Re: [Freeipa-devel] [PATCH] Password vault

2015-06-01 Thread Martin Kosek
On 06/02/2015 02:00 AM, Endi Sukma Dewata wrote: Please take a look at the updated patch. On 5/27/2015 12:39 AM, Jan Cholasta wrote: 21) vault_archive is not a retrieve operation, it should be based on LDAPUpdate instead of LDAPRetrieve. Or Command actually, since it does not do anything with L

Re: [Freeipa-devel] [PATCH] Password vault

2015-06-01 Thread Endi Sukma Dewata
On 5/28/2015 12:46 AM, Jan Cholasta wrote: On a related note, since KRA is optional, can we move the vaults container to cn=kra,cn=vaults? This is the convetion used by the other optional components (DNS and recently CA). I mean cn=vaults,cn=kra of course. If you are talking about the o=kra,,

Re: [Freeipa-devel] [PATCH] Password vault

2015-06-01 Thread Endi Sukma Dewata
Please take a look at the updated patch. On 5/27/2015 12:39 AM, Jan Cholasta wrote: 21) vault_archive is not a retrieve operation, it should be based on LDAPUpdate instead of LDAPRetrieve. Or Command actually, since it does not do anything with LDAP. The same applies to vault_retrieve. The vau

Re: [Freeipa-devel] [PATCH 0007] replica install fails with domain level 1

2015-06-01 Thread Ludwig Krispenz
Hi Oleg, On 06/01/2015 04:14 PM, Petr Vobornik wrote: On 06/01/2015 01:48 PM, Ludwig Krispenz wrote: On 06/01/2015 01:34 PM, Oleg Fayans wrote: So far I've bumped into problem, using the newly built packages: I've installed a master, a replica (replica1) Then replica3 (prepared on replica1),

Re: [Freeipa-devel] [PATCH 0262] Installer FIX: remove temporal ccache

2015-06-01 Thread Martin Basti
On 01/06/15 16:14, Rob Crittenden wrote: Martin Basti wrote: Fixes an issue caused by the latest installer patches pushed to master. Patch attached. The use of globals makes my skin crawl a bit, but since you're making changes in here you should take a look at this ticket: https://fedora

Re: [Freeipa-devel] Domain level change failed

2015-06-01 Thread Petr Vobornik
On 06/01/2015 04:13 PM, Oleg Fayans wrote: Hi, In my installation of the freeipa built with the latest topology patches applied, I was unable to reset domain level to 0 on neither of nodes: ofayans@testmaster:~/ldap]$ ipa domainlevel-set 0 ipa: ERROR: Domain Level cannot be lowered. I am able

Re: [Freeipa-devel] Domain level change failed

2015-06-01 Thread Tomas Babej
On 06/01/2015 04:13 PM, Oleg Fayans wrote: > Hi, > > In my installation of the freeipa built with the latest topology patches > applied, I was unable to reset domain level to 0 on neither of nodes: > > ofayans@testmaster:~/ldap]$ ipa domainlevel-set 0 > ipa: ERROR: Domain Level cannot be lowere

Re: [Freeipa-devel] [PATCH 0262] Installer FIX: remove temporal ccache

2015-06-01 Thread Rob Crittenden
Martin Basti wrote: Fixes an issue caused by the latest installer patches pushed to master. Patch attached. The use of globals makes my skin crawl a bit, but since you're making changes in here you should take a look at this ticket: https://fedorahosted.org/freeipa/ticket/5042 rob -- M

Re: [Freeipa-devel] [PATCH 0007] replica install fails with domain level 1

2015-06-01 Thread Petr Vobornik
On 06/01/2015 01:48 PM, Ludwig Krispenz wrote: On 06/01/2015 01:34 PM, Oleg Fayans wrote: So far I've bumped into problem, using the newly built packages: I've installed a master, a replica (replica1) Then replica3 (prepared on replica1), so, my topology looks like this: master <=> replica1 <

[Freeipa-devel] Domain level change failed

2015-06-01 Thread Oleg Fayans
Hi, In my installation of the freeipa built with the latest topology patches applied, I was unable to reset domain level to 0 on neither of nodes: ofayans@testmaster:~/ldap]$ ipa domainlevel-set 0 ipa: ERROR: Domain Level cannot be lowered. I am able to reset domain level to 0 manually using

Re: [Freeipa-devel] [PATCH 0007] replica install fails with domain level 1

2015-06-01 Thread thierry bordaz
On 06/01/2015 11:19 AM, Oleg Fayans wrote: Woks for me too. Will perform extensive testing today, and report everything that I find. Thanks, Ludwig! On 05/29/2015 04:44 PM, Ludwig Krispenz wrote: This is a patch for the two issues reported in ticket #5035 https://fedorahosted.org/freeipa/ticke

Re: [Freeipa-devel] [PATCH 0014 v3] Support multiple user and host certificates

2015-06-01 Thread Martin Basti
On 01/06/15 06:40, Fraser Tweedale wrote: New version of patch; ``{host,service}-show --out=FILE`` now writes all certs to FILE. Rebased on latest master. Thanks, Fraser On Thu, May 28, 2015 at 09:18:04PM +1000, Fraser Tweedale wrote: Updated patch attached. Notably restores/adds revocation

[Freeipa-devel] [PATCH 0262] Installer FIX: remove temporal ccache

2015-06-01 Thread Martin Basti
Fixes an issue caused by the latest installer patches pushed to master. Patch attached. -- Martin Basti From dab97352b07b4c71e2506fc9eb1f88b4c9c94f17 Mon Sep 17 00:00:00 2001 From: Martin Basti Date: Mon, 1 Jun 2015 13:13:17 +0200 Subject: [PATCH] Installers fix: remove temporal ccache Enviro

Re: [Freeipa-devel] [PATCH 0007] replica install fails with domain level 1

2015-06-01 Thread Ludwig Krispenz
On 06/01/2015 01:34 PM, Oleg Fayans wrote: So far I've bumped into problem, using the newly built packages: I've installed a master, a replica (replica1) Then replica3 (prepared on replica1), so, my topology looks like this: master <=> replica1 <=> replica3 However, the `ipa topologysegment

Re: [Freeipa-devel] [PATCH 0007] replica install fails with domain level 1

2015-06-01 Thread Oleg Fayans
Woks for me too. Will perform extensive testing today, and report everything that I find. Thanks, Ludwig! On 05/29/2015 04:44 PM, Ludwig Krispenz wrote: This is a patch for the two issues reported in ticket #5035 https://fedorahosted.org/freeipa/ticket/5035 Works for me. I was able to insta

Re: [Freeipa-devel] [PATCH 0007] replica install fails with domain level 1

2015-06-01 Thread Petr Vobornik
On 05/29/2015 04:44 PM, Ludwig Krispenz wrote: This is a patch for the two issues reported in ticket #5035 https://fedorahosted.org/freeipa/ticket/5035 Works for me. I was able to install 2 replicas with domain level 1 in one topology. Code looks good to me as well. Tentative ACK (would be

Re: [Freeipa-devel] [PATCHES 0001-0013 v5.1] Profiles and CA ACLs

2015-06-01 Thread Fraser Tweedale
On Mon, Jun 01, 2015 at 05:10:58PM +1000, Fraser Tweedale wrote: > On Fri, May 29, 2015 at 01:03:46PM +0200, Martin Kosek wrote: > > On 05/29/2015 11:21 AM, Martin Basti wrote: > > >On 29/05/15 06:17, Fraser Tweedale wrote: > > >>On Thu, May 28, 2015 at 02:42:53PM +0200, Martin Basti wrote: > > >>>