Re: [Freeipa-devel] Ipa-server-install Firewall Support

2014-04-04 Thread Martin Kosek
On 04/03/2014 06:33 PM, Justin Brown wrote: This discussion morphs out of some questions that I asked over on the user's mailing list: https://www.redhat.com/archives/freeipa-users/2014-April/msg00033.html. It's also related to Trac #2110. (The subject says ipa-server-install, but this will

Re: [Freeipa-devel] [PATCHES] OTP Patches

2014-04-04 Thread Martin Kosek
On 03/24/2014 02:33 PM, Nathaniel McCallum wrote: On Wed, 2014-03-19 at 17:37 +0200, Alexander Bokovoy wrote: On Fri, 21 Feb 2014, Nathaniel McCallum wrote: On Fri, 2014-02-21 at 00:08 +0200, Alexander Bokovoy wrote: On Thu, 20 Feb 2014, Nathaniel McCallum wrote: There is an error in libotp's

Re: [Freeipa-devel] OTP work, what's left?

2014-04-04 Thread Martin Kosek
On 04/03/2014 05:07 PM, Nathaniel McCallum wrote: On Tue, 2014-04-01 at 17:12 +0200, Martin Kosek wrote: On 03/28/2014 10:17 AM, Martin Kosek wrote: On 03/23/2014 10:26 PM, Alexander Bokovoy wrote: Hi! I've updated my COPR repo with current git master versions of FreeIPA and SSSD with few

Re: [Freeipa-devel] Changing RCUE to PatternFly

2014-04-04 Thread Alexander Bokovoy
On Thu, 03 Apr 2014, Petr Vobornik wrote: Hi all, this is a notice about what I'm going to do so you can raise objections before I spend any time on it. == Intro == First some facts: 1. RCUE was based on Bootstrap 2 (BS2), it used BS2 css file and provided it's own less files with overrides

Re: [Freeipa-devel] Ipa-server-install Firewall Support

2014-04-04 Thread Petr Spacek
On 4.4.2014 09:17, Martin Kosek wrote: On 04/04/2014 09:04 AM, Justin Brown wrote: I would actually do it the opposite way and open the ports after the FreeIPA server is fully configured. After all, I do not think we want to open the ports when the server is just half-configured and for

[Freeipa-devel] questions regarding ldap schema for pkcs11

2014-04-04 Thread Ludwig Krispenz
In the review discussion for the ldap schema for pkcs11 there was one topic, which we wanted to get the opinion from a broader audience before making a final decision. In pkcs11 there are many boolean attributes, like CKA_EXTRACTABLE, CKA_DERIVE, CKA_VERIFY and there are two suggestions how

Re: [Freeipa-devel] [PATCH] 0507 Allow anonymous read access to containers

2014-04-04 Thread Petr Viktorin
On 04/03/2014 03:28 PM, Simo Sorce wrote: On Thu, 2014-04-03 at 15:19 +0200, Petr Viktorin wrote: On 04/03/2014 02:53 PM, Simo Sorce wrote: On Thu, 2014-04-03 at 13:34 +0200, Petr Viktorin wrote: Hello, This adds anonymous read access to containers, as discussed in this thread:

[Freeipa-devel] [PATCH][RFC] 9 CA-less tests generate failure

2014-04-04 Thread Misnyovszki Adam
Hi, CA-less test suite always generate failures when installing revoked certificates. This is a known issue, described in https://fedorahosted.org/freeipa/ticket/4270 , this fix skips these tests, outputting a notification message for the ticket. Now it outputs this: [amisnyov@host freeipa]$

Re: [Freeipa-devel] [PATCH 0017] Add wait_for_dns option to default.conf

2014-04-04 Thread Petr Viktorin
On 04/02/2014 02:38 PM, Petr Spacek wrote: On 2.4.2014 14:36, Petr Spacek wrote: Hello, Add wait_for_dns option to default.conf. This option makes record changes in DNS tree synchronous. IPA calls will wait until new data are visible over DNS protocol or until timeout. It is intended only

Re: [Freeipa-devel] [PATCHES 163-166] Various ipatests fixes

2014-04-04 Thread Petr Viktorin
On 04/03/2014 12:55 PM, Petr Viktorin wrote: On 04/03/2014 12:42 PM, Tomas Babej wrote: Hi. these fix the following: * not properly removed PKI instance on IPA uninstall * improper usage of external hostname of AD subdomain in the legacy client tests * relax regex checks in legacy client

Re: [Freeipa-devel] [PATCH] [DOC] Add note about additional nameservers in resolv.conf

2014-04-04 Thread Petr Viktorin
On 03/29/2014 12:22 AM, Gabe Alford wrote: Changed 127.0.0.1 to 192.0.2.1 On Fri, Mar 28, 2014 at 1:38 AM, Petr Spacek pspa...@redhat.com mailto:pspa...@redhat.com wrote: On 28.3.2014 02:09, Gabe Alford wrote: I believe that Martin is right about the server installer no

Re: [Freeipa-devel] [PATCH 0029-0046] Internationalized domain names in DNS plugin

2014-04-04 Thread Petr Spacek
On 3.4.2014 15:35, Jan Cholasta wrote: On 2.4.2014 14:07, Martin Basti wrote: Patch 30: 2) +if isinstance(labels, str): +if not labels: +raise ValueError('empty string') ... +elif isinstance(labels, unicode): +if not labels: +

Re: [Freeipa-devel] questions regarding ldap schema for pkcs11

2014-04-04 Thread Petr Spacek
On 4.4.2014 10:20, Ludwig Krispenz wrote: In the review discussion for the ldap schema for pkcs11 there was one topic, which we wanted to get the opinion from a broader audience before making a final decision. I'll add my opinion for the record: In pkcs11 there are many boolean attributes,

Re: [Freeipa-devel] [PATCH 0017] Add wait_for_dns option to default.conf

2014-04-04 Thread Martin Kosek
On 04/04/2014 11:57 AM, Petr Viktorin wrote: On 04/02/2014 02:38 PM, Petr Spacek wrote: On 2.4.2014 14:36, Petr Spacek wrote: Hello, Add wait_for_dns option to default.conf. This option makes record changes in DNS tree synchronous. IPA calls will wait until new data are visible over DNS

Re: [Freeipa-devel] [PATCH 0017] Add wait_for_dns option to default.conf

2014-04-04 Thread Petr Viktorin
On 04/04/2014 01:50 PM, Martin Kosek wrote: On 04/04/2014 11:57 AM, Petr Viktorin wrote: On 04/02/2014 02:38 PM, Petr Spacek wrote: On 2.4.2014 14:36, Petr Spacek wrote: Hello, Add wait_for_dns option to default.conf. This option makes record changes in DNS tree synchronous. IPA calls will

Re: [Freeipa-devel] [PATCH] 0507 Allow anonymous read access to containers

2014-04-04 Thread Simo Sorce
On Fri, 2014-04-04 at 10:54 +0200, Petr Viktorin wrote: On 04/03/2014 03:28 PM, Simo Sorce wrote: On Thu, 2014-04-03 at 15:19 +0200, Petr Viktorin wrote: On 04/03/2014 02:53 PM, Simo Sorce wrote: On Thu, 2014-04-03 at 13:34 +0200, Petr Viktorin wrote: Hello, This adds anonymous read

Re: [Freeipa-devel] [PATCH 0029-0046] Internationalized domain names in DNS plugin

2014-04-04 Thread Martin Basti
On Thu, 2014-04-03 at 15:35 +0200, Jan Cholasta wrote: On 2.4.2014 14:07, Martin Basti wrote: Helo list, this patchset allows to use internationalized domian in DNS plugin. - dns names are stored in ACE form(punycoded) in LDAP - raw option shows dns data in ACE form, otherwise dns names

Re: [Freeipa-devel] Ipa-server-install Firewall Support

2014-04-04 Thread Simo Sorce
On Fri, 2014-04-04 at 09:59 +0200, Petr Spacek wrote: On 4.4.2014 09:17, Martin Kosek wrote: On 04/04/2014 09:04 AM, Justin Brown wrote: I would actually do it the opposite way and open the ports after the FreeIPA server is fully configured. After all, I do not think we want to open the

Re: [Freeipa-devel] questions regarding ldap schema for pkcs11

2014-04-04 Thread Simo Sorce
On Fri, 2014-04-04 at 13:19 +0200, Petr Spacek wrote: On 4.4.2014 10:20, Ludwig Krispenz wrote: In the review discussion for the ldap schema for pkcs11 there was one topic, which we wanted to get the opinion from a broader audience before making a final decision. I'll add my opinion for

Re: [Freeipa-devel] [PATCH 0029-0046] Internationalized domain names in DNS plugin

2014-04-04 Thread Martin Basti
On Fri, 2014-04-04 at 12:59 +0200, Petr Spacek wrote: On 3.4.2014 15:35, Jan Cholasta wrote: On 2.4.2014 14:07, Martin Basti wrote: Patch 30: 2) +if isinstance(labels, str): +if not labels: +raise ValueError('empty string') ... +elif

Re: [Freeipa-devel] [PATCH 0029-0046] Internationalized domain names in DNS plugin

2014-04-04 Thread Martin Basti
On Fri, 2014-04-04 at 15:46 +0200, Martin Basti wrote: On Fri, 2014-04-04 at 12:59 +0200, Petr Spacek wrote: On 3.4.2014 15:35, Jan Cholasta wrote: On 2.4.2014 14:07, Martin Basti wrote: Patch 30: 2) +if isinstance(labels, str): +if not labels: +

[Freeipa-devel] [PATCH] Add DRM to IPA

2014-04-04 Thread Ade Lee
This patch adds the capability of installing a Dogtag DRM to an IPA instance. With this patch, when ipa-server-install is run, a Dogtag CA and a Dogtag DRM are created. The DRM shares the same tomcat instance and DS instance as the Dogtag CA. Moreover, the same admin