Re: [Freeipa-devel] Release 4.4.1 planning

2016-08-31 Thread Martin Basti
On 30.08.2016 15:00, Alexander Bokovoy wrote: Hi, we have a plan to release FreeIPA 4.4.1 on Wednesday, Aug 31st. I started preparing a release page: http://www.freeipa.org/page/Releases/4.4.1 It has staggering 140+ closed tickets already. Please help me with filling in enhancements and

Re: [Freeipa-devel] [DESIGN][UPDATE] Time-Based HBAC Policies

2016-08-31 Thread Standa Laznicka
On 08/30/2016 03:34 PM, Simo Sorce wrote: On Tue, 2016-08-30 at 08:47 +0200, Standa Laznicka wrote: On 08/26/2016 05:37 PM, Simo Sorce wrote: On Fri, 2016-08-26 at 11:26 -0400, Simo Sorce wrote: On Fri, 2016-08-26 at 18:09 +0300, Alexander Bokovoy wrote: On Fri, 26 Aug 2016, Simo Sorce

Re: [Freeipa-devel] [PATCH] 0024 memory leak in ipapwd plugin

2016-08-31 Thread Martin Basti
On 30.08.2016 13:27, Martin Basti wrote: On 11.08.2016 16:39, Alexander Bokovoy wrote: On Thu, 11 Aug 2016, thierry bordaz wrote: +/* rc should always be 0 (else slapi_sdn_new_dn_byref should have sigsev) + * but if we end in rc==LDAP_OPERATIONS_ERROR be sure to stop here

[Freeipa-devel] [freeipa PR#34] dns: prompt for missing record parts in CLI (synchronize)

2016-08-31 Thread jcholast
jcholast's pull request #34: " dns: prompt for missing record parts in CLI" was synchronize See the full pull-request at https://github.com/freeipa/freeipa/pull/34 ... or pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/34/head:pr34

[Freeipa-devel] [freeipa PR#17] Tests: Random issuer certificate can be added to a service (+ack)

2016-08-31 Thread gkaihorodova
mirielka's pull request #17: "Tests: Random issuer certificate can be added to a service" label *ack* has been added See the full pull-request at https://github.com/freeipa/freeipa/pull/17 -- Manage your subscription for the Freeipa-devel mailing list:

Re: [Freeipa-devel] [DESIGN][UPDATE] Time-Based HBAC Policies

2016-08-31 Thread Petr Spacek
On 31.8.2016 12:42, Standa Laznicka wrote: > On 08/30/2016 03:34 PM, Simo Sorce wrote: >> On Tue, 2016-08-30 at 08:47 +0200, Standa Laznicka wrote: >>> On 08/26/2016 05:37 PM, Simo Sorce wrote: On Fri, 2016-08-26 at 11:26 -0400, Simo Sorce wrote: > On Fri, 2016-08-26 at 18:09 +0300,

[Freeipa-devel] [freeipa PR#40] do not use trusted forest name to construct domain admin principal (opened)

2016-08-31 Thread martbab
martbab's pull request #40: "do not use trusted forest name to construct domain admin principal" was opened PR body: """ When `trust-add` is supplied AD domain admin name without realm component, the code appends the uppercased AD forest root domain name to construct the full principal. This can

[Freeipa-devel] [freeipa PR#34] dns: prompt for missing record parts in CLI (synchronize)

2016-08-31 Thread jcholast
jcholast's pull request #34: " dns: prompt for missing record parts in CLI" was synchronize See the full pull-request at https://github.com/freeipa/freeipa/pull/34 ... or pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/34/head:pr34

[Freeipa-devel] [freeipa PR#34] dns: prompt for missing record parts in CLI (comment)

2016-08-31 Thread jcholast
jcholast commented on a pull request """ I have decided to instead copy & paste the code, as it exists solely for the purpose of supporting old servers, so it should not get any additional improvements in the future. """ See the full comment at

[Freeipa-devel] [freeipa PR#41] Postpone enabling LDAPS in replica promotion (opened)

2016-08-31 Thread tomaskrizek
tomaskrizek's pull request #41: "Postpone enabling LDAPS in replica promotion" was opened PR body: """ Fixes a bug that prevented ipa-replica-install with CA, because LDAPS was configured before the SSL cerificate was assigned. https://fedorahosted.org/freeipa/ticket/6226 """ See the full

[Freeipa-devel] [freeipa PR#40] do not use trusted forest name to construct domain admin principal (comment)

2016-08-31 Thread mbasti-rh
mbasti-rh commented on a pull request """ Fixed upstream master: https://fedorahosted.org/freeipa/changeset/f32e0e4e522e09390f4295dd79f52d7a48877d3a """ See the full comment at https://github.com/freeipa/freeipa/pull/40#issuecomment-243758104 -- Manage your subscription for the Freeipa-devel

[Freeipa-devel] [freeipa PR#40] do not use trusted forest name to construct domain admin principal (+pushed)

2016-08-31 Thread mbasti-rh
martbab's pull request #40: "do not use trusted forest name to construct domain admin principal" label *pushed* has been added See the full pull-request at https://github.com/freeipa/freeipa/pull/40 -- Manage your subscription for the Freeipa-devel mailing list:

[Freeipa-devel] [freeipa PR#40] do not use trusted forest name to construct domain admin principal (comment)

2016-08-31 Thread abbra
abbra commented on a pull request """ NACK. This is wrong. In the case of external trust to a child domain we cannot run netr_DsRGetForestTrustInformation() against the child domain, regardless what credentials we have. Instead, we should run this request against the forest root domain using

[Freeipa-devel] [freeipa PR#17] Tests: Random issuer certificate can be added to a service (+pushed)

2016-08-31 Thread mbasti-rh
mirielka's pull request #17: "Tests: Random issuer certificate can be added to a service" label *pushed* has been added See the full pull-request at https://github.com/freeipa/freeipa/pull/17 -- Manage your subscription for the Freeipa-devel mailing list:

[Freeipa-devel] [freeipa PR#40] do not use trusted forest name to construct domain admin principal (comment)

2016-08-31 Thread abbra
abbra commented on a pull request """ Apologies. This is indeed a minor issue which is correctly fixed, so ACK for this one. Note, though, this will not help with the actual query because regardless of what credentials were used, AD DC of a child domain behaves wrongly in Windows Server 2012R2

[Freeipa-devel] [freeipa PR#40] do not use trusted forest name to construct domain admin principal (+ack)

2016-08-31 Thread abbra
martbab's pull request #40: "do not use trusted forest name to construct domain admin principal" label *ack* has been added See the full pull-request at https://github.com/freeipa/freeipa/pull/40 -- Manage your subscription for the Freeipa-devel mailing list:

[Freeipa-devel] [freeipa PR#17] Tests: Random issuer certificate can be added to a service (closed)

2016-08-31 Thread mbasti-rh
mirielka's pull request #17: "Tests: Random issuer certificate can be added to a service" was closed See the full pull-request at https://github.com/freeipa/freeipa/pull/17 ... or pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa

[Freeipa-devel] [freeipa PR#35] rpcserver: assume version 1 for unversioned command calls (+pushed)

2016-08-31 Thread dkupka
jcholast's pull request #35: "rpcserver: assume version 1 for unversioned command calls" label *pushed* has been added See the full pull-request at https://github.com/freeipa/freeipa/pull/35 -- Manage your subscription for the Freeipa-devel mailing list:

Re: [Freeipa-devel] [PATCH] restrict setkeytab operation

2016-08-31 Thread Martin Basti
On 26.07.2016 13:38, Simo Sorce wrote: On Mon, 2016-07-25 at 11:26 -0400, Simo Sorce wrote: On Mon, 2016-07-25 at 11:10 -0400, Rob Crittenden wrote: Simo Sorce wrote: On Mon, 2016-07-25 at 10:55 -0400, Rob Crittenden wrote: Simo Sorce wrote: As described in #232 start restricting the use

[Freeipa-devel] [freeipa PR#35] rpcserver: assume version 1 for unversioned command calls (closed)

2016-08-31 Thread dkupka
jcholast's pull request #35: "rpcserver: assume version 1 for unversioned command calls" was closed See the full pull-request at https://github.com/freeipa/freeipa/pull/35 ... or pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa

[Freeipa-devel] [freeipa PR#35] rpcserver: assume version 1 for unversioned command calls (comment)

2016-08-31 Thread dkupka
dkupka commented on a pull request """ Fixed upstream master: https://fedorahosted.org/freeipa/changeset/8891465247a0bab5d07f560f2c963f3ee56905f0 """ See the full comment at https://github.com/freeipa/freeipa/pull/35#issuecomment-243750424 -- Manage your subscription for the Freeipa-devel

[Freeipa-devel] [freeipa PR#35] rpcserver: assume version 1 for unversioned command calls (+ack)

2016-08-31 Thread dkupka
jcholast's pull request #35: "rpcserver: assume version 1 for unversioned command calls" label *ack* has been added See the full pull-request at https://github.com/freeipa/freeipa/pull/35 -- Manage your subscription for the Freeipa-devel mailing list:

[Freeipa-devel] [freeipa PR#39] Tests: Add missing attributes to test_xmlrpc/test_trust tests (closed)

2016-08-31 Thread mbasti-rh
mirielka's pull request #39: "Tests: Add missing attributes to test_xmlrpc/test_trust tests" was closed See the full pull-request at https://github.com/freeipa/freeipa/pull/39 ... or pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa

[Freeipa-devel] [freeipa PR#39] Tests: Add missing attributes to test_xmlrpc/test_trust tests (+pushed)

2016-08-31 Thread mbasti-rh
mirielka's pull request #39: "Tests: Add missing attributes to test_xmlrpc/test_trust tests" label *pushed* has been added See the full pull-request at https://github.com/freeipa/freeipa/pull/39 -- Manage your subscription for the Freeipa-devel mailing list:

[Freeipa-devel] [freeipa PR#39] Tests: Add missing attributes to test_xmlrpc/test_trust tests (comment)

2016-08-31 Thread mbasti-rh
mbasti-rh commented on a pull request """ Fixed upstream master: https://fedorahosted.org/freeipa/changeset/60e88038c43c2ea2afc7e48f3e8dbd9bcfe955e8 """ See the full comment at https://github.com/freeipa/freeipa/pull/39#issuecomment-243757482 -- Manage your subscription for the Freeipa-devel

[Freeipa-devel] [freeipa PR#41] Postpone enabling LDAPS in replica promotion (comment)

2016-08-31 Thread jcholast
jcholast commented on a pull request """ `ipa-replica-install` fails with: ``` Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 448, in start_creation run_step(full_msg, method) File

[Freeipa-devel] [freeipa PR#41] Postpone enabling LDAPS in replica promotion (closed)

2016-08-31 Thread mbasti-rh
tomaskrizek's pull request #41: "Postpone enabling LDAPS in replica promotion" was closed See the full pull-request at https://github.com/freeipa/freeipa/pull/41 ... or pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/41/head:pr41

[Freeipa-devel] [freeipa PR#39] Tests: Add missing attributes to test_xmlrpc/test_trust tests (+ack)

2016-08-31 Thread gkaihorodova
mirielka's pull request #39: "Tests: Add missing attributes to test_xmlrpc/test_trust tests" label *ack* has been added See the full pull-request at https://github.com/freeipa/freeipa/pull/39 -- Manage your subscription for the Freeipa-devel mailing list:

[Freeipa-devel] [freeipa PR#41] Postpone enabling LDAPS in replica promotion (comment)

2016-08-31 Thread jcholast
jcholast commented on a pull request """ However, I don't think this should block the release of 4.4.1, so I would just revert 89de60c5d8ba64d619101a7498b8c4469b6e50ae and keep the ticket open. """ See the full comment at https://github.com/freeipa/freeipa/pull/41#issuecomment-243771692 --

[Freeipa-devel] [freeipa PR#42] Tests: Avoid skipping tests due to missing files (opened)

2016-08-31 Thread mirielka
mirielka's pull request #42: "Tests: Avoid skipping tests due to missing files" was opened PR body: """ When running test_install/test_updates and test_pkcs10/test_pkcs10 as outoftree, these are skipped with reason 'Unable to find test update files'. For outoftree tests wrong paths are checked

[Freeipa-devel] [freeipa PR#42] Tests: Avoid skipping tests due to missing files (comment)

2016-08-31 Thread mbasti-rh
mbasti-rh commented on a pull request """ I don't like this. Will we have if/elif for each possible location of where tests are executed. What changed? I'm sure those tests work in past. Why dir where test is executed was changed? """ See the full comment at

[Freeipa-devel] [freeipa PR#42] Tests: Avoid skipping tests due to missing files (comment)

2016-08-31 Thread mbasti-rh
mbasti-rh commented on a pull request """ Probably instead of that magic, there could be: ``` self.testdir = os.path.abspath(os.path.dirname(__file__)) ``` It should always find the proper local directory And please in read_file, instead of plus sign, use os.path.join(self.testdir, filename)

[Freeipa-devel] [freeipa PR#10] Client-side CSR autogeneration (comment)

2016-08-31 Thread LiptonB
LiptonB commented on a pull request """ As discussed elsewhere, this script generation is a fairly low-level operation; you have to specify the helper and know how to run the script. Most users will probably want a command that just takes in a private key location and a profile and requests