[Freeipa-devel] [PATCH] SSHPublicKey.fingerprint_dns_sha1 should return unicode value

2012-09-20 Thread Jan Cholasta
Hi, this one-liner fixes updating DNS SSHFP records in host-mod. Honza -- Jan Cholasta From 132bd4011909589e0db50d71828aeccadb09 Mon Sep 17 00:00:00 2001 From: Jan Cholasta jchol...@redhat.com Date: Thu, 20 Sep 2012 03:43:30 -0400 Subject: [PATCH] SSHPublicKey.fingerprint_dns_sha1 should

Re: [Freeipa-devel] [PATCH] 0074 validate SID for trusted domain when adding/modifying ID range

2012-09-20 Thread Martin Kosek
On 09/19/2012 06:19 PM, Alexander Bokovoy wrote: Hi, This patch adds validation of SID for trusted domain when adding or modifying ID range for the domain. We only allow creating ranges for trusted domains when the trust is already established -- the default range is created automatically

[Freeipa-devel] [PATCH] 311 Fix idrange plugin help

2012-09-20 Thread Martin Kosek
range plugin was renamed to idrange. Update plugin help to reflect this change. From 060c9b88d927919112d9b26def3bbed6660d9d38 Mon Sep 17 00:00:00 2001 From: Martin Kosek mko...@redhat.com Date: Thu, 20 Sep 2012 10:26:17 +0200 Subject: [PATCH] Fix idrange plugin help range plugin was renamed to

Re: [Freeipa-devel] [PATCH] 311 Fix idrange plugin help

2012-09-20 Thread Petr Spacek
On 09/20/2012 10:28 AM, Martin Kosek wrote: range plugin was renamed to idrange. Update plugin help to reflect this change. ACK :-) Petr^2 Spacek ___ Freeipa-devel mailing list Freeipa-devel@redhat.com

Re: [Freeipa-devel] [PATCH] 0077 Check direct/reverse hostname/address resolution in ipa-replica-install

2012-09-20 Thread Petr Viktorin
On 09/19/2012 08:46 PM, Rob Crittenden wrote: Petr Viktorin wrote: On 09/19/2012 04:56 PM, Rob Crittenden wrote: Petr Viktorin wrote: On 09/17/2012 08:10 PM, Rob Crittenden wrote: Petr Viktorin wrote: On 09/14/2012 08:46 AM, Martin Kosek wrote: On 09/13/2012 10:35 PM, Rob Crittenden wrote:

Re: [Freeipa-devel] [PATCH] 311 Fix idrange plugin help

2012-09-20 Thread Martin Kosek
On 09/20/2012 10:33 AM, Petr Spacek wrote: On 09/20/2012 10:28 AM, Martin Kosek wrote: range plugin was renamed to idrange. Update plugin help to reflect this change. ACK :-) Petr^2 Spacek Pushed to master, ipa-3-0. Martin ___ Freeipa-devel

Re: [Freeipa-devel] [PATCH] SSHPublicKey.fingerprint_dns_sha1 should return unicode value

2012-09-20 Thread Martin Kosek
On 09/20/2012 10:22 AM, Jan Cholasta wrote: Hi, this one-liner fixes updating DNS SSHFP records in host-mod. Honza ACK. Pushed to master, ipa-3-0. Martin ___ Freeipa-devel mailing list Freeipa-devel@redhat.com

Re: [Freeipa-devel] [PATCH] 0074 validate SID for trusted domain when adding/modifying ID range

2012-09-20 Thread Alexander Bokovoy
Hi, On Thu, 20 Sep 2012, Martin Kosek wrote: On 09/19/2012 06:19 PM, Alexander Bokovoy wrote: Hi, This patch adds validation of SID for trusted domain when adding or modifying ID range for the domain. We only allow creating ranges for trusted domains when the trust is already established --

Re: [Freeipa-devel] [PATCH] 0074 validate SID for trusted domain when adding/modifying ID range

2012-09-20 Thread Martin Kosek
On 09/20/2012 11:42 AM, Alexander Bokovoy wrote: Hi, On Thu, 20 Sep 2012, Martin Kosek wrote: On 09/19/2012 06:19 PM, Alexander Bokovoy wrote: Hi, This patch adds validation of SID for trusted domain when adding or modifying ID range for the domain. We only allow creating ranges for

Re: [Freeipa-devel] [PATCH] 0074 validate SID for trusted domain when adding/modifying ID range

2012-09-20 Thread Petr Viktorin
On 09/20/2012 12:12 PM, Martin Kosek wrote: On 09/20/2012 11:42 AM, Alexander Bokovoy wrote: Hi, On Thu, 20 Sep 2012, Martin Kosek wrote: On 09/19/2012 06:19 PM, Alexander Bokovoy wrote: Hi, This patch adds validation of SID for trusted domain when adding or modifying ID range for the

[Freeipa-devel] [PATCH] 0082 Use correct Dogtag port in ipaserver.install.certs

2012-09-20 Thread Petr Viktorin
Something I overlooked in the Dogtag 10 patch: On an instance upgraded from Dogtag 9 to Dogtag 10, ipa-replica-prepare used the wrong set of constants, and failed to contact the server. This patch fixes that. Additional fix for https://fedorahosted.org/freeipa/ticket/2846 -- Petr³ From

Re: [Freeipa-devel] [PATCH] 1051 Fix CS replica management

2012-09-20 Thread Jan Cholasta
Hi, Dne 31.8.2012 19:43, Rob Crittenden napsal(a): The naming in CS replication agreements is different from IPA agreements, we have to live with what the create. The master side should be on the local side, replica1, not the remote. This required reversing a few master variables. Pass in the

Re: [Freeipa-devel] [PATCH 0061] Add missing DNS view attach/detach to LDAP instance management code

2012-09-20 Thread Petr Spacek
On 09/13/2012 01:37 PM, Petr Spacek wrote: Hello, Add missing DNS view attach/detach to LDAP instance management code. This fixes race condition in BIND shutdown after SIGINT: - failing assert caused by use-after-free in dns_zt_find(): (((zt) != ((void *)0)) (((const

Re: [Freeipa-devel] [PATCH] 0074 validate SID for trusted domain when adding/modifying ID range

2012-09-20 Thread Alexander Bokovoy
On Thu, 20 Sep 2012, Petr Viktorin wrote: On 09/20/2012 12:12 PM, Martin Kosek wrote: On 09/20/2012 11:42 AM, Alexander Bokovoy wrote: Hi, On Thu, 20 Sep 2012, Martin Kosek wrote: On 09/19/2012 06:19 PM, Alexander Bokovoy wrote: Hi, This patch adds validation of SID for trusted domain when

[Freeipa-devel] [PATCH] 0075 Fix error messages and use proper ImportError for dcerpc

2012-09-20 Thread Alexander Bokovoy
Hi, fix use of NotFound error exception in plugins/group.py similar to what is discussed in patch 0074 for idrange plugin. -- / Alexander Bokovoy From 9028d2c8c8da9bc259e00250093352085317f91c Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy aboko...@redhat.com Date: Thu, 20 Sep 2012 14:02:15

Re: [Freeipa-devel] [PATCH] 0082 Use correct Dogtag port in ipaserver.install.certs

2012-09-20 Thread Martin Kosek
On 09/20/2012 12:48 PM, Petr Viktorin wrote: Something I overlooked in the Dogtag 10 patch: On an instance upgraded from Dogtag 9 to Dogtag 10, ipa-replica-prepare used the wrong set of constants, and failed to contact the server. This patch fixes that. Additional fix for

[Freeipa-devel] [PATCH] 0076-0077 Document trust commands and external group member

2012-09-20 Thread Alexander Bokovoy
Hi, attached patches 0076 and 0077 add base documentation about trust commands. Part of that documentation is also added to group membership plugin to describe external groups and external members. -- / Alexander Bokovoy From bb0c11364826c0738ab7bd649101cdaeaa0081f4 Mon Sep 17 00:00:00 2001

Re: [Freeipa-devel] [PATCH] 0074 validate SID for trusted domain when adding/modifying ID range

2012-09-20 Thread Martin Kosek
On 09/20/2012 01:58 PM, Alexander Bokovoy wrote: On Thu, 20 Sep 2012, Petr Viktorin wrote: On 09/20/2012 12:12 PM, Martin Kosek wrote: On 09/20/2012 11:42 AM, Alexander Bokovoy wrote: Hi, On Thu, 20 Sep 2012, Martin Kosek wrote: On 09/19/2012 06:19 PM, Alexander Bokovoy wrote: Hi, This

Re: [Freeipa-devel] [PATCH] 0074 validate SID for trusted domain when adding/modifying ID range

2012-09-20 Thread Alexander Bokovoy
On Thu, 20 Sep 2012, Martin Kosek wrote: On 09/20/2012 01:58 PM, Alexander Bokovoy wrote: On Thu, 20 Sep 2012, Petr Viktorin wrote: On 09/20/2012 12:12 PM, Martin Kosek wrote: On 09/20/2012 11:42 AM, Alexander Bokovoy wrote: Hi, On Thu, 20 Sep 2012, Martin Kosek wrote: On 09/19/2012 06:19

Re: [Freeipa-devel] [PATCH 0006] Improves sssd.conf handling during ipa-client uninstall

2012-09-20 Thread Martin Kosek
On 09/18/2012 11:21 AM, Tomas Babej wrote: On 09/12/2012 05:29 PM, Martin Kosek wrote: On 08/29/2012 02:54 PM, Tomas Babej wrote: On 08/27/2012 04:55 PM, Martin Kosek wrote: On 08/27/2012 03:37 PM, Jakub Hrozek wrote: On Mon, Aug 27, 2012 at 02:57:44PM +0200, Martin Kosek wrote: I think that

Re: [Freeipa-devel] [PATCH] 0074 validate SID for trusted domain when adding/modifying ID range

2012-09-20 Thread Martin Kosek
On 09/20/2012 02:31 PM, Alexander Bokovoy wrote: On Thu, 20 Sep 2012, Martin Kosek wrote: On 09/20/2012 01:58 PM, Alexander Bokovoy wrote: On Thu, 20 Sep 2012, Petr Viktorin wrote: On 09/20/2012 12:12 PM, Martin Kosek wrote: On 09/20/2012 11:42 AM, Alexander Bokovoy wrote: Hi, On Thu, 20

Re: [Freeipa-devel] [PATCH] 0075 Fix error messages and use proper ImportError for dcerpc

2012-09-20 Thread Martin Kosek
On 09/20/2012 02:01 PM, Alexander Bokovoy wrote: Hi, fix use of NotFound error exception in plugins/group.py similar to what is discussed in patch 0074 for idrange plugin. ACK. Pushed to master, ipa-3-0. Martin ___ Freeipa-devel mailing list

Re: [Freeipa-devel] [PATCH] 0076-0077 Document trust commands and external group member

2012-09-20 Thread Martin Kosek
On 09/20/2012 02:03 PM, Alexander Bokovoy wrote: Hi, attached patches 0076 and 0077 add base documentation about trust commands. Part of that documentation is also added to group membership plugin to describe external groups and external members. ACK. Pushed both patches to master,

Re: [Freeipa-devel] [PATCH] 0081 Only stop the main DS instance when upgrading it

2012-09-20 Thread Martin Kosek
On 09/14/2012 05:37 PM, Martin Kosek wrote: On 09/14/2012 04:53 PM, Petr Viktorin wrote: On 09/14/2012 04:12 PM, Petr Viktorin wrote: On 09/14/2012 03:12 PM, Simo Sorce wrote: On Fri, 2012-09-14 at 14:53 +0200, Petr Viktorin wrote: This fixes a 2.2→3.0 upgrade bug found while testing the

[Freeipa-devel] [PATCH 0065] Bump version in .spec file to 2.0

2012-09-20 Thread Petr Spacek
Hello, this patch bumps version in .spec file to 2.0. -- Petr^2 Spacek From b4fc1e119e5d602c196af47bde07d3cfe3091a3d Mon Sep 17 00:00:00 2001 From: Petr Spacek pspa...@redhat.com Date: Thu, 20 Sep 2012 16:14:05 +0200 Subject: [PATCH] Bump version in .spec file to 2.0. Signed-off-by: Petr

Re: [Freeipa-devel] [PATCH 0065] Bump version in .spec file to 2.0

2012-09-20 Thread Adam Tkac
On Thu, Sep 20, 2012 at 04:16:41PM +0200, Petr Spacek wrote: Hello, this patch bumps version in .spec file to 2.0. Ack From b4fc1e119e5d602c196af47bde07d3cfe3091a3d Mon Sep 17 00:00:00 2001 From: Petr Spacek pspa...@redhat.com Date: Thu, 20 Sep 2012 16:14:05 +0200 Subject: [PATCH] Bump

Re: [Freeipa-devel] [PATCH 0006] Improves sssd.conf handling during ipa-client uninstall

2012-09-20 Thread Tomas Babej
On 09/20/2012 02:42 PM, Martin Kosek wrote: On 09/18/2012 11:21 AM, Tomas Babej wrote: On 09/12/2012 05:29 PM, Martin Kosek wrote: On 08/29/2012 02:54 PM, Tomas Babej wrote: On 08/27/2012 04:55 PM, Martin Kosek wrote: On 08/27/2012 03:37 PM, Jakub Hrozek wrote: On Mon, Aug 27, 2012 at

Re: [Freeipa-devel] [PATCH 0065] Bump version in .spec file to 2.0

2012-09-20 Thread Petr Spacek
On 09/20/2012 04:18 PM, Adam Tkac wrote: On Thu, Sep 20, 2012 at 04:16:41PM +0200, Petr Spacek wrote: Hello, this patch bumps version in .spec file to 2.0. Ack Pushed to master: https://fedorahosted.org/bind-dyndb-ldap/changeset/bd1e312c74921f2572cad0a6ba7db7d25196d758 -- Petr^2 Spacek

Re: [Freeipa-devel] [PATCH 0006] Improves sssd.conf handling during ipa-client uninstall

2012-09-20 Thread Martin Kosek
On Thu, 2012-09-20 at 16:20 +0200, Tomas Babej wrote: On 09/20/2012 02:42 PM, Martin Kosek wrote: On 09/18/2012 11:21 AM, Tomas Babej wrote: On 09/12/2012 05:29 PM, Martin Kosek wrote: On 08/29/2012 02:54 PM, Tomas Babej wrote: On 08/27/2012 04:55 PM, Martin Kosek wrote: On 08/27/2012

Re: [Freeipa-devel] [PATCH] 1051 Fix CS replica management

2012-09-20 Thread Rob Crittenden
Jan Cholasta wrote: Hi, Dne 31.8.2012 19:43, Rob Crittenden napsal(a): The naming in CS replication agreements is different from IPA agreements, we have to live with what the create. The master side should be on the local side, replica1, not the remote. This required reversing a few master

Re: [Freeipa-devel] [PATCH] Set master_kdc and dns_lookup_kdc to true

2012-09-20 Thread Rob Crittenden
Sumit Bose wrote: On Sat, Sep 15, 2012 at 06:14:56PM -0400, Simo Sorce wrote: On Sat, 2012-09-15 at 22:02 +0200, Sumit Bose wrote: On Fri, Sep 14, 2012 at 05:57:23PM -0400, Rob Crittenden wrote: Sumit Bose wrote: Hi, those two patches should fix https://fedorahosted.org/freeipa/ticket/2515

Re: [Freeipa-devel] [PATCH] 1055 update audit cert renewal time

2012-09-20 Thread Rob Crittenden
Rob Crittenden wrote: The CA audit certificate is initially valid for two years but its profile has it renewing at six months. This bumps the value up to two years to match the other certificates. This relies on Petr's and Ade's dogtag 10 patches. Updated patch. The value of

Re: [Freeipa-devel] [PATCH] 1055 update audit cert renewal time

2012-09-20 Thread yi zhang
On 09/20/2012 02:58 PM, Rob Crittenden wrote: Updated patch. The value of policyset.caLogSigningSet.2.constraint.params.range needs to be bumped to 720 as well. I keep doing my test and let everyone know the test result. Yi -- ~ | Yi Zhang