[Freeipa-devel] [PATCH] 461 Update Dogtag 9 database during replica installation

2014-03-13 Thread Martin Kosek
When Dogtag 10 based FreeIPA replica is being installed for a Dogtag 9 based master, the PKI database is not updated and miss several ACLs which prevent some of the PKI functions, e.g. an ability to create other clones. Add an update file to do the database update. Content is based on

[Freeipa-devel] emerging standard for hosts/passwords policy/automount/netgroups in LDAP

2014-03-13 Thread Petr Spacek
Hello list, FYI I have come across following RFC drafts: (please start with the first one :-) http://www.ietf.org/id/draft-bannister-dbis-mapping-03.txt http://tools.ietf.org/html/draft-bannister-dbis-passwd-02 http://www.ietf.org/id/draft-bannister-dbis-policy-03.txt

[Freeipa-devel] emerging standard for System for Cross-Domain Identity Management

2014-03-13 Thread Petr Spacek
Hello list, my journey to the IETF land revealed following RFC drafts: System for Cross-Domain Identity Management 2. SCIM User Scenarios 2.1. Background Context The System for Cross-domain Identity Management (SCIM) specification is designed to make managing user identity in cloud based

[Freeipa-devel] LDAP Queue Length Control for better LDAP client performance?

2014-03-13 Thread Petr Spacek
Hello list, my journey to the IETF wonderland revealed one more RFC draft: LDAP Queue Length Control http://tools.ietf.org/html/draft-hollstein-queuelength-control-01 I have no idea if this can really improve LDAP client performance or not but IMHO it is worth exploring it. Maybe only an

Re: [Freeipa-devel] [PATCH] 549 webui: use unique ids for checkboxes

2014-03-13 Thread Petr Viktorin
On 03/12/2014 05:51 PM, Misnyovszki Adam wrote: On Tue, 25 Feb 2014 18:12:20 +0100 Petr Vobornik pvobo...@redhat.com wrote: This is a minor fix. Please don't close ticket 3904 yet if committed. Checkboxes have not used unique ids across the whole UI. It broke checking by clicking on label for

[Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Tomas Babej
Hi, Changes the code in the idrange_del method to not only check for the root domains that match the SID in the IDRange, but for the SIDs of subdomains of trusts as well. https://fedorahosted.org/freeipa/ticket/4247 -- Tomas Babej Associate Software Engeneer | Red Hat | Identity Management

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Martin Kosek
On 03/13/2014 12:45 PM, Tomas Babej wrote: Hi, Changes the code in the idrange_del method to not only check for the root domains that match the SID in the IDRange, but for the SIDs of subdomains of trusts as well. https://fedorahosted.org/freeipa/ticket/4247 This is a very complicated

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Alexander Bokovoy
On Thu, 13 Mar 2014, Tomas Babej wrote: Hi, Changes the code in the idrange_del method to not only check for the root domains that match the SID in the IDRange, but for the SIDs of subdomains of trusts as well. https://fedorahosted.org/freeipa/ticket/4247 -- Tomas Babej Associate Software

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Alexander Bokovoy
On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 12:45 PM, Tomas Babej wrote: Hi, Changes the code in the idrange_del method to not only check for the root domains that match the SID in the IDRange, but for the SIDs of subdomains of trusts as well.

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Martin Kosek
On 03/13/2014 12:59 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Tomas Babej wrote: Hi, Changes the code in the idrange_del method to not only check for the root domains that match the SID in the IDRange, but for the SIDs of subdomains of trusts as well.

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Martin Kosek
On 03/13/2014 01:01 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 12:45 PM, Tomas Babej wrote: Hi, Changes the code in the idrange_del method to not only check for the root domains that match the SID in the IDRange, but for the SIDs of subdomains of

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Alexander Bokovoy
On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 01:01 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 12:45 PM, Tomas Babej wrote: Hi, Changes the code in the idrange_del method to not only check for the root domains that match the SID in the

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Martin Kosek
On 03/13/2014 01:10 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 01:01 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 12:45 PM, Tomas Babej wrote: Hi, Changes the code in the idrange_del method to not only check for

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Petr Spacek
On 13.3.2014 13:20, Martin Kosek wrote: On 03/13/2014 01:10 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 01:01 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 12:45 PM, Tomas Babej wrote: Hi, Changes the code in the

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Alexander Bokovoy
On Thu, 13 Mar 2014, Petr Spacek wrote: On 13.3.2014 13:20, Martin Kosek wrote: On 03/13/2014 01:10 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 01:01 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 12:45 PM, Tomas

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Martin Kosek
On 03/13/2014 01:33 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Petr Spacek wrote: On 13.3.2014 13:20, Martin Kosek wrote: On 03/13/2014 01:10 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 01:01 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014,

Re: [Freeipa-devel] [PATCHES] 172-196 Refactor certificate renewal code

2014-03-13 Thread Jan Cholasta
On 12.3.2014 19:59, Petr Viktorin wrote: On 03/10/2014 01:03 PM, Jan Cholasta wrote: On 17.10.2013 18:59, Jan Cholasta wrote: On 17.10.2013 18:01, Petr Viktorin wrote: On 10/17/2013 02:21 PM, Jan Cholasta wrote: Hi, this patchset contains refactoring of the certificate renewal code, which

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Martin Kosek
On 03/13/2014 01:36 PM, Martin Kosek wrote: On 03/13/2014 01:33 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Petr Spacek wrote: On 13.3.2014 13:20, Martin Kosek wrote: On 03/13/2014 01:10 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 01:01 PM,

[Freeipa-devel] [PATCH] 0496 ipaserver.install.service: Fix estimated time display

2014-03-13 Thread Petr Viktorin
Hello, The time estimate display is broken, so I wrote a test for it. Also the bug should be fixed now. https://fedorahosted.org/freeipa/ticket/4242 -- PetrĀ³ From 4aee528f2f3085157ee9b1c888d4c35db45b694b Mon Sep 17 00:00:00 2001 From: Petr Viktorin pvikt...@redhat.com Date: Wed, 12 Mar 2014

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Alexander Bokovoy
On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 01:36 PM, Martin Kosek wrote: On 03/13/2014 01:33 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Petr Spacek wrote: On 13.3.2014 13:20, Martin Kosek wrote: On 03/13/2014 01:10 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin

Re: [Freeipa-devel] [PATCHES] 0473-0477+0497 Managed permission updater, part 1

2014-03-13 Thread Petr Viktorin
On 03/07/2014 10:45 AM, Martin Kosek wrote: On 03/05/2014 01:48 PM, Petr Viktorin wrote: On 03/03/2014 04:10 PM, Petr Viktorin wrote: On 02/28/2014 02:47 PM, Petr Viktorin wrote: On 02/28/2014 02:12 PM, Martin Kosek wrote: On 02/26/2014 10:44 AM, Petr Viktorin wrote: Hello, Here are a few

Re: [Freeipa-devel] emerging standard for hosts/passwords policy/automount/netgroups in LDAP

2014-03-13 Thread Dmitri Pal
On 03/13/2014 04:40 AM, Petr Spacek wrote: Hello list, FYI I have come across following RFC drafts: (please start with the first one :-) http://www.ietf.org/id/draft-bannister-dbis-mapping-03.txt http://tools.ietf.org/html/draft-bannister-dbis-passwd-02

Re: [Freeipa-devel] [PATCH] 0496 ipaserver.install.service: Fix estimated time display

2014-03-13 Thread Rob Crittenden
Petr Viktorin wrote: Hello, The time estimate display is broken, so I wrote a test for it. Also the bug should be fixed now. https://fedorahosted.org/freeipa/ticket/4242 ACK ___ Freeipa-devel mailing list Freeipa-devel@redhat.com

Re: [Freeipa-devel] [PATCH] 461 Update Dogtag 9 database during replica installation

2014-03-13 Thread Martin Kosek
On 03/13/2014 09:09 AM, Martin Kosek wrote: When Dogtag 10 based FreeIPA replica is being installed for a Dogtag 9 based master, the PKI database is not updated and miss several ACLs which prevent some of the PKI functions, e.g. an ability to create other clones. Add an update file to do

Re: [Freeipa-devel] LDAP Queue Length Control for better LDAP client performance?

2014-03-13 Thread Rich Megginson
On 03/13/2014 03:08 AM, Petr Spacek wrote: Hello list, my journey to the IETF wonderland revealed one more RFC draft: LDAP Queue Length Control http://tools.ietf.org/html/draft-hollstein-queuelength-control-01 I have no idea if this can really improve LDAP client performance or not but IMHO

Re: [Freeipa-devel] [PATCH] 546 webui: Datetime parsing and formatting

2014-03-13 Thread Misnyovszki Adam
On Thu, 06 Mar 2014 13:26:03 +0100 Petr Vobornik pvobo...@redhat.com wrote: On 6.3.2014 13:01, Misnyovszki Adam wrote: On Tue, 25 Feb 2014 18:05:28 +0100 Petr Vobornik pvobo...@redhat.com wrote: prerequisite for patch 547, 548 depends on tbabej's datetime patch this patch

Re: [Freeipa-devel] [PATCH] 0235 tests: Use ipa-getkeytab from /usr/sbin instead of the in-tree one

2014-03-13 Thread Martin Kosek
On 03/05/2014 03:51 PM, Petr Viktorin wrote: On 09/24/2013 05:34 PM, Petr Viktorin wrote: On 06/04/2013 05:48 PM, Simo Sorce wrote: On Tue, 2013-06-04 at 17:24 +0200, Petr Viktorin wrote: On 06/04/2013 02:53 PM, Simo Sorce wrote: On Tue, 2013-06-04 at 13:48 +0200, Petr Viktorin wrote:

Re: [Freeipa-devel] [PATCH] 546 webui: Datetime parsing and formatting

2014-03-13 Thread Petr Viktorin
On 03/13/2014 03:45 PM, Misnyovszki Adam wrote: On Thu, 06 Mar 2014 13:26:03 +0100 Petr Vobornik pvobo...@redhat.com wrote: On 6.3.2014 13:01, Misnyovszki Adam wrote: On Tue, 25 Feb 2014 18:05:28 +0100 Petr Vobornik pvobo...@redhat.com wrote: prerequisite for patch 547, 548 depends on

Re: [Freeipa-devel] [PATCH] 548 webui: change ipatokennotbefore and ipatokennotafter types to datetime

2014-03-13 Thread Misnyovszki Adam
On Tue, 25 Feb 2014 18:10:13 +0100 Petr Vobornik pvobo...@redhat.com wrote: Depends on tbabej's patches # 137, 140 and pvoborni's 546 and 531-541. https://fedorahosted.org/freeipa/ticket/3369 ACK ___ Freeipa-devel mailing list

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Tomas Babej
On 03/13/2014 01:47 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 01:36 PM, Martin Kosek wrote: On 03/13/2014 01:33 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Petr Spacek wrote: On 13.3.2014 13:20, Martin Kosek wrote: On 03/13/2014 01:10 PM,

Re: [Freeipa-devel] [PATCH] 461 Update Dogtag 9 database during replica installation

2014-03-13 Thread Martin Kosek
On 03/13/2014 03:15 PM, Martin Kosek wrote: On 03/13/2014 09:09 AM, Martin Kosek wrote: When Dogtag 10 based FreeIPA replica is being installed for a Dogtag 9 based master, the PKI database is not updated and miss several ACLs which prevent some of the PKI functions, e.g. an ability to create

Re: [Freeipa-devel] [PATCH] 550 webui-css: improve radio, checkbox keyboard support and color

2014-03-13 Thread Petr Vobornik
On 7.3.2014 15:34, Petr Vobornik wrote: checkboxes and radio buttons: - do not change color on hover when disabled - are focusable and checkable by keyboard again. This uses a little trick where the real checkbox is hidden under the artificial checkbox. That way it has the same position

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Tomas Babej
On 03/13/2014 04:28 PM, Tomas Babej wrote: On 03/13/2014 01:47 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Martin Kosek wrote: On 03/13/2014 01:36 PM, Martin Kosek wrote: On 03/13/2014 01:33 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Petr Spacek wrote: On 13.3.2014 13:20,

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Alexander Bokovoy
On Thu, 13 Mar 2014, Tomas Babej wrote: Tomas, could you please change the code correspondingly? Sure. Here is the updated patch. Slightly improved patch with better control flow. Thanks for the reviews. -- Tomas Babej Associate Software Engeneer | Red Hat | Identity Management RHCE | Brno

Re: [Freeipa-devel] [PATCH 0157] Prohibit deletion of active subdomain range

2014-03-13 Thread Petr Viktorin
On 03/13/2014 05:11 PM, Alexander Bokovoy wrote: On Thu, 13 Mar 2014, Tomas Babej wrote: Tomas, could you please change the code correspondingly? Sure. Here is the updated patch. Slightly improved patch with better control flow. Thanks for the reviews. -- Tomas Babej Associate Software

Re: [Freeipa-devel] [PATCH] 0496 ipaserver.install.service: Fix estimated time display

2014-03-13 Thread Petr Viktorin
On 03/13/2014 02:41 PM, Rob Crittenden wrote: Petr Viktorin wrote: Hello, The time estimate display is broken, so I wrote a test for it. Also the bug should be fixed now. https://fedorahosted.org/freeipa/ticket/4242 ACK Pushed to master: 7c9fa8fad96c039b96939f8df8d740ad6b50eec9 -- PetrĀ³

Re: [Freeipa-devel] emerging standard for hosts/passwords policy/automount/netgroups in LDAP

2014-03-13 Thread Simo Sorce
On Thu, 2014-03-13 at 09:40 +0100, Petr Spacek wrote: Hello list, FYI I have come across following RFC drafts: (please start with the first one :-) http://www.ietf.org/id/draft-bannister-dbis-mapping-03.txt http://tools.ietf.org/html/draft-bannister-dbis-passwd-02

Re: [Freeipa-devel] emerging standard for System for Cross-Domain Identity Management

2014-03-13 Thread Simo Sorce
On Thu, 2014-03-13 at 09:50 +0100, Petr Spacek wrote: Hello list, my journey to the IETF land revealed following RFC drafts: System for Cross-Domain Identity Management 2. SCIM User Scenarios 2.1. Background Context The System for Cross-domain Identity Management (SCIM)

Re: [Freeipa-devel] emerging standard for System for Cross-Domain Identity Management

2014-03-13 Thread Martin Kosek
On 03/13/2014 07:17 PM, Simo Sorce wrote: On Thu, 2014-03-13 at 09:50 +0100, Petr Spacek wrote: Hello list, my journey to the IETF land revealed following RFC drafts: System for Cross-Domain Identity Management 2. SCIM User Scenarios 2.1. Background Context The System for Cross-domain