Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Adam Young
On 11/03/2011 11:30 AM, Andrew Wnuk wrote: On 11/02/2011 03:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] So, a user becomes an agent on the ca by having a certificate in the user re

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Andrew Wnuk
On 11/02/2011 03:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] So, a user becomes an agent on the ca by having a certificate in the user record and being a member of the relevant admi

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Ade Lee
On Thu, 2011-11-03 at 09:22 -0400, Rob Crittenden wrote: > Ade Lee wrote: > > On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: > >> To clarify: there are two types of Data stored in the PKI CA DS > >> instances. One is Users and groups (IdM), and the other is > >> certificates and requests.

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Simo Sorce
On Thu, 2011-11-03 at 11:00 -0400, Ade Lee wrote: > On Thu, 2011-11-03 at 09:20 -0400, Adam Young wrote: > > On 11/03/2011 12:56 AM, Simo Sorce wrote: > > > On Wed, 2011-11-02 at 20:25 -0400, Adam Young wrote: > > >> On 11/02/2011 06:19 PM, Rob Crittenden wrote: > > >>> Simo Sorce wrote: > > O

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Adam Young
On 11/03/2011 11:00 AM, Ade Lee wrote: On Thu, 2011-11-03 at 09:20 -0400, Adam Young wrote: On 11/03/2011 12:56 AM, Simo Sorce wrote: On Wed, 2011-11-02 at 20:25 -0400, Adam Young wrote: On 11/02/2011 06:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Le

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Ade Lee
On Thu, 2011-11-03 at 09:20 -0400, Adam Young wrote: > On 11/03/2011 12:56 AM, Simo Sorce wrote: > > On Wed, 2011-11-02 at 20:25 -0400, Adam Young wrote: > >> On 11/02/2011 06:19 PM, Rob Crittenden wrote: > >>> Simo Sorce wrote: > On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: > > On We

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Rob Crittenden
Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: To clarify: there are two types of Data stored in the PKI CA DS instances. One is Users and groups (IdM), and the other is certificates and requests. The CA currently administers its own users: creates, add deletes, add pri

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-03 Thread Adam Young
On 11/03/2011 12:56 AM, Simo Sorce wrote: On Wed, 2011-11-02 at 20:25 -0400, Adam Young wrote: On 11/02/2011 06:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] So, a user becomes an a

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Simo Sorce
On Wed, 2011-11-02 at 20:25 -0400, Adam Young wrote: > On 11/02/2011 06:19 PM, Rob Crittenden wrote: > > Simo Sorce wrote: > >> On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: > >>> On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: > >> [...] > >>> So, a user becomes an agent on the ca by havi

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Adam Young
On 11/02/2011 06:19 PM, Rob Crittenden wrote: Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] So, a user becomes an agent on the ca by having a certificate in the user record and being a member of the relevant admi

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Rob Crittenden
Simo Sorce wrote: On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] So, a user becomes an agent on the ca by having a certificate in the user record and being a member of the relevant admin, agent or auditor group. I see this as follo

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Simo Sorce
On Wed, 2011-11-02 at 16:44 -0400, Ade Lee wrote: > On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: [...] > So, a user becomes an agent on the ca by having a certificate in the > user record and being a member of the relevant admin, agent or auditor > group. > > I see this as follows: > 1. ip

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Ade Lee
On Wed, 2011-11-02 at 16:03 -0400, Adam Young wrote: > To clarify: there are two types of Data stored in the PKI CA DS > instances. One is Users and groups (IdM), and the other is > certificates and requests. > > The CA currently administers its own users: creates, add deletes, add > privs

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Adam Young
To clarify: there are two types of Data stored in the PKI CA DS instances. One is Users and groups (IdM), and the other is certificates and requests. The CA currently administers its own users: creates, add deletes, add privs and so forth. If we extract the IdM objects from the CA cont

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-02 Thread Nathan Kinder
On 11/01/2011 10:08 AM, Ade Lee wrote: On Tue, 2011-11-01 at 12:49 -0400, Simo Sorce wrote: On Tue, 2011-11-01 at 12:40 -0400, Richard Megginson wrote: - Original Message - We had a brief discussion on unifying the PKI and IPA Directory Server instances. Here are my notes from it. Pl

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-01 Thread Ade Lee
On Tue, 2011-11-01 at 12:49 -0400, Simo Sorce wrote: > On Tue, 2011-11-01 at 12:40 -0400, Richard Megginson wrote: > > - Original Message - > > > > > > > > > > > > We had a brief discussion on unifying the PKI and IPA Directory > > > Server instances. Here are my notes from it. Please fi

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-01 Thread Simo Sorce
On Tue, 2011-11-01 at 12:40 -0400, Richard Megginson wrote: > - Original Message - > > > > > > > > We had a brief discussion on unifying the PKI and IPA Directory > > Server instances. Here are my notes from it. Please fill out the > > details and correct me if I've mis-stated anything b

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-01 Thread Simo Sorce
On Tue, 2011-11-01 at 12:12 -0400, Adam Young wrote: > We had a brief discussion on unifying the PKI and IPA Directory Server > instances. Here are my notes from it. Please fill out the details > and correct me if I've mis-stated anything below. > > > Issues: > > > 1. Both make change

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-01 Thread Richard Megginson
- Original Message - > > > > We had a brief discussion on unifying the PKI and IPA Directory > Server instances. Here are my notes from it. Please fill out the > details and correct me if I've mis-stated anything below. > > > Issues: > > > Do IPA and PKI use different suffixes? >

Re: [Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-01 Thread Adam Young
On 11/01/2011 12:12 PM, Adam Young wrote: We had a brief discussion on unifying the PKI and IPA Directory Server instances. Here are my notes from it. Please fill out the details and correct me if I've mis-stated anything below. Issues: 1. Both make changes to Config. One identified

[Freeipa-devel] Unifying the PKI and IPA Directory Server instances

2011-11-01 Thread Adam Young
We had a brief discussion on unifying the PKI and IPA Directory Server instances. Here are my notes from it. Please fill out the details and correct me if I've mis-stated anything below. Issues: 1. Both make changes to Config. One identified conflict is he configuration of the Unique