On Thu, 2014-09-18 at 14:27 -0400, Simo Sorce wrote: > On Thu, 18 Sep 2014 14:22:07 -0400 > Nathaniel McCallum <[email protected]> wrote: > > > On Thu, 2014-09-18 at 14:18 -0400, Simo Sorce wrote: > > > On Thu, 18 Sep 2014 13:56:44 -0400 > > > Nathaniel McCallum <[email protected]> wrote: > > > > > > > -objectClasses: (2.16.840.1.113730.3.8.16.2.2 NAME > > > > 'ipatokenTOTP' SUP ipaToken STRUCTURAL DESC 'TOTP Token Type' > > > > MUST (ipatokenOTPkey $ ipatokenOTPalgorithm $ ipatokenOTPdigits $ > > > > ipatokenTOTPclockOffset $ ipatokenTOTPtimeStep) MAY > > > > (ipatokenTOTPwatermark) X-ORIGIN 'IPA OTP') +objectClasses: > > > > (2.16.840.1.113730.3.8.16.2.2 NAME 'ipatokenTOTP' SUP ipaToken > > > > STRUCTURAL DESC 'TOTP Token Type' MUST (ipatokenOTPkey $ > > > > ipatokenOTPalgorithm $ ipatokenOTPdigits $ > > > > ipatokenTOTPclockOffset $ ipatokenTOTPtimeStep $ > > > > ipatokenTOTPwatermark) X-ORIGIN 'IPA OTP') > > > > > > NACK, you cannot move from MAY to MUST. > > > > This is precisely what we have been discussing on IRC today. The > > consensus was that this was acceptable because of the update plugin > > and the rarity of the state in which a token would not have > > ipatokenTOTPwatermark set (the token has to be created an never used). > > Sorry I was not around, but it is never acceptable, as it may cause > replication failures. > > This has been a long (albeit perhaps unspoken) rule in changing schema > in FreeIPA. > > Existing objectlasses can *never* gain new MUST attributes. This rule > is rigid and is non-negotiable.
I rescind this patch. It is no longer necessary. _______________________________________________ Freeipa-devel mailing list [email protected] https://www.redhat.com/mailman/listinfo/freeipa-devel
