Re: [Freeipa-devel] Host groups and netgroups

2010-11-30 Thread Dmitri Pal
JR Aquino wrote: On 11/24/10 11:19 AM, Dmitri Pal d...@redhat.com wrote: Hello, It is well known that with IPA we want to try to move people from the netgroups to host groups but many companies currently use netgroups as hostgroups. To simplify migration I suggest that we by default

Re: [Freeipa-devel] [PATCH] 620 add ipaUniqueId to UPGs

2010-11-30 Thread Simo Sorce
On Mon, 29 Nov 2010 17:12:41 -0500 Rob Crittenden rcrit...@redhat.com wrote: Add ipaUniqueId to user private groups. If we didn't then when the group is detached we need to add it and this makes the acis more problematic. I had to move where we load the UPG ldif until after the restart so

Re: [Freeipa-devel] [PATCH] 620 add ipaUniqueId to UPGs

2010-11-30 Thread Rob Crittenden
Simo Sorce wrote: On Mon, 29 Nov 2010 17:12:41 -0500 Rob Crittendenrcrit...@redhat.com wrote: Add ipaUniqueId to user private groups. If we didn't then when the group is detached we need to add it and this makes the acis more problematic. I had to move where we load the UPG ldif until after

Re: [Freeipa-devel] [PATCH] 609 Reduce the number of attributes a host is allowed to write.

2010-11-30 Thread Rob Crittenden
Simo Sorce wrote: On Wed, 17 Nov 2010 15:07:03 -0500 Rob Crittendenrcrit...@redhat.com wrote: +aci: (targetattr != userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbMKey ||

Re: [Freeipa-devel] [PATCH] 614 Display user and host membership in netgroups.

2010-11-30 Thread Rob Crittenden
Simo Sorce wrote: On Wed, 24 Nov 2010 09:00:24 +0100 Jan Zelenýjzel...@redhat.com wrote: Rob Crittendenrcrit...@redhat.com wrote: This uses an enhanced memberof plugin that allows multiple attributes to be configured to create memberOf attributes. This patch requires a new 389-ds-base,

Re: [Freeipa-devel] [PATCH] 609 Reduce the number of attributes a host is allowed to write.

2010-11-30 Thread Simo Sorce
On Tue, 30 Nov 2010 10:28:41 -0500 Rob Crittenden rcrit...@redhat.com wrote: Simo Sorce wrote: On Wed, 17 Nov 2010 15:07:03 -0500 Rob Crittendenrcrit...@redhat.com wrote: +aci: (targetattr != userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory ||

[Freeipa-devel] [PATCH] 621 drop install/tools/README

2010-11-30 Thread Rob Crittenden
The README in install/tools is really for v1 and contains almost nothing useful for v2 so I'm proposing to drop it altogether. I'm also adding a link to the QuickStart guide on the trac wiki. The guide itself needs a lot of work but its a start. rob From

[Freeipa-devel] [PATCH] 622 fix passwd output

2010-11-30 Thread Rob Crittenden
A couple of Password attributes had no label so prompting looked bad. When printing exceptions we need to convert the label and error to unicode so translations work. Use standard output routines instead of output_for_cli() in passwd plugin. ticket 352 rob From

Re: [Freeipa-devel] [PATCH] Prompt correctly for required Password params.

2010-11-30 Thread Rob Crittenden
Pavel Zuna wrote: Required Password params were prompted for like any other non-Password params, resulting in the password being displayed on the command line and there was no confirmation. Ticket #361 Pavel Ack, pushed to master rob ___

Re: [Freeipa-devel] [PATCH] Enable filtering search results by member attributes.

2010-11-30 Thread Pavel Zůna
On 2010-11-30 04:06, Rob Crittenden wrote: Pavel Zůna wrote: LDAPSearch base class has now the ability to generate additional options for objects with member attributes. These options are used to filter search results - search only for objects without the specified members. Any class that

[Freeipa-devel] [PATCH] admiyo-0105-action-panel-sibling

2010-11-30 Thread Adam Young
A note on this patch: I changed the labels on a couple of the entities for consitancy sake, including: Added 'HBAC' to the label for HBAC services Capitalized SUDO Removed the word Rule from the SUDO label Not sure if these will have any effect on the CLI. I suspect not, and that the QW

Re: [Freeipa-devel] [PATCH] 0022 Enable EntryUSN plugin by default

2010-11-30 Thread Rob Crittenden
Simo Sorce wrote: This patch enables the entryUSN plugin by default at install time. EntryUSN numbers are ususful fro clients that want to track newest objects w/o having to care about timestamps dated in the past and replicated by other masters. EntrUSN numbers are valid only in the context

[Freeipa-devel] [PATCH] sudo and netgroup schema compat updates

2010-11-30 Thread Nalin Dahyabhai
This is what I've got now; I think it's correct. - fix quoting in the netgroup compat configuration entry - don't bother looking for members of netgroups by looking for entries which list memberOf: $netgroup -- the netgroup should list them as member or memberUser or memberHost values -