Re: [Freeipa-devel] User life cycle: question regarding the design

2014-05-22 Thread thierry bordaz
On 05/21/2014 09:06 PM, Martin Kosek wrote: On 05/21/2014 08:14 PM, Simo Sorce wrote: On Wed, 2014-05-21 at 16:01 +0200, thierry bordaz wrote: Hello, Thanks for all these detailed descriptions. Just to be sure to be on the same page, here is my understanding of the

Re: [Freeipa-devel] [PATCH] 630 rpcserver: login_password datetime fix in expiration check

2014-05-22 Thread Tomas Babej
On 05/07/2014 04:37 PM, Petr Vobornik wrote: On 7.5.2014 16:30, Tomas Babej wrote: On 05/07/2014 04:26 PM, Petr Vobornik wrote: On 7.5.2014 16:01, Tomas Babej wrote: On 05/07/2014 03:47 PM, Petr Vobornik wrote: krbpasswordexpiration conversion to number of second since epoch failed

Re: [Freeipa-devel] Status/Question about User life cycle

2014-05-22 Thread Petr Viktorin
On 05/21/2014 10:00 PM, Dmitri Pal wrote: On 05/19/2014 10:45 AM, thierry bordaz wrote: On 05/19/2014 04:44 PM, Jan Cholasta wrote: On 19.5.2014 16:34, thierry bordaz wrote: On 05/19/2014 04:22 PM, Jan Cholasta wrote: On 19.5.2014 16:03, thierry bordaz wrote: On 05/19/2014 03:54 PM, Jan

[Freeipa-devel] [PATCH] 0550 ipalib.cli: Add filename argument to ipa console

2014-05-22 Thread Petr Viktorin
Hello, I find the `ipa console` command quite useful for testing, and it's bothered me that it can't execute a script. Fixing this helps me. Would it help anyone else? This would need a ticket + design doc before it's pushed. Compare: $ (echo 'print 1'; echo 'print 2') | ipa console (Custom

[Freeipa-devel] [PATCH] 0551 ldap2.find_entries: Do not modify attrs_list in-place

2014-05-22 Thread Petr Viktorin
This fixes https://fedorahosted.org/freeipa/ticket/4349. See the ticket for a description. -- PetrĀ³ From 423a7337dcd10cc88b2fb90872923bb21ada4713 Mon Sep 17 00:00:00 2001 From: Petr Viktorin pvikt...@redhat.com Date: Fri, 16 May 2014 13:18:36 +0200 Subject: [PATCH] ldap2.find_entries: Do not

[Freeipa-devel] [PATCHES] 0552-0554 Upgrading write permissions

2014-05-22 Thread Petr Viktorin
Hello, Here I start upgrading the existing default permissions to the new Managed style. https://fedorahosted.org/freeipa/ticket/4346 The patches rely on my patch 0551 (https://fedorahosted.org/freeipa/ticket/4349) You may run into what seems to be a 389 bug. If you get a Midair Collision

Re: [Freeipa-devel] [PATCH] 0551 ldap2.find_entries: Do not modify attrs_list in-place

2014-05-22 Thread Jan Cholasta
On 22.5.2014 15:07, Petr Viktorin wrote: This fixes https://fedorahosted.org/freeipa/ticket/4349. See the ticket for a description. Looks OK to me, ACK. -- Jan Cholasta ___ Freeipa-devel mailing list Freeipa-devel@redhat.com

Re: [Freeipa-devel] User life cycle: question regarding the design

2014-05-22 Thread Martin Kosek
On 05/21/2014 10:11 PM, Dmitri Pal wrote: On 05/21/2014 03:06 PM, Martin Kosek wrote: On 05/21/2014 08:14 PM, Simo Sorce wrote: On Wed, 2014-05-21 at 16:01 +0200, thierry bordaz wrote: Hello, Thanks for all these detailed descriptions. Just to be sure to be on the same page, here

Re: [Freeipa-devel] [PATCH] 0544 Remove the global anonymous read ACI

2014-05-22 Thread Petr Viktorin
On 05/21/2014 08:08 AM, Martin Kosek wrote: On 05/19/2014 03:27 PM, Petr Viktorin wrote: On 05/16/2014 02:00 PM, Martin Kosek wrote: On 04/29/2014 11:02 PM, Petr Viktorin wrote: I didn't test this as much as I'd like to, but it might come in handy when testing my earlier patches. The ACI is

Re: [Freeipa-devel] [PATCH] 0550 ipalib.cli: Add filename argument to ipa console

2014-05-22 Thread Nathaniel McCallum
On Thu, 2014-05-22 at 15:07 +0200, Petr Viktorin wrote: Hello, I find the `ipa console` command quite useful for testing, and it's bothered me that it can't execute a script. Fixing this helps me. Would it help anyone else? This would need a ticket + design doc before it's pushed.

Re: [Freeipa-devel] [PATCH 0052] Only specify the ipatokenuniqueid default in the add operation

2014-05-22 Thread Nathaniel McCallum
On Tue, 2014-05-13 at 12:55 -0400, Nathaniel McCallum wrote: On Tue, 2014-05-13 at 16:47 +0200, Jan Cholasta wrote: On 12.5.2014 20:50, Nathaniel McCallum wrote: On Mon, 2014-05-12 at 18:40 +0200, Misnyovszki Adam wrote: On Tue, 06 May 2014 11:46:14 -0400 Nathaniel McCallum

Re: [Freeipa-devel] [PATCHES] 0540-0542 Add managed read permissions to user

2014-05-22 Thread Petr Viktorin
On 05/21/2014 12:14 PM, Simo Sorce wrote: On Wed, 2014-05-21 at 08:03 +0200, Martin Kosek wrote: On 05/16/2014 04:33 PM, Petr Viktorin wrote: On 05/16/2014 01:54 PM, Martin Kosek wrote: On 04/29/2014 11:00 PM, Petr Viktorin wrote: Patch 0540 adds a bunch of managed read ACIs for user, as

Re: [Freeipa-devel] [PATCH 0048] Default the token owner to the person adding the token

2014-05-22 Thread Nathaniel McCallum
I still need a review on this. On Wed, 2014-05-07 at 10:06 -0400, Nathaniel McCallum wrote: On Wed, 2014-05-07 at 15:54 +0200, Petr Vobornik wrote: On 6.5.2014 17:07, Nathaniel McCallum wrote: On Tue, 2014-05-06 at 16:11 +0200, Jan Cholasta wrote: On 6.5.2014 15:16, Nathaniel McCallum

Re: [Freeipa-devel] [PATCH 0047] kdb: Don't provide password expiration when using only RADIUS

2014-05-22 Thread Nathaniel McCallum
On Fri, 2014-05-02 at 17:49 -0400, Nathaniel McCallum wrote: If the KDC doesn't use the FreeIPA password for authentication, then it is futile to provide this information. Doing so will only confuse the user. It also causes password change dialogues when the password is irrelevant.

[Freeipa-devel] User life cycle: plugins scope for staged users

2014-05-22 Thread thierry bordaz
Hello, In order to provision staged users (account inactivated) with there initial values: /usr/bin/ipa user-add tb20 --to-stage --first=tb20 --last=tb20 - Added user tb20 - User login: tb20 First name: tb20

Re: [Freeipa-devel] Status/Question about User life cycle

2014-05-22 Thread Martin Kosek
On 05/22/2014 10:47 AM, Petr Viktorin wrote: On 05/21/2014 10:00 PM, Dmitri Pal wrote: On 05/19/2014 10:45 AM, thierry bordaz wrote: On 05/19/2014 04:44 PM, Jan Cholasta wrote: On 19.5.2014 16:34, thierry bordaz wrote: On 05/19/2014 04:22 PM, Jan Cholasta wrote: On 19.5.2014 16:03, thierry

Re: [Freeipa-devel] [PATCH 0047] kdb: Don't provide password expiration when using only RADIUS

2014-05-22 Thread Alexander Bokovoy
On Thu, 22 May 2014, Nathaniel McCallum wrote: On Fri, 2014-05-02 at 17:49 -0400, Nathaniel McCallum wrote: If the KDC doesn't use the FreeIPA password for authentication, then it is futile to provide this information. Doing so will only confuse the user. It also causes password change

Re: [Freeipa-devel] [PATCH 0052] Only specify the ipatokenuniqueid default in the add operation

2014-05-22 Thread Petr Viktorin
On 05/22/2014 04:12 PM, Nathaniel McCallum wrote: On Tue, 2014-05-13 at 12:55 -0400, Nathaniel McCallum wrote: On Tue, 2014-05-13 at 16:47 +0200, Jan Cholasta wrote: On 12.5.2014 20:50, Nathaniel McCallum wrote: On Mon, 2014-05-12 at 18:40 +0200, Misnyovszki Adam wrote: On Tue, 06 May 2014

Re: [Freeipa-devel] [PATCH 0047] kdb: Don't provide password expiration when using only RADIUS

2014-05-22 Thread Petr Viktorin
On 05/22/2014 04:43 PM, Alexander Bokovoy wrote: On Thu, 22 May 2014, Nathaniel McCallum wrote: On Fri, 2014-05-02 at 17:49 -0400, Nathaniel McCallum wrote: If the KDC doesn't use the FreeIPA password for authentication, then it is futile to provide this information. Doing so will only confuse

Re: [Freeipa-devel] [PATCH 0052] Only specify the ipatokenuniqueid default in the add operation

2014-05-22 Thread Nathaniel McCallum
On Thu, 2014-05-22 at 16:45 +0200, Petr Viktorin wrote: On 05/22/2014 04:12 PM, Nathaniel McCallum wrote: On Tue, 2014-05-13 at 12:55 -0400, Nathaniel McCallum wrote: On Tue, 2014-05-13 at 16:47 +0200, Jan Cholasta wrote: On 12.5.2014 20:50, Nathaniel McCallum wrote: On Mon, 2014-05-12 at

Re: [Freeipa-devel] [PATCH 0052] Only specify the ipatokenuniqueid default in the add operation

2014-05-22 Thread Nathaniel McCallum
On Thu, 2014-05-22 at 10:53 -0400, Nathaniel McCallum wrote: On Thu, 2014-05-22 at 16:45 +0200, Petr Viktorin wrote: On 05/22/2014 04:12 PM, Nathaniel McCallum wrote: On Tue, 2014-05-13 at 12:55 -0400, Nathaniel McCallum wrote: On Tue, 2014-05-13 at 16:47 +0200, Jan Cholasta wrote: On

Re: [Freeipa-devel] [PATCH 0052] Only specify the ipatokenuniqueid default in the add operation

2014-05-22 Thread Petr Vobornik
On 22.5.2014 17:00, Nathaniel McCallum wrote: On Thu, 2014-05-22 at 10:53 -0400, Nathaniel McCallum wrote: On Thu, 2014-05-22 at 16:45 +0200, Petr Viktorin wrote: On 05/22/2014 04:12 PM, Nathaniel McCallum wrote: On Tue, 2014-05-13 at 12:55 -0400, Nathaniel McCallum wrote: On Tue, 2014-05-13

Re: [Freeipa-devel] [PATCH 0052] Only specify the ipatokenuniqueid default in the add operation

2014-05-22 Thread Petr Viktorin
On 05/22/2014 05:13 PM, Petr Vobornik wrote: On 22.5.2014 17:00, Nathaniel McCallum wrote: On Thu, 2014-05-22 at 10:53 -0400, Nathaniel McCallum wrote: On Thu, 2014-05-22 at 16:45 +0200, Petr Viktorin wrote: On 05/22/2014 04:12 PM, Nathaniel McCallum wrote: On Tue, 2014-05-13 at 12:55 -0400,

Re: [Freeipa-devel] Status/Question about User life cycle

2014-05-22 Thread thierry bordaz
On 05/22/2014 04:38 PM, Martin Kosek wrote: On 05/22/2014 10:47 AM, Petr Viktorin wrote: On 05/21/2014 10:00 PM, Dmitri Pal wrote: On 05/19/2014 10:45 AM, thierry bordaz wrote: On 05/19/2014 04:44 PM, Jan Cholasta wrote: On 19.5.2014 16:34, thierry bordaz wrote: On 05/19/2014 04:22 PM, Jan

Re: [Freeipa-devel] [PATCH 0052] Only specify the ipatokenuniqueid default in the add operation

2014-05-22 Thread Nathaniel McCallum
On Thu, 2014-05-22 at 17:13 +0200, Petr Vobornik wrote: On 22.5.2014 17:00, Nathaniel McCallum wrote: On Thu, 2014-05-22 at 10:53 -0400, Nathaniel McCallum wrote: On Thu, 2014-05-22 at 16:45 +0200, Petr Viktorin wrote: On 05/22/2014 04:12 PM, Nathaniel McCallum wrote: On Tue, 2014-05-13

Re: [Freeipa-devel] Status/Question about User life cycle

2014-05-22 Thread Simo Sorce
On Thu, 2014-05-22 at 17:52 +0200, thierry bordaz wrote: On 05/22/2014 04:38 PM, Martin Kosek wrote: On 05/22/2014 10:47 AM, Petr Viktorin wrote: On 05/21/2014 10:00 PM, Dmitri Pal wrote: On 05/19/2014 10:45 AM, thierry bordaz wrote: On 05/19/2014 04:44 PM, Jan Cholasta wrote: On

Re: [Freeipa-devel] [PATCH 0048] Default the token owner to the person adding the token

2014-05-22 Thread Simo Sorce
On Thu, 2014-05-22 at 10:21 -0400, Nathaniel McCallum wrote: I still need a review on this. LGTM. Simo. -- Simo Sorce * Red Hat, Inc * New York ___ Freeipa-devel mailing list Freeipa-devel@redhat.com

Re: [Freeipa-devel] User life cycle: question regarding the design

2014-05-22 Thread Simo Sorce
On Thu, 2014-05-22 at 15:35 +0200, Martin Kosek wrote: On 05/21/2014 10:11 PM, Dmitri Pal wrote: On 05/21/2014 03:06 PM, Martin Kosek wrote: On 05/21/2014 08:14 PM, Simo Sorce wrote: On Wed, 2014-05-21 at 16:01 +0200, thierry bordaz wrote: Hello, Thanks for all these detailed

[Freeipa-devel] Understanding FreeIPA replica internals

2014-05-22 Thread James
I'm trying to understand some of the FreeIPA replication internals so that I can better know how to do this properly in Puppet without storing any secret information in Puppet, and so that automating FreeIPA is awesome. Please point me to any docs, if there is reading I could be doing :) Here

Re: [Freeipa-devel] [PATCH 0048] Default the token owner to the person adding the token

2014-05-22 Thread Jan Cholasta
On 22.5.2014 16:21, Nathaniel McCallum wrote: I still need a review on this. On Wed, 2014-05-07 at 10:06 -0400, Nathaniel McCallum wrote: On Wed, 2014-05-07 at 15:54 +0200, Petr Vobornik wrote: On 6.5.2014 17:07, Nathaniel McCallum wrote: On Tue, 2014-05-06 at 16:11 +0200, Jan Cholasta