Re: [Freeipa-devel] [PATCH] 0001 Provide Kerberos over HTTP (MS-KKDCP)

2015-06-15 Thread Christian Heimes
On 2015-06-12 23:58, Adam Young wrote: So...I've been spoiled a bit by Gerrit. Here is what I just did to get them to apply: cd freeipa git clean -xdf . #use the -3 to do 3 way merge git am -3

[Freeipa-devel] Unable to prepare a replica file on a replica

2015-06-15 Thread Oleg Fayans
Hi all, In my letter from 06/09/2015 03:55 PM, I indicated 2 issues related to the topology plugin. One of them was later successfully fixed, another one is still there: ofayans@f22replica1:~]$ sudo ipa-replica-prepare --ip-address 192.168.122.140 f22replica2.bagam.net Directory Manager

Re: [Freeipa-devel] [PATCH] 873-874 ipa-replica-manage: adjust del to work with managed topology

2015-06-15 Thread Petr Vobornik
On 06/12/2015 04:18 PM, Petr Vobornik wrote: Some notes: 1. As mentioned in the WIP patch thread: original 'del' worked also with winsync agreements. I'm not sure why is that. Shouldn't 'disconnect' be used for winsync agreements? At least man page says that. This patch doesn't support it if

Re: [Freeipa-devel] [PATCH] 873-874 ipa-replica-manage: adjust del to work with managed topology

2015-06-15 Thread Martin Babinsky
On 06/15/2015 10:57 AM, Petr Vobornik wrote: On 06/12/2015 04:18 PM, Petr Vobornik wrote: Some notes: 1. As mentioned in the WIP patch thread: original 'del' worked also with winsync agreements. I'm not sure why is that. Shouldn't 'disconnect' be used for winsync agreements? At least man page

Re: [Freeipa-devel] [PATCH 0329] ipa-replica-manage: Do not allow topology altering commands

2015-06-15 Thread Martin Babinsky
On 06/10/2015 07:23 PM, Petr Vobornik wrote: On 06/10/2015 04:39 PM, Petr Vobornik wrote: On 06/10/2015 04:06 PM, Petr Vobornik wrote: On 06/02/2015 02:24 PM, Ludwig Krispenz wrote: hi, is there a real replacement for del, it is not in the scope of the topology commands, the removal of teh

Re: [Freeipa-devel] [PATCH] 873-874 ipa-replica-manage: adjust del to work with managed topology

2015-06-15 Thread Petr Vobornik
On 06/15/2015 02:44 PM, Martin Babinsky wrote: On 06/15/2015 02:15 PM, Petr Vobornik wrote: On 06/15/2015 01:46 PM, Martin Babinsky wrote: On 06/15/2015 10:57 AM, Petr Vobornik wrote: On 06/12/2015 04:18 PM, Petr Vobornik wrote: Some notes: 1. As mentioned in the WIP patch thread: original

Re: [Freeipa-devel] [PATCH] 873-874 ipa-replica-manage: adjust del to work with managed topology

2015-06-15 Thread Petr Vobornik
On 06/15/2015 01:46 PM, Martin Babinsky wrote: On 06/15/2015 10:57 AM, Petr Vobornik wrote: On 06/12/2015 04:18 PM, Petr Vobornik wrote: Some notes: 1. As mentioned in the WIP patch thread: original 'del' worked also with winsync agreements. I'm not sure why is that. Shouldn't 'disconnect' be

Re: [Freeipa-devel] [PATCH] 873-874 ipa-replica-manage: adjust del to work with managed topology

2015-06-15 Thread Martin Babinsky
On 06/15/2015 02:15 PM, Petr Vobornik wrote: On 06/15/2015 01:46 PM, Martin Babinsky wrote: On 06/15/2015 10:57 AM, Petr Vobornik wrote: On 06/12/2015 04:18 PM, Petr Vobornik wrote: Some notes: 1. As mentioned in the WIP patch thread: original 'del' worked also with winsync agreements. I'm

Re: [Freeipa-devel] [PATCH 0329] ipa-replica-manage: Do not allow topology altering commands

2015-06-15 Thread Petr Vobornik
On 06/15/2015 02:59 PM, Martin Babinsky wrote: On 06/10/2015 07:23 PM, Petr Vobornik wrote: On 06/10/2015 04:39 PM, Petr Vobornik wrote: On 06/10/2015 04:06 PM, Petr Vobornik wrote: On 06/02/2015 02:24 PM, Ludwig Krispenz wrote: hi, is there a real replacement for del, it is not in the

Re: [Freeipa-devel] [PATCH] 0005 User life cycle: del/mod/find/show stageuser commands

2015-06-15 Thread Simo Sorce
On Mon, 2015-06-15 at 16:48 +0200, Petr Vobornik wrote: On 06/09/2015 02:02 PM, Jan Cholasta wrote: Dne 20.5.2015 v 11:26 Jan Cholasta napsal(a): Dne 18.5.2015 v 10:33 thierry bordaz napsal(a): On 05/15/2015 04:44 PM, David Kupka wrote: Hello Thierry, thanks for the patch set. Overall

Re: [Freeipa-devel] [PATCH] 0005 User life cycle: del/mod/find/show stageuser commands

2015-06-15 Thread thierry bordaz
On 06/15/2015 05:00 PM, Simo Sorce wrote: On Mon, 2015-06-15 at 16:48 +0200, Petr Vobornik wrote: On 06/09/2015 02:02 PM, Jan Cholasta wrote: Dne 20.5.2015 v 11:26 Jan Cholasta napsal(a): Dne 18.5.2015 v 10:33 thierry bordaz napsal(a): On 05/15/2015 04:44 PM, David Kupka wrote: Hello

Re: [Freeipa-devel] [PATCH] Use Exception class instead of StandardError

2015-06-15 Thread Niranjan
Niranjan wrote: Niranjan wrote: Greetings, Please find the modified patch for ipapython/adminutil.py. I have run few tests manually like running ipa-server-install as non-root user or provide --quiet and --verbose to see if it raises ScriptError properly. Also i checked by running

[Freeipa-devel] [PATCH] 877 fix force-sync, re-initialize of replica and a check for replication agreement existence

2015-06-15 Thread Petr Vobornik
in other words limit usage of `agreement_dn` method only for manipulation and search of agreements which are not managed by topology plugin. For other cases is safer to search for the agreement. https://fedorahosted.org/freeipa/ticket/5066 -- Petr Vobornik From

Re: [Freeipa-devel] [PATCH 0039] ipa-kdb: common function to get key encodings/salt types

2015-06-15 Thread Martin Babinsky
On 05/28/2015 02:55 PM, Simo Sorce wrote: On Thu, 2015-05-28 at 14:43 +0200, Martin Babinsky wrote: A small improvement upon simo's fix for https://fedorahosted.org/freeipa/ticket/4914 -- Martin^3 Babinsky LGTM. Simo. Anyone else to review this patch? It also incidentally fixes a

[Freeipa-devel] upstream build failure

2015-06-15 Thread Oleg Fayans
Hi guys, The attempt to build the latest upstream branch fails with the following error: aci: (targetattr = krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword)(target = ldap:///uid=*,cn=deleted users,cn=accounts,cn=provisioning,dc=ipa,dc=example)(targetfilter =

[Freeipa-devel] [PATCH] 876 regenerate ACI.txt after stage user permission rename

2015-06-15 Thread Petr Vobornik
./makeaci was not run.. Pushed to master: 4137f2a8ed6bf1457c7dadf0ed4e6a4465abc621 under one-liner/simple rule -- Petr Vobornik From a92a51f94f5ef9cb6bc6b58d358eeec2f701c2f6 Mon Sep 17 00:00:00 2001 From: Petr Vobornik pvobo...@redhat.com Date: Mon, 15 Jun 2015 10:18:52 +0200 Subject: [PATCH]

Re: [Freeipa-devel] upstream build failure

2015-06-15 Thread Petr Vobornik
On 06/15/2015 10:16 AM, Oleg Fayans wrote: Hi guys, The attempt to build the latest upstream branch fails with the following error: aci: (targetattr = krblastpwdchange || krbpasswordexpiration || krbprincipalkey || userpassword)(target = ldap:///uid=*,cn=deleted

Re: [Freeipa-devel] [PATCH] Password vault

2015-06-15 Thread Endi Sukma Dewata
On 6/15/2015 2:22 AM, Jan Cholasta wrote: I think it would be better to use a new attribute type which inherits from ipaPublicKey (ipaVaultPublicKey?) rather than ipaPublicKey directly for assymetric vault public keys, so that assymetric public key and escrow public key are on the same level and

Re: [Freeipa-devel] [PATCH] Password vault

2015-06-15 Thread Jan Cholasta
Dne 10.6.2015 v 08:13 Martin Kosek napsal(a): On 06/09/2015 11:13 PM, Endi Sukma Dewata wrote: Please take a look at the attached patch to add symmetric asymmetric vaults. Some comments about the patch: I think it would be better to use a new attribute type which inherits from ipaPublicKey

Re: [Freeipa-devel] [PATCH] 869 topology: restrict direction changes

2015-06-15 Thread Petr Vobornik
On 06/12/2015 06:34 PM, Martin Babinsky wrote: On 06/11/2015 01:41 PM, Petr Vobornik wrote: On 06/11/2015 01:11 PM, Ludwig Krispenz wrote: On 06/11/2015 12:53 PM, Petr Vobornik wrote: On 06/11/2015 12:35 PM, Ludwig Krispenz wrote: On 06/11/2015 12:19 PM, Petr Vobornik wrote: On 06/11/2015

Re: [Freeipa-devel] [PATCH] 875 topology: fix swapped topologysegment-reinitialize behavior

2015-06-15 Thread Petr Vobornik
On 06/12/2015 06:31 PM, Martin Babinsky wrote: On 06/12/2015 04:19 PM, Petr Vobornik wrote: setting nsds5BeginReplicaRefresh;left to start reinintializes the right node and not the left node. This patch fixes API to match the behavior. part of: https://fedorahosted.org/freeipa/ticket/4302

Re: [Freeipa-devel] [PATCH 0244] DNSSEC: fix traceback in ipa-dnskeysyncd during shutdown phase

2015-06-15 Thread Petr Vobornik
On 06/11/2015 05:03 PM, Petr Spacek wrote: On 12.5.2015 14:51, Martin Basti wrote: https://fedorahosted.org/freeipa/ticket/4657 Patch attached. ACK Pushed to: master: f763b137ee1eee228f53b456b8245b1499185ef7 ipa-4-1: a5d8d79f76ce39817e16a64fe937c9bb34aa5d6a -- Petr Vobornik -- Manage

Re: [Freeipa-devel] [PATCH 0052] Stage User: Fix permissions naming and split them where, apropriate.

2015-06-15 Thread Petr Vobornik
On 06/11/2015 07:49 PM, thierry bordaz wrote: On 06/11/2015 04:34 PM, David Kupka wrote: Dne 11.6.2015 v 16:17 Martin Kosek napsal(a): On 06/11/2015 03:55 PM, David Kupka wrote: Dne 11.6.2015 v 14:12 thierry bordaz napsal(a): On 06/10/2015 02:14 PM, David Kupka wrote:

Re: [Freeipa-devel] [PATCH] Password vault

2015-06-15 Thread Jan Cholasta
Dne 15.6.2015 v 09:22 Jan Cholasta napsal(a): Dne 10.6.2015 v 08:13 Martin Kosek napsal(a): On 06/09/2015 11:13 PM, Endi Sukma Dewata wrote: Please take a look at the attached patch to add symmetric asymmetric vaults. Some comments about the patch: I think it would be better to use a new

Re: [Freeipa-devel] [PATCH 0264] Server Upgrade: disconnect ldap2 connection before DS restart

2015-06-15 Thread Petr Vobornik
On 06/12/2015 03:26 PM, Martin Babinsky wrote: On 06/10/2015 01:47 PM, Martin Basti wrote: Without this patch, upgrade may failed when api.Backend.ldap2 was connected before DS restart. Patch attached. ACK Pushed to master: c1d484afde34cb68cfb0d187004e107342180399 -- Petr Vobornik --