Re: [Freeipa-devel] [PATCH] 355 Avoid internal error when user is not Trust admin

2013-02-20 Thread Martin Kosek
On 02/19/2013 10:19 PM, Rob Crittenden wrote: Martin Kosek wrote: On 01/24/2013 12:01 PM, Martin Kosek wrote: When user tries to perform any action requiring communication with trusted domain, IPA server tries to retrieve a trust secret on his behalf to be able to establish the connection.

[Freeipa-devel] [PATCH 0035] Use default.conf as flag of IPA client being installed

2013-02-20 Thread Tomas Babej
Hi, When installing / uninstalling IPA client, the checks that determine whether IPA client is installed now take the existence of /etc/ipa/default.conf into consideration. The client will not uninstall unless either something is backed up or /etc/ipa/default.conf file does exist. The client

Re: [Freeipa-devel] [PATCH 0024] Make options checks in idrange-add/mod consistent

2013-02-20 Thread Martin Kosek
On 12/11/2012 12:34 PM, Tomas Babej wrote: Hi, **NOTE**: This is to be applied on top of my PATCH 0021 Option checks in idrange-add/mod have been made consistent. Both now enforce the following checks: - dom_sid and secondary_rid_base cannot be used together - rid_base must be used

Re: [Freeipa-devel] [PATCH] 0006 Remove check for alphabetic only characters from domain name validation

2013-02-20 Thread Ana Krivokapic
On 02/18/2013 01:08 PM, Martin Kosek wrote: On 02/18/2013 12:47 PM, Sumit Bose wrote: On Mon, Feb 18, 2013 at 12:27:35PM +0100, Petr Spacek wrote: On 15.2.2013 15:22, Ana Krivokapic wrote: Hello, The .isalpha() check in validate_domain_name() was too strict, causing some commands like ipa

Re: [Freeipa-devel] [PATCHES 0024-0025] Improvements to idrange.py

2013-02-20 Thread Tomas Babej
On 12/21/2012 12:15 PM, Tomas Babej wrote: Hi, Sending updated and rebased versions of patches 0024 and 0025. Tomas Sending rebased version, these got quite rotten. Tomas From f21b135d546678544ccf05efd587b46bba88e07a Mon Sep 17 00:00:00 2001 From: Tomas Babej tba...@redhat.com Date: Fri,

Re: [Freeipa-devel] [PATCH 0027] Add checks for SELinux in install scripts

2013-02-20 Thread Tomas Babej
On Tue 19 Feb 2013 08:37:26 PM CET, Rob Crittenden wrote: Tomas Babej wrote: On 02/04/2013 04:21 PM, Rob Crittenden wrote: Tomas Babej wrote: On 01/30/2013 05:12 PM, Tomas Babej wrote: Hi, The checks make sure that SELinux is: - installed and enabled (on server install) - installed and

Re: [Freeipa-devel] [PATCH] 355 Avoid internal error when user is not Trust admin

2013-02-20 Thread Petr Viktorin
On 02/20/2013 09:15 AM, Martin Kosek wrote: On 02/19/2013 10:19 PM, Rob Crittenden wrote: Martin Kosek wrote: On 01/24/2013 12:01 PM, Martin Kosek wrote: When user tries to perform any action requiring communication with trusted domain, IPA server tries to retrieve a trust secret on his

Re: [Freeipa-devel] [PATCHES 0031-0032] Improve HBAC rule handling in selinuxusermap-add/mod/find

2013-02-20 Thread Tomas Babej
On 02/19/2013 10:33 PM, Rob Crittenden wrote: Tomas Babej wrote: On 02/06/2013 07:57 PM, Rob Crittenden wrote: Tomas Babej wrote: Hi, this pair of patches improves HBAC rule handling in selinuxusermap commands. Patch 0031 deals with: https://fedorahosted.org/freeipa/ticket/3349 Patch 0032

Re: [Freeipa-devel] [PATCHES] 0022, 0115-0116 Make Sudo commands case-sensitive

2013-02-20 Thread Martin Kosek
On 12/17/2012 04:08 PM, Petr Viktorin wrote: https://fedorahosted.org/freeipa/ticket/2482 The first two patches are rebased from what I sent back in March; the third fixes ACIs using targetfilter. I finally got to your patches. Generally, everything worked like charm, I have just few minor

Re: [Freeipa-devel] [PATCHES 0024-0025] Improvements to idrange.py

2013-02-20 Thread Alexander Bokovoy
On Wed, 20 Feb 2013, Tomas Babej wrote: On 12/21/2012 12:15 PM, Tomas Babej wrote: Hi, Sending updated and rebased versions of patches 0024 and 0025. Tomas Sending rebased version, these got quite rotten. Thanks for updating them. @@ -504,25 +515,37 @@ class idrange_mod(LDAPUpdate):

Re: [Freeipa-devel] [PATCH] Add delegation info to MS-PAC

2013-02-20 Thread Martin Kosek
On 02/07/2013 10:42 PM, Simo Sorce wrote: This information is not strictly required but is part of the MS-PAC specification and I had some time to kill on the plane on my last trip back. I tested it briefly with cross-realm trusts and it seem to work fine. Neither IPA nor AD2012 complained

Re: [Freeipa-devel] [PATCHES 0024-0025] Improvements to idrange.py

2013-02-20 Thread Tomas Babej
On Wed 20 Feb 2013 02:24:03 PM CET, Alexander Bokovoy wrote: On Wed, 20 Feb 2013, Tomas Babej wrote: On 12/21/2012 12:15 PM, Tomas Babej wrote: Hi, Sending updated and rebased versions of patches 0024 and 0025. Tomas Sending rebased version, these got quite rotten. Thanks for updating

Re: [Freeipa-devel] [PATCH] Add delegation info to MS-PAC

2013-02-20 Thread Simo Sorce
On Wed, 2013-02-20 at 15:12 +0100, Martin Kosek wrote: On 02/07/2013 10:42 PM, Simo Sorce wrote: This information is not strictly required but is part of the MS-PAC specification and I had some time to kill on the plane on my last trip back. I tested it briefly with cross-realm trusts

Re: [Freeipa-devel] Backup and Restore design

2013-02-20 Thread Rob Crittenden
Simo Sorce wrote: On Tue, 2013-02-19 at 22:43 -0500, Rob Crittenden wrote: I've looked into some basic backup and restore procedures for IPA. My findings are here: http://freeipa.org/page/V3/Backup_and_Restore Great summary! For the catastrofic failure scenario, should we mention how to put

Re: [Freeipa-devel] [PATCHES] 0022, 0115-0116 Make Sudo commands case-sensitive

2013-02-20 Thread Petr Viktorin
On 02/20/2013 12:46 PM, Martin Kosek wrote: On 12/17/2012 04:08 PM, Petr Viktorin wrote: https://fedorahosted.org/freeipa/ticket/2482 The first two patches are rebased from what I sent back in March; the third fixes ACIs using targetfilter. I finally got to your patches. Generally,

Re: [Freeipa-devel] [PATCHES] 0104-0106 Provide means of displaying warning and informational messages on clients

2013-02-20 Thread Martin Kosek
On 02/19/2013 12:15 PM, Petr Viktorin wrote: On 02/13/2013 11:18 AM, Petr Viktorin wrote: On 01/29/2013 05:06 PM, Petr Viktorin wrote: On 01/04/2013 07:20 PM, Petr Viktorin wrote: On 12/14/2012 09:04 AM, Jan Cholasta wrote: On 13.12.2012 18:09, Petr Viktorin wrote: On 12/13/2012 04:43 PM,

Re: [Freeipa-devel] Backup and Restore design

2013-02-20 Thread Rich Megginson
On 02/20/2013 08:38 AM, Rob Crittenden wrote: Simo Sorce wrote: On Tue, 2013-02-19 at 22:43 -0500, Rob Crittenden wrote: I've looked into some basic backup and restore procedures for IPA. My findings are here: http://freeipa.org/page/V3/Backup_and_Restore Great summary! For the catastrofic

Re: [Freeipa-devel] [PATCHES] 0177-0179 Add missing dict methods to CIDict

2013-02-20 Thread Petr Viktorin
On 02/19/2013 01:51 PM, Jan Cholasta wrote: Hi, On 5.2.2013 18:02, Petr Viktorin wrote: CIDict, our case-insensitive dictionary, inherits from dict but did not reimplement the full dict interface. Calling the missing methods silently invoked case-sensitive behavior. Our code seems to avoid

Re: [Freeipa-devel] [PATCHES] 0022, 0115-0116 Make Sudo commands case-sensitive

2013-02-20 Thread Martin Kosek
On 02/20/2013 05:00 PM, Petr Viktorin wrote: On 02/20/2013 12:46 PM, Martin Kosek wrote: On 12/17/2012 04:08 PM, Petr Viktorin wrote: https://fedorahosted.org/freeipa/ticket/2482 The first two patches are rebased from what I sent back in March; the third fixes ACIs using targetfilter. I

Re: [Freeipa-devel] Backup and Restore design

2013-02-20 Thread Rob Crittenden
Rich Megginson wrote: On 02/20/2013 08:38 AM, Rob Crittenden wrote: Simo Sorce wrote: On Tue, 2013-02-19 at 22:43 -0500, Rob Crittenden wrote: I've looked into some basic backup and restore procedures for IPA. My findings are here: http://freeipa.org/page/V3/Backup_and_Restore Great

Re: [Freeipa-devel] Backup and Restore design

2013-02-20 Thread Rich Megginson
On 02/20/2013 09:44 AM, Rob Crittenden wrote: Rich Megginson wrote: On 02/20/2013 08:38 AM, Rob Crittenden wrote: Simo Sorce wrote: On Tue, 2013-02-19 at 22:43 -0500, Rob Crittenden wrote: I've looked into some basic backup and restore procedures for IPA. My findings are here:

Re: [Freeipa-devel] [PATCH] 355 Avoid internal error when user is not Trust admin

2013-02-20 Thread Martin Kosek
On 02/20/2013 12:30 PM, Petr Viktorin wrote: On 02/20/2013 09:15 AM, Martin Kosek wrote: On 02/19/2013 10:19 PM, Rob Crittenden wrote: Martin Kosek wrote: On 01/24/2013 12:01 PM, Martin Kosek wrote: When user tries to perform any action requiring communication with trusted domain, IPA server

Re: [Freeipa-devel] [PATCH] 355 Avoid internal error when user is not Trust admin

2013-02-20 Thread Rob Crittenden
Martin Kosek wrote: On 02/20/2013 12:30 PM, Petr Viktorin wrote: On 02/20/2013 09:15 AM, Martin Kosek wrote: On 02/19/2013 10:19 PM, Rob Crittenden wrote: Martin Kosek wrote: On 01/24/2013 12:01 PM, Martin Kosek wrote: When user tries to perform any action requiring communication with

[Freeipa-devel] NSS 3.14.3 Release, this fixes the certutil bug encountered during install

2013-02-20 Thread John Dennis
NSS 3.14.3 was just released by the NSS team. This is critical for us because it fixes https://bugzilla.mozilla.org/show_bug.cgi?id=840714 which was causing install failures as reported on this list. I expect a new RPM will follow shortly. John Original Message Subject: