Re: [Freeipa-devel] [DESIGN] Kerberos principal alias handling

2016-04-12 Thread David Kupka
On 08/04/16 17:10, Martin Babinsky wrote: Hi list, I have put together a draft [1] outlining the effort to reimplement the handling of Kerberos principals in both backend and frontend layers of FreeIPA so that we may have multiple aliases per user, host or service and thus implement stuff like h

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-04-12 Thread Fraser Tweedale
On Tue, Apr 12, 2016 at 09:31:30AM -0400, Simo Sorce wrote: > On Sat, 2016-04-09 at 10:11 +1000, Fraser Tweedale wrote: > > On Fri, Apr 08, 2016 at 10:47:19AM -0400, Simo Sorce wrote: > > > On Sat, 2016-04-09 at 00:23 +1000, Fraser Tweedale wrote: > > > > -name = gssapi.Name('host@%s' % (se

Re: [Freeipa-devel] [PATCH 0088-0095] Add --forward-policy option into installers

2016-04-12 Thread Martin Basti
On 04.04.2016 17:37, Petr Spacek wrote: On 31.3.2016 13:45, Martin Basti wrote: On 21.03.2016 16:51, Petr Spacek wrote: On 10.3.2016 22:17, Lukas Slebodnik wrote: On (10/03/16 22:14), Petr Spacek wrote: Hello, I forgot to send a patches before I leave, so here it is: Auto-detect default

Re: [Freeipa-devel] [TEST][patch-0035] Fixed failing legacy client tests

2016-04-12 Thread Martin Babinsky
On 04/12/2016 11:19 AM, Oleg Fayans wrote: ACK. -- Martin^3 Babinsky -- Manage your subscription for the Freeipa-devel mailing list: https://www.redhat.com/mailman/listinfo/freeipa-devel Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Re: [Freeipa-devel] [TEST][patch-0033] Added assertion errors to topology tests, track N 5772

2016-04-12 Thread Martin Babinsky
On 04/06/2016 02:40 PM, Oleg Fayans wrote: Hi Martin, The updated patches are attached On 04/04/2016 06:46 PM, Martin Babinsky wrote: On 03/31/2016 05:15 PM, Oleg Fayans wrote: Hi Martin, Thanks for the review. The updated patch(es) are included Testrun output can be found here: http://fpa

Re: [Freeipa-devel] [TEST][patch-0035] Test replica installed under domain level 0 is functional after domain upgrade

2016-04-12 Thread Martin Babinsky
On 04/07/2016 12:35 PM, Oleg Fayans wrote: Hi Oleg, since this is a part of replica promotion test suite please add the link to https://fedorahosted.org/freeipa/ticket/5723 to the commit message. The patch cannot be applied cleanly, even 3-way merge fails with: """ git am ../review/ofay

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-04-12 Thread Simo Sorce
On Sat, 2016-04-09 at 10:11 +1000, Fraser Tweedale wrote: > On Fri, Apr 08, 2016 at 10:47:19AM -0400, Simo Sorce wrote: > > On Sat, 2016-04-09 at 00:23 +1000, Fraser Tweedale wrote: > > > -name = gssapi.Name('host@%s' % (self.client,), > > > > > > - gssapi.NameTyp

Re: [Freeipa-devel] DNs of Custodia keys

2016-04-12 Thread Simo Sorce
On Tue, 2016-04-12 at 21:26 +1000, Fraser Tweedale wrote: > On Tue, Apr 12, 2016 at 12:55:50PM +0200, Jan Cholasta wrote: > > Hi, > > > > On 12.4.2016 09:03, Fraser Tweedale wrote: > > >Hi Simo and Honza et al, > > > > > >I have a design challenge pertaining to DNs for Custodia keys. > > >DNs for

Re: [Freeipa-devel] DNs of Custodia keys

2016-04-12 Thread Fraser Tweedale
On Tue, Apr 12, 2016 at 12:55:50PM +0200, Jan Cholasta wrote: > Hi, > > On 12.4.2016 09:03, Fraser Tweedale wrote: > >Hi Simo and Honza et al, > > > >I have a design challenge pertaining to DNs for Custodia keys. > >DNs for Custodia keys for host principals currently take the form: > > > > cn=

Re: [Freeipa-devel] [DESIGN] Server Roles

2016-04-12 Thread Jan Cholasta
On 12.4.2016 12:57, Jan Cholasta wrote: On 12.4.2016 10:45, Petr Spacek wrote: On 12.4.2016 09:31, Martin Babinsky wrote: On 03/17/2016 06:16 PM, Martin Babinsky wrote: Hi list, here is a link (http://www.freeipa.org/page/V4/Server_Roles) to WIP design document concerning the concept of Serve

Re: [Freeipa-devel] [DESIGN] Server Roles

2016-04-12 Thread Jan Cholasta
On 12.4.2016 10:45, Petr Spacek wrote: On 12.4.2016 09:31, Martin Babinsky wrote: On 03/17/2016 06:16 PM, Martin Babinsky wrote: Hi list, here is a link (http://www.freeipa.org/page/V4/Server_Roles) to WIP design document concerning the concept of Server Roles as a user-friendly abstraction of

Re: [Freeipa-devel] DNs of Custodia keys

2016-04-12 Thread Jan Cholasta
Hi, On 12.4.2016 09:03, Fraser Tweedale wrote: Hi Simo and Honza et al, I have a design challenge pertaining to DNs for Custodia keys. DNs for Custodia keys for host principals currently take the form: cn={sig,enc}/$HOSTNAME,cn=custodia,cn=ipa,cn=etc,$SUFFIX This prevents the creation of

Re: [Freeipa-devel] [PATCH] 0770 Switch /usr/bin/ipa to Python 3

2016-04-12 Thread Petr Spacek
On 19.2.2016 13:50, Petr Viktorin wrote: > Is it time yet? > > This patch switches /usr/bin/ipa to Python 3 for > - the in-tree ./ipa command > - RPMs, when built with_python3 NACK, the change in 'ipa' command broke ipa dnszone-find: # ipa dnsrecord-find dom-033.abc.idm.lab.eng.brq.redhat.com. i

[Freeipa-devel] [TEST][patch-0035] Fixed failing legacy client tests

2016-04-12 Thread Oleg Fayans
-- Oleg Fayans Quality Engineer FreeIPA team RedHat. From 795c84c8e5be1d77c50328c8d1425af5fec4e8cd Mon Sep 17 00:00:00 2001 From: Oleg Fayans Date: Tue, 12 Apr 2016 11:18:09 +0200 Subject: [PATCH] Fixed a failure in legacy_client tests https://fedorahosted.org/freeipa/ticket/5800 --- ipatests/

Re: [Freeipa-devel] [python-pytest-multihost]-Ticket-6 run_command produces exit code 1 on windows

2016-04-12 Thread Niranjan
Petr Viktorin wrote: > On 04/06/2016 10:55 AM, Niranjan wrote: > > Greetings, > > > > For https://fedorahosted.org/python-pytest-multihost/ticket/6 , i have > > proposed > > a patch, I think this patch is more of a workaround , than a solution. I > > would > > like to get more inputs on how to u

Re: [Freeipa-devel] [DESIGN] Server Roles

2016-04-12 Thread Petr Spacek
On 12.4.2016 09:31, Martin Babinsky wrote: > On 03/17/2016 06:16 PM, Martin Babinsky wrote: >> Hi list, >> >> here is a link (http://www.freeipa.org/page/V4/Server_Roles) to WIP >> design document concerning the concept of Server Roles as a >> user-friendly abstraction of the services running on IP

Re: [Freeipa-devel] [DESIGN] Kerberos principal alias handling

2016-04-12 Thread Petr Spacek
On 11.4.2016 16:58, thierry bordaz wrote: > > > On 04/11/2016 04:51 PM, Simo Sorce wrote: >> On Mon, 2016-04-11 at 16:29 +0200, thierry bordaz wrote: >>> On 04/08/2016 05:10 PM, Martin Babinsky wrote: Hi list, I have put together a draft [1] outlining the effort to reimplement

Re: [Freeipa-devel] DNs of Custodia keys

2016-04-12 Thread Petr Spacek
On 12.4.2016 09:03, Fraser Tweedale wrote: > Hi Simo and Honza et al, > > I have a design challenge pertaining to DNs for Custodia keys. > DNs for Custodia keys for host principals currently take the form: > > cn={sig,enc}/$HOSTNAME,cn=custodia,cn=ipa,cn=etc,$SUFFIX > > This prevents the cre

Re: [Freeipa-devel] [PATCH 0452] Add missing pre_common_callback to stageuser-add

2016-04-12 Thread Martin Basti
On 04.04.2016 18:03, Martin Babinsky wrote: On 03/31/2016 09:49 AM, Martin Basti wrote: https://fedorahosted.org/freeipa/ticket/5759 Patch attached. ACK. Pushed to: master: d9fe502e8346022ac7265556782c984a8b36ee85 ipa-4-3: 4ddb373cc373c34952e0fc1119dff8c18ecbe678 -- Manage your subscrip

Re: [Freeipa-devel] [DESIGN] Server Roles

2016-04-12 Thread Martin Babinsky
On 03/17/2016 06:16 PM, Martin Babinsky wrote: Hi list, here is a link (http://www.freeipa.org/page/V4/Server_Roles) to WIP design document concerning the concept of Server Roles as a user-friendly abstraction of the services running on IPA masters. The main aim of this feature is to provide a

[Freeipa-devel] DNs of Custodia keys

2016-04-12 Thread Fraser Tweedale
Hi Simo and Honza et al, I have a design challenge pertaining to DNs for Custodia keys. DNs for Custodia keys for host principals currently take the form: cn={sig,enc}/$HOSTNAME,cn=custodia,cn=ipa,cn=etc,$SUFFIX This prevents the creation of Custodia keys for service principals (pursuant to