Re: [Freeipa-devel] [PATCH] Password vault

2015-06-16 Thread Jan Cholasta
Dne 16.6.2015 v 01:02 Endi Sukma Dewata napsal(a): On 6/15/2015 2:22 AM, Jan Cholasta wrote: I think it would be better to use a new attribute type which inherits from ipaPublicKey (ipaVaultPublicKey?) rather than ipaPublicKey directly for assymetric vault public keys, so that assymetric public

Re: [Freeipa-devel] FreeIPA 4.2 Alpha preparations

2015-06-16 Thread Martin Kosek
On 06/16/2015 05:29 PM, Fraser Tweedale wrote: On Tue, Jun 16, 2015 at 05:10:00PM +0200, Martin Kosek wrote: On 06/12/2015 11:34 AM, Martin Kosek wrote: Hello all, As discussed in the last 2 weeks, we are getting close to the 4.2 finish line and releasing FreeIPA 4.2 Alpha 1. We already have m

Re: [Freeipa-devel] update on freeipa 4.2 pki issues

2015-06-16 Thread Martin Kosek
On 06/16/2015 06:39 PM, Fraser Tweedale wrote: I fixed several issues which broke Dogtag upgrades involving particular versions; these will be in the next release. I haven't yet gotten to to the reported failure running ipa-replica-upgrade on a replica (but I haven't forgotten about it either.)

Re: [Freeipa-devel] IPA Python API

2015-06-16 Thread Jan Cholasta
Dne 16.6.2015 v 20:29 Drew Erny napsal(a): Hi, All, I'm using the IPA Python API to write the Community Portal. Most of the documentation for using the IPA Python API is targeted a plugin authors, and this isn't a plugin for (what I think are) good reasons. I'm doing # in the main program

Re: [Freeipa-devel] IPA Python API

2015-06-16 Thread Drew Erny
On 06/16/2015 04:17 PM, Rob Crittenden wrote: Drew Erny wrote: On 06/16/2015 02:29 PM, Drew Erny wrote: Hi, All, I'm using the IPA Python API to write the Community Portal. Most of the documentation for using the IPA Python API is targeted a plugin authors, and this isn't a plugin for (what

Re: [Freeipa-devel] IPA Python API

2015-06-16 Thread Rob Crittenden
Drew Erny wrote: On 06/16/2015 02:29 PM, Drew Erny wrote: Hi, All, I'm using the IPA Python API to write the Community Portal. Most of the documentation for using the IPA Python API is targeted a plugin authors, and this isn't a plugin for (what I think are) good reasons. I'm doing # in th

Re: [Freeipa-devel] IPA Python API

2015-06-16 Thread Drew Erny
On 06/16/2015 02:29 PM, Drew Erny wrote: Hi, All, I'm using the IPA Python API to write the Community Portal. Most of the documentation for using the IPA Python API is targeted a plugin authors, and this isn't a plugin for (what I think are) good reasons. I'm doing # in the main program

[Freeipa-devel] IPA Python API

2015-06-16 Thread Drew Erny
Hi, All, I'm using the IPA Python API to write the Community Portal. Most of the documentation for using the IPA Python API is targeted a plugin authors, and this isn't a plugin for (what I think are) good reasons. I'm doing # in the main program import api from ipalib api.bootstr

Re: [Freeipa-devel] user deletion in offline mode does not get replicated after node recovery

2015-06-16 Thread thierry bordaz
Hello On Master: User 'onmaster' was deleted [16/Jun/2015:10:16:45 -0400] conn=402 op=19 SRCH base="cn=otp,dc=bagam,dc=net" scope=1 filter="(&(objectClass=ipatoken)(ipatokenOwner=uid=onmaster,cn=users,cn=accounts,dc=bagam,dc=net))" attrs="ipatokenNotAfter description ipatokenOwner object

[Freeipa-devel] update on freeipa 4.2 pki issues

2015-06-16 Thread Fraser Tweedale
I fixed several issues which broke Dogtag upgrades involving particular versions; these will be in the next release. I haven't yet gotten to to the reported failure running ipa-replica-upgrade on a replica (but I haven't forgotten about it either.) This is the only issue affecting *fresh installs

[Freeipa-devel] [PATCH 0041] add DS index for userCertificate attribute

2015-06-16 Thread Martin Babinsky
Related to http://www.freeipa.org/page/V4/User_Certificates and https://fedorahosted.org/freeipa/ticket/4238 -- Martin^3 Babinsky From 2c5a37557d0d5e19bfe3119f71e3010e4b4454dc Mon Sep 17 00:00:00 2001 From: Martin Babinsky Date: Tue, 16 Jun 2015 13:20:15 +0200 Subject: [PATCH] add DS index for

Re: [Freeipa-devel] user deletion in offline mode does not get replicated after node recovery

2015-06-16 Thread Ludwig Krispenz
Hi Oleg, the problem seems to be on replica2, when it logs this error: [16/Jun/2015:10:18:34 -0400] NSMMReplicationPlugin - changelog program - _cl5WriteOperationTxn: retry (49) the transaction (csn=55802fcf00030004) failed (rc=-30993 (BDB0068 DB_LOCK_DEADLOCK: Locker killed to resolve a

Re: [Freeipa-devel] FreeIPA 4.2 Alpha preparations

2015-06-16 Thread Fraser Tweedale
On Tue, Jun 16, 2015 at 05:10:00PM +0200, Martin Kosek wrote: > On 06/12/2015 11:34 AM, Martin Kosek wrote: > > Hello all, > > > > As discussed in the last 2 weeks, we are getting close to the 4.2 finish > > line > > and releasing FreeIPA 4.2 Alpha 1. We already have most of the major RFEs > > co

Re: [Freeipa-devel] [PATCH 0014] correct handling of one directional segments

2015-06-16 Thread thierry bordaz
On 06/16/2015 11:41 AM, Ludwig Krispenz wrote: this patch adresses issues in checking existing segments for one directional segments and correctly handles the merging of segments, so that all agreements will be removed when the merged segment is deleted This is looking good to me with few c

Re: [Freeipa-devel] FreeIPA 4.2 Alpha preparations

2015-06-16 Thread Martin Kosek
On 06/12/2015 11:34 AM, Martin Kosek wrote: > Hello all, > > As discussed in the last 2 weeks, we are getting close to the 4.2 finish line > and releasing FreeIPA 4.2 Alpha 1. We already have most of the major RFEs > complete, some still miss some partial functionality, but most are testable > an

Re: [Freeipa-devel] [PATCH 0050] Fix client ca.crt to match the server's cert

2015-06-16 Thread Gabe Alford
I know you guys are busy. Bump for review. Thanks, Gabe On Tue, May 26, 2015 at 8:16 AM, Gabe Alford wrote: > Hello, > > Fix for https://fedorahosted.org/freeipa/ticket/3809 > > Thanks, > > Gabe > -- Manage your subscription for the Freeipa-devel mailing list: https://www.redhat.com/mailman/l

Re: [Freeipa-devel] [PATCH 0264] Server Upgrade: disconnect ldap2 connection before DS restart

2015-06-16 Thread Simo Sorce
On Wed, 2015-06-10 at 13:47 +0200, Martin Basti wrote: > Without this patch, upgrade may failed when api.Backend.ldap2 was > connected before DS restart. > > Patch attached. > although this patch is fine as is, I wonder why it is needed. I would argue that ldap2 should be able to reconnect on

Re: [Freeipa-devel] [PATCHES 0252-0253] DNSSEC: allow to move DNSSEC key master to another IPA server

2015-06-16 Thread Martin Basti
On 05/06/15 12:54, Petr Spacek wrote: On 20.5.2015 18:00, Martin Basti wrote: This patch allows to disable DNSSEC key master on IPA server, or replace current DNSSEC key master with another IPA server. Only for master branch. https://fedorahosted.org/freeipa/ticket/4657 Patches attached. NAC

Re: [Freeipa-devel] [PATCHES 306-316] Automated migration tool from Winsync

2015-06-16 Thread Jan Cholasta
Dne 16.6.2015 v 10:14 Martin Babinsky napsal(a): On 05/06/2015 10:12 AM, Tomas Babej wrote: On 05/05/2015 02:02 PM, Tomas Babej wrote: On 04/29/2015 12:28 PM, Tomas Babej wrote: On 03/11/2015 04:20 PM, Jan Cholasta wrote: Hi, Dne 10.3.2015 v 16:35 Tomas Babej napsal(a): On 03/09/2015

[Freeipa-devel] [PATCH 0015] fix coverity issues

2015-06-16 Thread Ludwig Krispenz
This patch addresses coverity issues 13290 and 13291 >From 830f1f5af9695e35cb0843f8919c8fc555d13308 Mon Sep 17 00:00:00 2001 From: Ludwig Krispenz Date: Tue, 16 Jun 2015 11:14:37 +0200 Subject: [PATCH] fix coverity issues --- daemons/ipa-slapi-plugins/topology/topology_util.c | 14 +

[Freeipa-devel] [PATCH 0014] correct handling of one directional segments

2015-06-16 Thread Ludwig Krispenz
this patch adresses issues in checking existing segments for one directional segments and correctly handles the merging of segments, so that all agreements will be removed when the merged segment is deleted >From ad9850b00f369be67c0240b084afaf2ce1c97a9f Mon Sep 17 00:00:00 2001 From: Ludwig Krisp

Re: [Freeipa-devel] [PATCH 0040] generalize certificate creation during testing

2015-06-16 Thread Milan Kubik
On 06/09/2015 01:14 PM, Martin Babinsky wrote: A slight hack to ipatests/test_xmlrpc/testcert.py module in order to enable generation of multiple host/service/user certificates. It should make writing tests for new CA profile/sub-CA/user certificate functionality easier. Hi, looks good to

Re: [Freeipa-devel] [PATCHES 306-316] Automated migration tool from Winsync

2015-06-16 Thread Martin Babinsky
On 05/06/2015 10:12 AM, Tomas Babej wrote: On 05/05/2015 02:02 PM, Tomas Babej wrote: On 04/29/2015 12:28 PM, Tomas Babej wrote: On 03/11/2015 04:20 PM, Jan Cholasta wrote: Hi, Dne 10.3.2015 v 16:35 Tomas Babej napsal(a): On 03/09/2015 12:26 PM, Tomas Babej wrote: Hi, this couple of