Re: [Freeipa-devel] [PATCH] 734 Add handling for indirect memberof other entries.

2011-02-21 Thread Jakub Hrozek
On Sat, Feb 19, 2011 at 11:47:45PM -0500, Rob Crittenden wrote: This creates a new custom attribute, memberofindirect_[plugin]. Using this you can tell the difference between being an actual memberof another entry and being a memberof as the result if inheritence. This is particularly useful

Re: [Freeipa-devel] [PATCH] 734 Add handling for indirect memberof other entries.

2011-02-21 Thread Simo Sorce
On Mon, 21 Feb 2011 11:56:39 +0100 Jakub Hrozek jhro...@redhat.com wrote: On Sat, Feb 19, 2011 at 11:47:45PM -0500, Rob Crittenden wrote: I had to add a couple of short sleep calls to make things work a little better. The memberof plugin runs as a postop and we have no way of knowing when

Re: [Freeipa-devel] [PATCH] 734 Add handling for indirect memberof other entries.

2011-02-21 Thread Rob Crittenden
Simo Sorce wrote: On Mon, 21 Feb 2011 11:56:39 +0100 Jakub Hrozekjhro...@redhat.com wrote: On Sat, Feb 19, 2011 at 11:47:45PM -0500, Rob Crittenden wrote: I had to add a couple of short sleep calls to make things work a little better. The memberof plugin runs as a postop and we have no way

Re: [Freeipa-devel] [PATCH] 734 Add handling for indirect memberof other entries.

2011-02-21 Thread Rob Crittenden
Jakub Hrozek wrote: On Sat, Feb 19, 2011 at 11:47:45PM -0500, Rob Crittenden wrote: This creates a new custom attribute, memberofindirect_[plugin]. Using this you can tell the difference between being an actual memberof another entry and being a memberof as the result if inheritence. This is

Re: [Freeipa-devel] [PATCH] 734 Add handling for indirect memberof other entries.

2011-02-21 Thread Dmitri Pal
On 02/21/2011 08:52 AM, Rob Crittenden wrote: Simo Sorce wrote: On Mon, 21 Feb 2011 11:56:39 +0100 Jakub Hrozekjhro...@redhat.com wrote: On Sat, Feb 19, 2011 at 11:47:45PM -0500, Rob Crittenden wrote: I had to add a couple of short sleep calls to make things work a little better. The

Re: [Freeipa-devel] [PATCH] 0085 Register client into DNS on install

2011-02-21 Thread Dmitri Pal
On 02/17/2011 03:46 PM, Simo Sorce wrote: On Thu, 17 Feb 2011 11:53:52 -0500 Simo Sorce sso...@redhat.com wrote: On Thu, 17 Feb 2011 11:34:30 -0500 Simo Sorce sso...@redhat.com wrote: If DNS Updates are available then try to register the ip address as determined by connecting to the ipa

Re: [Freeipa-devel] [PATCH] 734 Add handling for indirect memberof other entries.

2011-02-21 Thread Rob Crittenden
Dmitri Pal wrote: On 02/21/2011 08:52 AM, Rob Crittenden wrote: Simo Sorce wrote: On Mon, 21 Feb 2011 11:56:39 +0100 Jakub Hrozekjhro...@redhat.com wrote: On Sat, Feb 19, 2011 at 11:47:45PM -0500, Rob Crittenden wrote: I had to add a couple of short sleep calls to make things work a

Re: [Freeipa-devel] [PATCH] 734 Add handling for indirect memberof other entries.

2011-02-21 Thread Rob Crittenden
Rob Crittenden wrote: Jakub Hrozek wrote: On Sat, Feb 19, 2011 at 11:47:45PM -0500, Rob Crittenden wrote: This creates a new custom attribute, memberofindirect_[plugin]. Using this you can tell the difference between being an actual memberof another entry and being a memberof as the result if

Re: [Freeipa-devel] [PATCH] 728 default roles

2011-02-21 Thread Rob Crittenden
Rob Crittenden wrote: Jakub Hrozek wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 02/17/2011 04:35 AM, Rob Crittenden wrote: Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing

Re: [Freeipa-devel] [PATCH] 106 I18n update.

2011-02-21 Thread Adam Young
On 02/18/2011 11:48 PM, Endi Sukma Dewata wrote: On 2/18/2011 10:35 PM, Adam Young wrote: Hard-coded messages through out the code have been replaced by i18n messages obtained from json_metadata and i18n_messages. https://fedorahosted.org/freeipa/ticket/899 Needs rebase, due to mkosek's big

Re: [Freeipa-devel] [PATCH] 728 default roles

2011-02-21 Thread Jakub Hrozek
On Mon, Feb 21, 2011 at 10:11:38AM -0500, Rob Crittenden wrote: Rob Crittenden wrote: Jakub Hrozek wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 02/17/2011 04:35 AM, Rob Crittenden wrote: Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles

[Freeipa-devel] [PATCH] Use pygettext to generate translatable strings from plugin files.

2011-02-21 Thread Pavel Zůna
This goes on top of my other localization patches! This patch replaces xgettext with a custom pygettext to generate translatable strings from plugin files in ipalib/plugins. pygettext was modified to handle plural forms (credit goes to Jan Hendrik Goellner) and had some bugs fixed by myself.

[Freeipa-devel] Long overdue review of the UI guide

2011-02-21 Thread Dmitri Pal
Hi, I finally got some time to review the UI spec. I found some minor and major issues. I do not have latest UI in front of me so please check that nothing is missing or incorrect based on the concerns below. 1) How many results we display in the facet list (like members of a goup)? What if

[Freeipa-devel] [PATCH] 735 configure krb5_realm in sssd ipa provider

2011-02-21 Thread Rob Crittenden
Set krb5_realm in sssd.conf in the ipa provider. ticket 925 rob freeipa-rcrit-735-sssd.patch Description: application/mbox ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel

Re: [Freeipa-devel] [PATCH] 728 default roles

2011-02-21 Thread Rob Crittenden
Jakub Hrozek wrote: On Mon, Feb 21, 2011 at 10:11:38AM -0500, Rob Crittenden wrote: Rob Crittenden wrote: Jakub Hrozek wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 02/17/2011 04:35 AM, Rob Crittenden wrote: Add default roles and permissions for HBAC, SUDO and pw policy Created

Re: [Freeipa-devel] [PATCH] 734 Add handling for indirect memberof other entries.

2011-02-21 Thread Jakub Hrozek
On Mon, Feb 21, 2011 at 09:44:49AM -0500, Rob Crittenden wrote: Rob Crittenden wrote: Jakub Hrozek wrote: On Sat, Feb 19, 2011 at 11:47:45PM -0500, Rob Crittenden wrote: This creates a new custom attribute, memberofindirect_[plugin]. Using this you can tell the difference between being an

Re: [Freeipa-devel] Long overdue review of the UI guide

2011-02-21 Thread Adam Young
On 02/21/2011 10:41 AM, Dmitri Pal wrote: Hi, I finally got some time to review the UI spec. I found some minor and major issues. I do not have latest UI in front of me so please check that nothing is missing or incorrect based on the concerns below. 1) How many results we display in the facet

Re: [Freeipa-devel] [PATCH] 106 I18n update.

2011-02-21 Thread Adam Young
On 02/21/2011 11:05 AM, Endi Sukma Dewata wrote: On 2/21/2011 9:25 AM, Adam Young wrote: I haven't got a chance to provide a long explanation for this, but please try to apply all patches that I've submitted (until 109) and see the user.js, group.js and certificate.js. I think they are clearly

Re: [Freeipa-devel] [PATCH] 735 configure krb5_realm in sssd ipa provider

2011-02-21 Thread Jakub Hrozek
On Mon, Feb 21, 2011 at 10:27:26AM -0500, Rob Crittenden wrote: Set krb5_realm in sssd.conf in the ipa provider. ticket 925 rob This works fine, so Ack. One question, though, why don't we add the realm only if ipa_domain.upper() != krb5_realm? It would make the config file a little more

Re: [Freeipa-devel] [PATCH] 734 Add handling for indirect memberof other entries.

2011-02-21 Thread Rob Crittenden
Jakub Hrozek wrote: On Mon, Feb 21, 2011 at 09:44:49AM -0500, Rob Crittenden wrote: Rob Crittenden wrote: Jakub Hrozek wrote: On Sat, Feb 19, 2011 at 11:47:45PM -0500, Rob Crittenden wrote: This creates a new custom attribute, memberofindirect_[plugin]. Using this you can tell the difference

[Freeipa-devel] [PATCH] 064 Document --enable-dns-updates in ipa-client-install man page

2011-02-21 Thread Jakub Hrozek
https://fedorahosted.org/freeipa/ticket/991 From b8d1fdcad3a6a23fbcb9aaf7cc7f332698fe5df5 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek jhro...@redhat.com Date: Mon, 21 Feb 2011 17:23:41 +0100 Subject: [PATCH] Document --enable-dns-updates in ipa-client-install man page

Re: [Freeipa-devel] [PATCH] 735 configure krb5_realm in sssd ipa provider

2011-02-21 Thread Rob Crittenden
Jakub Hrozek wrote: On Mon, Feb 21, 2011 at 10:27:26AM -0500, Rob Crittenden wrote: Set krb5_realm in sssd.conf in the ipa provider. ticket 925 rob This works fine, so Ack. One question, though, why don't we add the realm only if ipa_domain.upper() != krb5_realm? It would make the config

[Freeipa-devel] [PATCH] 736 hard limit for # of batch requests

2011-02-21 Thread Rob Crittenden
Set a hard limit of 256 for the # of commands in a batch request we'll handle. ticket 984 rob freeipa-rcrit-736-limit.patch Description: application/mbox ___ Freeipa-devel mailing list Freeipa-devel@redhat.com

Re: [Freeipa-devel] [PATCH] 064 Document --enable-dns-updates in ipa-client-install man page

2011-02-21 Thread Rob Crittenden
Jakub Hrozek wrote: https://fedorahosted.org/freeipa/ticket/991 ack, pushed to master ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel

Re: [Freeipa-devel] Long overdue review of the UI guide

2011-02-21 Thread Dmitri Pal
On 02/21/2011 11:01 AM, Adam Young wrote: 6) The UI in multiple places in the example of the action panel says Net Groups but in the text of document it is correct: Netgroups. Please make sure that the correct wording is used in the actual UI, i.e. Netgroups - one word. We are pretty

[Freeipa-devel] [PATCH] 737 move BuildRequires

2011-02-21 Thread Rob Crittenden
Move some BuildRequires so building with ONLY_CLIENT works. I tested with: $ mock -r fedora-14-x86_64 --define='ONLY_CLIENT 1' ./dist/srpms/freeipa-2.0.0GIT055a668-0.fc14.src.rpm rob freeipa-rcrit-737-spec.patch Description: application/mbox ___

Re: [Freeipa-devel] [PATCH] 061 Validate NAPTR records

2011-02-21 Thread Rob Crittenden
Jakub Hrozek wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I'm not sure about checking the flags - this might be a little too much validation. https://fedorahosted.org/freeipa/ticket/840 I think the flags length check needs to change. I would do this instead: flags =

Re: [Freeipa-devel] [PATCH] 18 Use TLS for ipadiscovery during ipa client install

2011-02-21 Thread Rob Crittenden
JR Aquino wrote: On 2/17/11 9:46 AM, Jan Zelenyjzel...@redhat.com wrote: JR Aquinojr.aqu...@citrix.com wrote: Lets try now. Attached is the corrected patch. There were several spots in ipa-client-install where the server could be defined and it was getting missed. I have omitted any change

Re: [Freeipa-devel] [PATCH] 18 Use TLS for ipadiscovery during ipa client install

2011-02-21 Thread Jan Zeleny
Rob Crittenden rcrit...@redhat.com wrote: JR Aquino wrote: On 2/17/11 9:46 AM, Jan Zelenyjzel...@redhat.com wrote: JR Aquinojr.aqu...@citrix.com wrote: Lets try now. Attached is the corrected patch. There were several spots in ipa-client-install where the server could be defined

Re: [Freeipa-devel] Long overdue review of the UI guide

2011-02-21 Thread Adam Young
On 02/21/2011 12:56 PM, Dmitri Pal wrote: In all other places we use netgroups as one word. -- https://fedorahosted.org/freeipa/ticket/995 ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel

Re: [Freeipa-devel] [PATCH] Don't load the LDAP schema during startup

2011-02-21 Thread Rob Crittenden
Jan Zelený wrote: Loading of the schema is now performed in the first request that requires it. https://fedorahosted.org/freeipa/ticket/583 Jan We still need to enforce that we get the schema, some low-level functions depend on it. Also, if the UI doesn't get its aciattrs (which are

Re: [Freeipa-devel] [PATCH] 18 Use TLS for ipadiscovery during ipa client install

2011-02-21 Thread JR Aquino
On 2/21/11 10:46 AM, Jan Zeleny jzel...@redhat.com wrote: Rob Crittenden rcrit...@redhat.com wrote: JR Aquino wrote: On 2/17/11 9:46 AM, Jan Zelenyjzel...@redhat.com wrote: JR Aquinojr.aqu...@citrix.com wrote: Lets try now. Attached is the corrected patch. There were several spots

Re: [Freeipa-devel] [PATCH] 049 Make nsslib IPv6 aware

2011-02-21 Thread Rob Crittenden
Jakub Hrozek wrote: On Thu, Feb 17, 2011 at 08:25:37PM +0100, Jakub Hrozek wrote: On Wed, Feb 09, 2011 at 10:23:27AM +0100, Jan Zelený wrote: Jakub Hrozekjhro...@redhat.com wrote: On Thu, Feb 03, 2011 at 02:23:11PM +0100, Jan Zelený wrote: Jakub Hrozekjhro...@redhat.com wrote: Hi,

Re: [Freeipa-devel] [PATCH] 106 I18n update.

2011-02-21 Thread Adam Young
On 02/21/2011 11:05 AM, Endi Sukma Dewata wrote: On 2/21/2011 9:25 AM, Adam Young wrote: I haven't got a chance to provide a long explanation for this, but please try to apply all patches that I've submitted (until 109) and see the user.js, group.js and certificate.js. I think they are clearly

Re: [Freeipa-devel] [PATCH] 107 Updated test data files.

2011-02-21 Thread Adam Young
On 02/18/2011 10:31 AM, Adam Young wrote: On 02/18/2011 03:15 AM, Endi Sukma Dewata wrote: https://fedorahosted.org/freeipa/ticket/899 ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel If

[Freeipa-devel] [PATCH] 110 Fixed error message for invalid Kerberos ticket.

2011-02-21 Thread Endi Sukma Dewata
https://fedorahosted.org/freeipa/ticket/490 -- Endi S. Dewata From f6f733d3cd23fdb79a4ff69e38af945bf0e67f15 Mon Sep 17 00:00:00 2001 From: Endi S. Dewata edew...@redhat.com Date: Fri, 18 Feb 2011 13:34:56 -0600 Subject: [PATCH] Fixed error message for invalid Kerberos ticket.

Re: [Freeipa-devel] [PATCH] 110 Fixed error message for invalid Kerberos ticket.

2011-02-21 Thread Adam Young
On 02/21/2011 03:23 PM, Endi Sukma Dewata wrote: https://fedorahosted.org/freeipa/ticket/490 ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel ACK

Re: [Freeipa-devel] [PATCH] 18 Use TLS for ipadiscovery during ipa client install

2011-02-21 Thread JR Aquino
On 2/21/11 11:18 AM, JR Aquino jr.aqu...@citrix.com wrote: On 2/21/11 10:46 AM, Jan Zeleny jzel...@redhat.com wrote: Rob Crittenden rcrit...@redhat.com wrote: JR Aquino wrote: On 2/17/11 9:46 AM, Jan Zelenyjzel...@redhat.com wrote: JR Aquinojr.aqu...@citrix.com wrote: Lets try now.

Re: [Freeipa-devel] [PATCH] 110 Fixed error message for invalid Kerberos ticket.

2011-02-21 Thread Endi Sukma Dewata
On 2/21/2011 2:38 PM, Adam Young wrote: https://fedorahosted.org/freeipa/ticket/490 ACK Pushed to master. -- Endi S. Dewata ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel

[Freeipa-devel] [PATCH] 738 default.conf man page

2011-02-21 Thread Rob Crittenden
Add a man page for the IPA configuration file default.conf. ticket 969 rob freeipa-rcrit-738-man.patch Description: application/mbox ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel

Re: [Freeipa-devel] [PATCH] 78 Use ldapi: instead of unsecured ldap: in ipa core tools.

2011-02-21 Thread JR Aquino
On 2/15/11 6:19 AM, Pavel Zuna pz...@redhat.com wrote: On 02/14/2011 04:56 PM, JR Aquino wrote: On 2/10/11 2:42 AM, Pavel Zunapz...@redhat.com wrote: On 02/08/2011 01:06 PM, Pavel Zuna wrote: The patch also corrects exception handling in some of the tools. Fix #874 Pavel Updated patch

[Freeipa-devel] [PATCH] admiyo-0198-search-filter-focus

2011-02-21 Thread Adam Young
Not going to complete the whole tab-order aspect, but this covers the most important part, which is hitting enter and also focus for the filter field From bfb42f808cb7928768a40a6393b217c1aa60f9c6 Mon Sep 17 00:00:00 2001 From: Adam Young ayo...@redhat.com Date: Mon, 21 Feb 2011 17:28:06 -0500

Re: [Freeipa-devel] [PATCH] admiyo-0198-search-filter-focus

2011-02-21 Thread Endi Sukma Dewata
On 2/21/2011 4:32 PM, Adam Young wrote: Not going to complete the whole tab-order aspect, but this covers the most important part, which is hitting enter and also focus for the filter field ACK and pushed to master. -- Endi S. Dewata ___

Re: [Freeipa-devel] Help define the roles IPA has by default

2011-02-21 Thread David O'Brien
Dmitri Pal wrote: On 02/11/2011 10:12 AM, Rob Crittenden wrote: Dmitri Pal wrote: On 02/10/2011 07:25 PM, David O'Brien wrote: Dmitri Pal wrote: On 02/10/2011 03:05 PM, Jakub Hrozek wrote: On 02/10/2011 05:12 PM, Rob Crittenden wrote: But what other roles do we need? The mind boggles and