Re: [Freeipa-devel] [PATCHES] 0289-0302 Managed Read permissions

2013-10-02 Thread Petr Viktorin
On 10/01/2013 09:50 PM, Simo Sorce wrote: - Original Message - On 10/01/2013 10:56 AM, Petr Viktorin wrote: Hello, These patches implement the framework for https://fedorahosted.org/freeipa/ticket/3566 Design is at http://www.freeipa.org/page/V3/Managed_Read_permissions. As you can

Re: [Freeipa-devel] [PATCHES] 0289-0302 Managed Read permissions

2013-10-02 Thread Martin Kosek
On 10/01/2013 10:56 AM, Petr Viktorin wrote: Hello, These patches implement the framework for https://fedorahosted.org/freeipa/ticket/3566 Design is at http://www.freeipa.org/page/V3/Managed_Read_permissions. As you can see from the TODOs it's not yet complete; I'll need a few more

Re: [Freeipa-devel] [PATCH 0192] Prevent deadlock in PTR record synchronization (versions = 2.x)

2013-10-02 Thread Petr Spacek
On 1.10.2013 14:28, Tomas Hozza wrote: On 09/26/2013 03:11 PM, Petr Spacek wrote: Hello, attached patch prevents/hides deadlock in plugin versions versions = 2.x. I plan to push it to v2 branch. Branches v3 and newer shouldn't be affected. https://fedorahosted.org/bind-dyndb-ldap/ticket/113

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-10-02 Thread Petr Viktorin
On 10/01/2013 11:00 PM, Nathaniel McCallum wrote: On Thu, 2013-09-05 at 12:19 +0200, Petr Viktorin wrote: On 09/05/2013 06:38 AM, Nathaniel McCallum wrote: 3. I had to make the 'id' option optional to make the uuid autogeneration work in otp-add. However, this has the side-effect that 'id' is

Re: [Freeipa-devel] Multiple CA certificates in LDAP, questions

2013-10-02 Thread Jan Cholasta
On 1.10.2013 22:08, Rob Crittenden wrote: Simo Sorce wrote: - Original Message - On 13.9.2013 11:05, Jan Cholasta wrote: On 13.9.2013 10:53, Martin Kosek wrote: On 09/13/2013 10:51 AM, Jan Cholasta wrote: On 5.9.2013 10:28, Jan Cholasta wrote: On 3.9.2013 18:16, Dmitri Pal wrote:

Re: [Freeipa-devel] [PATCH] 448 Load updated Web UI files after server upgrade

2013-10-02 Thread Petr Vobornik
On 09/27/2013 09:16 AM, Ana Krivokapic wrote: On 08/30/2013 05:21 PM, Petr Vobornik wrote: snip https://fedorahosted.org/freeipa/ticket/3798 I tested the patch and it seems to work fine. Code-wise it looks good as well. Nitpick: There is an unused function 'updated()' in the new

Re: [Freeipa-devel] [PATCHES] 0289-0302 Managed Read permissions

2013-10-02 Thread Simo Sorce
- Original Message - On 10/01/2013 10:56 AM, Petr Viktorin wrote: Hello, These patches implement the framework for https://fedorahosted.org/freeipa/ticket/3566 Design is at http://www.freeipa.org/page/V3/Managed_Read_permissions. As you can see from the TODOs it's not

Re: [Freeipa-devel] Multiple CA certificates in LDAP, questions

2013-10-02 Thread Simo Sorce
- Original Message - On 1.10.2013 22:08, Rob Crittenden wrote: Simo Sorce wrote: - Original Message - On 13.9.2013 11:05, Jan Cholasta wrote: On 13.9.2013 10:53, Martin Kosek wrote: On 09/13/2013 10:51 AM, Jan Cholasta wrote: On 5.9.2013 10:28, Jan Cholasta wrote:

[Freeipa-devel] [PoC/RfC] ipa-kdb: check for alternatives if cross realm TGT cannot be found

2013-10-02 Thread Sumit Bose
Hi, the attached two patches are a proof-of-concept how we can eliminate the need to have [capaths] defined in krb5.conf for member domains in trusted forests together with Alexander's patch 0123. capaths are used in the core KDC code at two places. One is to validate transited field in the TGT,

Re: [Freeipa-devel] [PATCHES] 0289-0302 Managed Read permissions

2013-10-02 Thread Petr Viktorin
On 10/02/2013 01:07 PM, Simo Sorce wrote: - Original Message - On 10/01/2013 10:56 AM, Petr Viktorin wrote: Hello, These patches implement the framework for https://fedorahosted.org/freeipa/ticket/3566 Design is at http://www.freeipa.org/page/V3/Managed_Read_permissions. As you can

Re: [Freeipa-devel] [PoC/RfC] ipa-kdb: check for alternatives if cross realm TGT cannot be found

2013-10-02 Thread Alexander Bokovoy
On Wed, 02 Oct 2013, Sumit Bose wrote: Hi, the attached two patches are a proof-of-concept how we can eliminate the need to have [capaths] defined in krb5.conf for member domains in trusted forests together with Alexander's patch 0123. capaths are used in the core KDC code at two places. One

Re: [Freeipa-devel] [PATCH 0018] Ensure credentials structure is initialized

2013-10-02 Thread Petr Viktorin
On 09/27/2013 01:16 PM, Petr Vobornik wrote: On 09/27/2013 12:49 PM, Petr Viktorin wrote: On 09/26/2013 04:48 PM, Nathaniel McCallum wrote: On Thu, 2013-09-26 at 12:36 +0200, Petr Viktorin wrote: On 09/26/2013 12:07 AM, Nathaniel McCallum wrote: Patch attached. There's a ticket to make

[Freeipa-devel] [PATCH] 0303 Use correct super-calls in get_args() methods

2013-10-02 Thread Petr Viktorin
As Nathaniel found while implementing OTP, weird super() calls in get_args make it difficult to customize the get_args behavior in LDAP CRUD methods. This patch makes the super() calls properly follow the inheritance chain. I've sent a previous version of the patch, which only corrected one

Re: [Freeipa-devel] [PATCH] 0303 Use correct super-calls in get_args() methods

2013-10-02 Thread Nathaniel McCallum
On Wed, 2013-10-02 at 15:49 +0200, Petr Viktorin wrote: As Nathaniel found while implementing OTP, weird super() calls in get_args make it difficult to customize the get_args behavior in LDAP CRUD methods. This patch makes the super() calls properly follow the inheritance chain. I've

Re: [Freeipa-devel] [PATCH] 0303 Use correct super-calls in get_args() methods

2013-10-02 Thread Petr Viktorin
On 10/02/2013 04:00 PM, Nathaniel McCallum wrote: On Wed, 2013-10-02 at 15:49 +0200, Petr Viktorin wrote: As Nathaniel found while implementing OTP, weird super() calls in get_args make it difficult to customize the get_args behavior in LDAP CRUD methods. This patch makes the super() calls

[Freeipa-devel] [PATCH] 0304 ipapython.nsslib: Name arguments to NSPRError

2013-10-02 Thread Petr Viktorin
As I found out when installing on a misconfigured system, we use wrong argument order for NSPRError in nsslib. This patch corrects the problem. FWIW raising NSPRError might not be correct; the nss.error.NSPRError docstring states: Raised internally, there should be no need to raise this

Re: [Freeipa-devel] [PATCH] 0067 Use fqdn when creating msdcs SRV records

2013-10-02 Thread Petr Vobornik
On 09/18/2013 06:42 PM, Ana Krivokapic wrote: Hello, This patch addresses ticket https://fedorahosted.org/freeipa/ticket/3908. The patch does what it advertises - it uses fqdn every time for mcsdcs SRV records. It's not consistent with other DNS SRV records, where fqdn is used only when

Re: [Freeipa-devel] [PATCH] 0067 Use fqdn when creating msdcs SRV records

2013-10-02 Thread Martin Kosek
On 10/02/2013 05:17 PM, Petr Vobornik wrote: On 09/18/2013 06:42 PM, Ana Krivokapic wrote: Hello, This patch addresses ticket https://fedorahosted.org/freeipa/ticket/3908. The patch does what it advertises - it uses fqdn every time for mcsdcs SRV records. It's not consistent with

Re: [Freeipa-devel] [PATCH] 0304 ipapython.nsslib: Name arguments to NSPRError

2013-10-02 Thread Petr Vobornik
On 10/02/2013 04:34 PM, Petr Viktorin wrote: As I found out when installing on a misconfigured system, we use wrong argument order for NSPRError in nsslib. This patch corrects the problem. ACK A nitpick: $ git diff HEAD~1 | pep8 --diff ./ipapython/nsslib.py:145:14: E111 indentation is not a

Re: [Freeipa-devel] [PATCH] 0118 add support for subdomains

2013-10-02 Thread Tomas Babej
On 10/01/2013 05:15 PM, Alexander Bokovoy wrote: On Mon, 30 Sep 2013, Alexander Bokovoy wrote: On Mon, 30 Sep 2013, Tomas Babej wrote: On 09/28/2013 10:01 PM, Alexander Bokovoy wrote: On Fri, 27 Sep 2013, Sumit Bose wrote: On Fri, Sep 27, 2013 at 03:53:08PM +0300, Alexander Bokovoy wrote:

Re: [Freeipa-devel] [PATCH] 0118 add support for subdomains

2013-10-02 Thread Alexander Bokovoy
On Wed, 02 Oct 2013, Tomas Babej wrote: I'll send new patchset shortly. New patchset is attached. 1. Added test update for ipalib/frontend.py changes 2. Used LDAPQuery as base for trustdomain_enable|disable commands as suggested by Honza. 3. Fixed issues with removal of trust account password

Re: [Freeipa-devel] [PATCH] 0118 add support for subdomains

2013-10-02 Thread Sumit Bose
On Wed, Oct 02, 2013 at 10:31:21PM +0200, Tomas Babej wrote: On 10/01/2013 05:15 PM, Alexander Bokovoy wrote: On Mon, 30 Sep 2013, Alexander Bokovoy wrote: On Mon, 30 Sep 2013, Tomas Babej wrote: On 09/28/2013 10:01 PM, Alexander Bokovoy wrote: On Fri, 27 Sep 2013, Sumit Bose wrote: On Fri,