[Freeipa-devel] [PATCH PoC] proper support of kerberos principal aliases

2015-09-09 Thread Martin Babinsky
Work-in-progress patchset for https://fedorahosted.org/freeipa/ticket/3864 I didn't even format the patches according to guidelines since I will certainly get many comments from Simo/Alexander and do a lot of reworking. But I hope I'm at least on a right track. -- Martin^3 Babinsky From

Re: [Freeipa-devel] [PATCH] 916 vault: add vault container commands

2015-09-09 Thread Jan Cholasta
On 8.9.2015 23:06, Petr Vobornik wrote: On 09/03/2015 03:18 PM, Jan Cholasta wrote: On 2.9.2015 07:26, Endi Sukma Dewata wrote: On 9/1/2015 10:22 AM, Simo Sorce wrote: On Tue, 2015-09-01 at 17:15 +0200, Petr Vobornik wrote: On 09/01/2015 04:39 PM, Jan Cholasta wrote: On 1.9.2015 16:26, Jan

Re: [Freeipa-devel] IPA 3.0 migrated to 4.1 users break winsync agreement when deleted in active directory

2015-09-09 Thread Martin Basti
On 09/09/2015 10:50 AM, Andreas Calminder wrote: Forgot to write that deleting users in active directory not migrated with the migrate-ds command works fine, it's only migrated users present in the ad that breaks the winsync agreement on deletion. On 09/09/2015 10:35 AM, Andreas Calminder

Re: [Freeipa-devel] [PATCH 0058, 0064] dns: do not add (forward)zone if it is already resolvable.

2015-09-09 Thread Petr Spacek
On 8.9.2015 16:30, David Kupka wrote: > On 28/08/15 13:36, Martin Basti wrote: >> >> >> On 08/28/2015 10:03 AM, Petr Spacek wrote: >>> On 27.8.2015 14:22, David Kupka wrote: @@ -2101,11 +2101,25 @@ class DNSZoneBase(LDAPObject): class DNSZoneBase_add(LDAPCreate): +

Re: [Freeipa-devel] [PATCH 0311] tests: fix vault tests

2015-09-09 Thread Martin Babinsky
On 09/08/2015 05:45 PM, Martin Basti wrote: Attached patch fixes vault tests. Tests work for me, ACK. -- Martin^3 Babinsky -- Manage your subscription for the Freeipa-devel mailing list: https://www.redhat.com/mailman/listinfo/freeipa-devel Contribute to FreeIPA:

Re: [Freeipa-devel] [PATCH 0311] tests: fix vault tests

2015-09-09 Thread Martin Basti
On 09/09/2015 02:21 PM, Martin Babinsky wrote: On 09/08/2015 05:45 PM, Martin Basti wrote: Attached patch fixes vault tests. Tests work for me, ACK. pushed to master: * 9ffe7f49987bf788449a2007a33f0a3d83ea4553 FIX vault tests ipa-4-2: * 72ba3777ca8c58dbbb912a19f81fd2bb2983b8d6 FIX vault

Re: [Freeipa-devel] [PATCH PoC] proper support of kerberos principal aliases

2015-09-09 Thread Simo Sorce
On Wed, 2015-09-09 at 10:52 +0200, Martin Babinsky wrote: > if (found) { > +/* replace the incoming principal with the value got > from LDAP > + * search. This is needed so that correctly case > principal is > + * returned in the case

Re: [Freeipa-devel] [PATCH PoC] proper support of kerberos principal aliases

2015-09-09 Thread Simo Sorce
On Wed, 2015-09-09 at 10:52 +0200, Martin Babinsky wrote: > Work-in-progress patchset for https://fedorahosted.org/freeipa/ticket/3864 > > I didn't even format the patches according to guidelines since I will > certainly get many comments from Simo/Alexander and do a lot of > reworking. But I

Re: [Freeipa-devel] IPA 3.0 migrated to 4.1 users break winsync agreement when deleted in active directory

2015-09-09 Thread Rich Megginson
On 09/09/2015 03:39 AM, Martin Basti wrote: On 09/09/2015 10:50 AM, Andreas Calminder wrote: Forgot to write that deleting users in active directory not migrated with the migrate-ds command works fine, it's only migrated users present in the ad that breaks the winsync agreement on deletion.

Re: [Freeipa-devel] [PATCH PoC] proper support of kerberos principal aliases

2015-09-09 Thread Simo Sorce
On Wed, 2015-09-09 at 16:21 +0200, David Kupka wrote: > On 09/09/15 15:59, Simo Sorce wrote: > > On Wed, 2015-09-09 at 10:52 +0200, Martin Babinsky wrote: > >> if (found) { > >> +/* replace the incoming principal with the value got > >> from LDAP > >> +

Re: [Freeipa-devel] [PATCH PoC] proper support of kerberos principal aliases

2015-09-09 Thread David Kupka
On 09/09/15 15:59, Simo Sorce wrote: On Wed, 2015-09-09 at 10:52 +0200, Martin Babinsky wrote: if (found) { +/* replace the incoming principal with the value got from LDAP + * search. This is needed so that correctly case principal is +

Re: [Freeipa-devel] IPA 3.0 migrated to 4.1 users break winsync agreement when deleted in active directory

2015-09-09 Thread Andreas Calminder
Hi, thanks for your reply, I'm able to list the user with ldapsearch and I can't find any conflict entries described in the article. The 4.1 environment is only 1 server connected to active directory. Forgot to reply to the list before, doh! I've noticed a difference between users in 3.0 and

Re: [Freeipa-devel] IPA 3.0 migrated to 4.1 users break winsync agreement when deleted in active directory

2015-09-09 Thread Andreas Calminder
Yes, kind of. I wanted a new environment with a proper certificate authority setup with only the old users and groups from the IPA 3.0 environment. The old environment use a self signed ca, I thought it would be easier to just migrate my users and groups. On 9 Sep 2015 4:49 pm, Rob Crittenden

Re: [Freeipa-devel] IPA 3.0 migrated to 4.1 users break winsync agreement when deleted in active directory

2015-09-09 Thread Rob Crittenden
Andreas Calminder wrote: > Hi, > thanks for your reply, I'm able to list the user with ldapsearch and I > can't find any conflict entries described in the article. The 4.1 > environment is only 1 server connected to active directory. Forgot to > reply to the list before, doh! > > I've noticed a

Re: [Freeipa-devel] [PATCHSET] Replica promotion patches

2015-09-09 Thread Simo Sorce
On Wed, 2015-08-26 at 17:27 -0400, Simo Sorce wrote: > This patchset implements https://fedorahosted.org/freeipa/ticket/2888 > and introduces a number of required changes and dependencies to achieve > this goal. > This work requires the custodia project to securely transfer keys > between ipa

Re: [Freeipa-devel] [PATCH] 916 vault: add vault container commands

2015-09-09 Thread Petr Vobornik
On 09/09/2015 10:52 AM, Jan Cholasta wrote: On 8.9.2015 23:06, Petr Vobornik wrote: On 09/03/2015 03:18 PM, Jan Cholasta wrote: On 2.9.2015 07:26, Endi Sukma Dewata wrote: On 9/1/2015 10:22 AM, Simo Sorce wrote: On Tue, 2015-09-01 at 17:15 +0200, Petr Vobornik wrote: On 09/01/2015 04:39 PM,

Re: [Freeipa-devel] IPA 3.0 migrated to 4.1 users break winsync agreement when deleted in active directory

2015-09-09 Thread Andreas Calminder
Hi, I just wanted to post the solution for this, I've reported this to Redhat and a bug has been filed (https://bugzilla.redhat.com/1261536). The problem was that migrate-ds copied the attribute mepManagedEntry on migration, the suggested workaround, running migrate-ds with