Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-31 Thread Jan Cholasta
Dne 30.7.2014 v 16:39 Nalin Dahyabhai napsal(a): On Wed, Jul 30, 2014 at 04:28:50PM +0200, Jan Cholasta wrote: These two functions are used to force local hostname in certmonger. IMO the right thing to do here would be to drop these two functions and fix ipa-submit so that it reads the required

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-31 Thread Nalin Dahyabhai
On Thu, Jul 31, 2014 at 09:19:28AM +0200, Jan Cholasta wrote: If you mean host, yes, the man page says it's the server's hostname, but I don't think that's entirely true - it is currently set during server install, but it defaults to local hostname even on clients. IMO we could set it in

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-30 Thread David Kupka
On 07/23/2014 03:45 PM, Nalin Dahyabhai wrote: On Wed, Jul 23, 2014 at 10:12:39AM +0200, Martin Kosek wrote: Certmonger API looked complete enough to pull this off: https://git.fedorahosted.org/cgit/certmonger.git/tree/doc/api.txt If I am wrong, please tell me. No, it's meant to be complete

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-30 Thread Jan Cholasta
Dne 30.7.2014 v 15:51 David Kupka napsal(a): On 07/23/2014 03:45 PM, Nalin Dahyabhai wrote: On Wed, Jul 23, 2014 at 10:12:39AM +0200, Martin Kosek wrote: Certmonger API looked complete enough to pull this off: https://git.fedorahosted.org/cgit/certmonger.git/tree/doc/api.txt If I am wrong,

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-30 Thread Nalin Dahyabhai
On Wed, Jul 30, 2014 at 04:28:50PM +0200, Jan Cholasta wrote: These two functions are used to force local hostname in certmonger. IMO the right thing to do here would be to drop these two functions and fix ipa-submit so that it reads the required configuration from /etc/ipa/default.conf. Can

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-30 Thread Nalin Dahyabhai
On Wed, Jul 30, 2014 at 03:51:08PM +0200, David Kupka wrote: In fact it is almost enough complete for us. The only operation I can't find is 'write ca_external_helper'. add_principal_to_cas and remove_principal_from_cas are modifying this entry in ca file. Certmonger provide 'get_location'

[Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-23 Thread David Kupka
While solving ticket #4280 I noticed that we are messing with certmonger's files right under its hands. That can lead to some unpleasant race condition issues. Is there any reason why not to call certmonger via DBus and ask it to stop tracking the requests? -- David Kupka

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-23 Thread Martin Kosek
On 07/23/2014 09:56 AM, David Kupka wrote: While solving ticket #4280 I noticed that we are messing with certmonger's files right under its hands. That can lead to some unpleasant race condition issues. Is there any reason why not to call certmonger via DBus and ask it to stop tracking the

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-23 Thread Jan Cholasta
On 23.7.2014 10:12, Martin Kosek wrote: On 07/23/2014 09:56 AM, David Kupka wrote: While solving ticket #4280 I noticed that we are messing with certmonger's files right under its hands. That can lead to some unpleasant race condition issues. Is there any reason why not to call certmonger via

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-23 Thread Alexander Bokovoy
On Wed, 23 Jul 2014, Martin Kosek wrote: On 07/23/2014 09:56 AM, David Kupka wrote: While solving ticket #4280 I noticed that we are messing with certmonger's files right under its hands. That can lead to some unpleasant race condition issues. Is there any reason why not to call certmonger via

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-23 Thread Martin Kosek
On 07/23/2014 10:33 AM, Jan Cholasta wrote: On 23.7.2014 10:12, Martin Kosek wrote: On 07/23/2014 09:56 AM, David Kupka wrote: While solving ticket #4280 I noticed that we are messing with certmonger's files right under its hands. That can lead to some unpleasant race condition issues. Is

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-23 Thread Jan Cholasta
On 23.7.2014 10:38, Martin Kosek wrote: On 07/23/2014 10:33 AM, Jan Cholasta wrote: On 23.7.2014 10:12, Martin Kosek wrote: On 07/23/2014 09:56 AM, David Kupka wrote: While solving ticket #4280 I noticed that we are messing with certmonger's files right under its hands. That can lead to some

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-23 Thread Martin Kosek
On 07/23/2014 10:49 AM, Jan Cholasta wrote: On 23.7.2014 10:38, Martin Kosek wrote: On 07/23/2014 10:33 AM, Jan Cholasta wrote: On 23.7.2014 10:12, Martin Kosek wrote: On 07/23/2014 09:56 AM, David Kupka wrote: While solving ticket #4280 I noticed that we are messing with certmonger's files

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-23 Thread Jan Cholasta
On 23.7.2014 12:23, Martin Kosek wrote: On 07/23/2014 10:49 AM, Jan Cholasta wrote: On 23.7.2014 10:38, Martin Kosek wrote: On 07/23/2014 10:33 AM, Jan Cholasta wrote: On 23.7.2014 10:12, Martin Kosek wrote: On 07/23/2014 09:56 AM, David Kupka wrote: While solving ticket #4280 I noticed

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-23 Thread Nalin Dahyabhai
On Wed, Jul 23, 2014 at 11:32:52AM +0300, Alexander Bokovoy wrote: Were there DBus Python bindings available in RHEL 5/6 at the time when the code was written? Yes, but the API itself wasn't all there, and large parts of the internals needed to be rewritten around its 0.53 release. Before

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-23 Thread Nalin Dahyabhai
On Wed, Jul 23, 2014 at 10:12:39AM +0200, Martin Kosek wrote: Certmonger API looked complete enough to pull this off: https://git.fedorahosted.org/cgit/certmonger.git/tree/doc/api.txt If I am wrong, please tell me. No, it's meant to be complete -- the getcert command only uses the APIs to