Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Adam Young
On 11/03/2011 12:56 AM, Simo Sorce wrote: On Wed, 2011-11-02 at 20:25 -0400, Adam Young wrote: On 11/02/2011 06:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] So, a user becomes an

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Rob Crittenden
Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: To clarify: there are two types of Data stored in the PKI CA DS instances. One is Users and groups (IdM), and the other is certificates and requests. The CA currently administers its own users: creates, add deletes, add

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Ade Lee
On Thu, 2011-11-03 at 09:20 -0400, Adam Young wrote: On 11/03/2011 12:56 AM, Simo Sorce wrote: On Wed, 2011-11-02 at 20:25 -0400, Adam Young wrote: On 11/02/2011 06:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Adam Young
On 11/03/2011 11:00 AM, Ade Lee wrote: On Thu, 2011-11-03 at 09:20 -0400, Adam Young wrote: On 11/03/2011 12:56 AM, Simo Sorce wrote: On Wed, 2011-11-02 at 20:25 -0400, Adam Young wrote: On 11/02/2011 06:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Simo Sorce
On Thu, 2011-11-03 at 11:00 -0400, Ade Lee wrote: On Thu, 2011-11-03 at 09:20 -0400, Adam Young wrote: On 11/03/2011 12:56 AM, Simo Sorce wrote: On Wed, 2011-11-02 at 20:25 -0400, Adam Young wrote: On 11/02/2011 06:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Ade Lee
On Thu, 2011-11-03 at 09:22 -0400, Rob Crittenden wrote: Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: To clarify: there are two types of Data stored in the PKI CA DS instances. One is Users and groups (IdM), and the other is certificates and requests. The CA

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Andrew Wnuk
On 11/02/2011 03:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] So, a user becomes an agent on the ca by having a certificate in the user record and being a member of the relevant

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Adam Young
On 11/03/2011 11:30 AM, Andrew Wnuk wrote: On 11/02/2011 03:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] So, a user becomes an agent on the ca by having a certificate in the user

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Nathan Kinder
On 11/01/2011 10:08 AM, Ade Lee wrote: On Tue, 2011-11-01 at 12:49 -0400, Simo Sorce wrote: On Tue, 2011-11-01 at 12:40 -0400, Richard Megginson wrote: - Original Message - We had a brief discussion on unifying the PKI and IPA Directory Server instances. Here are my notes from it.

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Adam Young
To clarify: there are two types of Data stored in the PKI CA DS instances. One is Users and groups (IdM), and the other is certificates and requests. The CA currently administers its own users: creates, add deletes, add privs and so forth. If we extract the IdM objects from the CA

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Ade Lee
On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: To clarify: there are two types of Data stored in the PKI CA DS instances. One is Users and groups (IdM), and the other is certificates and requests. The CA currently administers its own users: creates, add deletes, add privs and

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Simo Sorce
On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] So, a user becomes an agent on the ca by having a certificate in the user record and being a member of the relevant admin, agent or auditor group. I see this as follows: 1. ipa

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Rob Crittenden
Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] So, a user becomes an agent on the ca by having a certificate in the user record and being a member of the relevant admin, agent or auditor group. I see this as

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Adam Young
On 11/02/2011 06:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] So, a user becomes an agent on the ca by having a certificate in the user record and being a member of the relevant

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Simo Sorce
On Wed, 2011-11-02 at 20:25 -0400, Adam Young wrote: On 11/02/2011 06:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] So, a user becomes an agent on the ca by having a certificate

[Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-01 Thread Adam Young
We had a brief discussion on unifying the PKI and IPA Directory Server instances. Here are my notes from it. Please fill out the details and correct me if I've mis-stated anything below. Issues: 1. Both make changes to Config. One identified conflict is he configuration of the

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-01 Thread Adam Young
On 11/01/2011 12:12 PM, Adam Young wrote: We had a brief discussion on unifying the PKI and IPA Directory Server instances. Here are my notes from it. Please fill out the details and correct me if I've mis-stated anything below. Issues: 1. Both make changes to Config. One

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-01 Thread Richard Megginson
- Original Message - We had a brief discussion on unifying the PKI and IPA Directory Server instances. Here are my notes from it. Please fill out the details and correct me if I've mis-stated anything below. Issues: Do IPA and PKI use different suffixes? 1.

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-01 Thread Simo Sorce
On Tue, 2011-11-01 at 12:12 -0400, Adam Young wrote: We had a brief discussion on unifying the PKI and IPA Directory Server instances. Here are my notes from it. Please fill out the details and correct me if I've mis-stated anything below. Issues: 1. Both make changes to

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-01 Thread Simo Sorce
On Tue, 2011-11-01 at 12:40 -0400, Richard Megginson wrote: - Original Message - We had a brief discussion on unifying the PKI and IPA Directory Server instances. Here are my notes from it. Please fill out the details and correct me if I've mis-stated anything below.

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-01 Thread Ade Lee
On Tue, 2011-11-01 at 12:49 -0400, Simo Sorce wrote: On Tue, 2011-11-01 at 12:40 -0400, Richard Megginson wrote: - Original Message - We had a brief discussion on unifying the PKI and IPA Directory Server instances. Here are my notes from it. Please fill out the