Re: [Freeipa-devel] [DESIGN] FreeIPA on FIPS + NSS question

2017-01-13 Thread Petr Vobornik
On 01/13/2017 03:49 PM, Rob Crittenden wrote: > Tomas Krizek wrote: >> On 01/12/2017 04:17 PM, Rob Crittenden wrote: >>> Tomas Krizek wrote: On 12/19/2016 04:41 PM, Standa Laznicka wrote: > On 12/19/2016 03:07 PM, John Dennis wrote: >> On 12/19/2016 03:12 AM, Standa Laznicka wrote:

[Freeipa-devel] [freeipa PR#395][comment] Configure PKI ajp redirection to use "localhost" instead of "::1"

2017-01-13 Thread pvoborni
URL: https://github.com/freeipa/freeipa/pull/395 Title: #395: Configure PKI ajp redirection to use "localhost" instead of "::1" pvoborni commented: """ Btw our goal is not to make pure IPv6 working - this was not tested even before the regression. """ See the full comment at

[Freeipa-devel] [freeipa PR#395][comment] Configure PKI ajp redirection to use "localhost" instead of "::1"

2017-01-13 Thread flo-renaud
URL: https://github.com/freeipa/freeipa/pull/395 Title: #395: Configure PKI ajp redirection to use "localhost" instead of "::1" flo-renaud commented: """ Hi @tomaskrizek, I was not able to reproduce the master install issue. Here are my steps: On the master: ip addr del 127.0.0.1 dev lo ip -4

[Freeipa-devel] [freeipa PR#393][synchronized] [WIP] Py3 allow to run wsgi

2017-01-13 Thread mbasti-rh
URL: https://github.com/freeipa/freeipa/pull/393 Author: mbasti-rh Title: #393: [WIP] Py3 allow to run wsgi Action: synchronized To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/393/head:pr393 git checkout pr393 From

Re: [Freeipa-devel] GetEffectiveRights and add ACIs

2017-01-13 Thread thierry bordaz
Hello, The option specifies the value of 'objectclass' attribute during the GER. That is evaluated at attributeLevelRights but not at the entryLevelRights. I was not able to fix the test case using this option. For information I opened that ticket

[Freeipa-devel] [freeipa PR#395][comment] Configure PKI ajp redirection to use "localhost" instead of "::1"

2017-01-13 Thread pvoborni
URL: https://github.com/freeipa/freeipa/pull/395 Title: #395: Configure PKI ajp redirection to use "localhost" instead of "::1" pvoborni commented: """ Possible ways how to fix upgrades are outlined in https://bugzilla.redhat.com/show_bug.cgi?id=1398600#c48 and comment 49. """ See the full

[Freeipa-devel] [freeipa PR#395][comment] Configure PKI ajp redirection to use "localhost" instead of "::1"

2017-01-13 Thread tomaskrizek
URL: https://github.com/freeipa/freeipa/pull/395 Title: #395: Configure PKI ajp redirection to use "localhost" instead of "::1" tomaskrizek commented: """ The fix solves [ticket #6575](https://fedorahosted.org/freeipa/ticket/6575), but I once again encountered [ticket

Re: [Freeipa-devel] [DESIGN] FreeIPA on FIPS + NSS question

2017-01-13 Thread Rob Crittenden
Tomas Krizek wrote: > On 01/12/2017 04:17 PM, Rob Crittenden wrote: >> Tomas Krizek wrote: >>> On 12/19/2016 04:41 PM, Standa Laznicka wrote: On 12/19/2016 03:07 PM, John Dennis wrote: > On 12/19/2016 03:12 AM, Standa Laznicka wrote: >> On 12/16/2016 03:23 PM, Rob Crittenden wrote:

[Freeipa-devel] [freeipa PR#395][comment] Configure PKI ajp redirection to use "localhost" instead of "::1"

2017-01-13 Thread tiran
URL: https://github.com/freeipa/freeipa/pull/395 Title: #395: Configure PKI ajp redirection to use "localhost" instead of "::1" tiran commented: """ Bad news, you are out of luck. Dogtag uses its own LDAP connector, which in turn uses JSS (NSS bindings for Java) to provide TLS for LDAP.

Re: [Freeipa-devel] [DESIGN] FreeIPA on FIPS + NSS question

2017-01-13 Thread Tomas Krizek
On 01/12/2017 04:17 PM, Rob Crittenden wrote: > Tomas Krizek wrote: >> On 12/19/2016 04:41 PM, Standa Laznicka wrote: >>> On 12/19/2016 03:07 PM, John Dennis wrote: On 12/19/2016 03:12 AM, Standa Laznicka wrote: > On 12/16/2016 03:23 PM, Rob Crittenden wrote: >> Standa Laznicka wrote:

[Freeipa-devel] [freeipa PR#384][comment] Add fix for user prompt in dnsrecord-add

2017-01-13 Thread HonzaCholasta
URL: https://github.com/freeipa/freeipa/pull/384 Title: #384: Add fix for user prompt in dnsrecord-add HonzaCholasta commented: """ I'm afraid this is not a proper fix, as it introduces a regression in CLI behavior. A proper fix would be to use correct argument names - in the trace in the

Re: [Freeipa-devel] GetEffectiveRights and add ACIs

2017-01-13 Thread thierry bordaz
Hi Fraser, I failed to reproduce you test case, I mean the aci granted the add right to a group member to ADD an entry with the filtered attribute. Now I have a doubt to test attribute valule on an entry that does not yet exist. Would you run /usr/lib64/mozldap/ldapsearch -D "cn=directory

[Freeipa-devel] [freeipa PR#347][synchronized] Improvements in {get|set}_directive functions

2017-01-13 Thread martbab
URL: https://github.com/freeipa/freeipa/pull/347 Author: martbab Title: #347: Improvements in {get|set}_directive functions Action: synchronized To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/347/head:pr347 git checkout pr347

[Freeipa-devel] [freeipa PR#377][comment] dogtaginstance: track server certificate with our renew agent

2017-01-13 Thread stlaz
URL: https://github.com/freeipa/freeipa/pull/377 Title: #377: dogtaginstance: track server certificate with our renew agent stlaz commented: """ This PR can be safely pushed, an unknown upstream contributor with the same github nick as me will later create a PR with the proposed classmethod

Re: [Freeipa-devel] GetEffectiveRights and add ACIs

2017-01-13 Thread Ludwig Krispenz
Hi, if you look at: https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/10/html/Administration_Guide/Viewing_the_ACIs_for_an_Entry-Get_Effective_Rights_Control.html#ex-ger-non-entry then it looks like you can provide GER a bit of information eg objectclass of the new

[Freeipa-devel] [freeipa PR#393][synchronized] [WIP] Py3 allow to run wsgi

2017-01-13 Thread mbasti-rh
URL: https://github.com/freeipa/freeipa/pull/393 Author: mbasti-rh Title: #393: [WIP] Py3 allow to run wsgi Action: synchronized To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/393/head:pr393 git checkout pr393 From

[Freeipa-devel] [freeipa PR#393][edited] [WIP] Py3 allow to run wsgi

2017-01-13 Thread mbasti-rh
URL: https://github.com/freeipa/freeipa/pull/393 Author: mbasti-rh Title: #393: [WIP] Py3 allow to run wsgi Action: edited Changed field: body Original value: """ With these patches we can run commands with server running on py3 Note: to use py3 install module `python3-mod_wsgi` that

[Freeipa-devel] [freeipa PR#395][comment] Configure PKI ajp redirection to use "localhost" instead of "::1"

2017-01-13 Thread tiran
URL: https://github.com/freeipa/freeipa/pull/395 Title: #395: Configure PKI ajp redirection to use "localhost" instead of "::1" tiran commented: """ I have created ticket https://fedorahosted.org/pki/ticket/2575 to track the issue. """ See the full comment at