Re: [Freeipa-devel] [PATCHES] 0080-0081 Add userClass attributes for users and hosts

2013-11-14 Thread Petr Vobornik
On 11/13/2013 01:33 PM, Ana Krivokapic wrote: On 11/12/2013 01:27 PM, Ana Krivokapic wrote: On 10/30/2013 09:56 PM, Martin Kosek wrote: - Original Message - From: Simo Sorce s...@redhat.com To: Ana Krivokapic akriv...@redhat.com Cc: Martin Kosek mko...@redhat.com, freeipa-devel

Re: [Freeipa-devel] [PATCHES] 0072-0074 Add automember rebuild membership to the web UI

2013-11-14 Thread Petr Vobornik
On 10/29/2013 12:33 PM, Ana Krivokapic wrote: On 10/24/2013 03:48 PM, Petr Vobornik wrote: On 10/16/2013 11:37 PM, Ana Krivokapic wrote: On 09/27/2013 04:38 PM, Petr Vobornik wrote: On 09/25/2013 11:51 AM, Ana Krivokapic wrote: Hello, This patch set addresses ticket

Re: [Freeipa-devel] [PATCH 0113] ipa-client: Set NIS domain name in the installer

2013-11-14 Thread Ana Krivokapic
On 09/26/2013 10:28 AM, Tomas Babej wrote: +if options.no_nisdomain and not options.nisdomain: This should be `if options.no_nisdomain and options.nisdomain:`. +parser.error(--no-nisdomain cannot be used together with --nisdomain) Shouldn't we also revert the nisdomain authconfig

Re: [Freeipa-devel] [PATCH] 0082 Use EXTERNAL auth mechanism in ldapmodify

2013-11-14 Thread Martin Kosek
On 11/13/2013 05:45 PM, Tomas Babej wrote: On 11/05/2013 06:44 PM, Ana Krivokapic wrote: Hello, This patch addresses ticket https://fedorahosted.org/freeipa/ticket/3895. ___ Freeipa-devel mailing list Freeipa-devel@redhat.com

Re: [Freeipa-devel] [PATCHES] 0068-0070 Automember rebuild membership

2013-11-14 Thread Martin Kosek
On 11/13/2013 04:56 PM, Ana Krivokapic wrote: On 11/13/2013 03:08 PM, Martin Kosek wrote: On 10/29/2013 12:30 PM, Ana Krivokapic wrote: On 10/15/2013 06:09 PM, Ana Krivokapic wrote: On 09/30/2013 10:02 AM, Petr Viktorin wrote: On 09/27/2013 03:12 PM, Martin Kosek wrote: On 09/27/2013 03:00

Re: [Freeipa-devel] [PATCHES] 0068-0070 Automember rebuild membership

2013-11-14 Thread Ana Krivokapic
On 11/14/2013 03:11 PM, Martin Kosek wrote: On 11/13/2013 04:56 PM, Ana Krivokapic wrote: On 11/13/2013 03:08 PM, Martin Kosek wrote: On 10/29/2013 12:30 PM, Ana Krivokapic wrote: On 10/15/2013 06:09 PM, Ana Krivokapic wrote: On 09/30/2013 10:02 AM, Petr Viktorin wrote: On 09/27/2013 03:12

[Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-14 Thread Petr Spacek
Hello, there is an interesting idea that installers should be idempotent. I have heard it on LinuxAlt conference 2013 in Brno, Czech republic and it is implemented e.g. by project Chef [1] and it is used e.g. by OpenStack installer [2] (used e.g. by SUSE). What Wikipedia says about

[Freeipa-devel] FreeIPA 3.3.latest failing tests: config_mod: Add/Remove the unrelated objectclass from ipauserobjectclasses

2013-11-14 Thread Petr Spacek
Hello, latest FreeIPA build from branch ipa-3-3 (built today on Fedora 20, latest bits) fails following tests: == ERROR: test_config[0]: config_mod: Try to add an unrelated objectclass to ipauserobjectclasses

[Freeipa-devel] FreeIPA 3.3.latest is failing tests: Find all certificates for this IPA server short name (exact)

2013-11-14 Thread Petr Spacek
Hello, latest FreeIPA build from branch ipa-3-3 (built today on Fedora 20, latest bits) fails following tests: == FAIL: Find all certificates for this IPA server short name (exact)

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-14 Thread Derek Moore
As someone who has fought with using/modifying/QA'ing unstable FreeIPA installers from the nightly repos, I wholeheartedly second this motion! Make sure the oVirt guys get wind of this idea also! ;) PS: semi-related note — Can FreeIPA be made to consume the CSR that results from the

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-14 Thread Derek Moore
PPS: you guys might be able to borrow oVirt's otopi installer engine, it seems to have been created to make install scripts more declarative. Although to the end-user otopi can seem dense, complicated, and mysterious (e.g., its weird .conf file syntax). They might need your help making otopi more

[Freeipa-devel] Include proposal to contrib (expired user accounts query tool)

2013-11-14 Thread Antti Peltonen
Hi all, I have created the following https://bitbucket.org/bcow/freeipa-expired-user-accounts-query tool to mitigate a situation when users in directory never login to servers and therefore do not receive alerts about expiring passwords. My tool can be used to query the LDAP directory and list

Re: [Freeipa-devel] Include proposal to contrib (expired user accounts query tool)

2013-11-14 Thread Dmitri Pal
On 11/14/2013 12:08 PM, Antti Peltonen wrote: Hi all, I have created the following https://bitbucket.org/bcow/freeipa-expired-user-accounts-query tool to mitigate a situation when users in directory never login to servers and therefore do not receive alerts about expiring passwords. My tool

Re: [Freeipa-devel] [PATCH 0024] Add OTP support to ipalib CLI

2013-11-14 Thread Nathaniel McCallum
On Wed, 2013-10-30 at 08:57 +0100, Jan Cholasta wrote: On 8.10.2013 16:35, Nathaniel McCallum wrote: On Tue, 2013-10-08 at 09:19 +0200, Jan Cholasta wrote: +class Base32DecodeError(ExecutionError): Is this really necessary? Are we going to add encodingDecodeError for every kind of new

Re: [Freeipa-devel] [PATCH 0024] Add OTP support to ipalib CLI

2013-11-14 Thread Nathaniel McCallum
On Tue, 2013-10-29 at 10:18 -0400, Rob Crittenden wrote: Petr Vobornik wrote: On 10/04/2013 10:16 PM, Nathaniel McCallum wrote: This patch supersedes my patch 0017 and requires patches 0020-0023. I believe I have solved all of the outstanding issues from the review of patch 0017, unless

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-14 Thread Jan Pazdziora
On Thu, Nov 14, 2013 at 03:40:52PM +0100, Petr Spacek wrote: In reality, it means that you can re-run OpenStack installer on the same machine/set of machines (with the same configuration, of course!) and it will re-do everything again. You can re-run The point is that it should *not* redo

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-14 Thread James
On Thu, Nov 14, 2013 at 11:41 AM, Derek Moore derek.p.mo...@gmail.com wrote: PPS: you guys might be able to borrow oVirt's otopi installer engine, it seems to have been created to make install scripts more declarative. If you like declarative, you should consider using my puppet-ipa module to

Re: [Freeipa-devel] Include proposal to contrib (expired user accounts query tool)

2013-11-14 Thread Antti Peltonen
Hi, On 14 November 2013 21:06, Dmitri Pal d...@redhat.com wrote: A quick look at the tool's command line indicates that it is probably not using any of the IPA framework and rather goes over LDAP. I am not sure that this is the best approach, let us discuss... Could you please point me

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-14 Thread Petr Spacek
On 15.11.2013 02:14, Jan Pazdziora wrote: On Thu, Nov 14, 2013 at 03:40:52PM +0100, Petr Spacek wrote: In reality, it means that you can re-run OpenStack installer on the same machine/set of machines (with the same configuration, of course!) and it will re-do everything again. You can re-run