On 11/27/2015 04:18 PM, Simo Sorce wrote:
> On Fri, 2015-11-27 at 14:51 +0100, Petr Vobornik wrote:
>> On 10/23/2015 04:57 PM, Simo Sorce wrote:
>>> On 23/10/15 08:39, Petr Vobornik wrote:
>>>> not sure if the change in2606f5aecd6ac0db31abb515b691529bb7eaf14e was a
>>>> mistake or done on purpose.
>>>>
>>>> Anyway:
>>>> commit 2606f5aecd6ac0db31abb515b691529bb7eaf14e
>>>>
>>>> has:
>>>> -            realm, hostname, dirman_passwd, port, starttls=True)
>>>> +            realm, hostname, dirman_passwd, port)
>>>>
>>>> In CSReplicationManager
>>>>
>>>> which causes, e.g.:
>>>>
>>>> ipa-csreplica-manage -p Secret123 list ipa.example.com
>>>> cannot connect to 'ldaps://ipa.example.com:389': TLS error
>>>> -5938:Encountered end of file
>>>>
>>>> Attached patch reverts it.
>>>
>>> I am not sure it was a mistake, we have changed replication from using
>>> TLS to always use LDAP+GSSAPI, so why is ipa-csreplica-manage depending
>>> on ldaps anyway ?
>>>
>>> It may need to when dealing with very old domains where we have split
>>> instances for CS and IPA, but not in anything modern. I would rather
>>> change the command to cope with using LDAP+GSSAPI.
>>>
>>> A simple revert may break something in replica promotion, would need to
>>> be tested with a full master+replica install.
>>
>> I had this patch applied in branch while developing Topology graph - 
>> promotion of several replicas worked. Replica promotion uses new 
>> CAReplicationManager - not CSReplicationManager so it shouldn't be 
>> affected.  CSReplicationManager is used only in 
>> get_cs_replication_manager call. This call is used only in 
>> ipa-csreplica-manage and ipa_restore.py.
>>
>> Without this patch the related functionality in both 
>> ipa-csreplica-manage and ipa_restore.py (see 
>> https://fedorahosted.org/freeipa/ticket/5479#comment:2 ) doesn't work.
>>
>> I don't think that changing ipa-csreplica-manage is worth the effort 
>> given that we want to deprecate the tool.
>>
>> Therefore I propose to go with this patch.
> 
> OK then, go ahead.
> 
> Simo.
> 

ACK, patch works fine.

Pushed to master: 7b976c664d5b961d5297f235197e9124ce66d5ff

-- 
Manage your subscription for the Freeipa-devel mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-devel
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Reply via email to