Re: [Freeipa-devel] [PATCHES] 295-299 Allow changing chaining of the IPA CA certificate

2014-07-30 Thread Jan Cholasta
Dne 29.7.2014 v 16:33 Rob Crittenden napsal(a): Rob Crittenden wrote: Jan Cholasta wrote: Dne 28.7.2014 v 21:39 Rob Crittenden napsal(a): This is oh-so close. AFAICT it generally does what it should, I think it is ready for a wider audience. Just a few more things: 306: A while True loop is

[Freeipa-devel] [PATCH] 0628 test_ipagetkeytab: Fix assertion in negative test

2014-07-30 Thread Petr Viktorin
Hello, This fixes a test that was broken by a recent ipa-getkeytab fix. -- PetrĀ³ From 8a7490d910fc3106c9eab2d9083808684213c24e Mon Sep 17 00:00:00 2001 From: Petr Viktorin pvikt...@redhat.com Date: Wed, 30 Jul 2014 10:13:06 +0200 Subject: [PATCH] test_ipagetkeytab: Fix assertion in negative

Re: [Freeipa-devel] [PATCH] 0628 test_ipagetkeytab: Fix assertion in negative test

2014-07-30 Thread Martin Kosek
On 07/30/2014 10:17 AM, Petr Viktorin wrote: Hello, This fixes a test that was broken by a recent ipa-getkeytab fix. /me sighs. Yup, this fixes the problem, ACK. Pushed to: master: 410da23aeccbf932493af86a9150d4fb02c01a01 ipa-4-1: 410da23aeccbf932493af86a9150d4fb02c01a01 ipa-4-0:

Re: [Freeipa-devel] [PATCHES] 295-299 Allow changing chaining of the IPA CA certificate

2014-07-30 Thread Rob Crittenden
Jan Cholasta wrote: Dne 29.7.2014 v 16:33 Rob Crittenden napsal(a): Rob Crittenden wrote: Jan Cholasta wrote: Dne 28.7.2014 v 21:39 Rob Crittenden napsal(a): This is oh-so close. AFAICT it generally does what it should, I think it is ready for a wider audience. Just a few more things:

Re: [Freeipa-devel] [PATCHES] 295-299 Allow changing chaining of the IPA CA certificate

2014-07-30 Thread Jan Cholasta
Dne 30.7.2014 v 14:47 Rob Crittenden napsal(a): Jan Cholasta wrote: Dne 29.7.2014 v 16:33 Rob Crittenden napsal(a): Rob Crittenden wrote: Jan Cholasta wrote: Dne 28.7.2014 v 21:39 Rob Crittenden napsal(a): This is oh-so close. AFAICT it generally does what it should, I think it is ready for

[Freeipa-devel] FreeIPAOpenLMI

2014-07-30 Thread Martin Kosek
Hello all, As discussed before, FreeIPA could take advantage of a remote management system to allow easier deployment/modification of servers, replicas or clients. OpenLMI seems to be the right tool for the job, I started a discussion about the use cases on their list, openlmi-devel:

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-30 Thread David Kupka
On 07/23/2014 03:45 PM, Nalin Dahyabhai wrote: On Wed, Jul 23, 2014 at 10:12:39AM +0200, Martin Kosek wrote: Certmonger API looked complete enough to pull this off: https://git.fedorahosted.org/cgit/certmonger.git/tree/doc/api.txt If I am wrong, please tell me. No, it's meant to be complete

Re: [Freeipa-devel] [PATCHES] 295-299 Allow changing chaining of the IPA CA certificate

2014-07-30 Thread Petr Viktorin
On 07/30/2014 02:51 PM, Jan Cholasta wrote: Dne 30.7.2014 v 14:47 Rob Crittenden napsal(a): Jan Cholasta wrote: Dne 29.7.2014 v 16:33 Rob Crittenden napsal(a): Rob Crittenden wrote: Jan Cholasta wrote: Dne 28.7.2014 v 21:39 Rob Crittenden napsal(a): This is oh-so close. AFAICT it generally

Re: [Freeipa-devel] [PATCHES] 0264-0267 backup, restore: Don't overwrite /etc/{passwd, group}

2014-07-30 Thread Petr Viktorin
On 07/29/2014 06:03 PM, Petr Viktorin wrote: On 07/29/2014 05:02 PM, Petr Viktorin wrote: Hello, The first patch here consolidates our system user creation code a bit. The second patch fixes an oversight in the restore script. The third changes the backup script to not include

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-30 Thread Jan Cholasta
Dne 30.7.2014 v 15:51 David Kupka napsal(a): On 07/23/2014 03:45 PM, Nalin Dahyabhai wrote: On Wed, Jul 23, 2014 at 10:12:39AM +0200, Martin Kosek wrote: Certmonger API looked complete enough to pull this off: https://git.fedorahosted.org/cgit/certmonger.git/tree/doc/api.txt If I am wrong,

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-30 Thread Nalin Dahyabhai
On Wed, Jul 30, 2014 at 04:28:50PM +0200, Jan Cholasta wrote: These two functions are used to force local hostname in certmonger. IMO the right thing to do here would be to drop these two functions and fix ipa-submit so that it reads the required configuration from /etc/ipa/default.conf. Can

Re: [Freeipa-devel] Reasons for not using certmonger DBus API

2014-07-30 Thread Nalin Dahyabhai
On Wed, Jul 30, 2014 at 03:51:08PM +0200, David Kupka wrote: In fact it is almost enough complete for us. The only operation I can't find is 'write ca_external_helper'. add_principal_to_cas and remove_principal_from_cas are modifying this entry in ca file. Certmonger provide 'get_location'