Re: [Freeipa-devel] Should mask/unmask be part of disabling/enabling services in systemd?

2014-09-22 Thread Petr Spacek
On 19.9.2014 18:33, Simo Sorce wrote: On Fri, 19 Sep 2014 17:50:16 +0200 Martin Kosek mko...@redhat.com wrote: On 09/19/2014 05:23 PM, Rob Crittenden wrote: Martin Basti wrote: Hello list, I need to use systemd mask/unmask in ipa service. But as Honza wrote: IMO masking/unmasking should be

Re: [Freeipa-devel] Should mask/unmask be part of disabling/enabling services in systemd?

2014-09-22 Thread Martin Kosek
On 09/19/2014 06:33 PM, Simo Sorce wrote: On Fri, 19 Sep 2014 17:50:16 +0200 Martin Kosek mko...@redhat.com wrote: On 09/19/2014 05:23 PM, Rob Crittenden wrote: Martin Basti wrote: Hello list, I need to use systemd mask/unmask in ipa service. But as Honza wrote: IMO masking/unmasking

Re: [Freeipa-devel] [PATCH 0065] Don't allow users to create tokens with a specified ID

2014-09-22 Thread Martin Kosek
On 09/20/2014 10:22 PM, Nathaniel McCallum wrote: On Wed, 2014-09-17 at 12:31 +0200, Martin Kosek wrote: On 09/17/2014 08:51 AM, Jan Cholasta wrote: Hi, Dne 16.9.2014 v 19:32 Nathaniel McCallum napsal(a): We perform this enforcement at the API level since: * DS level enforcement would be

Re: [Freeipa-devel] [PATCH 0069] Adds 389DS plugin to enforce UUID token IDs

2014-09-22 Thread thierry bordaz
Hello Nathaniel, Just a remark, in is_token if the entry is objectclass=ipaToken it returns without freeing the 'objectclass' char array. thanks thierry On 09/21/2014 09:07 PM, Nathaniel McCallum wrote: Users that can rename the token (such as admins) can also create non-UUID

Re: [Freeipa-devel] Should mask/unmask be part of disabling/enabling services in systemd?

2014-09-22 Thread Jan Cholasta
Dne 19.9.2014 v 17:23 Rob Crittenden napsal(a): Martin Basti wrote: Hello list, I need to use systemd mask/unmask in ipa service. But as Honza wrote: IMO masking/unmasking should be part of disabling/enabling a service in systemd. AFAIK in most other init systems when you disable a service,

Re: [Freeipa-devel] [PATCH] 0645 ipa-replica-prepare: Wait for the DNS entry to be resolvable

2014-09-22 Thread Martin Kosek
On 09/19/2014 07:29 PM, Petr Viktorin wrote: https://fedorahosted.org/freeipa/ticket/4551 See ticket commit message for details. Shouldn't we add a 1 sec sleep between tries? Wouldn't current version just hammer DNS server with as many DNS queries as it can send? Martin

Re: [Freeipa-devel] [PATCH] 0645 ipa-replica-prepare: Wait for the DNS entry to be resolvable

2014-09-22 Thread Petr Spacek
On 22.9.2014 10:14, Martin Kosek wrote: On 09/19/2014 07:29 PM, Petr Viktorin wrote: https://fedorahosted.org/freeipa/ticket/4551 See ticket commit message for details. Shouldn't we add a 1 sec sleep between tries? Wouldn't current version just hammer DNS server with as many DNS queries as

Re: [Freeipa-devel] [PATCH 0069] Adds 389DS plugin to enforce UUID token IDs

2014-09-22 Thread Martin Kosek
On 09/22/2014 09:33 AM, thierry bordaz wrote: Hello Nathaniel, Just a remark, in is_token if the entry is objectclass=ipaToken it returns without freeing the 'objectclass' char array. thanks thierry On 09/21/2014 09:07 PM, Nathaniel McCallum wrote: Users that can rename

Re: [Freeipa-devel] [PATCH] 0645 ipa-replica-prepare: Wait for the DNS entry to be resolvable

2014-09-22 Thread Martin Kosek
On 09/22/2014 10:31 AM, Petr Spacek wrote: On 22.9.2014 10:14, Martin Kosek wrote: On 09/19/2014 07:29 PM, Petr Viktorin wrote: https://fedorahosted.org/freeipa/ticket/4551 See ticket commit message for details. Shouldn't we add a 1 sec sleep between tries? Wouldn't current version just

Re: [Freeipa-devel] [PATCH 0064] Create ipa-otp-decrement 389DS plugin

2014-09-22 Thread thierry bordaz
On 09/20/2014 09:39 PM, Nathaniel McCallum wrote: On Sat, 2014-09-20 at 00:25 +0200, thierry bordaz wrote: Hello Nathaniel, sanitize_input translates MOD/REPLACE into MOD/DEL+MOD/ADD. It looks good but difficult to think to all possible cases. I think to the

Re: [Freeipa-devel] [PATCH 0297] Add log message about initial LDAP synchronization

2014-09-22 Thread Tomas Hozza
On 09/17/2014 01:33 PM, Petr Spacek wrote: Hello, Add log message about initial LDAP synchronization. ACK. Regards, -- Tomas Hozza Software Engineer - EMEA ENG Developer Experience PGP: 1D9F3C2D Red Hat Inc. http://cz.redhat.com

Re: [Freeipa-devel] [PATCH 0122] Add dogtag 10.2 to specfile

2014-09-22 Thread Petr Viktorin
On 09/12/2014 04:46 PM, Martin Basti wrote: On 12/09/14 16:38, Martin Kosek wrote: On 09/12/2014 04:14 PM, Martin Basti wrote: On 12/09/14 16:02, Martin Basti wrote: I always forgot to install dogtag 10.2, so here is updated specfile. COPR: http://copr.fedoraproject.org/coprs/vakwetu/dogtag/

Re: [Freeipa-devel] [PATCH] 0645 ipa-replica-prepare: Wait for the DNS entry to be resolvable

2014-09-22 Thread Petr Spacek
On 22.9.2014 10:38, Martin Kosek wrote: On 09/22/2014 10:31 AM, Petr Spacek wrote: On 22.9.2014 10:14, Martin Kosek wrote: On 09/19/2014 07:29 PM, Petr Viktorin wrote: https://fedorahosted.org/freeipa/ticket/4551 See ticket commit message for details. Shouldn't we add a 1 sec sleep

Re: [Freeipa-devel] [PATCH 0297] Add log message about initial LDAP synchronization

2014-09-22 Thread Petr Spacek
On 22.9.2014 11:52, Tomas Hozza wrote: On 09/17/2014 01:33 PM, Petr Spacek wrote: Hello, Add log message about initial LDAP synchronization. ACK. Thanks! Pushed to master: ce1b8f400d236d0da5b76c90ddc93adbf6980691 v4: f03ff4d877240f13db419fde28e51d216277b87c -- Petr^2 Spacek

Re: [Freeipa-devel] [PATCH 0298-0302] Implement handling of inactive master zones

2014-09-22 Thread Martin Basti
On 19/09/14 15:46, Petr Spacek wrote: Hello, This patch set fixes https://fedorahosted.org/bind-dyndb-ldap/ticket/127 https://bugzilla.redhat.com/show_bug.cgi?id=1138317 Please review it ASAP, it targets IPA 4.1/Fedora 21. Tomas and Martin, please communicate who is going to review what :-)

Re: [Freeipa-devel] [PATCH] 0105 FIX: LDAP_updater

2014-09-22 Thread Petr Viktorin
On 09/01/2014 04:31 PM, Martin Basti wrote: On 24/07/14 09:06, Martin Basti wrote: On 23/07/14 15:17, Martin Basti wrote: This patch fixes ordering problem of schema updates Martin should it be in IPA 4.0.x ? It requires rebased ldap_python (will be in Fedora 21) Patch attached I found a

Re: [Freeipa-devel] [PATCH] 0645 ipa-replica-prepare: Wait for the DNS entry to be resolvable

2014-09-22 Thread Petr Viktorin
On 09/22/2014 01:48 PM, Petr Spacek wrote: On 22.9.2014 10:38, Martin Kosek wrote: On 09/22/2014 10:31 AM, Petr Spacek wrote: On 22.9.2014 10:14, Martin Kosek wrote: On 09/19/2014 07:29 PM, Petr Viktorin wrote: https://fedorahosted.org/freeipa/ticket/4551 See ticket commit message for

[Freeipa-devel] [PATCHES] 319, 324-335 CA management and renewal fixes

2014-09-22 Thread Jan Cholasta
Hi, the attached patches fix various bugs and shortcomings in the CA management and renewal code. Related tickets: https://fedorahosted.org/freeipa/ticket/4416, https://fedorahosted.org/freeipa/ticket/4460. (Patch 319 was originally posted at

Re: [Freeipa-devel] [PATCH 0298-0302] Implement handling of inactive master zones

2014-09-22 Thread Petr Viktorin
On 09/22/2014 02:01 PM, Martin Basti wrote: On 19/09/14 15:46, Petr Spacek wrote: Hello, This patch set fixes https://fedorahosted.org/bind-dyndb-ldap/ticket/127 https://bugzilla.redhat.com/show_bug.cgi?id=1138317 Please review it ASAP, it targets IPA 4.1/Fedora 21. Tomas and Martin, please

Re: [Freeipa-devel] [PATCH 0064] Create ipa-otp-decrement 389DS plugin

2014-09-22 Thread Nathaniel McCallum
On Mon, 2014-09-22 at 11:22 +0200, thierry bordaz wrote: On 09/20/2014 09:39 PM, Nathaniel McCallum wrote: On Sat, 2014-09-20 at 00:25 +0200, thierry bordaz wrote: Hello Nathaniel, sanitize_input translates MOD/REPLACE into MOD/DEL+MOD/ADD. It looks good but difficult

Re: [Freeipa-devel] [PATCH 0298-0302] Implement handling of inactive master zones

2014-09-22 Thread Tomas Hozza
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 09/19/2014 03:46 PM, Petr Spacek wrote: Hello, This patch set fixes https://fedorahosted.org/bind-dyndb-ldap/ticket/127 https://bugzilla.redhat.com/show_bug.cgi?id=1138317 Please review it ASAP, it targets IPA 4.1/Fedora 21. Tomas and

Re: [Freeipa-devel] [PATCH 0064] Create ipa-otp-decrement 389DS plugin

2014-09-22 Thread Simo Sorce
On Sun, 21 Sep 2014 22:33:47 -0400 Nathaniel McCallum npmccal...@redhat.com wrote: Comments inline. + +#define ch_malloc(type) \ +(type*) slapi_ch_malloc(sizeof(type)) +#define ch_calloc(count, type) \ +(type*) slapi_ch_calloc(count, sizeof(type)) +#define ch_free(p) \ +

Re: [Freeipa-devel] [PATCH] 0015-16 Allow multiple krbprincipalnames + test

2014-09-22 Thread David Kupka
On 09/18/2014 09:42 PM, Martin Kosek wrote: On 09/18/2014 09:11 PM, Simo Sorce wrote: On Thu, 18 Sep 2014 14:57:45 -0400 Rob Crittenden rcrit...@redhat.com wrote: Martin Kosek wrote: On 09/18/2014 04:06 PM, David Kupka wrote: On 09/18/2014 03:44 PM, Rob Crittenden wrote: David Kupka wrote:

Re: [Freeipa-devel] [PATCH 0064] Create ipa-otp-decrement 389DS plugin

2014-09-22 Thread thierry bordaz
Hello Nathaniel, I have a separated remark about updating the mods. modifications of the entry occurs in two phases: * call BE_PREOP plugins then apply the mods on the entry * call BE_TXN_PREOP plugin then apply *only* extra mods on the entry The plugin (BE_TXN_PREOP)

Re: [Freeipa-devel] [PATCH 0069] Adds 389DS plugin to enforce UUID token IDs

2014-09-22 Thread Simo Sorce
On Mon, 22 Sep 2014 10:34:54 +0200 Martin Kosek mko...@redhat.com wrote: On 09/22/2014 09:33 AM, thierry bordaz wrote: Hello Nathaniel, Just a remark, in is_token if the entry is objectclass=ipaToken it returns without freeing the 'objectclass' char array. thanks thierry

Re: [Freeipa-devel] [PATCH 0069] Adds 389DS plugin to enforce UUID token IDs

2014-09-22 Thread Nathaniel McCallum
On Mon, 2014-09-22 at 09:50 -0400, Simo Sorce wrote: On Mon, 22 Sep 2014 10:34:54 +0200 Martin Kosek mko...@redhat.com wrote: On 09/22/2014 09:33 AM, thierry bordaz wrote: Hello Nathaniel, Just a remark, in is_token if the entry is objectclass=ipaToken it returns without

Re: [Freeipa-devel] [PATCH] 0015-16 Allow multiple krbprincipalnames + test

2014-09-22 Thread Simo Sorce
On Mon, 22 Sep 2014 15:36:01 +0200 David Kupka dku...@redhat.com wrote: On 09/18/2014 09:42 PM, Martin Kosek wrote: On 09/18/2014 09:11 PM, Simo Sorce wrote: On Thu, 18 Sep 2014 14:57:45 -0400 Rob Crittenden rcrit...@redhat.com wrote: Martin Kosek wrote: On 09/18/2014 04:06 PM, David

Re: [Freeipa-devel] [PATCH] 749-754 webui: new ID views section

2014-09-22 Thread Petr Vobornik
On 19.9.2014 14:29, Petr Vobornik wrote: Hello, attached patches implements Web UI part of ID Views. Backend is currently on review as well - thread [PATCHES 247-259] ID views - management part. https://fedorahosted.org/freeipa/ticket/4535 I expect that backed can change and that the UI might

[Freeipa-devel] [PATCH] 755 webui-ci: case-insensitive record check

2014-09-22 Thread Petr Vobornik
[PATCH] webui-ci: case-insensitive record check Indirect association are no longer lower cased, which caused a issue in CI. -- Petr Vobornik From 78ec25f05eabfd61b89d497fa72e3f997dc3ef99 Mon Sep 17 00:00:00 2001 From: Petr Vobornik pvobo...@redhat.com Date: Mon, 22 Sep 2014 12:01:47 +0200

[Freeipa-devel] [PATCH] 756 webui: fix regression in association facet preop

2014-09-22 Thread Petr Vobornik
Association facet specs use 'add_method' instead of 'add_command' origin: https://fedorahosted.org/freeipa/ticket/4507 -- Petr Vobornik From ba765690eb3189381fecf1f6e071419e3f4530d6 Mon Sep 17 00:00:00 2001 From: Petr Vobornik pvobo...@redhat.com Date: Fri, 19 Sep 2014 18:27:35 +0200 Subject:

Re: [Freeipa-devel] [PATCH 0069] Adds 389DS plugin to enforce UUID token IDs

2014-09-22 Thread Simo Sorce
On Mon, 22 Sep 2014 10:02:01 -0400 Nathaniel McCallum npmccal...@redhat.com wrote: On Mon, 2014-09-22 at 09:50 -0400, Simo Sorce wrote: On Mon, 22 Sep 2014 10:34:54 +0200 Martin Kosek mko...@redhat.com wrote: On 09/22/2014 09:33 AM, thierry bordaz wrote: Hello Nathaniel,

Re: [Freeipa-devel] [PATCH] 0015-16 Allow multiple krbprincipalnames + test

2014-09-22 Thread Alexander Bokovoy
On Mon, 22 Sep 2014, Simo Sorce wrote: On Mon, 22 Sep 2014 15:36:01 +0200 David Kupka dku...@redhat.com wrote: On 09/18/2014 09:42 PM, Martin Kosek wrote: On 09/18/2014 09:11 PM, Simo Sorce wrote: On Thu, 18 Sep 2014 14:57:45 -0400 Rob Crittenden rcrit...@redhat.com wrote: Martin Kosek

Re: [Freeipa-devel] Should mask/unmask be part of disabling/enabling services in systemd?

2014-09-22 Thread Martin Basti
On 22/09/14 08:53, Martin Kosek wrote: On 09/19/2014 06:33 PM, Simo Sorce wrote: On Fri, 19 Sep 2014 17:50:16 +0200 Martin Kosekmko...@redhat.com wrote: On 09/19/2014 05:23 PM, Rob Crittenden wrote: Martin Basti wrote: Hello list, I need to use systemd mask/unmask in ipa service. But as

Re: [Freeipa-devel] [PATCH 0069] Adds 389DS plugin to enforce UUID token IDs

2014-09-22 Thread Nathaniel McCallum
On Mon, 2014-09-22 at 10:55 -0400, Simo Sorce wrote: On Mon, 22 Sep 2014 10:02:01 -0400 Nathaniel McCallum npmccal...@redhat.com wrote: On Mon, 2014-09-22 at 09:50 -0400, Simo Sorce wrote: On Mon, 22 Sep 2014 10:34:54 +0200 Martin Kosek mko...@redhat.com wrote: On 09/22/2014

Re: [Freeipa-devel] [PATCH] 0015-16 Allow multiple krbprincipalnames + test

2014-09-22 Thread Martin Kosek
On 09/22/2014 04:16 PM, Simo Sorce wrote: On Mon, 22 Sep 2014 15:36:01 +0200 David Kupka dku...@redhat.com wrote: On 09/18/2014 09:42 PM, Martin Kosek wrote: On 09/18/2014 09:11 PM, Simo Sorce wrote: On Thu, 18 Sep 2014 14:57:45 -0400 Rob Crittenden rcrit...@redhat.com wrote: Martin

Re: [Freeipa-devel] Should mask/unmask be part of disabling/enabling services in systemd?

2014-09-22 Thread Simo Sorce
On Mon, 22 Sep 2014 17:05:15 +0200 Martin Basti mba...@redhat.com wrote: On 22/09/14 08:53, Martin Kosek wrote: On 09/19/2014 06:33 PM, Simo Sorce wrote: On Fri, 19 Sep 2014 17:50:16 +0200 Martin Kosekmko...@redhat.com wrote: On 09/19/2014 05:23 PM, Rob Crittenden wrote: Martin

Re: [Freeipa-devel] Should mask/unmask be part of disabling/enabling services in systemd?

2014-09-22 Thread Martin Basti
On 22/09/14 17:29, Simo Sorce wrote: On Mon, 22 Sep 2014 17:05:15 +0200 Martin Basti mba...@redhat.com wrote: On 22/09/14 08:53, Martin Kosek wrote: On 09/19/2014 06:33 PM, Simo Sorce wrote: On Fri, 19 Sep 2014 17:50:16 +0200 Martin Kosekmko...@redhat.com wrote: On 09/19/2014 05:23 PM,

Re: [Freeipa-devel] [PATCH 0065] Don't allow users to create tokens with a specified ID

2014-09-22 Thread Martin Kosek
On 09/20/2014 10:22 PM, Nathaniel McCallum wrote: On Wed, 2014-09-17 at 12:31 +0200, Martin Kosek wrote: On 09/17/2014 08:51 AM, Jan Cholasta wrote: Hi, Dne 16.9.2014 v 19:32 Nathaniel McCallum napsal(a): We perform this enforcement at the API level since: * DS level enforcement would be

Re: [Freeipa-devel] Should mask/unmask be part of disabling/enabling services in systemd?

2014-09-22 Thread Rob Crittenden
Simo Sorce wrote: On Mon, 22 Sep 2014 17:05:15 +0200 Martin Basti mba...@redhat.com wrote: On 22/09/14 08:53, Martin Kosek wrote: On 09/19/2014 06:33 PM, Simo Sorce wrote: On Fri, 19 Sep 2014 17:50:16 +0200 Martin Kosekmko...@redhat.com wrote: On 09/19/2014 05:23 PM, Rob Crittenden

Re: [Freeipa-devel] [PATCH 0065] Don't allow users to create tokens with a specified ID

2014-09-22 Thread thierry bordaz
On 09/22/2014 05:37 PM, Martin Kosek wrote: On 09/20/2014 10:22 PM, Nathaniel McCallum wrote: On Wed, 2014-09-17 at 12:31 +0200, Martin Kosek wrote: On 09/17/2014 08:51 AM, Jan Cholasta wrote: Hi, Dne 16.9.2014 v 19:32 Nathaniel McCallum napsal(a): We perform this enforcement at the API

[Freeipa-devel] Krb service delegation rules in CLI

2014-09-22 Thread Martin Basti
Hello, Related ticket: https://fedorahosted.org/freeipa/ticket/3644 1) API The ipaKrb5DelegationACL objectclass requires targets which are stored in extra objectclass. A) we allow users to create groups of principals and then associate them as targets -- user can use same group for

Re: [Freeipa-devel] [PATCH 0069] Adds 389DS plugin to enforce UUID token IDs

2014-09-22 Thread Rich Megginson
On 09/22/2014 09:14 AM, Nathaniel McCallum wrote: On Mon, 2014-09-22 at 10:55 -0400, Simo Sorce wrote: On Mon, 22 Sep 2014 10:02:01 -0400 Nathaniel McCallum npmccal...@redhat.com wrote: On Mon, 2014-09-22 at 09:50 -0400, Simo Sorce wrote: On Mon, 22 Sep 2014 10:34:54 +0200 Martin Kosek

Re: [Freeipa-devel] [PATCH 0069] Adds 389DS plugin to enforce UUID token IDs

2014-09-22 Thread Simo Sorce
On Mon, 22 Sep 2014 11:14:31 -0400 Nathaniel McCallum npmccal...@redhat.com wrote: On Mon, 2014-09-22 at 10:55 -0400, Simo Sorce wrote: On Mon, 22 Sep 2014 10:02:01 -0400 Nathaniel McCallum npmccal...@redhat.com wrote: On Mon, 2014-09-22 at 09:50 -0400, Simo Sorce wrote: On Mon, 22

Re: [Freeipa-devel] [PATCH] 0015-16 Allow multiple krbprincipalnames + test

2014-09-22 Thread Simo Sorce
On Mon, 22 Sep 2014 17:25:27 +0200 Martin Kosek mko...@redhat.com wrote: On 09/22/2014 04:16 PM, Simo Sorce wrote: On Mon, 22 Sep 2014 15:36:01 +0200 David Kupka dku...@redhat.com wrote: On 09/18/2014 09:42 PM, Martin Kosek wrote: On 09/18/2014 09:11 PM, Simo Sorce wrote: On Thu, 18

Re: [Freeipa-devel] Should mask/unmask be part of disabling/enabling services in systemd?

2014-09-22 Thread Simo Sorce
On Mon, 22 Sep 2014 17:36:01 +0200 Martin Basti mba...@redhat.com wrote: On 22/09/14 17:29, Simo Sorce wrote: On Mon, 22 Sep 2014 17:05:15 +0200 Martin Basti mba...@redhat.com wrote: On 22/09/14 08:53, Martin Kosek wrote: On 09/19/2014 06:33 PM, Simo Sorce wrote: On Fri, 19 Sep 2014

Re: [Freeipa-devel] [PATCH 0065] Don't allow users to create tokens with a specified ID

2014-09-22 Thread Simo Sorce
On Mon, 22 Sep 2014 17:42:39 +0200 thierry bordaz tbor...@redhat.com wrote: RFC 4527 Thanks a lot Thierry, this is exactly the control I had in mind last week. If we could implement it then we could solve any issue where the RDN needs to be modified by the ADD operation. Simo. -- Simo Sorce

Re: [Freeipa-devel] [PATCHES 0114-0115, 0120-0121, 0123-0125] DNS: allow to add root zone '.'

2014-09-22 Thread Martin Basti
On 19/09/14 13:54, Martin Kosek wrote: I did not review, just found something that hit me in the eyes: On 09/19/2014 01:25 PM, Martin Basti wrote: +class OptionDeprecatedWarning(PublicMessage): + +**13004** Used when user uses a deprecated option + + +errno = 13004 +type =

Re: [Freeipa-devel] [PATCH 0126 - 0127] DNS: remove --class option

2014-09-22 Thread Martin Basti
On 22/09/14 13:17, Petr Vobornik wrote: On 19.9.2014 16:15, Martin Basti wrote: Ticket: https://fedorahosted.org/freeipa/ticket/3414 Patch attached. Patch 126: 1. I think that just DeprecatedParam('dnsclass?'), should be enough. Also 2. You forgot to update API.txt and VERSION Patch

Re: [Freeipa-devel] [PATCH 0126 - 0127] DNS: remove --class option

2014-09-22 Thread Martin Basti
On 22/09/14 13:17, Petr Vobornik wrote: On 19.9.2014 16:15, Martin Basti wrote: Ticket: https://fedorahosted.org/freeipa/ticket/3414 Patch attached. Patch 126: 1. I think that just DeprecatedParam('dnsclass?'), should be enough. Sorry I forgot to reply, I was getting error without

Re: [Freeipa-devel] [PATCH 0118] Allow to disable service (in LDAP)

2014-09-22 Thread Martin Basti
On 19/09/14 14:47, Jan Cholasta wrote: Dne 19.9.2014 v 13:33 Martin Basti napsal(a): On 02/09/14 11:59, Martin Basti wrote: On 02/09/14 09:10, Jan Cholasta wrote: Hi, Dne 1.9.2014 v 16:57 Martin Basti napsal(a): This patch allows to disable service in LDAP to prevents service to be started

Re: [Freeipa-devel] [PATCH 0065] Don't allow users to create tokens with a specified ID

2014-09-22 Thread Simo Sorce
On Mon, 22 Sep 2014 12:58:58 -0400 Simo Sorce s...@redhat.com wrote: On Mon, 22 Sep 2014 17:42:39 +0200 thierry bordaz tbor...@redhat.com wrote: RFC 4527 Thanks a lot Thierry, this is exactly the control I had in mind last week. If we could implement it then we could solve any issue

Re: [Freeipa-devel] [PATCH 0069] Adds 389DS plugin to enforce UUID token IDs

2014-09-22 Thread Martin Kosek
On 09/22/2014 04:55 PM, Simo Sorce wrote: On Mon, 22 Sep 2014 10:02:01 -0400 Nathaniel McCallum npmccal...@redhat.com wrote: On Mon, 2014-09-22 at 09:50 -0400, Simo Sorce wrote: On Mon, 22 Sep 2014 10:34:54 +0200 Martin Kosek mko...@redhat.com wrote: On 09/22/2014 09:33 AM, thierry bordaz

Re: [Freeipa-devel] [PATCH 0065] Don't allow users to create tokens with a specified ID

2014-09-22 Thread Martin Kosek
On 09/22/2014 06:58 PM, Simo Sorce wrote: On Mon, 22 Sep 2014 17:42:39 +0200 thierry bordaz tbor...@redhat.com wrote: RFC 4527 Thanks a lot Thierry, this is exactly the control I had in mind last week. If we could implement it then we could solve any issue where the RDN needs to be modified

Re: [Freeipa-devel] [PATCH 0069] Adds 389DS plugin to enforce UUID token IDs

2014-09-22 Thread Simo Sorce
On Mon, 22 Sep 2014 21:21:04 +0200 Martin Kosek mko...@redhat.com wrote: On 09/22/2014 04:55 PM, Simo Sorce wrote: On Mon, 22 Sep 2014 10:02:01 -0400 Nathaniel McCallum npmccal...@redhat.com wrote: On Mon, 2014-09-22 at 09:50 -0400, Simo Sorce wrote: On Mon, 22 Sep 2014 10:34:54 +0200

Re: [Freeipa-devel] Krb service delegation rules in CLI

2014-09-22 Thread Alexander Bokovoy
On Mon, 22 Sep 2014, Martin Basti wrote: Hello, Related ticket: https://fedorahosted.org/freeipa/ticket/3644 1) API The ipaKrb5DelegationACL objectclass requires targets which are stored in extra objectclass. A) we allow users to create groups of principals and then associate them as

Re: [Freeipa-devel] [PATCH 0065] Don't allow users to create tokens with a specified ID

2014-09-22 Thread Rich Megginson
On 09/22/2014 01:28 PM, Martin Kosek wrote: On 09/22/2014 06:58 PM, Simo Sorce wrote: On Mon, 22 Sep 2014 17:42:39 +0200 thierry bordaz tbor...@redhat.com wrote: RFC 4527 Thanks a lot Thierry, this is exactly the control I had in mind last week. If we could implement it then we could solve

Re: [Freeipa-devel] Krb service delegation rules in CLI

2014-09-22 Thread Simo Sorce
On Mon, 22 Sep 2014 17:45:55 +0200 Martin Basti mba...@redhat.com wrote: Hello, Related ticket: https://fedorahosted.org/freeipa/ticket/3644 1) API The ipaKrb5DelegationACL objectclass requires targets which are stored in extra objectclass. A) we allow users to create groups of