Re: [Freeipa-devel] [PATCHES] Remove dependencies to private samba libs

2012-09-06 Thread Martin Kosek
On 09/03/2012 02:03 PM, Alexander Bokovoy wrote: - Original Message - From: Sumit Bose sb...@redhat.com To: freeipa-devel freeipa-devel@redhat.com Sent: Sunday, September 2, 2012 8:04:22 PM Subject: [Freeipa-devel] [PATCHES] Remove dependencies to private samba libs Hi, private

Re: [Freeipa-devel] [PATCH] 197 Fixed search in HBAC test

2012-09-06 Thread Petr Vobornik
On 09/05/2012 07:24 PM, Endi Sukma Dewata wrote: On 9/3/2012 6:28 AM, Petr Vobornik wrote: b) force refresh when searching with unchanged filter I did (b). Updated patch attached. I don't want to implement 'expiration date' at the moment. It's too widespread change. Maybe in FreeIPA 3.2.

Re: [Freeipa-devel] [PATCH] 203 Notify success on add, delete and update

2012-09-06 Thread Petr Vobornik
On 09/05/2012 07:25 PM, Endi Sukma Dewata wrote: On 9/3/2012 8:35 AM, Petr Vobornik wrote: Notification of success was added to: * details facet: update * association facet and association widget: add, delete items * attribute facet: delete items (notification of add should be handled in

Re: [Freeipa-devel] [PATCH] 199 Permissions: select only applicable options on type change

2012-09-06 Thread Petr Vobornik
On 09/05/2012 07:24 PM, Endi Sukma Dewata wrote: On 9/3/2012 5:59 AM, Petr Vobornik wrote: Updated patch attached. ACK. Pushed to master and ipa-3-0. -- Petr Vobornik ___ Freeipa-devel mailing list Freeipa-devel@redhat.com

Re: [Freeipa-devel] [PATCH] 209 Fixed problem while deleting entry with unsaved changes

2012-09-06 Thread Petr Vobornik
On 09/06/2012 12:46 AM, Endi Sukma Dewata wrote: On 9/5/2012 10:00 AM, Petr Vobornik wrote: While deleting an entry it now resets a facet if there are unsaved changes. It prevents pop up of various error dialogs when UI tries to redirect to search page after successful delete.

Re: [Freeipa-devel] [PATCH] 206-208 Fixed number parameters MIN boundary validation in Web UI

2012-09-06 Thread Petr Vobornik
On 09/05/2012 11:40 PM, Endi Sukma Dewata wrote: On 9/5/2012 9:08 AM, Petr Vobornik wrote: Integers were missing most of minimum checks and Decimals boundaries weren't checked at all in Web UI. First part is done in ipalib, second in Web UI. 1) [PATCH] 206 Fixed metadata serialization of

Re: [Freeipa-devel] [PATCH] 204 Update of confirmation of actions

2012-09-06 Thread Petr Vobornik
On 09/05/2012 09:30 PM, Endi Sukma Dewata wrote: On 9/3/2012 11:05 AM, Petr Vobornik wrote: This patch is changing confirmation of actions according to ticket #3035, see the ticket description. It does following changes: * Confirmation of update action was removed. * Action lists resets to

Re: [Freeipa-devel] [PATCH] 1041 pull in cachememsize logging

2012-09-06 Thread Martin Kosek
On 09/05/2012 08:04 PM, Rob Crittenden wrote: Rob Crittenden wrote: 389-ds-base added logging if the entry cache is smaller than the database so users will know they need to tune their DS install. Set this as the minimum for IPA. rob Rebased patch. rob It looks like a changelog

[Freeipa-devel] [PATCH] 304 Allow localhost in zone ACIs

2012-09-06 Thread Martin Kosek
Loopback address, localhost and localnets ACIs are no longer an issue for bind-dyndb-ldap. Allow them in our validators. -- Martin Kosek mko...@redhat.com Senior Software Engineer - Identity Management Team Red Hat Inc. From 74dcac478622c502bab7aef9ba7bade0bd9a704f Mon Sep 17 00:00:00 2001 From:

Re: [Freeipa-devel] [PATCH 0011] Make sure selinuxusemap behaves consistently to HBAC rule

2012-09-06 Thread Tomas Babej
On 09/05/2012 01:56 PM, Martin Kosek wrote: On 09/03/2012 05:12 PM, Tomas Babej wrote: Hi, Both selinuxusermap-add and selinuxusermap-mod commands now behave consistently in not allowing user/host category or user/host members and HBAC rule being set at the same time. Also adds a bunch of unit

Re: [Freeipa-devel] [PATCH] 304 Allow localhost in zone ACIs

2012-09-06 Thread Petr Vobornik
On 09/06/2012 11:51 AM, Martin Kosek wrote: Loopback address, localhost and localnets ACIs are no longer an issue for bind-dyndb-ldap. Allow them in our validators. Martin's patch works and looks good - ACK. Attaching patch for Web UI part. -- Petr Vobornik From

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Martin Kosek
On 09/05/2012 08:06 PM, Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On 07/05/2012 08:39 PM, Rob Crittenden wrote: Martin Kosek wrote: On 07/03/2012 04:41 PM, Rob Crittenden wrote: Deleting a replica can leave a replication vector (RUV) on the other servers. This can

Re: [Freeipa-devel] [PATCH] 304 Allow localhost in zone ACIs

2012-09-06 Thread Martin Kosek
On 09/06/2012 01:35 PM, Petr Vobornik wrote: On 09/06/2012 11:51 AM, Martin Kosek wrote: Loopback address, localhost and localnets ACIs are no longer an issue for bind-dyndb-ldap. Allow them in our validators. Martin's patch works and looks good - ACK. Attaching patch for Web UI part.

Re: [Freeipa-devel] [PATCH] 1053 support 389-ds posix-winsync plugin

2012-09-06 Thread Martin Kosek
On 09/05/2012 08:13 PM, Rich Megginson wrote: On 09/05/2012 12:08 PM, Rob Crittenden wrote: Add support for the 389-ds posix winsync plugin. This plugin will sync the POSIX attributes from AD. We need to avoid trying to re-add them in our plugin. ack I did a sanity check, that winsync

Re: [Freeipa-devel] [PATCH] 1053 support 389-ds posix-winsync plugin

2012-09-06 Thread Simo Sorce
On Thu, 2012-09-06 at 14:30 +0200, Martin Kosek wrote: On 09/05/2012 08:13 PM, Rich Megginson wrote: On 09/05/2012 12:08 PM, Rob Crittenden wrote: Add support for the 389-ds posix winsync plugin. This plugin will sync the POSIX attributes from AD. We need to avoid trying to re-add them in

Re: [Freeipa-devel] [PATCH] Patch to allow IPA to work with dogtag 10 on f18

2012-09-06 Thread Rob Crittenden
Ade Lee wrote: On Wed, 2012-09-05 at 16:20 -0400, Rob Crittenden wrote: Martin Kosek wrote: On 08/31/2012 04:53 PM, Petr Viktorin wrote: On 08/28/2012 03:40 PM, Petr Viktorin wrote: On 08/17/2012 06:04 PM, Ade Lee wrote: On Fri, 2012-08-17 at 09:34 -0400, Ade Lee wrote: On Thu, 2012-08-16

Re: [Freeipa-devel] [PATCH] 1046 add e-mail by default

2012-09-06 Thread Martin Kosek
On 08/24/2012 07:54 PM, Rob Crittenden wrote: We weren't automatically creating the mail attribute despite having the default e-mail domain. This patch will add it to all new users. To disable creating this set the default e-mail domain to empty in ipa config. rob 1) Patch needs a

Re: [Freeipa-devel] [PATCH] Patch to allow IPA to work with dogtag 10 on f18

2012-09-06 Thread Petr Viktorin
On 09/06/2012 02:35 PM, Rob Crittenden wrote: Ade Lee wrote: On Wed, 2012-09-05 at 16:20 -0400, Rob Crittenden wrote: Martin Kosek wrote: On 08/31/2012 04:53 PM, Petr Viktorin wrote: On 08/28/2012 03:40 PM, Petr Viktorin wrote: On 08/17/2012 06:04 PM, Ade Lee wrote: On Fri, 2012-08-17 at

Re: [Freeipa-devel] [PATCH] 1053 support 389-ds posix-winsync plugin

2012-09-06 Thread Martin Kosek
On 09/06/2012 02:35 PM, Simo Sorce wrote: On Thu, 2012-09-06 at 14:30 +0200, Martin Kosek wrote: On 09/05/2012 08:13 PM, Rich Megginson wrote: On 09/05/2012 12:08 PM, Rob Crittenden wrote: Add support for the 389-ds posix winsync plugin. This plugin will sync the POSIX attributes from AD. We

Re: [Freeipa-devel] [PATCH] 300-301 Fix DNS SOA serial parameters boundaries

2012-09-06 Thread Petr Viktorin
On 09/05/2012 01:31 PM, Martin Kosek wrote: On 09/05/2012 12:26 PM, Petr Viktorin wrote: On 09/05/2012 12:14 PM, Petr Viktorin wrote: This works well, but please see some comments below. On 09/04/2012 04:22 PM, Martin Kosek wrote: To test, simply run the following command: ipa

Re: [Freeipa-devel] [PATCH] 1053 support 389-ds posix-winsync plugin

2012-09-06 Thread Rob Crittenden
Martin Kosek wrote: On 09/06/2012 02:35 PM, Simo Sorce wrote: On Thu, 2012-09-06 at 14:30 +0200, Martin Kosek wrote: On 09/05/2012 08:13 PM, Rich Megginson wrote: On 09/05/2012 12:08 PM, Rob Crittenden wrote: Add support for the 389-ds posix winsync plugin. This plugin will sync the POSIX

Re: [Freeipa-devel] [PATCH] 300-301 Fix DNS SOA serial parameters boundaries

2012-09-06 Thread Martin Kosek
On 09/06/2012 02:51 PM, Petr Viktorin wrote: On 09/05/2012 01:31 PM, Martin Kosek wrote: On 09/05/2012 12:26 PM, Petr Viktorin wrote: On 09/05/2012 12:14 PM, Petr Viktorin wrote: This works well, but please see some comments below. On 09/04/2012 04:22 PM, Martin Kosek wrote: To test, simply

Re: [Freeipa-devel] [PATCH] 1041 pull in cachememsize logging

2012-09-06 Thread Rob Crittenden
Martin Kosek wrote: On 09/05/2012 08:04 PM, Rob Crittenden wrote: Rob Crittenden wrote: 389-ds-base added logging if the entry cache is smaller than the database so users will know they need to tune their DS install. Set this as the minimum for IPA. rob Rebased patch. rob It looks like

Re: [Freeipa-devel] [PATCH] 1053 support 389-ds posix-winsync plugin

2012-09-06 Thread Simo Sorce
On Thu, 2012-09-06 at 14:49 +0200, Martin Kosek wrote: On 09/06/2012 02:35 PM, Simo Sorce wrote: On Thu, 2012-09-06 at 14:30 +0200, Martin Kosek wrote: On 09/05/2012 08:13 PM, Rich Megginson wrote: On 09/05/2012 12:08 PM, Rob Crittenden wrote: Add support for the 389-ds posix winsync

Re: [Freeipa-devel] [PATCH] 1053 support 389-ds posix-winsync plugin

2012-09-06 Thread Rich Megginson
On 09/06/2012 06:35 AM, Simo Sorce wrote: On Thu, 2012-09-06 at 14:30 +0200, Martin Kosek wrote: On 09/05/2012 08:13 PM, Rich Megginson wrote: On 09/05/2012 12:08 PM, Rob Crittenden wrote: Add support for the 389-ds posix winsync plugin. This plugin will sync the POSIX attributes from AD. We

Re: [Freeipa-devel] [PATCHES] Various fixes for trust and range CLI

2012-09-06 Thread Petr Vobornik
On 09/06/2012 01:39 PM, Sumit Bose wrote: Hi, this series of patches touches couple of tickets related to the trust and (id)range CLI. I post them together because some of them depend on each other. I already rebased them on Martin's Add range safety check for range_mod and range_del patch

Re: [Freeipa-devel] [PATCH] 1050 prevent replica orphans

2012-09-06 Thread Martin Kosek
On 08/31/2012 07:40 PM, Rob Crittenden wrote: Rob Crittenden wrote: It was possible use ipa-replica-manage connect/disconnect/del to end up orphaning or or more IPA masters. This is an attempt to catch and prevent that case. I tested with this topology, trying to delete B. A - B - C I

Re: [Freeipa-devel] [PATCH] 1046 add e-mail by default

2012-09-06 Thread Rob Crittenden
Martin Kosek wrote: On 08/24/2012 07:54 PM, Rob Crittenden wrote: We weren't automatically creating the mail attribute despite having the default e-mail domain. This patch will add it to all new users. To disable creating this set the default e-mail domain to empty in ipa config. rob 1)

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Rob Crittenden
Rob Crittenden wrote: Martin Kosek wrote: On 09/05/2012 08:06 PM, Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On 07/05/2012 08:39 PM, Rob Crittenden wrote: Martin Kosek wrote: On 07/03/2012 04:41 PM, Rob Crittenden wrote: Deleting a replica can leave a replication

Re: [Freeipa-devel] [PATCH] 204 Update of confirmation of actions

2012-09-06 Thread Petr Vobornik
On 09/06/2012 11:24 AM, Petr Vobornik wrote: On 09/05/2012 09:30 PM, Endi Sukma Dewata wrote: On 9/3/2012 11:05 AM, Petr Vobornik wrote: This patch is changing confirmation of actions according to ticket #3035, see the ticket description. It does following changes: * Confirmation of update

Re: [Freeipa-devel] [PATCH] 83 Use OpenSSH-style public keys as the preferred format of SSH public keys

2012-09-06 Thread Jan Cholasta
Dne 5.9.2012 22:57, Rob Crittenden napsal(a): Jan Cholasta wrote: Hi, this patch changes the format of the sshpubkey parameter to the format used by OpenSSH (see sshd(8)). Public keys in the old format (raw RFC 4253 blob) are automatically converted to OpenSSH-style public keys. OpenSSH-style

Re: [Freeipa-devel] [PATCH] 303 Add range safety check for range_mod and range_del

2012-09-06 Thread Sumit Bose
On Wed, Sep 05, 2012 at 05:13:41PM +0200, Martin Kosek wrote: range_mod and range_del command could easily create objects with ID which is suddenly out of specified range. This could cause issues in trust scenarios where range objects are used for computation of remote IDs. Add validator

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Rob Crittenden
Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On 09/05/2012 08:06 PM, Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On 07/05/2012 08:39 PM, Rob Crittenden wrote: Martin Kosek wrote: On 07/03/2012 04:41 PM, Rob Crittenden wrote: Deleting a replica can

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Martin Kosek
On 09/06/2012 05:55 PM, Rob Crittenden wrote: Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On 09/05/2012 08:06 PM, Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On 07/05/2012 08:39 PM, Rob Crittenden wrote: Martin Kosek wrote: On 07/03/2012 04:41 PM,

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Martin Kosek
On 09/06/2012 06:05 PM, Martin Kosek wrote: On 09/06/2012 05:55 PM, Rob Crittenden wrote: Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On 09/05/2012 08:06 PM, Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On 07/05/2012 08:39 PM, Rob Crittenden wrote:

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Martin Kosek
On 09/06/2012 06:09 PM, Martin Kosek wrote: On 09/06/2012 06:05 PM, Martin Kosek wrote: On 09/06/2012 05:55 PM, Rob Crittenden wrote: Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On 09/05/2012 08:06 PM, Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On

Re: [Freeipa-devel] [PATCH 0013] Remove user-unfriendly u character from error messages

2012-09-06 Thread Petr Viktorin
On 09/05/2012 04:35 PM, Tomas Babej wrote: On 09/05/2012 03:42 PM, Petr Viktorin wrote: On 09/05/2012 03:19 PM, Tomas Babej wrote: Hi, User-unfriendly errors were caused by re-raising errors from external python module netaddr. https://fedorahosted.org/freeipa/ticket/2588 Tomas

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Rich Megginson
On 09/06/2012 10:09 AM, Martin Kosek wrote: On 09/06/2012 06:09 PM, Martin Kosek wrote: On 09/06/2012 06:05 PM, Martin Kosek wrote: On 09/06/2012 05:55 PM, Rob Crittenden wrote: Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On 09/05/2012 08:06 PM, Rob Crittenden wrote:

Re: [Freeipa-devel] Ticket #2866 - referential integrity in IPA

2012-09-06 Thread Martin Kosek
On 09/04/2012 04:40 PM, Rich Megginson wrote: On 09/03/2012 08:42 AM, Martin Kosek wrote: On 08/27/2012 06:29 PM, Rich Megginson wrote: On 08/27/2012 10:24 AM, Martin Kosek wrote: On 08/17/2012 04:00 PM, Rich Megginson wrote: On 08/17/2012 07:44 AM, Martin Kosek wrote: Hi guys, I am now

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Martin Kosek
On 09/06/2012 06:13 PM, Rich Megginson wrote: On 09/06/2012 10:09 AM, Martin Kosek wrote: On 09/06/2012 06:09 PM, Martin Kosek wrote: On 09/06/2012 06:05 PM, Martin Kosek wrote: On 09/06/2012 05:55 PM, Rob Crittenden wrote: Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Mark Reynolds
On 09/06/2012 12:13 PM, Rich Megginson wrote: On 09/06/2012 10:09 AM, Martin Kosek wrote: On 09/06/2012 06:09 PM, Martin Kosek wrote: On 09/06/2012 06:05 PM, Martin Kosek wrote: On 09/06/2012 05:55 PM, Rob Crittenden wrote: Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote:

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Rich Megginson
On 09/06/2012 10:40 AM, Mark Reynolds wrote: On 09/06/2012 12:13 PM, Rich Megginson wrote: On 09/06/2012 10:09 AM, Martin Kosek wrote: On 09/06/2012 06:09 PM, Martin Kosek wrote: On 09/06/2012 06:05 PM, Martin Kosek wrote: On 09/06/2012 05:55 PM, Rob Crittenden wrote: Rob Crittenden

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Mark Reynolds
On 09/06/2012 12:27 PM, Martin Kosek wrote: On 09/06/2012 06:13 PM, Rich Megginson wrote: On 09/06/2012 10:09 AM, Martin Kosek wrote: On 09/06/2012 06:09 PM, Martin Kosek wrote: On 09/06/2012 06:05 PM, Martin Kosek wrote: On 09/06/2012 05:55 PM, Rob Crittenden wrote: Rob Crittenden wrote:

Re: [Freeipa-devel] Ticket #2866 - referential integrity in IPA

2012-09-06 Thread Nathan Kinder
On 09/06/2012 09:28 AM, Martin Kosek wrote: On 09/04/2012 04:40 PM, Rich Megginson wrote: On 09/03/2012 08:42 AM, Martin Kosek wrote: On 08/27/2012 06:29 PM, Rich Megginson wrote: On 08/27/2012 10:24 AM, Martin Kosek wrote: On 08/17/2012 04:00 PM, Rich Megginson wrote: On 08/17/2012 07:44

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Martin Kosek
On Thu, 2012-09-06 at 12:42 -0400, Mark Reynolds wrote: On 09/06/2012 12:27 PM, Martin Kosek wrote: On 09/06/2012 06:13 PM, Rich Megginson wrote: On 09/06/2012 10:09 AM, Martin Kosek wrote: On 09/06/2012 06:09 PM, Martin Kosek wrote: On 09/06/2012 06:05 PM, Martin Kosek wrote: On

Re: [Freeipa-devel] [PATCH] 303 Add range safety check for range_mod and range_del

2012-09-06 Thread Martin Kosek
On Thu, 2012-09-06 at 17:55 +0200, Sumit Bose wrote: On Wed, Sep 05, 2012 at 05:13:41PM +0200, Martin Kosek wrote: range_mod and range_del command could easily create objects with ID which is suddenly out of specified range. This could cause issues in trust scenarios where range objects are

Re: [Freeipa-devel] [PATCH] 1031 run cleanallruv task

2012-09-06 Thread Rob Crittenden
Martin Kosek wrote: On 09/06/2012 05:55 PM, Rob Crittenden wrote: Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On 09/05/2012 08:06 PM, Rob Crittenden wrote: Rob Crittenden wrote: Martin Kosek wrote: On 07/05/2012 08:39 PM, Rob Crittenden wrote: Martin Kosek wrote: On

Re: [Freeipa-devel] [PATCH] 1050 prevent replica orphans

2012-09-06 Thread Rob Crittenden
Martin Kosek wrote: On 08/31/2012 07:40 PM, Rob Crittenden wrote: Rob Crittenden wrote: It was possible use ipa-replica-manage connect/disconnect/del to end up orphaning or or more IPA masters. This is an attempt to catch and prevent that case. I tested with this topology, trying to delete B.