Re: [Freeipa-devel] [PATCH 0376] Add schema for unknown record types

2015-05-22 Thread Petr Spacek
On 22.5.2015 09:22, Martin Kosek wrote: On 05/22/2015 09:17 AM, Martin Basti wrote: On 21/05/15 12:42, Petr Spacek wrote: Hello, Add schema for unknown record types. This patch complements my previous patch 367. The change was pushed to

Re: [Freeipa-devel] [PATCH 0367] Support unknown record types (RFC 3597)

2015-05-22 Thread Petr Spacek
On 18.5.2015 17:31, Petr Spacek wrote: Hello, This patch is unrelated to metaDB but it should be merged before alpha, too. Thank you for review! Support unknown record types (RFC 3597). Fallback to generic LDAP attribute UnknownRecord;TYP256 if attempt to add specific attribute like

Re: [Freeipa-devel] [PATCH 0376] Add schema for unknown record types

2015-05-22 Thread Martin Kosek
On 05/22/2015 09:17 AM, Martin Basti wrote: On 21/05/15 12:42, Petr Spacek wrote: Hello, Add schema for unknown record types. This patch complements my previous patch 367. The change was pushed to https://github.com/pspacek/bind-dyndb-ldap/tree/unknown_record_types , too. ACK Hmmm, I

Re: [Freeipa-devel] [PATCH 0339-0363] Implement meta-database

2015-05-22 Thread Tomas Hozza
On 05/15/2015 11:37 AM, Petr Spacek wrote: Hello, this patch set adds meta-database which is one of prerequisites for other work. These changes should not be user-visible. You might compile the plugin with CFLAGS=-DMETADB_DEBUG and check contect of /tmp/metadb.db after BIND shutdown.

Re: [Freeipa-devel] [PATCHES 0001-0011 v3] Profile management

2015-05-22 Thread Martin Kosek
On 05/21/2015 05:33 PM, Martin Basti wrote: On 20/05/15 16:41, Fraser Tweedale wrote: Hi Honza, Martin et al, Latest patches attached. On top of previous patches (most review matters addressed**) patches 0008..0011 add support for profiles and user certificates to `ipa cert-request'. **

Re: [Freeipa-devel] [PATCH 0376] Add schema for unknown record types

2015-05-22 Thread Martin Basti
On 21/05/15 12:42, Petr Spacek wrote: Hello, Add schema for unknown record types. This patch complements my previous patch 367. The change was pushed to https://github.com/pspacek/bind-dyndb-ldap/tree/unknown_record_types , too. ACK -- Martin Basti -- Manage your subscription for the

Re: [Freeipa-devel] [PATCHES 0001-0011 v3] Profile management

2015-05-22 Thread Fraser Tweedale
On Thu, May 21, 2015 at 05:33:11PM +0200, Martin Basti wrote: On 20/05/15 16:41, Fraser Tweedale wrote: Hi Honza, Martin et al, Latest patches attached. On top of previous patches (most review matters addressed**) patches 0008..0011 add support for profiles and user certificates to `ipa

Re: [Freeipa-devel] certprofiles -- problem with delete

2015-05-22 Thread Fraser Tweedale
On Thu, May 21, 2015 at 03:20:30PM +0200, Martin Kosek wrote: On 05/21/2015 03:10 PM, Fraser Tweedale wrote: On Thu, May 21, 2015 at 02:36:14PM +0200, Milan Kubik wrote: Hi Fraser and list, I ran into this when I was tinkering with the commands. The ipa certprofile plugin[s] does not

Re: [Freeipa-devel] [PATCH 0325] Add Domain Level feature

2015-05-22 Thread Petr Vobornik
On 05/22/2015 07:08 AM, Jan Cholasta wrote: Dne 21.5.2015 v 18:18 Tomas Babej napsal(a): On 05/19/2015 04:07 PM, Tomas Babej wrote: On 05/19/2015 03:59 PM, Martin Kosek wrote: On 05/19/2015 03:56 PM, Tomas Babej wrote: On 05/19/2015 03:51 PM, Martin Kosek wrote: On 05/19/2015 03:49 PM,

Re: [Freeipa-devel] proposal: new API command to list IPA servers

2015-05-22 Thread Martin Kosek
On 05/21/2015 04:29 PM, Rob Crittenden wrote: Petr Vobornik wrote: Hi all, proposal is to create following two commands: ipa server-find ipa server-show FQDN These commands will display a list of IPA servers stored in cn=masters,cn=ipa,cn=etc,$SUFFIX No mod and add commands atm. They

[Freeipa-devel] Kerberos over HTTPS (KDC proxy)

2015-05-22 Thread Christian Heimes
Hello, since May 1st I'm a new Red Hat employee and developer with the FreeIPA team. Some of you may already recognize my name from my contributions to CPython core, Python security and TLS/SSL improvements, or a couple of PEPs. I'm very glad that I can now work on Open Source as a full time job.

Re: [Freeipa-devel] Kerberos over HTTPS (KDC proxy)

2015-05-22 Thread Martin Kosek
On 05/22/2015 12:24 PM, Christian Heimes wrote: Hello, since May 1st I'm a new Red Hat employee and developer with the FreeIPA team. Some of you may already recognize my name from my contributions to CPython core, Python security and TLS/SSL improvements, or a couple of PEPs. I'm very glad that

Re: [Freeipa-devel] Kerberos over HTTPS (KDC proxy)

2015-05-22 Thread Christian Heimes
On 2015-05-22 13:02, Martin Kosek wrote: The original proposal was to do it globally in cn=config. But if it is about to be stored in the cn=masters, per-replica, this looks as the right way. My first proposal used cn=ipaConfig,cn=etc because it was the first place I found. It took me a bit to

Re: [Freeipa-devel] [PATCH 0325] Add Domain Level feature

2015-05-22 Thread Tomas Babej
On 05/22/2015 12:36 PM, Petr Vobornik wrote: On 05/22/2015 07:08 AM, Jan Cholasta wrote: Dne 21.5.2015 v 18:18 Tomas Babej napsal(a): On 05/19/2015 04:07 PM, Tomas Babej wrote: On 05/19/2015 03:59 PM, Martin Kosek wrote: On 05/19/2015 03:56 PM, Tomas Babej wrote: On 05/19/2015 03:51

Re: [Freeipa-devel] Kerberos over HTTPS (KDC proxy)

2015-05-22 Thread Petr Vobornik
On 05/22/2015 01:17 PM, Christian Heimes wrote: On 2015-05-22 13:02, Martin Kosek wrote: The original proposal was to do it globally in cn=config. But if it is about to be stored in the cn=masters, per-replica, this looks as the right way. My first proposal used cn=ipaConfig,cn=etc because it

Re: [Freeipa-devel] Kerberos over HTTPS (KDC proxy)

2015-05-22 Thread Martin Basti
On 22/05/15 13:02, Martin Kosek wrote: On 05/22/2015 12:24 PM, Christian Heimes wrote: Hello, since May 1st I'm a new Red Hat employee and developer with the FreeIPA team. Some of you may already recognize my name from my contributions to CPython core, Python security and TLS/SSL improvements,

Re: [Freeipa-devel] [PATCH 0251] Fix uniqueness: exclude compat tree from uid uniquness plugin

2015-05-22 Thread Petr Vobornik
On 05/21/2015 11:07 AM, thierry bordaz wrote: Enforcing uniqueness for uid attribute prevent to move users to delete users subtree. snip So is this patch ACKed? Sorry, yes the fix is good. ACK master: * 98e4c6d6de130a0e94cd1705acc5418bdbda1eb1 Uid uniqueness: fix: exclude compat tree

Re: [Freeipa-devel] [PATCH 0325] Add Domain Level feature

2015-05-22 Thread Tomas Babej
On 05/22/2015 03:32 PM, Petr Vobornik wrote: On 05/22/2015 03:18 PM, Petr Vobornik wrote: On 05/22/2015 01:08 PM, Tomas Babej wrote: snip 1) https://www.redhat.com/archives/freeipa-devel/2015-May/msg00228.html - I still don't agree that the plugin should be based on LDAPObject. On the

Re: [Freeipa-devel] [PATCH] 854 git ignore ipaplatform/__init__.py

2015-05-22 Thread Petr Vobornik
On 05/21/2015 09:55 AM, Martin Babinsky wrote: On 05/20/2015 03:57 PM, Petr Vobornik wrote: This file is generated in `make version-update` added in 9f049ca14403f3696d54d186e6b1b15181f055df Yay no more warnings about untracked file! ACK Pushed to master:

Re: [Freeipa-devel] [PATCH 0254] Server Upgrade: Wait until DS is ready after restart

2015-05-22 Thread Petr Vobornik
On 05/21/2015 03:16 PM, Fraser Tweedale wrote: On Thu, May 21, 2015 at 01:38:43PM +0200, Martin Basti wrote: This patch should fix following traceback. 2015-05-20T03:50:41Z ERROR Upgrade failed with cannot connect to 'ldapi://%2fvar%2frun%2fslapd-IPA-LOCAL.socket': 2015-05-20T03:50:41Z DEBUG

Re: [Freeipa-devel] [PATCH 0325] Add Domain Level feature

2015-05-22 Thread Petr Vobornik
On 05/22/2015 01:08 PM, Tomas Babej wrote: snip 1) https://www.redhat.com/archives/freeipa-devel/2015-May/msg00228.html - I still don't agree that the plugin should be based on LDAPObject. On the other hand, with LDAPObject base, Web UI for this feature is much more simpler because it can

[Freeipa-devel] [PATCH 0048] fix ipa help command output errors

2015-05-22 Thread Gabe Alford
Hello, This should fix https://fedorahosted.org/freeipa/ticket/3584, and as requested in the ticket, this should also fix https://fedorahosted.org/freeipa/ticket/2284 Thanks, Gabe From 3d4e7b60287f30e70455facb0035fa30df913c34 Mon Sep 17 00:00:00 2001 From: Gabe redhatri...@gmail.com Date: Fri,

[Freeipa-devel] [PATCH 0256] DNS: add UnknonwRecord attribute to schema

2015-05-22 Thread Martin Basti
Patch attached. Initial part of https://fedorahosted.org/freeipa/ticket/4939 -- Martin Basti From 50fd8f7d2d11f963a288c18dd4d1d98c941b7d51 Mon Sep 17 00:00:00 2001 From: Martin Basti mba...@redhat.com Date: Fri, 22 May 2015 12:39:08 +0200 Subject: [PATCH] DNS: add UnknownRecord to schema

Re: [Freeipa-devel] Kerberos over HTTPS (KDC proxy)

2015-05-22 Thread Christian Heimes
On 2015-05-22 14:02, Petr Vobornik wrote: Actually the service part of IPA servers is not covered in the proposal. The proposal just says that it can be added later. There will be question if it should even be called services. Maybe capabilities would be better term given that KDC Proxy is

Re: [Freeipa-devel] [PATCH 0255] Server Upgrade: Fix: executed schema upgrade

2015-05-22 Thread Petr Vobornik
On 05/21/2015 04:51 PM, Fraser Tweedale wrote: On Thu, May 21, 2015 at 02:49:03PM +0200, Martin Basti wrote: Accidentaly , schema upgrade hasn't beed executed by ipa-server-upgrade. https://fedorahosted.org/freeipa/ticket/4904 Patch attached. -- Martin Basti ACK; the schema changes once

Re: [Freeipa-devel] [PATCH 0325] Add Domain Level feature

2015-05-22 Thread Petr Vobornik
On 05/22/2015 03:18 PM, Petr Vobornik wrote: On 05/22/2015 01:08 PM, Tomas Babej wrote: snip 1) https://www.redhat.com/archives/freeipa-devel/2015-May/msg00228.html - I still don't agree that the plugin should be based on LDAPObject. On the other hand, with LDAPObject base, Web UI for this

Re: [Freeipa-devel] [PATCH 0048] fix ipa help command output errors

2015-05-22 Thread Martin Basti
On 22/05/15 16:08, Gabe Alford wrote: Hello, This should fix https://fedorahosted.org/freeipa/ticket/3584, and as requested in the ticket, this should also fix https://fedorahosted.org/freeipa/ticket/2284 Thanks, Gabe Thank you! IMO your first part of fix only mask issue, not solving

Re: [Freeipa-devel] [PATCH 0325] Add Domain Level feature

2015-05-22 Thread Tomas Babej
On 05/22/2015 03:52 PM, Tomas Babej wrote: On 05/22/2015 03:32 PM, Petr Vobornik wrote: On 05/22/2015 03:18 PM, Petr Vobornik wrote: On 05/22/2015 01:08 PM, Tomas Babej wrote: snip 1) https://www.redhat.com/archives/freeipa-devel/2015-May/msg00228.html - I still don't agree that the

Re: [Freeipa-devel] [PATCH] manage replication topology in the shared tree

2015-05-22 Thread Petr Vobornik
On 05/21/2015 12:55 PM, thierry bordaz wrote: On 05/20/2015 05:40 PM, Ludwig Krispenz wrote: please find new versions of patches 0003 and 0005 for the topology plugin. the ds plugin patch includes - changes to match domain level patch - remove trailing white spaces - use proper oids for

Re: [Freeipa-devel] [PATCH 0048] fix ipa help command output errors

2015-05-22 Thread Gabe Alford
On Fri, May 22, 2015 at 9:01 AM, Martin Basti mba...@redhat.com wrote: On 22/05/15 16:08, Gabe Alford wrote: Hello, This should fix https://fedorahosted.org/freeipa/ticket/3584, and as requested in the ticket, this should also fix https://fedorahosted.org/freeipa/ticket/2284 Thanks,

[Freeipa-devel] [PATCH 0258] Server Upgrade: move code from ipa-upgrade config into separate module

2015-05-22 Thread Martin Basti
IPA services upgrade is executed only by ipa-server-upgrade, ipa-upgradeconfig will not work. Patch attached. https://fedorahosted.org/freeipa/ticket/4904 -- Martin Basti From 23272ea2f1eb8473563a7c84bbae3f276a9a495f Mon Sep 17 00:00:00 2001 From: Martin Basti mba...@redhat.com Date: Fri, 22

Re: [Freeipa-devel] [PATCH 0048] fix ipa help command output errors

2015-05-22 Thread Martin Basti
On 22/05/15 17:40, Gabe Alford wrote: On Fri, May 22, 2015 at 9:01 AM, Martin Basti mba...@redhat.com mailto:mba...@redhat.com wrote: On 22/05/15 16:08, Gabe Alford wrote: Hello, This should fix https://fedorahosted.org/freeipa/ticket/3584, and as requested in the ticket,