Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-06-08 Thread Jan Cholasta
On 6.6.2016 15:25, Fraser Tweedale wrote: On Wed, Jun 01, 2016 at 02:49:06PM +1000, Fraser Tweedale wrote: Updated patch attached; comments inline below. On Mon, Apr 25, 2016 at 07:55:46AM +0200, Jan Cholasta wrote: I think it would be better to merge the `client` and `client_servicename` into

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-06-06 Thread Fraser Tweedale
On Wed, Jun 01, 2016 at 02:49:06PM +1000, Fraser Tweedale wrote: > Updated patch attached; comments inline below. > > On Mon, Apr 25, 2016 at 07:55:46AM +0200, Jan Cholasta wrote: > > I think it would be better to merge the `client` and `client_servicename` > > into a single `client_principal` arg

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-05-31 Thread Fraser Tweedale
Updated patch attached; comments inline below. On Mon, Apr 25, 2016 at 07:55:46AM +0200, Jan Cholasta wrote: > I think it would be better to merge the `client` and `client_servicename` > into a single `client_principal` argument, as both of the arguments are used > only to specify the principal na

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-04-26 Thread Jan Cholasta
On 25.4.2016 07:55, Jan Cholasta wrote: Hi, On 20.4.2016 08:22, Fraser Tweedale wrote: On Mon, Apr 18, 2016 at 03:44:08PM -0400, Simo Sorce wrote: On Thu, 2016-04-14 at 16:33 +1000, Fraser Tweedale wrote: On Wed, Apr 13, 2016 at 11:15:50AM +1000, Fraser Tweedale wrote: On Tue, Apr 12, 2016 a

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-04-24 Thread Jan Cholasta
Hi, On 20.4.2016 08:22, Fraser Tweedale wrote: On Mon, Apr 18, 2016 at 03:44:08PM -0400, Simo Sorce wrote: On Thu, 2016-04-14 at 16:33 +1000, Fraser Tweedale wrote: On Wed, Apr 13, 2016 at 11:15:50AM +1000, Fraser Tweedale wrote: On Tue, Apr 12, 2016 at 09:31:30AM -0400, Simo Sorce wrote: On

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-04-19 Thread Fraser Tweedale
On Mon, Apr 18, 2016 at 03:44:08PM -0400, Simo Sorce wrote: > On Thu, 2016-04-14 at 16:33 +1000, Fraser Tweedale wrote: > > On Wed, Apr 13, 2016 at 11:15:50AM +1000, Fraser Tweedale wrote: > > > On Tue, Apr 12, 2016 at 09:31:30AM -0400, Simo Sorce wrote: > > > > On Sat, 2016-04-09 at 10:11 +1000, F

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-04-18 Thread Simo Sorce
On Thu, 2016-04-14 at 16:33 +1000, Fraser Tweedale wrote: > On Wed, Apr 13, 2016 at 11:15:50AM +1000, Fraser Tweedale wrote: > > On Tue, Apr 12, 2016 at 09:31:30AM -0400, Simo Sorce wrote: > > > On Sat, 2016-04-09 at 10:11 +1000, Fraser Tweedale wrote: > > > > On Fri, Apr 08, 2016 at 10:47:19AM -04

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-04-13 Thread Fraser Tweedale
On Wed, Apr 13, 2016 at 11:15:50AM +1000, Fraser Tweedale wrote: > On Tue, Apr 12, 2016 at 09:31:30AM -0400, Simo Sorce wrote: > > On Sat, 2016-04-09 at 10:11 +1000, Fraser Tweedale wrote: > > > On Fri, Apr 08, 2016 at 10:47:19AM -0400, Simo Sorce wrote: > > > > On Sat, 2016-04-09 at 00:23 +1000, F

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-04-12 Thread Fraser Tweedale
On Tue, Apr 12, 2016 at 09:31:30AM -0400, Simo Sorce wrote: > On Sat, 2016-04-09 at 10:11 +1000, Fraser Tweedale wrote: > > On Fri, Apr 08, 2016 at 10:47:19AM -0400, Simo Sorce wrote: > > > On Sat, 2016-04-09 at 00:23 +1000, Fraser Tweedale wrote: > > > > -name = gssapi.Name('host@%s' % (se

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-04-12 Thread Simo Sorce
On Sat, 2016-04-09 at 10:11 +1000, Fraser Tweedale wrote: > On Fri, Apr 08, 2016 at 10:47:19AM -0400, Simo Sorce wrote: > > On Sat, 2016-04-09 at 00:23 +1000, Fraser Tweedale wrote: > > > -name = gssapi.Name('host@%s' % (self.client,), > > > > > > - gssapi.NameTyp

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-04-08 Thread Fraser Tweedale
On Fri, Apr 08, 2016 at 10:47:19AM -0400, Simo Sorce wrote: > On Sat, 2016-04-09 at 00:23 +1000, Fraser Tweedale wrote: > > -name = gssapi.Name('host@%s' % (self.client,), > > > > - gssapi.NameType.hostbased_service) > > If you remove this then on a serve that ha

Re: [Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-04-08 Thread Simo Sorce
On Sat, 2016-04-09 at 00:23 +1000, Fraser Tweedale wrote: > -name = gssapi.Name('host@%s' % (self.client,), > > - gssapi.NameType.hostbased_service) If you remove this then on a serve that has nfs keys in the keytab you may end up acquiring the wrong credentials.

[Freeipa-devel] [PATCH] 0051 Allow CustodiaClient to be used by arbitrary principals

2016-04-08 Thread Fraser Tweedale
Hi all, The attached patch (first of many for long-awaited sub-CAs feature) makes it possible to use CustodiaClient without root privileges, as an arbitrary principal. Cheers, Fraser From 8e6cab0e47dd4e3152d8bbd84c8675353aa2cb4a Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Fri, 8 Apr 201