Re: [Freeipa-devel] [PATCH 0137] ipalib: Add DateTime parameter

2014-05-13 Thread Petr Viktorin
On 05/07/2014 06:15 PM, Dmitri Pal wrote: On 05/07/2014 11:46 AM, Nathaniel McCallum wrote: On Wed, 2014-05-07 at 09:50 -0400, Dmitri Pal wrote: On 05/07/2014 04:06 AM, Jan Cholasta wrote: On 6.5.2014 19:55, Nathaniel McCallum wrote: I know it is a bit late on this, but for the OTP token

Re: [Freeipa-devel] [PATCH 0003] freeipa-ci: Remove freeipa packages before distro-sync in build

2014-05-13 Thread Petr Viktorin
On 05/07/2014 03:05 PM, Tomas Babej wrote: Hi, this fixes the problem on builders, which do distro-sync while having freeipa packages present from previous build run. This causes unnecessary downgrades., which may result into failures (as now with the smartproxy pushed). I've put the

Re: [Freeipa-devel] [PATCH 0137] ipalib: Add DateTime parameter

2014-05-13 Thread Martin Kosek
On 05/13/2014 12:54 PM, Petr Viktorin wrote: On 05/07/2014 06:15 PM, Dmitri Pal wrote: On 05/07/2014 11:46 AM, Nathaniel McCallum wrote: On Wed, 2014-05-07 at 09:50 -0400, Dmitri Pal wrote: On 05/07/2014 04:06 AM, Jan Cholasta wrote: On 6.5.2014 19:55, Nathaniel McCallum wrote: I know it is

Re: [Freeipa-devel] [PATCH] 1107 smartproxy cleanup

2014-05-13 Thread Martin Kosek
On 05/08/2014 07:38 PM, Nathaniel McCallum wrote: On Thu, 2014-05-08 at 13:36 -0400, Rob Crittenden wrote: Nathaniel McCallum wrote: On Thu, 2014-05-08 at 09:12 -0400, Rob Crittenden wrote: Rob Crittenden wrote: Rob Crittenden wrote: Remove some unused files, fix an import which means we

Re: [Freeipa-devel] [PATCH 0137] ipalib: Add DateTime parameter

2014-05-13 Thread Jan Cholasta
On 13.5.2014 13:24, Martin Kosek wrote: On 05/13/2014 12:54 PM, Petr Viktorin wrote: On 05/07/2014 06:15 PM, Dmitri Pal wrote: On 05/07/2014 11:46 AM, Nathaniel McCallum wrote: On Wed, 2014-05-07 at 09:50 -0400, Dmitri Pal wrote: On 05/07/2014 04:06 AM, Jan Cholasta wrote: On 6.5.2014

Re: [Freeipa-devel] [WIP] OTP Token Import

2014-05-13 Thread Jan Cholasta
Hi, On 13.5.2014 01:39, Nathaniel McCallum wrote: The attached patch implements the OTP Token import script. However, it doesn't work. Specifically, at the bottom of the file, when I call otptoken-add, I get: Unknown option: digits If I prefix ipatoken to digits, I get: Unknown option:

Re: [Freeipa-devel] [WIP] OTP Token Import

2014-05-13 Thread Nathaniel McCallum
On Tue, 2014-05-13 at 15:13 +0200, Jan Cholasta wrote: Hi, On 13.5.2014 01:39, Nathaniel McCallum wrote: The attached patch implements the OTP Token import script. However, it doesn't work. Specifically, at the bottom of the file, when I call otptoken-add, I get: Unknown option: digits

Re: [Freeipa-devel] [WIP] OTP Token Import

2014-05-13 Thread Jan Cholasta
On 13.5.2014 15:20, Nathaniel McCallum wrote: On Tue, 2014-05-13 at 15:13 +0200, Jan Cholasta wrote: Hi, On 13.5.2014 01:39, Nathaniel McCallum wrote: The attached patch implements the OTP Token import script. However, it doesn't work. Specifically, at the bottom of the file, when I call

Re: [Freeipa-devel] [PATCH][DOC] Sometimes users set bad uid ranges

2014-05-13 Thread Petr Viktorin
On 05/09/2014 04:14 AM, Gabe Alford wrote: Hello, Just wondering if there are any takers in reviewing this patch. Sorry, looks like it fell through the cracks :( AFAIK the OS; entity should work for both Fedora and RHEL, so it should be possible to only have one copy of the

Re: [Freeipa-devel] [PATCH 0049] Add support for protected tokens

2014-05-13 Thread Jan Cholasta
On 12.5.2014 21:02, Nathaniel McCallum wrote: On Thu, 2014-05-08 at 13:51 -0400, Simo Sorce wrote: On Thu, 2014-05-08 at 12:26 -0400, Nathaniel McCallum wrote: On Wed, 2014-05-07 at 11:17 -0400, Simo Sorce wrote: On Wed, 2014-05-07 at 09:54 -0400, Dmitri Pal wrote: On 05/07/2014 09:05 AM,

Re: [Freeipa-devel] Consistent password hashing and lookups

2014-05-13 Thread Dmitri Pal
On 05/12/2014 10:37 PM, James wrote: On Mon, May 12, 2014 at 6:22 PM, Dmitri Pal d...@redhat.com wrote: On 05/12/2014 06:07 PM, James wrote: On Mon, 2014-05-12 at 17:56 -0400, Dmitri Pal wrote: Is there any other attribute to look at? For example the timestamp when it was last set and base

Re: [Freeipa-devel] [PATCH 0052] Only specify the ipatokenuniqueid default in the add operation

2014-05-13 Thread Jan Cholasta
On 12.5.2014 20:50, Nathaniel McCallum wrote: On Mon, 2014-05-12 at 18:40 +0200, Misnyovszki Adam wrote: On Tue, 06 May 2014 11:46:14 -0400 Nathaniel McCallum npmccal...@redhat.com wrote: On Tue, 2014-05-06 at 11:38 -0400, Nathaniel McCallum wrote: On Tue, 2014-05-06 at 17:34 +0200, Petr

Re: [Freeipa-devel] Consistent password hashing and lookups

2014-05-13 Thread James
On Tue, May 13, 2014 at 10:36 AM, Dmitri Pal d...@redhat.com wrote: This is their problem. Why would we aid them to do wrong things and make it easier? I really miss the point. Why it is all needed? Why do you need to reset passwords in IPA through puppet? What is the use case? Give me about

[Freeipa-devel] [PATCH 0053] Implement OTP token importing

2014-05-13 Thread Nathaniel McCallum
This patch adds support for importing tokens using RFC 6030 key container files. This includes decryption support. For sysadmin sanity, any tokens which fail to add will be written to the output file for examination. The main use case here is where a small subset of a large set of tokens fails to

Re: [Freeipa-devel] [PATCH 0053] Implement OTP token importing

2014-05-13 Thread Nathaniel McCallum
On Tue, 2014-05-13 at 12:38 -0400, Nathaniel McCallum wrote: This patch adds support for importing tokens using RFC 6030 key container files. This includes decryption support. For sysadmin sanity, any tokens which fail to add will be written to the output file for examination. The main use

Re: [Freeipa-devel] [PATCH 0052] Only specify the ipatokenuniqueid default in the add operation

2014-05-13 Thread Nathaniel McCallum
On Tue, 2014-05-13 at 16:47 +0200, Jan Cholasta wrote: On 12.5.2014 20:50, Nathaniel McCallum wrote: On Mon, 2014-05-12 at 18:40 +0200, Misnyovszki Adam wrote: On Tue, 06 May 2014 11:46:14 -0400 Nathaniel McCallum npmccal...@redhat.com wrote: On Tue, 2014-05-06 at 11:38 -0400, Nathaniel

Re: [Freeipa-devel] [PATCH 0049] Add support for protected tokens

2014-05-13 Thread Nathaniel McCallum
On Tue, 2014-05-13 at 16:33 +0200, Jan Cholasta wrote: On 12.5.2014 21:02, Nathaniel McCallum wrote: On Thu, 2014-05-08 at 13:51 -0400, Simo Sorce wrote: On Thu, 2014-05-08 at 12:26 -0400, Nathaniel McCallum wrote: On Wed, 2014-05-07 at 11:17 -0400, Simo Sorce wrote: On Wed, 2014-05-07 at

Re: [Freeipa-devel] Consistent password hashing and lookups

2014-05-13 Thread Simo Sorce
- Original Message - On Mon, 2014-05-12 at 17:56 -0400, Dmitri Pal wrote: Is there any other attribute to look at? For example the timestamp when it was last set and base the update on that rather than on matching password values? There are some other solutions, but they are

Re: [Freeipa-devel] Consistent password hashing and lookups

2014-05-13 Thread Simo Sorce
b- Original Message - On Mon, May 12, 2014 at 6:22 PM, Dmitri Pal d...@redhat.com wrote: On 05/12/2014 06:07 PM, James wrote: On Mon, 2014-05-12 at 17:56 -0400, Dmitri Pal wrote: Is there any other attribute to look at? For example the timestamp when it was last set and base

Re: [Freeipa-devel] [PATCH][DOC] Sometimes users set bad uid ranges

2014-05-13 Thread Gabe Alford
I had a typo with the one of the UIDs which is fixed with this patch. The difference is that Fedora/SSSD treats UIDs of 1000 and below as local system accounts whereas RHEL treats local system accounts at 500 and SSSD local system accounts at 1000. That's why there are conditional paragraphs