Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-10-07 Thread Petr Viktorin
On 09/05/2013 06:25 AM, Nathaniel McCallum wrote: This patch has a few problems that I'd like some help with. There are a few notes here as well. 1. The handling of the 'key' option is insecure. It should probably be treated like a password (hidden from logs, etc). However, in this case, it is

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-10-02 Thread Petr Viktorin
On 10/01/2013 11:00 PM, Nathaniel McCallum wrote: On Thu, 2013-09-05 at 12:19 +0200, Petr Viktorin wrote: On 09/05/2013 06:38 AM, Nathaniel McCallum wrote: 3. I had to make the 'id' option optional to make the uuid autogeneration work in otp-add. However, this has the side-effect that 'id' is

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-10-01 Thread Nathaniel McCallum
On Thu, 2013-09-05 at 12:19 +0200, Petr Viktorin wrote: On 09/05/2013 06:38 AM, Nathaniel McCallum wrote: 3. I had to make the 'id' option optional to make the uuid autogeneration work in otp-add. However, this has the side-effect that 'id' is now optional in all the other commands. This is

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-16 Thread Martin Kosek
On 09/13/2013 08:39 PM, Dmitri Pal wrote: On 09/13/2013 11:55 AM, Petr Vobornik wrote: On 09/05/2013 06:25 AM, Nathaniel McCallum wrote: This patch has a few problems that I'd like some help with. There are a few notes here as well. snip Some additional findings: 1. Inconsistency:

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-14 Thread Jan Cholasta
On 13.9.2013 10:07, Jan Cholasta wrote: On 5.9.2013 06:25, Nathaniel McCallum wrote: This patch has a few problems that I'd like some help with. There are a few notes here as well. 1. The handling of the 'key' option is insecure. It should probably be treated like a password (hidden from logs,

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-13 Thread Jan Cholasta
On 5.9.2013 06:25, Nathaniel McCallum wrote: This patch has a few problems that I'd like some help with. There are a few notes here as well. 1. The handling of the 'key' option is insecure. It should probably be treated like a password (hidden from logs, etc). However, in this case, it is

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-13 Thread Petr Viktorin
I'm sorry for the late reply, I got caught up in other work and forgot about this thread. On 09/05/2013 03:31 PM, Nathaniel McCallum wrote: On Thu, 2013-09-05 at 12:19 +0200, Petr Viktorin wrote: On 09/05/2013 06:38 AM, Nathaniel McCallum wrote: On Thu, 2013-09-05 at 00:25 -0400, Nathaniel

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-13 Thread Nathaniel McCallum
On Thu, 2013-09-12 at 13:48 +0200, Petr Viktorin wrote: I'm sorry for the late reply, I got caught up in other work and forgot about this thread. On 09/05/2013 03:31 PM, Nathaniel McCallum wrote: On Thu, 2013-09-05 at 12:19 +0200, Petr Viktorin wrote: On 09/05/2013 06:38 AM, Nathaniel

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-13 Thread Petr Vobornik
On 09/05/2013 06:25 AM, Nathaniel McCallum wrote: This patch has a few problems that I'd like some help with. There are a few notes here as well. snip Some additional findings: 1. Inconsistency: 'ipatokenowner' in command output should be normalized the same way as 'manager' in user plugin

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-13 Thread Petr Vobornik
On 09/12/2013 09:15 PM, Dmitri Pal wrote: On 09/12/2013 07:28 AM, Petr Vobornik wrote: Qs: a. Do we have some use cases for adding internal OTP? I wonder which otp-add options are essential (ipatokenvendor, ipatokenmodel, ipatokenserial, ipatokenotpkey, ipatokenotpalgorithm, ipatokenotpdigits,

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-13 Thread Dmitri Pal
On 09/12/2013 07:28 AM, Petr Vobornik wrote: Qs: a. Do we have some use cases for adding internal OTP? I wonder which otp-add options are essential (ipatokenvendor, ipatokenmodel, ipatokenserial, ipatokenotpkey, ipatokenotpalgorithm, ipatokenotpdigits, ipatokentotpclockoffset,

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-13 Thread Dmitri Pal
On 09/13/2013 11:55 AM, Petr Vobornik wrote: On 09/05/2013 06:25 AM, Nathaniel McCallum wrote: This patch has a few problems that I'd like some help with. There are a few notes here as well. snip Some additional findings: 1. Inconsistency: 'ipatokenowner' in command output should be

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-13 Thread Dmitri Pal
On 09/13/2013 12:19 PM, Petr Vobornik wrote: ipatokenvendor will be us , ipatokenmodel, IPA? ipatokenserial Generated , ipatokenotpkey Generated , ipatokenotpalgorithm Uses default TOTP we do not support more for now. In future it will be a global policy I assume. ,

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-12 Thread Petr Vobornik
I've started the work on OTP UI and found few issues in this patch: 1. api.txt is not regenerated. Run ./makeapi. Same issue is in patch #15 and #16. 2. python-qrcode is missing in BuildRequires 3. minor: would be nice if attribute names in `takes_params` and `default_attributes` would have

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-12 Thread Petr Viktorin
On 09/12/2013 03:38 PM, Nathaniel McCallum wrote: On Thu, 2013-09-12 at 13:48 +0200, Petr Viktorin wrote: I'm sorry for the late reply, I got caught up in other work and forgot about this thread. On 09/05/2013 03:31 PM, Nathaniel McCallum wrote: On Thu, 2013-09-05 at 12:19 +0200, Petr

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-12 Thread Martin Kosek
On 09/05/2013 06:25 AM, Nathaniel McCallum wrote: This patch has a few problems that I'd like some help with. There are a few notes here as well. 1. The handling of the 'key' option is insecure. It should probably be treated like a password (hidden from logs, etc). However, in this case, it

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-09 Thread Martin Kosek
On 09/07/2013 06:28 PM, Simo Sorce wrote: On Thu, 2013-09-05 at 00:38 -0400, Nathaniel McCallum wrote: On Thu, 2013-09-05 at 00:25 -0400, Nathaniel McCallum wrote: This patch has a few problems that I'd like some help with. There are a few notes here as well. 1. The handling of the 'key'

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-07 Thread Simo Sorce
On Thu, 2013-09-05 at 00:38 -0400, Nathaniel McCallum wrote: On Thu, 2013-09-05 at 00:25 -0400, Nathaniel McCallum wrote: This patch has a few problems that I'd like some help with. There are a few notes here as well. 1. The handling of the 'key' option is insecure. It should probably be

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-05 Thread Petr Viktorin
On 09/05/2013 06:38 AM, Nathaniel McCallum wrote: On Thu, 2013-09-05 at 00:25 -0400, Nathaniel McCallum wrote: This patch has a few problems that I'd like some help with. There are a few notes here as well. 1. The handling of the 'key' option is insecure. It should probably be treated like a

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-05 Thread Nathaniel McCallum
On Thu, 2013-09-05 at 12:19 +0200, Petr Viktorin wrote: On 09/05/2013 06:38 AM, Nathaniel McCallum wrote: On Thu, 2013-09-05 at 00:25 -0400, Nathaniel McCallum wrote: This patch has a few problems that I'd like some help with. There are a few notes here as well. 1. The handling of the

[Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-04 Thread Nathaniel McCallum
This patch has a few problems that I'd like some help with. There are a few notes here as well. 1. The handling of the 'key' option is insecure. It should probably be treated like a password (hidden from logs, etc). However, in this case, it is binary, so I'm not quite sure how to do that.

Re: [Freeipa-devel] [PATCH 0017] Add OTP support to ipalib CLI

2013-09-04 Thread Nathaniel McCallum
On Thu, 2013-09-05 at 00:25 -0400, Nathaniel McCallum wrote: This patch has a few problems that I'd like some help with. There are a few notes here as well. 1. The handling of the 'key' option is insecure. It should probably be treated like a password (hidden from logs, etc). However, in