Re: [Freeipa-devel] [PATCH] 993 disable UPG for migration

2012-04-03 Thread Martin Kosek
On Mon, 2012-04-02 at 15:18 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Fri, 2012-03-30 at 09:05 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2012-03-29 at 11:27 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Wed, 2012-03-28 at 17:28 -0400, Rob Crittenden wrote:

Re: [Freeipa-devel] [PATCH] 993 disable UPG for migration

2012-04-02 Thread Martin Kosek
On Fri, 2012-03-30 at 09:05 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2012-03-29 at 11:27 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Wed, 2012-03-28 at 17:28 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2012-03-22 at 15:21 -0400, Rob Crittenden wrote:

Re: [Freeipa-devel] [PATCH] 993 disable UPG for migration

2012-04-02 Thread Rob Crittenden
Martin Kosek wrote: On Fri, 2012-03-30 at 09:05 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2012-03-29 at 11:27 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Wed, 2012-03-28 at 17:28 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2012-03-22 at 15:21 -0400, Rob

Re: [Freeipa-devel] [PATCH] 993 disable UPG for migration

2012-03-30 Thread Rob Crittenden
Martin Kosek wrote: On Thu, 2012-03-29 at 11:27 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Wed, 2012-03-28 at 17:28 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2012-03-22 at 15:21 -0400, Rob Crittenden wrote: We don't want to create private groups automatically for

Re: [Freeipa-devel] [PATCH] 993 disable UPG for migration

2012-03-29 Thread Martin Kosek
On Wed, 2012-03-28 at 17:28 -0400, Rob Crittenden wrote: Martin Kosek wrote: On Thu, 2012-03-22 at 15:21 -0400, Rob Crittenden wrote: We don't want to create private groups automatically for migrated users, there could be namespace overlap (and race conditions prevent us from trying to

Re: [Freeipa-devel] [PATCH] 993 disable UPG for migration

2012-03-29 Thread Simo Sorce
On Thu, 2012-03-29 at 11:27 -0400, Rob Crittenden wrote: This patch is much better and covers my previous concerns. I just find an issue with UPG. It is not created for non-posix users when UPGs are enabled: # echo Secret123 | ipa migrate-ds ldap://ldap.example.com --with-compat

Re: [Freeipa-devel] [PATCH] 993 disable UPG for migration

2012-03-29 Thread Rob Crittenden
Simo Sorce wrote: On Thu, 2012-03-29 at 11:27 -0400, Rob Crittenden wrote: This patch is much better and covers my previous concerns. I just find an issue with UPG. It is not created for non-posix users when UPGs are enabled: # echo Secret123 | ipa migrate-ds ldap://ldap.example.com

Re: [Freeipa-devel] [PATCH] 993 disable UPG for migration

2012-03-29 Thread Simo Sorce
On Thu, 2012-03-29 at 15:25 -0400, Rob Crittenden wrote: Simo Sorce wrote: On Thu, 2012-03-29 at 11:27 -0400, Rob Crittenden wrote: This patch is much better and covers my previous concerns. I just find an issue with UPG. It is not created for non-posix users when UPGs are enabled:

[Freeipa-devel] [PATCH] 993 disable UPG for migration

2012-03-22 Thread Rob Crittenden
We don't want to create private groups automatically for migrated users, there could be namespace overlap (and race conditions prevent us from trying to check in advance). Check the sanity of groups in general, warn if the group for the gidnumber doesn't exist at least on the remote server.