Re: [Freeipa-devel] [DRAFT] Release notes FreeIPA 4.5.0

On 03/14/2017 01:51 PM, Martin Basti wrote: Hello, DRAFT for FreeIPA 4.5.0 release notes is ready http://www.freeipa.org/page/Releases/4.5.0 Please update/let me know what is missing, what is extra. Martin^2 Hi Martin, thank you for the release notes. Could you update the section about

[Freeipa-devel] Certificate Identity Mapping - new API to retrieve matching users

Hi, related to the Certificate Identity Mapping feature, a new CLI will be needed to find all the users matching a given certificate. I propose to provide this as: ipa certmaptest --certificate --- 2 users matched --- Matched user login: test1 Matched user login:

Re: [Freeipa-devel] Stageuser API

On 01/16/2017 03:52 PM, David Kupka wrote: Hello everyone! I've noticed that our API for stageuser is missing some commands that user has (stageuser-{add,remove}-{principal,cert}). I was wondering if there is reason for it but after asking some fellows developers it seems that there's none. I

Re: [Freeipa-devel] Certificate Identity Mapping

On 12/16/2016 09:34 AM, Florence Blanc-Renaud wrote: On 12/06/2016 04:39 PM, Florence Blanc-Renaud wrote: Hi, I have started a feature description for the Certificate Identity Mapping at the following location: http://www.freeipa.org/page/V4/Certificate_Identity_Mapping This is a first step

Re: [Freeipa-devel] Certificate Identity Mapping

. On 16.12.2016 11:53, Sumit Bose wrote: On Tue, Dec 06, 2016 at 04:39:10PM +0100, Florence Blanc-Renaud wrote: Hi, I have started a feature description for the Certificate Identity Mapping at the following location: http://www.freeipa.org/page/V4/Certificate_Identity_Mapping This is a first step, focusing

Re: [Freeipa-devel] Certificate Identity Mapping

On 12/06/2016 04:39 PM, Florence Blanc-Renaud wrote: Hi, I have started a feature description for the Certificate Identity Mapping at the following location: http://www.freeipa.org/page/V4/Certificate_Identity_Mapping This is a first step, focusing on the interface we would like to provide

[Freeipa-devel] Certificate Identity Mapping

Hi, I have started a feature description for the Certificate Identity Mapping at the following location: http://www.freeipa.org/page/V4/Certificate_Identity_Mapping This is a first step, focusing on the interface we would like to provide. It still contains open questions, some of which are

Re: [Freeipa-devel] [PATCH] 0014

On 09/02/2016 08:08 AM, Jan Cholasta wrote: On 1.9.2016 19:37, Tomas Krizek wrote: On 09/01/2016 03:58 PM, Florence Blanc-Renaud wrote: Hi, please find attached a patch for ipa-certupdate in CA-less deployment. https://fedorahosted.org/freeipa/ticket/6288 Flo. The patch is malformed

[Freeipa-devel] [PATCH] 0014

Hi, please find attached a patch for ipa-certupdate in CA-less deployment. https://fedorahosted.org/freeipa/ticket/6288 Flo. >From c09f7b9282f82aba28d241be86e773e3b748cd09 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud <f...@redhat.com> Date: Thu, 1 Sep 2016 15:53:38 +020

Re: [Freeipa-devel] [PATCH 0059] Fix to ipa-cacert-manage man and help differences

On 08/02/2016 09:11 AM, Stanislav Laznicka wrote: On 07/19/2016 10:25 AM, Florence Blanc-Renaud wrote: On 07/15/2016 02:09 PM, Stanislav Laznicka wrote: https://fedorahosted.org/freeipa/ticket/6013 Hi Stanislav, thanks for your patch. As CERTFILE is added in the arguments for install, I

Re: [Freeipa-devel] [PATCH] 0013 Fix ipa hbactest output

On 08/03/2016 05:49 PM, Martin Basti wrote: On 02.08.2016 13:22, Florence Blanc-Renaud wrote: Hi, please find attached a patch related to 'ipa hbactest' producing a Traceback. https://fedorahosted.org/freeipa/ticket/6157 Flo. Hello Flo, 1) can you please move that check, right bellow

[Freeipa-devel] [PATCH] 0013 Fix ipa hbactest output

Hi, please find attached a patch related to 'ipa hbactest' producing a Traceback. https://fedorahosted.org/freeipa/ticket/6157 Flo. >From 38a855bfc1279ae38ac3f8083903af29e9e00a8b Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud <f...@redhat.com> Date: Tue, 2 Aug 2016 10:40

Re: [Freeipa-devel] [PATCH 0560] ipa-client-automount: don not initialize API during uninstall

On 07/29/2016 04:56 PM, Martin Basti wrote: https://fedorahosted.org/freeipa/ticket/6072 Patch attached. Hi Martin, thanks for your patch. I could not reproduce the issue anymore with ipa-client-automount --uninstall, thus looks good to me. Ack, Flo. -- Manage your subscription for the

Re: [Freeipa-devel] [PATCH 0197] re-set canonical principal name on migrated users

On 07/28/2016 10:56 AM, Martin Babinsky wrote: Fixes https://fedorahosted.org/freeipa/ticket/6101 I have also noticed that the principal aliases are not preserved during migration from FreeIPA 4.4. That, however, requires more powerful runes to transform the realm of all values and warrants a

Re: [Freeipa-devel] [PATCH 0018] Minor fix in ipa-replica-manage MAN page

On 07/27/2016 05:47 AM, Abhijeet Kasurde wrote: Ping. On 07/13/2016 09:24 AM, Abhijeet Kasurde wrote: Hi All, Please review patch. Fixes: https://fedorahosted.org/freeipa/ticket/6058 -- Thanks, Abhijeet Kasurde IRC: akasurde http://akasurde.github.io -- Thanks, Abhijeet Kasurde IRC:

Re: [Freeipa-devel] [PATCHES 678-679] client: fix hiding of commands which lack server support

On 07/25/2016 02:47 PM, Jan Cholasta wrote: Hi, the attached patches fix . Honza Hi, Tested with freeipa server 4.1.4-4.fc22 and patched client, correctly hides the commands. Tested with server 4.4 + patched client, correctly shows the

[Freeipa-devel] [PATCH] 0012 Fix session cookies

Hi, please find attached a patch related to session cookies used by IPA API. https://fedorahosted.org/freeipa/ticket/5984 >From 7cc3b19c21a66483bff14e7a9c84b29c969673de Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud <f...@redhat.com> Date: Thu, 21 Jul 2016 16:54:43 +0200 Subjec

Re: [Freeipa-devel] [PATCH] 0010 Show full error message for selinuxusermap-add-hostgroup

On 07/20/2016 10:50 AM, Jan Cholasta wrote: On 20.7.2016 10:26, Florence Blanc-Renaud wrote: On 07/18/2016 02:52 PM, Florence Blanc-Renaud wrote: On 07/18/2016 08:20 AM, Jan Cholasta wrote: Hi, On 7.7.2016 16:40, Florence Blanc-Renaud wrote: On 07/07/2016 01:23 PM, Petr Vobornik wrote

Re: [Freeipa-devel] [PATCH] 0010 Show full error message for selinuxusermap-add-hostgroup

On 07/18/2016 02:52 PM, Florence Blanc-Renaud wrote: On 07/18/2016 08:20 AM, Jan Cholasta wrote: Hi, On 7.7.2016 16:40, Florence Blanc-Renaud wrote: On 07/07/2016 01:23 PM, Petr Vobornik wrote: On 07/05/2016 02:38 PM, Florence Blanc-Renaud wrote: Hi, the output of ipa selinuxusermap-add

Re: [Freeipa-devel] [PATCH 0059] Fix to ipa-cacert-manage man and help differences

On 07/15/2016 02:09 PM, Stanislav Laznicka wrote: https://fedorahosted.org/freeipa/ticket/6013 Hi Stanislav, thanks for your patch. As CERTFILE is added in the arguments for install, I would suggest to mention it in the command description. For instance: install - Install a CA

Re: [Freeipa-devel] [PATCH] 0010 Show full error message for selinuxusermap-add-hostgroup

On 07/18/2016 08:20 AM, Jan Cholasta wrote: Hi, On 7.7.2016 16:40, Florence Blanc-Renaud wrote: On 07/07/2016 01:23 PM, Petr Vobornik wrote: On 07/05/2016 02:38 PM, Florence Blanc-Renaud wrote: Hi, the output of ipa selinuxusermap-add-hostgroup and selinuxusermap-add-user does not display

[Freeipa-devel] [PATCH] 0011 server uninstall fails to remove krb principals

Hi, please find a patch for the 3rd issue of ticket 6012. https://fedorahosted.org/freeipa/ticket/6012 >From 53f4ca564fe130db3f50c03dbc3f449332016a77 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud <fren...@redhat.com> Date: Mon, 11 Jul 2016 09:00:44 +0200 Subject: [PATCH] server

Re: [Freeipa-devel] [PATCH] 0010 Show full error message for selinuxusermap-add-hostgroup

On 07/07/2016 01:23 PM, Petr Vobornik wrote: On 07/05/2016 02:38 PM, Florence Blanc-Renaud wrote: Hi, the output of ipa selinuxusermap-add-hostgroup and selinuxusermap-add-user does not display any more the host/host group or user/group that could not be added. This patch fixes this regression

Re: [Freeipa-devel] [PATCH] 0010 Show full error message for selinuxusermap-add-hostgroup

On 07/07/2016 01:23 PM, Petr Vobornik wrote: On 07/05/2016 02:38 PM, Florence Blanc-Renaud wrote: Hi, the output of ipa selinuxusermap-add-hostgroup and selinuxusermap-add-user does not display any more the host/host group or user/group that could not be added. This patch fixes this regression

Re: [Freeipa-devel] [PATCH 0017] Added fix for correct IPA backup file name

On 07/07/2016 10:58 AM, Abhijeet Kasurde wrote: Hi All, Please review the patch. Fixes : https://fedorahosted.org/freeipa/ticket/6031 -- Thanks, Abhijeet Kasurde IRC: akasurde http://akasurde.github.io Hi Abhijeet, thanks for your patch. I have a comment though: if the filename is

Re: [Freeipa-devel] [PATCH] Fix minor typos

On 07/05/2016 10:34 PM, Lukas Slebodnik wrote: On (05/07/16 18:21), Florence Blanc-Renaud wrote: On 07/04/2016 08:30 PM, Yuri Chornoivan wrote: Hi, A fresh portion of typo fixes. Thanks in advance for reviewing. Best regards, Yuri Hi Yuri, thanks for your patch! The patch introduces

Re: [Freeipa-devel] [PATCH] Fix minor typos

On 07/04/2016 08:30 PM, Yuri Chornoivan wrote: Hi, A fresh portion of typo fixes. Thanks in advance for reviewing. Best regards, Yuri Hi Yuri, thanks for your patch! The patch introduces new pep8/pep257 complaints that you can detect using "git diff HEAD~$NUMBER_OF_PATCHES -U0 | pep8

[Freeipa-devel] [PATCH] 0010 Show full error message for selinuxusermap-add-hostgroup

of the class ClientMethod. https://fedorahosted.org/freeipa/ticket/6026 >From 1f723b069c7469be98b12b80c677f34c36b4c0ac Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud <fren...@redhat.com> Date: Tue, 5 Jul 2016 10:10:57 +0200 Subject: [PATCH] Show full error message for selinuxus

Re: [Freeipa-devel] [PATCH] pylint fixes

On 06/21/2016 01:51 PM, Martin Basti wrote: On 21.06.2016 08:38, Florence Blanc-Renaud wrote: On 06/20/2016 07:08 PM, Martin Basti wrote: On 20.06.2016 19:06, Martin Basti wrote: On 20.06.2016 12:00, Florence Blanc-Renaud wrote: On 06/09/2016 05:10 PM, Petr Spacek wrote: Hello, I've

Re: [Freeipa-devel] [PATCH] 0082 cert-request: better error msg when 'add' not supported

On 06/30/2016 01:30 PM, Fraser Tweedale wrote: On Thu, Jun 30, 2016 at 07:49:04PM +1000, Fraser Tweedale wrote: On Thu, Jun 30, 2016 at 11:38:35AM +0200, Florence Blanc-Renaud wrote: On 06/30/2016 06:29 AM, Fraser Tweedale wrote: On Wed, Jun 29, 2016 at 11:30:14AM +0200, Florence Blanc-Renaud

Re: [Freeipa-devel] [PATCH] 0082 cert-request: better error msg when 'add' not supported

On 06/30/2016 06:29 AM, Fraser Tweedale wrote: On Wed, Jun 29, 2016 at 11:30:14AM +0200, Florence Blanc-Renaud wrote: On 06/29/2016 07:25 AM, Fraser Tweedale wrote: The attached patch fixes https://fedorahosted.org/freeipa/ticket/5991. Thanks, Fraser Hi Fraser, A few cosmetic comments

[Freeipa-devel] [PATCH] 0009 Do not log error when removing a non-existing file

Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud <fren...@redhat.com> Date: Thu, 30 Jun 2016 09:15:45 +0200 Subject: [PATCH] Do not log error when removing a non-existing file When the uninstaller tries to remove /etc/systemd/system/httpd.d/ipa.conf and the file does not exist, only log

Re: [Freeipa-devel] [PATCH] 0008 Do not allow installation in FIPS mode

On 06/29/2016 01:04 PM, Martin Basti wrote: On 28.06.2016 16:57, Florence Blanc-Renaud wrote: On 06/28/2016 11:05 AM, Martin Basti wrote: On 28.06.2016 10:51, Florence Blanc-Renaud wrote: On 06/27/2016 10:18 PM, Rob Crittenden wrote: Florence Blanc-Renaud wrote: Hi all, thanks for your

Re: [Freeipa-devel] [PATCH] 0082 cert-request: better error msg when 'add' not supported

On 06/29/2016 07:25 AM, Fraser Tweedale wrote: The attached patch fixes https://fedorahosted.org/freeipa/ticket/5991. Thanks, Fraser Hi Fraser, A few cosmetic comments: PEP8 issues: ./ipalib/errors.py:1399:1: E302 expected 2 blank lines, found 1 ./ipaserver/plugins/cert.py:394:80: E501

Re: [Freeipa-devel] [PATCH] 0008 Do not allow installation in FIPS mode

On 06/28/2016 11:05 AM, Martin Basti wrote: On 28.06.2016 10:51, Florence Blanc-Renaud wrote: On 06/27/2016 10:18 PM, Rob Crittenden wrote: Florence Blanc-Renaud wrote: Hi all, thanks for your suggestions. Updated patch attached. Flo. The invocation in ipactl should say server

Re: [Freeipa-devel] [PATCH] 0008 Do not allow installation in FIPS mode

On 06/27/2016 10:18 PM, Rob Crittenden wrote: Florence Blanc-Renaud wrote: Hi all, thanks for your suggestions. Updated patch attached. Flo. The invocation in ipactl should say server, not client. Otherwise LGTM (untested). rob Hi all, thanks to Rob for catching the typo. Patch

Re: [Freeipa-devel] [PATCH] 0008 Do not allow installation in FIPS mode

On 06/27/2016 03:55 PM, Rob Crittenden wrote: Petr Spacek wrote: On 27.6.2016 08:38, Florence Blanc-Renaud wrote: Hi, this fix is a port of Bug 1131570 - Do not allow IdM server/replica/client installation in a FIPS-140 mode It prevents installation of FreeIPA if the host is fips-enabled

[Freeipa-devel] [PATCH] 0008 Do not allow installation in FIPS mode

001 From: Florence Blanc-Renaud <fren...@redhat.com> Date: Fri, 24 Jun 2016 16:16:22 +0200 Subject: [PATCH] Do not allow installation in FIPS mode https://fedorahosted.org/freeipa/ticket/5761 --- client/ipa-client-install | 4 install/tools/ipactl

[Freeipa-devel] [PATCH] 0007 Fix ipa-server-certinstall with certs signed by 3rd-party CA

not get into /etc/pki/pki-tomcat/alias) and a bz has been opened against selinux-policy to solve this issue. https://fedorahosted.org/freeipa/ticket/4785 https://fedorahosted.org/freeipa/ticket/4786 >From 031c26cd4a3fc9c8cbcf40544e256b2cdfea639f Mon Sep 17 00:00:00 2001 From: Florence Bl

[Freeipa-devel] Questions re. 3rd party certificates

Hi, I am working on the following issues and I have questions re. 3rd party certificates: - https://fedorahosted.org/freeipa/ticket/4785 ipa-server-certinstall tracks the 3rd party cert it installs with certmonger - https://fedorahosted.org/freeipa/ticket/4786 ipa-server-certinstall does not

Re: [Freeipa-devel] [PATCH] pylint fixes

On 06/09/2016 05:10 PM, Petr Spacek wrote: Hello, I've received a bunch of pylint fixes produced by upstream contributor who is not subscribed to the list so I'm resending them here. All credit goes to Bárta Jan<55042ba...@sstebrno.eu>. Flo, if you have time for it I think that it could be a

Re: [Freeipa-devel] [PATCH 0043] Stop uninstaller from failing if a service can't be started

On 06/07/2016 10:14 AM, Stanislav Laznicka wrote: https://fedorahosted.org/freeipa/ticket/5775 LGTM, ACK -- Manage your subscription for the Freeipa-devel mailing list: https://www.redhat.com/mailman/listinfo/freeipa-devel Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

[Freeipa-devel] Storing directory path in variables

Hi, I am working on a bug linked to a trailing / in a directory name. It looks like hardcoded paths for directories sometimes contain the trailing / but not always (for instance dsinstance.config_dirname() returns something like '/etc/dirsrv/slapd-DOM-221-ABC-IDM-LAB-ENG-BRQ-REDHAT-COM*/*'

Re: [Freeipa-devel] [PATCH] 0006 add context to exception on LdapEntry decode error

On 06/08/2016 01:14 PM, Stanislav Laznicka wrote: On 06/08/2016 01:13 PM, Stanislav Laznicka wrote: On 06/07/2016 05:11 PM, Florence Blanc-Renaud wrote: On 06/07/2016 04:08 PM, Stanislav Laznicka wrote: On 06/06/2016 02:47 PM, Florence Blanc-Renaud wrote: Hi, please find attached

Re: [Freeipa-devel] [PATCH] man: Decribe ipa-client-install workaround for broken D-Bus enviroment.

On 06/09/2016 07:00 AM, David Kupka wrote: On 02/03/16 11:18, David Kupka wrote: https://fedorahosted.org/freeipa/ticket/5694 Sending updated version crafted with Flo's help, thanks. ACK. Thanks for your patience explaining the details, Flo. -- Manage your subscription for the

Re: [Freeipa-devel] [PATCH] 0003 batch command can be used to trigger internal errors on server

of a file, these commits should include the ticket number if more info is needed. Standa On 05/27/2016 03:53 PM, Florence Blanc-Renaud wrote: Hi all, the following patch checks the format of parameters passed to a method called through the batch command. I picked the ConversionError for invalid

Re: [Freeipa-devel] [PATCH] 0005 Always qualify requests for admin in ipa-replica-conncheck

On 06/06/2016 07:18 PM, Martin Basti wrote: On 02.06.2016 14:58, Florence Blanc-Renaud wrote: Hi, this patch modifies ipa-replica-conncheck when it performs the SSH connection to the master, so that the username is always fully qualified. https://fedorahosted.org/freeipa/ticket/5812

[Freeipa-devel] [PATCH] 0006 add context to exception on LdapEntry decode error

Hi, please find attached the patch for Ticket 5434 add context to exception on LdapEntry decode error https://fedorahosted.org/freeipa/ticket/5434 From 8094fca2e0a11c1c108959da3a8f05c3d9c62bb7 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud <fren...@redhat.com> Date: Fri, 3 Jun 2

Re: [Freeipa-devel] [PATCH] 0002 Add the culprit line when a configuration file has an incorrect format

On 06/02/2016 07:18 PM, Martin Basti wrote: On 30.05.2016 18:11, Florence Blanc-Renaud wrote: Hi Martin, thanks for the review and the suggestion. Please find the updated patch attached. Flo. On 05/30/2016 11:00 AM, Martin Basti wrote: On 27.05.2016 11:35, Florence Blanc-Renaud

[Freeipa-devel] [PATCH] 0005 Always qualify requests for admin in ipa-replica-conncheck

Hi, this patch modifies ipa-replica-conncheck when it performs the SSH connection to the master, so that the username is always fully qualified. https://fedorahosted.org/freeipa/ticket/5812 -- Florence Blanc-Renaud Identity Management Team, Red Hat From

Re: [Freeipa-devel] [PATCH] 0004 Report missing certificate in external trust chain

Hi, thanks to Jan and Fraser for the review and the suggested error message. Please find the updated patch attached. Flo. On 06/02/2016 08:55 AM, Fraser Tweedale wrote: On Thu, Jun 02, 2016 at 07:54:31AM +0200, Jan Cholasta wrote: Hi, On 30.5.2016 19:58, Florence Blanc-Renaud wrote: Hi

[Freeipa-devel] [PATCH] 0004 Report missing certificate in external trust chain

Hi all, this patch adds in the error message the missing certificate that caused i/pa-server-install --external-cert-file=.../ to fail. https://fedorahosted.org/freeipa/ticket/5792 -- Florence Blanc-Renaud Identity Management Team, Red Hat From 5500fa36a7e61d3d86ee4550029c09fef917ce95 Mon

Re: [Freeipa-devel] [PATCH] 0002 Add the culprit line when a configuration file has an incorrect format

Hi Martin, thanks for the review and the suggestion. Please find the updated patch attached. Flo. On 05/30/2016 11:00 AM, Martin Basti wrote: On 27.05.2016 11:35, Florence Blanc-Renaud wrote: Hi all, this patch adds information to the output of ipa-client-install when it fails due

[Freeipa-devel] [PATCH] 0003 batch command can be used to trigger internal errors on server

-- Florence Blanc-Renaud Identity Management Team, Red Hat From 3695130deb27584a3f154505d905f4cec91913c8 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud <fren...@redhat.com> Date: Fri, 27 May 2016 08:19:39 +0200 Subject: [PATCH] batch command can be used to trigger internal errors on

[Freeipa-devel] [PATCH] 0002 Add the culprit line when a configuration file has an incorrect format

Hi all, this patch adds information to the output of ipa-client-install when it fails due to invalid format in a configuration file: ipa-client-install failing with SyntaxError: Syntax Error: Unknown line format Fixes: https://fedorahosted.org/freeipa/ticket/5811 -- Florence Blanc-Renaud

[Freeipa-devel] Questions on git

recommended to pull then merge or merge then pull? Thanks for your tips, Flo. -- Florence Blanc-Renaud Identity Management Team, Red Hat -- Manage your subscription for the Freeipa-devel mailing list: https://www.redhat.com/mailman/listinfo/freeipa-devel Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

[Freeipa-devel] [PATCH] 0001 Add missing CA options to the manpage for ipa-replica-install

(CERTIFICATE SYSTEM OPTIONS and DNS OPTIONS). I also fixed a wrong short option for --realm (-r). Fixes: https://fedorahosted.org/freeipa/ticket/5835 From e2ec0bb1570caec67df58d259be63ac7191e24b0 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud <fren...@redhat.com> Date: Fri, 20 May 2016 12