On 12.3.2014 12:12, Ludwig Krispenz wrote: On 03/11/2014 11:33 AM, Petr Spacek wrote: On 10.3.2014 12:08, Martin Kosek wrote: On 03/10/2014 11:49 AM, Petr Spacek wrote: On 7.3.2014 17:33, Dmitri Pal wrote:

Re: [Freeipa-devel] LDAP schema for PKCS#11

2014-03-12 Thread Stef Walter
On 05.03.2014 18:02, Jan Cholasta wrote: > On 5.3.2014 13:20, Stef Walter wrote: >> On 03.03.2014 15:24, Jan Cholasta wrote: >>> On 3.3.2014 15:07, Stef Walter wrote: On 03.03.2014 15:03, Jan Cholasta wrote: > If you plug a PKCS#11 module into p11-kit, will p11-kit use NSS trust > obje

Re: [Freeipa-devel] DNSSEC: upgrade path to Vault

2014-03-12 Thread Ludwig Krispenz
On 03/12/2014 01:09 PM, Petr Spacek wrote: On 12.3.2014 12:12, Ludwig Krispenz wrote: On 03/11/2014 11:33 AM, Petr Spacek wrote: On 10.3.2014 12:08, Martin Kosek wrote: On 03/10/2014 11:49 AM, Petr Spacek wrote: On 7.3.2014 17:33, Dmitri Pal wrote: I do not think it is the right architectura

Re: [Freeipa-devel] DNSSEC: upgrade path to Vault

2014-03-12 Thread Petr Spacek
On 12.3.2014 12:12, Ludwig Krispenz wrote: On 03/11/2014 11:33 AM, Petr Spacek wrote: On 10.3.2014 12:08, Martin Kosek wrote: On 03/10/2014 11:49 AM, Petr Spacek wrote: On 7.3.2014 17:33, Dmitri Pal wrote: I do not think it is the right architectural approach to try to fix a specific use case

Re: [Freeipa-devel] [PATCH] 1106 IPA REST smart proxy

2014-03-12 Thread Martin Kosek
On 03/12/2014 12:02 PM, Petr Viktorin wrote: > On 03/10/2014 08:55 PM, Rob Crittenden wrote: >> Rob Crittenden wrote: >>> Petr Viktorin wrote: On 02/27/2014 10:18 PM, Rob Crittenden wrote: > Rob Crittenden wrote: > Updated patch based on feedback from Foreman team. I added a new URI, >

Re: [Freeipa-devel] [PATCH] 0149: ipa-sam: ipa-sam: cache gid to sid and uid to sid requests in idmap cache

2014-03-12 Thread Petr Viktorin
On 03/12/2014 11:02 AM, Sumit Bose wrote: On Tue, Mar 11, 2014 at 11:04:29PM +0200, Alexander Bokovoy wrote: On Tue, 11 Mar 2014, Sumit Bose wrote: On Tue, Mar 11, 2014 at 07:09:42PM +0200, Alexander Bokovoy wrote: Hi, Add idmap_cache calls to ipa-sam to prevent huge numbers of LDAP calls to

Re: [Freeipa-devel] [PATCH] 0471 permission_add: Remove permission entry if adding the ACI fails

2014-03-12 Thread Petr Viktorin
On 03/12/2014 10:20 AM, Jan Pazdziora wrote: On Tue, Mar 11, 2014 at 04:09:37PM +0100, Petr Viktorin wrote: Unfortunately, yes, these operations are racy. When something fails, or when doing two operations simultaneously, it is possible that the objects are not both added. If that happens, it i

Re: [Freeipa-devel] DNSSEC: upgrade path to Vault

2014-03-12 Thread Ludwig Krispenz
On 03/11/2014 11:33 AM, Petr Spacek wrote: On 10.3.2014 12:08, Martin Kosek wrote: On 03/10/2014 11:49 AM, Petr Spacek wrote: On 7.3.2014 17:33, Dmitri Pal wrote: I do not think it is the right architectural approach to try to fix a specific use case with one off solution while we already kno

Re: [Freeipa-devel] [PATCH] 0147: ipaserver/rpcserver: catch ACIError and return proper message for out-of-realm users

2014-03-12 Thread Jan Pazdziora
On Thu, Mar 06, 2014 at 12:03:23PM +0200, Alexander Bokovoy wrote: > Hi, > > we had similar issue in past, in jsonserver_session() class, fixed by > 0292ebd1 which Tomas did for ticket > https://fedorahosted.org/freeipa/ticket/3252 > > This one is for non-sessioned call: > https://fedorahosted.o

Re: [Freeipa-devel] DNSSEC: upgrade path to Vault

2014-03-12 Thread Petr Spacek
On 11.3.2014 21:19, Martin Kosek wrote: On 03/11/2014 07:40 PM, Simo Sorce wrote: On Tue, 2014-03-11 at 11:33 +0100, Petr Spacek wrote: Yesterday we have agreed that DNSSEC support is not going to depend on Vault ... - walk through cn=masters,cn=ipa,cn=etc,dc=ipa,dc=example and check if there

Re: [Freeipa-devel] [PATCH] 0149: ipa-sam: ipa-sam: cache gid to sid and uid to sid requests in idmap cache

2014-03-12 Thread Sumit Bose
On Tue, Mar 11, 2014 at 11:04:29PM +0200, Alexander Bokovoy wrote: > On Tue, 11 Mar 2014, Sumit Bose wrote: > >On Tue, Mar 11, 2014 at 07:09:42PM +0200, Alexander Bokovoy wrote: > >>Hi, > >> > >> > >>Add idmap_cache calls to ipa-sam to prevent huge numbers of LDAP calls > >>to the > >>directory ser

Re: [Freeipa-devel] [PATCH] 0471 permission_add: Remove permission entry if adding the ACI fails

2014-03-12 Thread Jan Pazdziora
On Tue, Mar 11, 2014 at 04:09:37PM +0100, Petr Viktorin wrote: > > Unfortunately, yes, these operations are racy. When something fails, > or when doing two operations simultaneously, it is possible that the > objects are not both added. > If that happens, it is the ACI that should be missing. The