[Freeipa-devel] [PATCH] 240 Fix LDAP effective rights control with python-ldap 2.4.x

2012-03-21 Thread Martin Kosek
Test instructions are attached to the ticket. --- The new version of python-ldap changed the way it created LDAPv3 extended controls. The API used in 2.4.x can no longer be used because it does not send the bind DN with effective rights control and LDAP server thus rejects it. This patch implement

Re: [Freeipa-devel] [PATCH] 985 no longer shell escape for pkisilent

2012-03-21 Thread Jan Cholasta
On 20.3.2012 22:34, Rob Crittenden wrote: pkisilent now shell escapes its arguments so we no longer need to do so, and in fact, if we do it ends up with double-escaping breaking all installs of IPA with a dogtag CA. rob ACK. Honza -- Jan Cholasta ___

Re: [Freeipa-devel] [PATCH] 985 no longer shell escape for pkisilent

2012-03-21 Thread Martin Kosek
On Wed, 2012-03-21 at 10:01 +0100, Jan Cholasta wrote: > On 20.3.2012 22:34, Rob Crittenden wrote: > > pkisilent now shell escapes its arguments so we no longer need to do so, > > and in fact, if we do it ends up with double-escaping breaking all > > installs of IPA with a dogtag CA. > > > > rob >

Re: [Freeipa-devel] [PATCH] 240 Fix LDAP effective rights control with python-ldap 2.4.x

2012-03-21 Thread Jan Cholasta
On 21.3.2012 09:57, Martin Kosek wrote: Test instructions are attached to the ticket. --- The new version of python-ldap changed the way it created LDAPv3 extended controls. The API used in 2.4.x can no longer be used because it does not send the bind DN with effective rights control and LDAP ser

Re: [Freeipa-devel] [PATCH] 240 Fix LDAP effective rights control with python-ldap 2.4.x

2012-03-21 Thread Martin Kosek
On Wed, 2012-03-21 at 10:16 +0100, Jan Cholasta wrote: > On 21.3.2012 09:57, Martin Kosek wrote: > > Test instructions are attached to the ticket. > > --- > > The new version of python-ldap changed the way it created LDAPv3 > > extended controls. The API used in 2.4.x can no longer be used > > beca

[Freeipa-devel] [PATCH] 241 Fix precallback validators in DNS plugin

2012-03-21 Thread Martin Kosek
DNS plugin contains several RR type record validators run in pre_callback which cannot be used as standard param validator as it needs more data and resources that standard validators provide. However, the precallback validators are not run for DNS records created by new structured options and thus

Re: [Freeipa-devel] [PATCH] 0015 Only split CSV strings once

2012-03-21 Thread Petr Viktorin
On 03/20/2012 10:08 PM, Rob Crittenden wrote: Petr Viktorin wrote: On 03/16/2012 12:55 PM, Petr Viktorin wrote: On 03/15/2012 08:55 PM, Rob Crittenden wrote: Petr Viktorin wrote: https://fedorahosted.org/freeipa/ticket/2227 (Unable to add certain sudo commands to groups). What an interesting

[Freeipa-devel] [PATCH] 19 Search allowed attributes in superior objectclasses

2012-03-21 Thread Ondrej Hamada
https://fedorahosted.org/freeipa/ticket/2293 This patch fixes regression caused by patch for ticket #2293. The function get_allowed_attributes was searching only through the specified objectclasses but not through their superior objectclasses. This patch adds such behaviour by recursive call o

Re: [Freeipa-devel] [PATCH] 0021 Add CLI tests

2012-03-21 Thread Petr Viktorin
On 03/16/2012 01:02 PM, Petr Viktorin wrote: On 03/13/2012 12:23 PM, Petr Viktorin wrote: On 03/12/2012 09:18 PM, Rob Crittenden wrote: Petr Viktorin wrote: Most of the tests we have check if the server does the right thing with XML-RPC calls. How the commandline is converted to command argume

Re: [Freeipa-devel] [PATCH] Try to reacquire keytab file if host already joined

2012-03-21 Thread Dmitri Pal
On 03/20/2012 06:16 PM, Lars Sjöström wrote: >> Lars Sjöström wrote: >>> Hi, >>> >>> Understood! Would it be ok to add an optional flag then? >>> like --reacquire ? >>> >>> like so: >>> # run only if force and reacquire is set >>> if options.force and options.reacquire: >>> # try to fetch keytab.

Re: [Freeipa-devel] [PATCH] 0015 Only split CSV strings once

2012-03-21 Thread Dmitri Pal
On 03/21/2012 10:28 AM, Petr Viktorin wrote: > On 03/20/2012 10:08 PM, Rob Crittenden wrote: >> Petr Viktorin wrote: >>> On 03/16/2012 12:55 PM, Petr Viktorin wrote: On 03/15/2012 08:55 PM, Rob Crittenden wrote: > Petr Viktorin wrote: >> https://fedorahosted.org/freeipa/ticket/2227 (Un

Re: [Freeipa-devel] [PATCH] 0015 Only split CSV strings once

2012-03-21 Thread Petr Viktorin
On 03/21/2012 04:12 PM, Dmitri Pal wrote: On 03/21/2012 10:28 AM, Petr Viktorin wrote: On 03/20/2012 10:08 PM, Rob Crittenden wrote: Petr Viktorin wrote: On 03/16/2012 12:55 PM, Petr Viktorin wrote: On 03/15/2012 08:55 PM, Rob Crittenden wrote: Petr Viktorin wrote: https://fedorahosted.org/

[Freeipa-devel] [PATCH] 242 Harden raw record processing in DNS plugin

2012-03-21 Thread Martin Kosek
Few test cases are attached to the ticket. This patch depends on my patch 241. --- There were cases where DNS plugin was too tolerant in a raw DNS record option (---rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust

Re: [Freeipa-devel] [PATCH] 0015 Only split CSV strings once

2012-03-21 Thread Rob Crittenden
Petr Viktorin wrote: On 03/21/2012 04:12 PM, Dmitri Pal wrote: On 03/21/2012 10:28 AM, Petr Viktorin wrote: On 03/20/2012 10:08 PM, Rob Crittenden wrote: Petr Viktorin wrote: On 03/16/2012 12:55 PM, Petr Viktorin wrote: On 03/15/2012 08:55 PM, Rob Crittenden wrote: Petr Viktorin wrote: htt