Re: [Freeipa-devel] Why do we require DNS record when service is being added?

2015-07-14 Thread Jan Pazdziora
On Tue, Jul 14, 2015 at 08:31:19AM +0200, Petr Spacek wrote: On 13.7.2015 19:37, Jan Pazdziora wrote: However -- what is the purpose of the DNS check when adding service? The service is typically a Kerberos service, which usually is not going to work if the host does not have DNS record.

Re: [Freeipa-devel] Why do we require DNS record when service is being added?

2015-07-14 Thread Petr Spacek
On 13.7.2015 19:37, Jan Pazdziora wrote: Hello, we got a nack https://www.redhat.com/archives/freeipa-devel/2015-July/msg00259.html when attempting to address ticket https://fedorahosted.org/freeipa/ticket/3959 Basically, when service is being added with ipa

Re: [Freeipa-devel] [PATCH 0006] Start dirsrv for kdcproxy upgrade

2015-07-14 Thread Jan Cholasta
Dne 13.7.2015 v 16:30 Martin Basti napsal(a): On 10/07/15 18:29, Christian Heimes wrote: Hi, this patch ensures that DS is running before HTTPInstance attempts to connect to LDAP. https://fedorahosted.org/freeipa/ticket/5113 While I was testing the patch I ran into trouble with DS. The

Re: [Freeipa-devel] [PATCH 007-010] Remove tuple unpacking from except clause

2015-07-14 Thread Alexander Bokovoy
On Tue, 14 Jul 2015, Christian Heimes wrote: On 2015-07-13 16:29, Alexander Bokovoy wrote: I will pushmark the commit there. Please do not push this specific version of the patch yet. Christian will do the changes with four separate commits as discussed on the IRC, to avoid future problems

Re: [Freeipa-devel] [PATCH 0006] Start dirsrv for kdcproxy upgrade

2015-07-14 Thread Jan Cholasta
Dne 14.7.2015 v 12:38 Jan Cholasta napsal(a): Dne 13.7.2015 v 16:30 Martin Basti napsal(a): On 10/07/15 18:29, Christian Heimes wrote: Hi, this patch ensures that DS is running before HTTPInstance attempts to connect to LDAP. https://fedorahosted.org/freeipa/ticket/5113 While I was testing

Re: [Freeipa-devel] [PATCH 0282] Prevent to rename certprofile profile id

2015-07-14 Thread Jan Cholasta
Dne 10.7.2015 v 12:52 Simo Sorce napsal(a): On Fri, 2015-07-10 at 11:28 +0200, Jan Cholasta wrote: Dne 10.7.2015 v 11:10 Simo Sorce napsal(a): On Fri, 2015-07-10 at 11:01 +0200, Jan Cholasta wrote: Dne 10.7.2015 v 10:59 Jan Cholasta napsal(a): Dne 10.7.2015 v 10:43 Martin Basti napsal(a):

Re: [Freeipa-devel] [PATCH 0023] enable debugging of spawned ntpd command during client install

2015-07-14 Thread Martin Babinsky
On 03/30/2015 12:38 PM, Martin Babinsky wrote: On 03/26/2015 01:14 PM, Martin Kosek wrote: On 03/25/2015 04:18 PM, Jan Cholasta wrote: Hi, Dne 25.3.2015 v 15:26 Martin Babinsky napsal(a): The attached patch related to https://fedorahosted.org/freeipa/ticket/4931 Please make sure

Re: [Freeipa-devel] [PATCH 529] Fix DNS record installation for replicas

2015-07-14 Thread Jan Cholasta
Dne 13.7.2015 v 15:03 Martin Basti napsal(a): On 10/07/15 19:57, Simo Sorce wrote: On Fri, 2015-07-10 at 13:03 -0400, Simo Sorce wrote: This bug affects 4.2, we should backport the fix there too. See ticket: https://fedorahosted.org/freeipa/ticket/5116 For what is worth I tested this change

Re: [Freeipa-devel] Why do we require DNS record when service is being added?

2015-07-14 Thread Alexander Bokovoy
On Tue, 14 Jul 2015, Jan Pazdziora wrote: On Tue, Jul 14, 2015 at 08:31:19AM +0200, Petr Spacek wrote: On 13.7.2015 19:37, Jan Pazdziora wrote: However -- what is the purpose of the DNS check when adding service? The service is typically a Kerberos service, which usually is not going to work

Re: [Freeipa-devel] [patch 0004] spec file: Update the package name from libipa_hbac-python to python-libipa_hbac

2015-07-14 Thread Jan Cholasta
Dne 10.7.2015 v 13:25 Milan Kubik napsal(a): On 07/10/2015 12:55 PM, Jan Cholasta wrote: Hi, Dne 10.7.2015 v 12:05 Milan Kubik napsal(a): Name update + the renamed package breaks 'dnf builddep'. I will report the bug. Yum can take care of the conflict resolution. Patch attached.

Re: [Freeipa-devel] [PATCH 007-010] Remove tuple unpacking from except clause

2015-07-14 Thread Christian Heimes
On 2015-07-13 16:29, Alexander Bokovoy wrote: I will pushmark the commit there. Please do not push this specific version of the patch yet. Christian will do the changes with four separate commits as discussed on the IRC, to avoid future problems with maintenance and backports. Alex, please

[Freeipa-devel] [PATCH 011] [py3] Replace file() with open()

2015-07-14 Thread Christian Heimes
The patch replaces file() with open() and a proper with statement. The patch is related to https://fedorahosted.org/freeipa/ticket/5127 Christian From db8e96818344b5d9c59789b1a77abc0f958873a0 Mon Sep 17 00:00:00 2001 From: Christian Heimes chei...@redhat.com Date: Tue, 14 Jul 2015 13:18:55 +0200

[Freeipa-devel] [PATCH] 0191 Add SELinux boolean for oddjobd-activated services

2015-07-14 Thread Alexander Bokovoy
Hi! An SELinux policy we need for one-way trust is now in Fedora updates-testing repository. Attached patch adds support for 'httpd_run_ipa' SELinux boolean. Below is how one-way trust is using the communication with oddjobd (it is a slightly fixed copy of the description of bug

Re: [Freeipa-devel] [PATCH 011] [py3] Replace file() with open()

2015-07-14 Thread Tomas Babej
On 07/14/2015 01:29 PM, Christian Heimes wrote: On 2015-07-14 13:24, Christian Heimes wrote: The patch replaces file() with open() and a proper with statement. The patch is related to https://fedorahosted.org/freeipa/ticket/5127 Christian The first patch has a typo. Note to self:

[Freeipa-devel] [PATCH 464] spec file: Move /etc/ipa/kdcproxy to the server subpackage

2015-07-14 Thread Jan Cholasta
Hi, the attached patch fixes client-only builds. Honza -- Jan Cholasta From 1576727ebb7fe9084a5c7bdf9a40670e41093b07 Mon Sep 17 00:00:00 2001 From: Jan Cholasta jchol...@redhat.com Date: Tue, 14 Jul 2015 11:41:46 + Subject: [PATCH] spec file: Move /etc/ipa/kdcproxy to the server subpackage

[Freeipa-devel] 4.3 Branch?

2015-07-14 Thread Nathaniel McCallum
4.3 is going to be a very narrow feature release. Should we branch 4.3 early so that we can still land new features on master during 4.3? -- Manage your subscription for the Freeipa-devel mailing list: https://www.redhat.com/mailman/listinfo/freeipa-devel Contribute to FreeIPA:

Re: [Freeipa-devel] [PATCH 011] [py3] Replace file() with open()

2015-07-14 Thread Christian Heimes
On 2015-07-14 13:24, Christian Heimes wrote: The patch replaces file() with open() and a proper with statement. The patch is related to https://fedorahosted.org/freeipa/ticket/5127 Christian The first patch has a typo. Note to self: save file first, then commit Christian From

Re: [Freeipa-devel] [PATCH 007-010] Remove tuple unpacking from except clause

2015-07-14 Thread Tomas Babej
On 07/14/2015 12:45 PM, Alexander Bokovoy wrote: On Tue, 14 Jul 2015, Christian Heimes wrote: On 2015-07-13 16:29, Alexander Bokovoy wrote: I will pushmark the commit there. Please do not push this specific version of the patch yet. Christian will do the changes with four separate commits

Re: [Freeipa-devel] [PATCH 0283] copy-schema-to-ca: allow to overwrite schema files

2015-07-14 Thread David Kupka
On 10/07/15 14:31, Martin Basti wrote: https://fedorahosted.org/freeipa/ticket/5034 Patch attached. Works for me, ACK. -- David Kupka -- Manage your subscription for the Freeipa-devel mailing list: https://www.redhat.com/mailman/listinfo/freeipa-devel Contribute to FreeIPA:

Re: [Freeipa-devel] [PATCHES 0042-45] new commands for adding/removing certificates from entries

2015-07-14 Thread Milan KubĂ­k
On 07/02/2015 04:44 PM, Jan Cholasta wrote: Dne 2.7.2015 v 16:36 Martin Babinsky napsal(a): On 07/02/2015 02:37 PM, Martin Babinsky wrote: On 07/02/2015 11:28 AM, Martin Babinsky wrote: On 07/02/2015 11:12 AM, Martin Babinsky wrote: On 07/01/2015 03:05 PM, Martin Babinsky wrote: On

Re: [Freeipa-devel] Why do we require DNS record when service is being added?

2015-07-14 Thread Alexander Bokovoy
On Tue, 14 Jul 2015, Petr Spacek wrote: On 14.7.2015 10:08, Alexander Bokovoy wrote: On Tue, 14 Jul 2015, Jan Pazdziora wrote: On Tue, Jul 14, 2015 at 08:31:19AM +0200, Petr Spacek wrote: On 13.7.2015 19:37, Jan Pazdziora wrote: However -- what is the purpose of the DNS check when adding

Re: [Freeipa-devel] [PATCH 0052] Create server-dns sub-package

2015-07-14 Thread Petr Spacek
On 2.7.2015 09:56, Petr Spacek wrote: On 2.7.2015 09:36, Alexander Bokovoy wrote: On Thu, 02 Jul 2015, Jan Cholasta wrote: Can this be done without adding server-core? I'm not aware of such method (except of adding all DNS dependencies as Requires straight into freeipa-server package).

Re: [Freeipa-devel] Why do we require DNS record when service is being added?

2015-07-14 Thread Petr Spacek
On 14.7.2015 10:08, Alexander Bokovoy wrote: On Tue, 14 Jul 2015, Jan Pazdziora wrote: On Tue, Jul 14, 2015 at 08:31:19AM +0200, Petr Spacek wrote: On 13.7.2015 19:37, Jan Pazdziora wrote: However -- what is the purpose of the DNS check when adding service? The service is typically a

Re: [Freeipa-devel] Why do we require DNS record when service is being added?

2015-07-14 Thread Petr Spacek
On 14.7.2015 13:50, Alexander Bokovoy wrote: On Tue, 14 Jul 2015, Petr Spacek wrote: On 14.7.2015 10:08, Alexander Bokovoy wrote: On Tue, 14 Jul 2015, Jan Pazdziora wrote: On Tue, Jul 14, 2015 at 08:31:19AM +0200, Petr Spacek wrote: On 13.7.2015 19:37, Jan Pazdziora wrote: However -- what

Re: [Freeipa-devel] [PATCH 0052] Create server-dns sub-package

2015-07-14 Thread Petr Spacek
On 14.7.2015 16:29, Jan Cholasta wrote: Dne 14.7.2015 v 14:33 Petr Spacek napsal(a): On 2.7.2015 09:56, Petr Spacek wrote: On 2.7.2015 09:36, Alexander Bokovoy wrote: On Thu, 02 Jul 2015, Jan Cholasta wrote: Can this be done without adding server-core? I'm not aware of such method (except of

Re: [Freeipa-devel] [PATCH 0052] Create server-dns sub-package

2015-07-14 Thread Jan Cholasta
Dne 14.7.2015 v 14:33 Petr Spacek napsal(a): On 2.7.2015 09:56, Petr Spacek wrote: On 2.7.2015 09:36, Alexander Bokovoy wrote: On Thu, 02 Jul 2015, Jan Cholasta wrote: Can this be done without adding server-core? I'm not aware of such method (except of adding all DNS dependencies as Requires

[Freeipa-devel] ipa-devel repos on jdennis.fedorapeople.org

2015-07-14 Thread Petr Spacek
Hello, Is anyone using repos https://jdennis.fedorapeople.org/ipa-devel/ ? AFAIK nobody in Brno is seriously using it but I'm not sure about people outside the Brno. Could we use COPR instead and get out of builder business? Upcoming lab maintenance window could be a good time to do that. --

Re: [Freeipa-devel] [PATCH 0052] Create server-dns sub-package

2015-07-14 Thread Alexander Bokovoy
On Tue, 14 Jul 2015, Petr Spacek wrote: On 14.7.2015 16:29, Jan Cholasta wrote: Dne 14.7.2015 v 14:33 Petr Spacek napsal(a): On 2.7.2015 09:56, Petr Spacek wrote: On 2.7.2015 09:36, Alexander Bokovoy wrote: On Thu, 02 Jul 2015, Jan Cholasta wrote: Can this be done without adding

[Freeipa-devel] [PATCH] 903 fix hbac rule search for non-admin users

2015-07-14 Thread Petr Vobornik
hbacrule has it default attributes (which are used in search) attribute 'memberhostgroup'. This attr is not in ACI nor in schema. If the search contains an attribute which can't be read then the search won't return anything. Therefore all searches with filter set fail. Also I don't think this

[Freeipa-devel] [PATCH] 902 webui: fix user reset password dialog

2015-07-14 Thread Petr Vobornik
Could not open user password dialog. regression introduced in ed78dcfa3acde7aeb1f381f49988c6911c5277ee https://fedorahosted.org/freeipa/ticket/5131 -- Petr Vobornik From 69324d20025039d821ca4c6a2d06abb38f79ab4c Mon Sep 17 00:00:00 2001 From: Petr Vobornik pvobo...@redhat.com Date: Tue, 14 Jul

[Freeipa-devel] Finishing the Community Portal

2015-07-14 Thread Drew Erny
Hi, all, I'm just about finished with the Community Portal, which I've said a couple of times, but I really mean it this time. The Captcha was the last technical detail that needed addressing. At this point, any further programming is going to be dedicated to configuration of the application.