Re: [Freeipa-devel] [PATCH] 69 Configure SSH features of SSSD in ipa-client-install

2012-03-01 Thread Rob Crittenden
Jan Cholasta wrote: On 29.2.2012 15:00, Martin Kosek wrote: On Wed, 2012-02-29 at 14:44 +0100, Jan Cholasta wrote: On 29.2.2012 14:24, Martin Kosek wrote: On Wed, 2012-02-29 at 10:52 +0100, Jan Cholasta wrote: On 28.2.2012 23:42, Rob Crittenden wrote: Jan Cholasta wrote: Hi, this patch con

[Freeipa-devel] [PATCH] 978 fix hostnames in hbac tests

2012-03-01 Thread Rob Crittenden
I pushed this under the 1-liner rule. Martin drastically improved hostname validation and this broke several HBAC tests that were using invalid domain names. Pushed to master and ipa-2-2. Incidentally there are some broken sudo tests too but I addressed those in patch 919. rob >From 1aa8c8

[Freeipa-devel] [PATCH] 977 fix WSGI exceptions

2012-03-01 Thread Rob Crittenden
Trying to raise some exceptions in the WSGI code just raised other exceptiosn and were generally confusing. To test this do various combinations (with and without a ccache) of: curl -kv https://ipa.example.com/ipa/json --negotiate -u : -H 'Referer: https://ipa.example.com/ipa/json' curl -kv

Re: [Freeipa-devel] [PATCH] 0100 Improved usability of login dialog

2012-03-01 Thread Rob Crittenden
Petr Vobornik wrote: Usability was improved in Unauthorized/Login dialog. When the dialog is opened a link which switches to login form is focus so user can do following: 1) press enter (login form is displayed and username field is focused ) 2) type username 3) press tab 4) type password 5) pr

Re: [Freeipa-devel] [PATCH] 098 Forms based authentication UI

2012-03-01 Thread Rob Crittenden
Petr Vobornik wrote: Support for forms based authentication was added to UI. It consist of: 1) new login page Page url is [ipa server]/ipa/ui/login.html Page contains a login form. For authentication it sends ajax request at [ipa server]/session/json/login_password. If authentication is succes

Re: [Freeipa-devel] [PATCH] 484 Fix credentials checks with s4u2proxy delegation

2012-03-01 Thread Rob Crittenden
Simo Sorce wrote: The commit message says it all I think. This is critical for 2.2 and master. Simo. ACK. Tested with patch krb 1.9 on F-16. Pushed to master and ipa-2-2 rob ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redh

[Freeipa-devel] [PATCH] 484 Fix credentials checks with s4u2proxy delegation

2012-03-01 Thread Simo Sorce
The commit message says it all I think. This is critical for 2.2 and master. Simo. -- Simo Sorce * Red Hat, Inc * New York >From 7508e59ce8dc72f9d93ae9a707ee4888f7fa5f29 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 1 Mar 2012 17:22:10 -0500 Subject: [PATCH] Fix ticket checks when using

Re: [Freeipa-devel] [PATCH] 956 user lockout status

2012-03-01 Thread Rob Crittenden
Martin Kosek wrote: On Wed, 2012-02-29 at 11:20 +0100, Petr Viktorin wrote: On 02/27/2012 06:31 PM, Martin Kosek wrote: 4) Minor change: -except Exception: +except: Don't do that. It would for example disable Ctrl+C by trapping KeyboardInterrupt. PEP8 has a

Re: [Freeipa-devel] [PATCH] 918, 919 update sudo schema

2012-03-01 Thread Rob Crittenden
Rob Crittenden wrote: Jan Cholasta wrote: On 17.1.2012 04:55, Rob Crittenden wrote: Jan Cholasta wrote: Dne 13.1.2012 17:39, Rob Crittenden napsal(a): Jan Cholasta wrote: Dne 14.12.2011 16:21, Rob Crittenden napsal(a): Jan Cholasta wrote: Dne 14.12.2011 15:23, Rob Crittenden napsal(a): Ja

Re: [Freeipa-devel] [PATCH] 226 Improve hostname verification in install tools

2012-03-01 Thread Rob Crittenden
Rob Crittenden wrote: Martin Kosek wrote: Our install tools like ipa-server-install, ipa-replica-{prepare, install} may allow hostnames that do not match the requirements in ipalib. This creates a disconnect and may cause issues when user cannot delete hostnames created by install tools. This p

Re: [Freeipa-devel] [PATCH] 976 add tests for HTTP_Status

2012-03-01 Thread Rob Crittenden
Jan Cholasta wrote: On 29.2.2012 22:22, Rob Crittenden wrote: The tests for not_found were broken, this fixes it and adds tests for the other statuses. I changed the parent class of HTTP_Status because it calls self.info which is provided by Plugable. This wasn't a problem at runtime because Ba

Re: [Freeipa-devel] [PATCH] 918, 919 update sudo schema

2012-03-01 Thread Rob Crittenden
Jan Cholasta wrote: On 17.1.2012 04:55, Rob Crittenden wrote: Jan Cholasta wrote: Dne 13.1.2012 17:39, Rob Crittenden napsal(a): Jan Cholasta wrote: Dne 14.12.2011 16:21, Rob Crittenden napsal(a): Jan Cholasta wrote: Dne 14.12.2011 15:23, Rob Crittenden napsal(a): Jan Cholasta wrote: Dne

Re: [Freeipa-devel] [PATCH] 0009 Support for IPv6 elements in idnsForwarders attribute

2012-03-01 Thread Petr Spacek
Hello, here is (again) reworked patch for https://fedorahosted.org/bind-dyndb-ldap/ticket/49 . Adam pointed me to existing BIND parser, which I missed. Now is all parsing & socket magic done inside BIND libraries. Our code is a bit shorter and syntax is 100% BIND-compatible. (But it means same

Re: [Freeipa-devel] [PATCH] 976 add tests for HTTP_Status

2012-03-01 Thread Jan Cholasta
On 29.2.2012 22:22, Rob Crittenden wrote: The tests for not_found were broken, this fixes it and adds tests for the other statuses. I changed the parent class of HTTP_Status because it calls self.info which is provided by Plugable. This wasn't a problem at runtime because Backend provides self.l

Re: [Freeipa-devel] [PATCH] 12 When migrating warn user if compat is enabled

2012-03-01 Thread Rob Crittenden
Ondrej Hamada wrote: On 02/29/2012 05:07 PM, Rob Crittenden wrote: Ondrej Hamada wrote: On 02/28/2012 10:52 PM, Rob Crittenden wrote: Ondrej Hamada wrote: On 02/27/2012 09:47 PM, Rob Crittenden wrote: Ondrej Hamada wrote: On 02/21/2012 02:32 PM, Ondrej Hamada wrote: On 02/20/2012 06:53 PM,

Re: [Freeipa-devel] [PATCH] 226 Improve hostname verification in install tools

2012-03-01 Thread Rob Crittenden
Martin Kosek wrote: Our install tools like ipa-server-install, ipa-replica-{prepare, install} may allow hostnames that do not match the requirements in ipalib. This creates a disconnect and may cause issues when user cannot delete hostnames created by install tools. This patch makes sure that ip

Re: [Freeipa-devel] [PATCH] 940 apply some validation to some classes only

2012-03-01 Thread Rob Crittenden
Jan Cholasta wrote: On 29.2.2012 19:45, Rob Crittenden wrote: Jan Cholasta wrote: On 20.2.2012 22:56, Rob Crittenden wrote: Rob Crittenden wrote: The variable name rdnattr can be misleading. It is only used to give the name of hte RDN in something that can be renamed. Compare this to somethin

Re: [Freeipa-devel] [PATCH] 69 Configure SSH features of SSSD in ipa-client-install

2012-03-01 Thread Jan Cholasta
On 29.2.2012 15:00, Martin Kosek wrote: On Wed, 2012-02-29 at 14:44 +0100, Jan Cholasta wrote: On 29.2.2012 14:24, Martin Kosek wrote: On Wed, 2012-02-29 at 10:52 +0100, Jan Cholasta wrote: On 28.2.2012 23:42, Rob Crittenden wrote: Jan Cholasta wrote: Hi, this patch configures the new SSH f

Re: [Freeipa-devel] [PATCH] 971 detect binary LDAP data

2012-03-01 Thread Jan Cholasta
On 29.2.2012 15:45, Rob Crittenden wrote: Jan Cholasta wrote: On 28.2.2012 18:58, Rob Crittenden wrote: Jan Cholasta wrote: On 28.2.2012 18:02, Petr Viktorin wrote: On 02/28/2012 04:45 PM, Rob Crittenden wrote: Petr Viktorin wrote: On 02/28/2012 04:02 AM, Rob Crittenden wrote: Petr Viktori

Re: [Freeipa-devel] [PATCH] 0009 Support for IPv6 elements in idnsForwarders attribute

2012-03-01 Thread Petr Spacek
Hello, here is reworked patch for https://fedorahosted.org/bind-dyndb-ldap/ticket/49 . Changes after yesterday's discussion on IRC with Simo and Mkosek: It follows BIND9 syntax for optional specification of port & adds documentation for this new syntax. Petr^2 Spacek On 02/29/2012 05:33 PM

Re: [Freeipa-devel] More types of replica in FreeIPA

2012-03-01 Thread Ondrej Hamada
On 02/29/2012 04:36 PM, Simo Sorce wrote: On Wed, 2012-02-29 at 16:19 +0100, Ondrej Hamada wrote: Hi everyone, I'm currently working on my thesis. It's objective is $SUBJ and we already have ticket for that: #194. The task is to create two more replica types - the HUB and Consumer. In 389-DS bot

[Freeipa-devel] [PATCH] 0100 Improved usability of login dialog

2012-03-01 Thread Petr Vobornik
Usability was improved in Unauthorized/Login dialog. When the dialog is opened a link which switches to login form is focus so user can do following: 1) press enter (login form is displayed and username field is focused ) 2) type username 3) press tab 4) type password 5) press enter this sequ

[Freeipa-devel] [PATCH] 229 Add help for new structured DNS framework

2012-03-01 Thread Martin Kosek
DNS Test Day shown that the new RR specific DNS options and the concepts behind them may not be easily understood. This patch adds an explanation of the new DNS framework for structured options to make it easier for the user to understand and use the new options. https://fedorahosted.org/freeipa/t

Re: [Freeipa-devel] [PATCH] 12 When migrating warn user if compat is enabled

2012-03-01 Thread Ondrej Hamada
On 02/29/2012 05:07 PM, Rob Crittenden wrote: Ondrej Hamada wrote: On 02/28/2012 10:52 PM, Rob Crittenden wrote: Ondrej Hamada wrote: On 02/27/2012 09:47 PM, Rob Crittenden wrote: Ondrej Hamada wrote: On 02/21/2012 02:32 PM, Ondrej Hamada wrote: On 02/20/2012 06:53 PM, Rob Crittenden wrote:

[Freeipa-devel] [PATCH] 227-228 Add last missing bits in new bind-dyndb-ldap

2012-03-01 Thread Martin Kosek
These 2 patches changes the DNS API to support the last missing bits in new bind-dyndb-ldap: 1) Both global and per-zone forwarders now support a conditional custom port (with format "IP_ADDRESS PORT") 2) Missing global configuration options have been added: * idnsforwardpolicy: Default policy fo

Re: [Freeipa-devel] [PATCH] 940 apply some validation to some classes only

2012-03-01 Thread Jan Cholasta
On 29.2.2012 19:45, Rob Crittenden wrote: Jan Cholasta wrote: On 20.2.2012 22:56, Rob Crittenden wrote: Rob Crittenden wrote: The variable name rdnattr can be misleading. It is only used to give the name of hte RDN in something that can be renamed. Compare this to something like netgroups wher

Re: [Freeipa-devel] [PATCH] 0014 Add final debug message in installers

2012-03-01 Thread Petr Viktorin
On 02/29/2012 07:46 PM, Rob Crittenden wrote: Martin Kosek wrote: On Mon, 2012-02-27 at 17:51 +0100, Petr Viktorin wrote: On 02/22/2012 10:41 AM, Petr Viktorin wrote: This fixes https://fedorahosted.org/freeipa/ticket/2071 (Add final debug message in installers). The try/except blocks at the e

[Freeipa-devel] [PATCH] 226 Improve hostname verification in install tools

2012-03-01 Thread Martin Kosek
Our install tools like ipa-server-install, ipa-replica-{prepare, install} may allow hostnames that do not match the requirements in ipalib. This creates a disconnect and may cause issues when user cannot delete hostnames created by install tools. This patch makes sure that ipalib requirements are

Re: [Freeipa-devel] [PATCHES] 0016 Fixes for{add, set, del}attr with managed attributes

2012-03-01 Thread Petr Viktorin
On 02/29/2012 04:34 PM, Petr Viktorin wrote: On 02/29/2012 03:50 PM, Rob Crittenden wrote: Petr Viktorin wrote: On 02/27/2012 11:03 PM, Rob Crittenden wrote: Petr Viktorin wrote: Patch 16 defers validation & conversion until after {add,del,set}attr is processed, so that we don't search for an