Re: [Freeipa-devel] Time-Based Account Policies

2015-08-11 Thread Petr Vobornik
On 08/03/2015 04:30 PM, Alexander Bokovoy wrote: On Mon, 03 Aug 2015, Stanislav Laznicka wrote: snip 3. The mockups for HBAC time policies show quite a wizard-like UI. While I might be very wrong here, I was thinking of rather a simple UI where user would be able to set the values for each

Re: [Freeipa-devel] Time-Based Account Policies

2015-08-06 Thread Stanislav Laznicka
On 08/03/2015 04:30 PM, Alexander Bokovoy wrote: On Mon, 03 Aug 2015, Stanislav Laznicka wrote: dragons may appear, although with a tiny tiny possibility of a golden treasure in the end. Yes, I think intervals are required. Alright. I gave it a little thought considering the current state of

Re: [Freeipa-devel] Time-Based Account Policies

2015-08-03 Thread Alexander Bokovoy
On Mon, 03 Aug 2015, Stanislav Laznicka wrote: dragons may appear, although with a tiny tiny possibility of a golden treasure in the end. Yes, I think intervals are required. Alright. I gave it a little thought considering the current state of the language for time rules and considering where

Re: [Freeipa-devel] Time-Based Account Policies

2015-08-03 Thread Alexander Bokovoy
On Mon, 03 Aug 2015, Stanislav Laznicka wrote: Hi, I have made some changes to the structure of the HBAC time rules extension, namely the code that validates the time rules' strings was moved from the ipalib/parameters to the hbacrule module itself, and a more fresh approach was used in code

Re: [Freeipa-devel] Time-Based Account Policies

2015-08-03 Thread Stanislav Laznicka
On 08/03/2015 11:45 AM, Alexander Bokovoy wrote: On Mon, 03 Aug 2015, Stanislav Laznicka wrote: Hi, I have made some changes to the structure of the HBAC time rules extension, namely the code that validates the time rules' strings was moved from the ipalib/parameters to the hbacrule module

Re: [Freeipa-devel] Time-Based Account Policies

2015-07-13 Thread Stanislav Laznicka
On 07/10/2015 04:17 PM, Martin Basti wrote: On 10/07/15 12:08, Stanislav Laznicka wrote: Hi, Long time no post from me, time to make it up to you. I have been working on the the implementation of the design of time policies for HBAC rules on FreeIPA and SSSD sides. Attached is the current

Re: [Freeipa-devel] Time-Based Account Policies

2015-07-10 Thread Petr Vobornik
On 07/10/2015 12:43 PM, Alexander Bokovoy wrote: On Fri, 10 Jul 2015, Stanislav Laznicka wrote: Hi, Long time no post from me, time to make it up to you. Welcome back! I have been working on the the implementation of the design of time policies for HBAC rules on FreeIPA and SSSD sides.

Re: [Freeipa-devel] Time-Based Account Policies

2015-07-10 Thread Stanislav Laznicka
On 07/10/2015 01:10 PM, Petr Vobornik wrote: On 07/10/2015 12:43 PM, Alexander Bokovoy wrote: On Fri, 10 Jul 2015, Stanislav Laznicka wrote: Hi, Long time no post from me, time to make it up to you. Welcome back! I have been working on the the implementation of the design of time policies

Re: [Freeipa-devel] Time-Based Account Policies

2015-07-10 Thread Alexander Bokovoy
On Fri, 10 Jul 2015, Stanislav Laznicka wrote: Hi, Long time no post from me, time to make it up to you. Welcome back! I have been working on the the implementation of the design of time policies for HBAC rules on FreeIPA and SSSD sides. Attached is the current state of the FreeIPA

Re: [Freeipa-devel] Time-Based Account Policies

2015-07-10 Thread Stanislav Laznicka
On 07/10/2015 01:12 PM, Matúš Honěk wrote: On 07/10/2015 12:43 PM, Alexander Bokovoy wrote: On Fri, 10 Jul 2015, Stanislav Laznicka wrote: Hi, Long time no post from me, time to make it up to you. Welcome back! I have been working on the the implementation of the design of time policies

Re: [Freeipa-devel] Time-Based Account Policies

2015-07-10 Thread Matúš Honěk
On 07/10/2015 12:43 PM, Alexander Bokovoy wrote: On Fri, 10 Jul 2015, Stanislav Laznicka wrote: Hi, Long time no post from me, time to make it up to you. Welcome back! I have been working on the the implementation of the design of time policies for HBAC rules on FreeIPA and SSSD sides.

Re: [Freeipa-devel] Time-Based Account Policies

2015-07-10 Thread Martin Basti
On 10/07/15 12:08, Stanislav Laznicka wrote: Hi, Long time no post from me, time to make it up to you. I have been working on the the implementation of the design of time policies for HBAC rules on FreeIPA and SSSD sides. Attached is the current state of the FreeIPA solution. My comments and

Re: [Freeipa-devel] Time-Based Account Policies - Feature Proposal

2015-04-16 Thread Jan Cholasta
Hi, Dne 15.4.2015 v 16:07 Stanislav Láznička napsal(a): Hi, I have prepared a feature proposal for the wiki. I followed the Feature Proposal Template and the chapter How to Test is currently missing so it might rather be considered a draft. Please, see it, I hope it's alright. The text:

Re: [Freeipa-devel] Time-Based Account Policies - Feature Proposal

2015-04-16 Thread Standa Láznička
On 4/16/2015 10:26 AM, Alexander Bokovoy wrote: On Thu, 16 Apr 2015, Stanislav Láznička wrote: On 04/16/2015 08:04 AM, Jan Cholasta wrote: Hi, Dne 15.4.2015 v 16:07 Stanislav Láznička napsal(a): Hi, I have prepared a feature proposal for the wiki. I followed the Feature Proposal Template

Re: [Freeipa-devel] Time-Based Account Policies - Feature Proposal

2015-04-16 Thread Stanislav Láznička
On 04/16/2015 08:04 AM, Jan Cholasta wrote: Hi, Dne 15.4.2015 v 16:07 Stanislav Láznička napsal(a): Hi, I have prepared a feature proposal for the wiki. I followed the Feature Proposal Template and the chapter How to Test is currently missing so it might rather be considered a draft. Please,

Re: [Freeipa-devel] Time-Based Account Policies - Feature Proposal

2015-04-16 Thread Jan Cholasta
Dne 16.4.2015 v 10:04 Stanislav Láznička napsal(a): On 04/16/2015 08:04 AM, Jan Cholasta wrote: Hi, Dne 15.4.2015 v 16:07 Stanislav Láznička napsal(a): Hi, I have prepared a feature proposal for the wiki. I followed the Feature Proposal Template and the chapter How to Test is currently

Re: [Freeipa-devel] Time-Based Account Policies - Feature Proposal

2015-04-16 Thread Alexander Bokovoy
On Thu, 16 Apr 2015, Stanislav Láznička wrote: On 04/16/2015 08:04 AM, Jan Cholasta wrote: Hi, Dne 15.4.2015 v 16:07 Stanislav Láznička napsal(a): Hi, I have prepared a feature proposal for the wiki. I followed the Feature Proposal Template and the chapter How to Test is currently missing so

Re: [Freeipa-devel] Time-Based Account Policies - Feature Proposal

2015-04-16 Thread Simo Sorce
On Thu, 2015-04-16 at 10:04 +0200, Stanislav Láznička wrote: Possible values of each keyword: timeofday -2359 dayofweek Mon, Tue, Wed, Thu, Fri, Sat, Sun dayofmonth 1-31 weekofmonth 1-5 monthofyear Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov,

Re: [Freeipa-devel] Time-Based Account Policies - Feature Proposal

2015-04-16 Thread Alexander Bokovoy
On Thu, 16 Apr 2015, Simo Sorce wrote: On Thu, 2015-04-16 at 10:04 +0200, Stanislav Láznička wrote: Possible values of each keyword: timeofday -2359 dayofweek Mon, Tue, Wed, Thu, Fri, Sat, Sun dayofmonth 1-31 weekofmonth 1-5 monthofyear Jan, Feb, Mar, Apr,

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Jan Cholasta
Dne 24.3.2015 v 19:20 Simo Sorce napsal(a): On Tue, 2015-03-24 at 08:40 +0100, Martin Kosek wrote: On 03/24/2015 08:20 AM, Jakub Hrozek wrote: On Tue, Mar 24, 2015 at 08:07:53AM +0100, Martin Kosek wrote: On 03/24/2015 07:16 AM, Jan Cholasta wrote: Dne 23.3.2015 v 20:17 Standa Láznička

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Jan Cholasta
Dne 25.3.2015 v 18:25 Stanislav Láznička napsal(a): On 03/25/2015 12:34 PM, Alexander Bokovoy wrote: When using hbactest command you just need to supply implied time zone as an option to the command itself. After all, you are simulating rule execution so it does not matter where the value comes

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Standa Láznička
On 3/26/2015 11:13 AM, Jan Cholasta wrote: Dne 25.3.2015 v 18:25 Stanislav Láznička napsal(a): On 03/25/2015 12:34 PM, Alexander Bokovoy wrote: When using hbactest command you just need to supply implied time zone as an option to the command itself. After all, you are simulating rule execution

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Martin Kosek
On 03/26/2015 01:08 PM, Standa Láznička wrote: On 3/26/2015 11:13 AM, Jan Cholasta wrote: Dne 25.3.2015 v 18:25 Stanislav Láznička napsal(a): On 03/25/2015 12:34 PM, Alexander Bokovoy wrote: When using hbactest command you just need to supply implied time zone as an option to the command

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Martin Kosek
On 03/26/2015 05:06 PM, Simo Sorce wrote: On Thu, 2015-03-26 at 16:47 +0100, Martin Kosek wrote: ... Reference: http://www.redhat.com/archives/freeipa-devel/2015-March/msg00158.html I see how the language I sued may be confusing. But I was pointing out only that you can't just do one or the

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Martin Kosek
On 03/26/2015 04:57 PM, Jan Cholasta wrote: Dne 26.3.2015 v 16:47 Martin Kosek napsal(a): On 03/26/2015 04:39 PM, Simo Sorce wrote: On Thu, 2015-03-26 at 16:35 +0100, Martin Kosek wrote: On 03/26/2015 04:26 PM, Jan Cholasta wrote: [...] I don't see any point in storing time zone in the host

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Simo Sorce
On Thu, 2015-03-26 at 16:47 +0100, Martin Kosek wrote: On 03/26/2015 04:39 PM, Simo Sorce wrote: On Thu, 2015-03-26 at 16:35 +0100, Martin Kosek wrote: On 03/26/2015 04:26 PM, Jan Cholasta wrote: [...] I don't see any point in storing time zone in the host object, if it's not used

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Standa Láznička
On 3/26/2015 1:24 PM, Martin Kosek wrote: On 03/26/2015 01:08 PM, Standa Láznička wrote: On 3/26/2015 11:13 AM, Jan Cholasta wrote: Dne 25.3.2015 v 18:25 Stanislav Láznička napsal(a): On 03/25/2015 12:34 PM, Alexander Bokovoy wrote: When using hbactest command you just need to supply implied

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Martin Kosek
On 03/26/2015 02:40 PM, Standa Láznička wrote: On 3/26/2015 1:24 PM, Martin Kosek wrote: On 03/26/2015 01:08 PM, Standa Láznička wrote: On 3/26/2015 11:13 AM, Jan Cholasta wrote: Dne 25.3.2015 v 18:25 Stanislav Láznička napsal(a): On 03/25/2015 12:34 PM, Alexander Bokovoy wrote: When using

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Simo Sorce
On Thu, 2015-03-26 at 16:35 +0100, Martin Kosek wrote: On 03/26/2015 04:26 PM, Jan Cholasta wrote: [...] I don't see any point in storing time zone in the host object, if it's not used for anything meaningful and has to be manually synchronized with the host's actual configured time

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Martin Kosek
On 03/26/2015 04:30 PM, Simo Sorce wrote: On Thu, 2015-03-26 at 16:26 +0100, Jan Cholasta wrote: I think the timezone still may be with the host object but only as the UI helper as you suggest. Although I would maybe rather not see it with the object at all and have the admin just set the

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Martin Kosek
On 03/26/2015 04:39 PM, Simo Sorce wrote: On Thu, 2015-03-26 at 16:35 +0100, Martin Kosek wrote: On 03/26/2015 04:26 PM, Jan Cholasta wrote: [...] I don't see any point in storing time zone in the host object, if it's not used for anything meaningful and has to be manually synchronized

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Jan Cholasta
Dne 26.3.2015 v 16:47 Martin Kosek napsal(a): On 03/26/2015 04:39 PM, Simo Sorce wrote: On Thu, 2015-03-26 at 16:35 +0100, Martin Kosek wrote: On 03/26/2015 04:26 PM, Jan Cholasta wrote: [...] I don't see any point in storing time zone in the host object, if it's not used for anything

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Martin Kosek
On 03/26/2015 04:26 PM, Jan Cholasta wrote: Dne 26.3.2015 v 14:55 Martin Kosek napsal(a): On 03/26/2015 02:40 PM, Standa Láznička wrote: On 3/26/2015 1:24 PM, Martin Kosek wrote: On 03/26/2015 01:08 PM, Standa Láznička wrote: On 3/26/2015 11:13 AM, Jan Cholasta wrote: Dne 25.3.2015 v 18:25

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Standa Láznička
On 26. 3. 2015, at 14:55, Martin Kosek mko...@redhat.com wrote: On 03/26/2015 02:40 PM, Standa Láznička wrote: On 3/26/2015 1:24 PM, Martin Kosek wrote: On 03/26/2015 01:08 PM, Standa Láznička wrote: On 3/26/2015 11:13 AM, Jan Cholasta wrote: Dne 25.3.2015 v 18:25 Stanislav Láznička

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Simo Sorce
On Thu, 2015-03-26 at 16:39 +0100, Martin Kosek wrote: On 03/26/2015 04:30 PM, Simo Sorce wrote: On Thu, 2015-03-26 at 16:26 +0100, Jan Cholasta wrote: I think the timezone still may be with the host object but only as the UI helper as you suggest. Although I would maybe rather not see it

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Jan Cholasta
Dne 26.3.2015 v 14:55 Martin Kosek napsal(a): On 03/26/2015 02:40 PM, Standa Láznička wrote: On 3/26/2015 1:24 PM, Martin Kosek wrote: On 03/26/2015 01:08 PM, Standa Láznička wrote: On 3/26/2015 11:13 AM, Jan Cholasta wrote: Dne 25.3.2015 v 18:25 Stanislav Láznička napsal(a): On 03/25/2015

Re: [Freeipa-devel] Time-based account policies

2015-03-26 Thread Martin Kosek
On 03/26/2015 04:42 PM, Simo Sorce wrote: On Thu, 2015-03-26 at 16:39 +0100, Martin Kosek wrote: On 03/26/2015 04:30 PM, Simo Sorce wrote: On Thu, 2015-03-26 at 16:26 +0100, Jan Cholasta wrote: I think the timezone still may be with the host object but only as the UI helper as you suggest.

Re: [Freeipa-devel] Time-based account policies

2015-03-25 Thread Jan Cholasta
Dne 24.3.2015 v 18:08 Stanislav Láznička napsal(a): On 03/24/2015 08:53 AM, Jan Cholasta wrote: Dne 24.3.2015 v 08:40 Martin Kosek napsal(a): On 03/24/2015 08:20 AM, Jakub Hrozek wrote: On Tue, Mar 24, 2015 at 08:07:53AM +0100, Martin Kosek wrote: On 03/24/2015 07:16 AM, Jan Cholasta wrote:

Re: [Freeipa-devel] Time-based account policies

2015-03-25 Thread Stanislav Láznička
On 03/25/2015 12:34 PM, Alexander Bokovoy wrote: When using hbactest command you just need to supply implied time zone as an option to the command itself. After all, you are simulating rule execution so it does not matter where the value comes from. Oh, good, I haven't thought of that. That

Re: [Freeipa-devel] Time-based account policies

2015-03-25 Thread Martin Kosek
On 03/25/2015 12:09 PM, Stanislav Láznička wrote: On 03/25/2015 08:21 AM, Jan Cholasta wrote: Dne 24.3.2015 v 18:08 Stanislav Láznička napsal(a): On 03/24/2015 08:53 AM, Jan Cholasta wrote: Dne 24.3.2015 v 08:40 Martin Kosek napsal(a): On 03/24/2015 08:20 AM, Jakub Hrozek wrote: On Tue, Mar

Re: [Freeipa-devel] Time-based account policies

2015-03-25 Thread Alexander Bokovoy
On Wed, 25 Mar 2015, Stanislav Láznička wrote: On 03/25/2015 08:21 AM, Jan Cholasta wrote: Dne 24.3.2015 v 18:08 Stanislav Láznička napsal(a): On 03/24/2015 08:53 AM, Jan Cholasta wrote: Dne 24.3.2015 v 08:40 Martin Kosek napsal(a): On 03/24/2015 08:20 AM, Jakub Hrozek wrote: On Tue, Mar

Re: [Freeipa-devel] Time-based account policies

2015-03-25 Thread Stanislav Láznička
On 03/25/2015 08:21 AM, Jan Cholasta wrote: Dne 24.3.2015 v 18:08 Stanislav Láznička napsal(a): On 03/24/2015 08:53 AM, Jan Cholasta wrote: Dne 24.3.2015 v 08:40 Martin Kosek napsal(a): On 03/24/2015 08:20 AM, Jakub Hrozek wrote: On Tue, Mar 24, 2015 at 08:07:53AM +0100, Martin Kosek wrote:

Re: [Freeipa-devel] Time-based account policies

2015-03-24 Thread Stanislav Láznička
On 03/24/2015 08:53 AM, Jan Cholasta wrote: Dne 24.3.2015 v 08:40 Martin Kosek napsal(a): On 03/24/2015 08:20 AM, Jakub Hrozek wrote: On Tue, Mar 24, 2015 at 08:07:53AM +0100, Martin Kosek wrote: On 03/24/2015 07:16 AM, Jan Cholasta wrote: Dne 23.3.2015 v 20:17 Standa Láznička napsal(a):

Re: [Freeipa-devel] Time-based account policies

2015-03-24 Thread Jan Cholasta
Dne 23.3.2015 v 20:17 Standa Láznička napsal(a): On 3/23/2015 10:10 AM, Jan Cholasta wrote: Hi, Dne 20.3.2015 v 13:30 Stanislav Láznička napsal(a): ... As for the local time - timezone in the tuple (time, timezone) would only say Local Time, which can't be found in Olson's and it means the

Re: [Freeipa-devel] Time-based account policies

2015-03-24 Thread Alexander Bokovoy
On Tue, 24 Mar 2015, Jan Cholasta wrote: Dne 23.3.2015 v 20:17 Standa Láznička napsal(a): On 3/23/2015 10:10 AM, Jan Cholasta wrote: Hi, Dne 20.3.2015 v 13:30 Stanislav Láznička napsal(a): ... As for the local time - timezone in the tuple (time, timezone) would only say Local Time, which

Re: [Freeipa-devel] Time-based account policies

2015-03-24 Thread Martin Kosek
On 03/24/2015 07:16 AM, Jan Cholasta wrote: Dne 23.3.2015 v 20:17 Standa Láznička napsal(a): ... Given the above, HBAC rules could contain (time, anchor), where anchor is UTC, user local time or host local time. Truth is, it was not really clear to me from the last week's discussion whose

Re: [Freeipa-devel] Time-based account policies

2015-03-24 Thread Simo Sorce
On Tue, 2015-03-24 at 08:40 +0100, Martin Kosek wrote: On 03/24/2015 08:20 AM, Jakub Hrozek wrote: On Tue, Mar 24, 2015 at 08:07:53AM +0100, Martin Kosek wrote: On 03/24/2015 07:16 AM, Jan Cholasta wrote: Dne 23.3.2015 v 20:17 Standa Láznička napsal(a): ... Given the above, HBAC rules

Re: [Freeipa-devel] Time-based account policies

2015-03-24 Thread Petr Spacek
On 24.3.2015 08:20, Jakub Hrozek wrote: On Tue, Mar 24, 2015 at 08:07:53AM +0100, Martin Kosek wrote: On 03/24/2015 07:16 AM, Jan Cholasta wrote: Dne 23.3.2015 v 20:17 Standa Láznička napsal(a): ... Given the above, HBAC rules could contain (time, anchor), where anchor is UTC, user local

Re: [Freeipa-devel] Time-based account policies

2015-03-24 Thread Jan Cholasta
Dne 24.3.2015 v 08:40 Martin Kosek napsal(a): On 03/24/2015 08:20 AM, Jakub Hrozek wrote: On Tue, Mar 24, 2015 at 08:07:53AM +0100, Martin Kosek wrote: On 03/24/2015 07:16 AM, Jan Cholasta wrote: Dne 23.3.2015 v 20:17 Standa Láznička napsal(a): ... Given the above, HBAC rules could contain

Re: [Freeipa-devel] Time-based account policies

2015-03-24 Thread Jakub Hrozek
On Tue, Mar 24, 2015 at 08:07:53AM +0100, Martin Kosek wrote: On 03/24/2015 07:16 AM, Jan Cholasta wrote: Dne 23.3.2015 v 20:17 Standa Láznička napsal(a): ... Given the above, HBAC rules could contain (time, anchor), where anchor is UTC, user local time or host local time. Truth is, it

Re: [Freeipa-devel] Time-based account policies

2015-03-24 Thread Martin Kosek
On 03/24/2015 08:20 AM, Jakub Hrozek wrote: On Tue, Mar 24, 2015 at 08:07:53AM +0100, Martin Kosek wrote: On 03/24/2015 07:16 AM, Jan Cholasta wrote: Dne 23.3.2015 v 20:17 Standa Láznička napsal(a): ... Given the above, HBAC rules could contain (time, anchor), where anchor is UTC, user local

Re: [Freeipa-devel] Time-based account policies

2015-03-23 Thread Standa Láznička
On 3/23/2015 10:10 AM, Jan Cholasta wrote: Hi, Dne 20.3.2015 v 13:30 Stanislav Láznička napsal(a): ... As for the local time - timezone in the tuple (time, timezone) would only say Local Time, which can't be found in Olson's and it means the time record from the tuple should be compared to

Re: [Freeipa-devel] Time-based account policies

2015-03-23 Thread Jan Cholasta
Hi, Dne 20.3.2015 v 13:30 Stanislav Láznička napsal(a): Hi! I went through the last week's thread on Time-Based Policies, discussed some parts I wasn't very sure about with Martin, and would like to make a summary of it, followed by some further questions on the topic. The mail is a bit longer

Re: [Freeipa-devel] Time-based account policies

2015-03-11 Thread Alexander Bokovoy
On Tue, 10 Mar 2015, John Dennis wrote: On 03/10/2015 12:56 PM, Alexander Bokovoy wrote: See my answer to John. We don't need to end up with iCal at all since iCal doesn't have procedural definitions of holidays. It has EXDATE/RRULE allowing to express exceptions and repeating rules (EXRULE for

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Martin Kosek
On 03/10/2015 03:34 PM, Alexander Bokovoy wrote: On Tue, 10 Mar 2015, Simo Sorce wrote: On Tue, 2015-03-10 at 14:54 +0100, Martin Kosek wrote: On 03/09/2015 09:05 PM, Nathaniel McCallum wrote: On Mon, 2015-03-09 at 22:02 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Simo Sorce wrote:

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Simo Sorce
On Tue, 2015-03-10 at 14:54 +0100, Martin Kosek wrote: On 03/09/2015 09:05 PM, Nathaniel McCallum wrote: On Mon, 2015-03-09 at 22:02 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Simo Sorce wrote: ... For some tasks 'local' is the only thing that makes sense (your morning alarm

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Alexander Bokovoy
On Tue, 10 Mar 2015, Simo Sorce wrote: On Tue, 2015-03-10 at 14:54 +0100, Martin Kosek wrote: On 03/09/2015 09:05 PM, Nathaniel McCallum wrote: On Mon, 2015-03-09 at 22:02 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Simo Sorce wrote: ... For some tasks 'local' is the only thing that

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Simo Sorce
On Tue, 2015-03-10 at 15:00 +0100, Martin Kosek wrote: On 03/09/2015 07:22 PM, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Jakub Hrozek wrote: On Mon, Mar 09, 2015 at 04:08:46PM +0100, Martin Kosek wrote: On 03/09/2015 03:58 PM, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Martin

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Martin Kosek
On 03/09/2015 09:05 PM, Nathaniel McCallum wrote: On Mon, 2015-03-09 at 22:02 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Simo Sorce wrote: ... For some tasks 'local' is the only thing that makes sense (your morning alarm clock), for other things 'UTC' is the only thing that make

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Martin Kosek
On 03/09/2015 07:22 PM, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Jakub Hrozek wrote: On Mon, Mar 09, 2015 at 04:08:46PM +0100, Martin Kosek wrote: On 03/09/2015 03:58 PM, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Martin Kosek wrote: ... One of bigger issues we had was lack of

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Stanislav Láznička
On 03/10/2015 04:06 PM, Jakub Hrozek wrote: On Tue, Mar 10, 2015 at 03:47:10PM +0100, Martin Kosek wrote: This is where importing iCal is helpful because it allows you to outsource the task of creating such event to something else. Parsing event information would produce a rule definition we

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Alexander Bokovoy
On Tue, 10 Mar 2015, Martin Kosek wrote: On 03/10/2015 05:18 PM, Alexander Bokovoy wrote: On Tue, 10 Mar 2015, John Dennis wrote: On 03/10/2015 11:06 AM, Jakub Hrozek wrote: We may need to use libraries for processing iCal rules, like libical

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Martin Kosek
On 03/10/2015 05:18 PM, Alexander Bokovoy wrote: On Tue, 10 Mar 2015, John Dennis wrote: On 03/10/2015 11:06 AM, Jakub Hrozek wrote: We may need to use libraries for processing iCal rules, like libical (http://koji.fedoraproject.org/koji/buildinfo?buildID=606329)... Is that what Alexander

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Alexander Bokovoy
On Tue, 10 Mar 2015, Stanislav Láznička wrote: On 03/10/2015 04:06 PM, Jakub Hrozek wrote: On Tue, Mar 10, 2015 at 03:47:10PM +0100, Martin Kosek wrote: This is where importing iCal is helpful because it allows you to outsource the task of creating such event to something else. Parsing event

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Alexander Bokovoy
On Tue, 10 Mar 2015, Gabe Alford wrote: On Tue, Mar 10, 2015 at 9:51 AM, Stanislav Láznička s...@seznam.cz wrote: On 03/10/2015 04:06 PM, Jakub Hrozek wrote: On Tue, Mar 10, 2015 at 03:47:10PM +0100, Martin Kosek wrote: This is where importing iCal is helpful because it allows you to

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Jakub Hrozek
On Tue, Mar 10, 2015 at 03:47:10PM +0100, Martin Kosek wrote: This is where importing iCal is helpful because it allows you to outsource the task of creating such event to something else. Parsing event information would produce a rule definition we would store and SSSD would apply as

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread John Dennis
On 03/10/2015 12:13 PM, Alexander Bokovoy wrote: HBAC rule is a tuple (user|group, host|hostgroup, service|servicegroup). This tuple would get extension representing time/date information in a multivalued attribute that would describe all time/date intervals applicable to this rule. I must be

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Alexander Bokovoy
On Tue, 10 Mar 2015, John Dennis wrote: On 03/10/2015 12:13 PM, Alexander Bokovoy wrote: HBAC rule is a tuple (user|group, host|hostgroup, service|servicegroup). This tuple would get extension representing time/date information in a multivalued attribute that would describe all time/date

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Alexander Bokovoy
On Tue, 10 Mar 2015, Martin Kosek wrote: On 03/10/2015 03:34 PM, Alexander Bokovoy wrote: On Tue, 10 Mar 2015, Simo Sorce wrote: On Tue, 2015-03-10 at 14:54 +0100, Martin Kosek wrote: On 03/09/2015 09:05 PM, Nathaniel McCallum wrote: On Mon, 2015-03-09 at 22:02 +0200, Alexander Bokovoy

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Gabe Alford
On Tue, Mar 10, 2015 at 9:51 AM, Stanislav Láznička s...@seznam.cz wrote: On 03/10/2015 04:06 PM, Jakub Hrozek wrote: On Tue, Mar 10, 2015 at 03:47:10PM +0100, Martin Kosek wrote: This is where importing iCal is helpful because it allows you to outsource the task of creating such event to

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread Alexander Bokovoy
On Tue, 10 Mar 2015, John Dennis wrote: On 03/10/2015 11:06 AM, Jakub Hrozek wrote: We may need to use libraries for processing iCal rules, like libical (http://koji.fedoraproject.org/koji/buildinfo?buildID=606329)... Is that what Alexander said, though? In his reply, I see: Parsing event

Re: [Freeipa-devel] Time-based account policies

2015-03-10 Thread John Dennis
On 03/10/2015 12:56 PM, Alexander Bokovoy wrote: See my answer to John. We don't need to end up with iCal at all since iCal doesn't have procedural definitions of holidays. It has EXDATE/RRULE allowing to express exceptions and repeating rules (EXRULE for exception rules was removed in RFC5545

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Nathaniel McCallum
On Mon, 2015-03-09 at 08:00 +0100, Stanislav Láznička wrote: Hi! My name is Stanislav Laznicka and I am a student at Brno University of Technology. As a part of my Master's thesis, I am supposed to design and implement time-based account policies extensions for FreeIPA and SSSD.

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Alexander Bokovoy
On Mon, 09 Mar 2015, Martin Kosek wrote: On 03/09/2015 02:02 PM, Nathaniel McCallum wrote: On Mon, 2015-03-09 at 08:00 +0100, Stanislav Láznička wrote: Hi! My name is Stanislav Laznicka and I am a student at Brno University of Technology. As a part of my Master's thesis, I am supposed to

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Martin Kosek
On 03/09/2015 02:02 PM, Nathaniel McCallum wrote: On Mon, 2015-03-09 at 08:00 +0100, Stanislav Láznička wrote: Hi! My name is Stanislav Laznicka and I am a student at Brno University of Technology. As a part of my Master's thesis, I am supposed to design and implement time-based account

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Alexander Bokovoy
On Mon, 09 Mar 2015, Martin Kosek wrote: On 03/09/2015 03:58 PM, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Martin Kosek wrote: ... One of bigger issues we had was lack of versatile ical format parser to handle calendar-like specification of events -- we need to allow importing these ones

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Martin Kosek
On 03/09/2015 03:58 PM, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Martin Kosek wrote: ... One of bigger issues we had was lack of versatile ical format parser to handle calendar-like specification of events -- we need to allow importing these ones instead of inventing our own. Good point.

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Alexander Bokovoy
On Mon, 09 Mar 2015, Jakub Hrozek wrote: On Mon, Mar 09, 2015 at 04:08:46PM +0100, Martin Kosek wrote: On 03/09/2015 03:58 PM, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Martin Kosek wrote: ... One of bigger issues we had was lack of versatile ical format parser to handle calendar-like

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Simo Sorce
On Mon, 2015-03-09 at 16:17 -0400, John Dennis wrote: On 03/09/2015 03:45 PM, Simo Sorce wrote: We've been through this a few times already, it just doesn't work. At a minimum you need to be able to select between UTC and Local Time and it is a rathole down there (What time is it *here* may

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Simo Sorce
On Mon, 2015-03-09 at 20:55 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Nathaniel McCallum wrote: On Mon, 2015-03-09 at 20:22 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Jakub Hrozek wrote: On Mon, Mar 09, 2015 at 04:08:46PM +0100, Martin Kosek wrote: On 03/09/2015

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Simo Sorce
On Mon, 2015-03-09 at 18:13 +0100, Jakub Hrozek wrote: On Mon, Mar 09, 2015 at 04:08:46PM +0100, Martin Kosek wrote: On 03/09/2015 03:58 PM, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Martin Kosek wrote: ... One of bigger issues we had was lack of versatile ical format parser to

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Nathaniel McCallum
On Mon, 2015-03-09 at 22:02 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Simo Sorce wrote: On Mon, 2015-03-09 at 20:55 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Nathaniel McCallum wrote: On Mon, 2015-03-09 at 20:22 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread John Dennis
On 03/09/2015 03:45 PM, Simo Sorce wrote: We've been through this a few times already, it just doesn't work. At a minimum you need to be able to select between UTC and Local Time and it is a rathole down there (What time is it *here* may be a hard question to answer :-/) O.K. I'll bite,

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Nathaniel McCallum
On Mon, 2015-03-09 at 20:22 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Jakub Hrozek wrote: On Mon, Mar 09, 2015 at 04:08:46PM +0100, Martin Kosek wrote: On 03/09/2015 03:58 PM, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Martin Kosek wrote: ... One of bigger issues we

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Alexander Bokovoy
On Mon, 09 Mar 2015, Nathaniel McCallum wrote: On Mon, 2015-03-09 at 20:22 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Jakub Hrozek wrote: On Mon, Mar 09, 2015 at 04:08:46PM +0100, Martin Kosek wrote: On 03/09/2015 03:58 PM, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Martin

Re: [Freeipa-devel] Time-based account policies

2015-03-09 Thread Alexander Bokovoy
On Mon, 09 Mar 2015, Simo Sorce wrote: On Mon, 2015-03-09 at 20:55 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Nathaniel McCallum wrote: On Mon, 2015-03-09 at 20:22 +0200, Alexander Bokovoy wrote: On Mon, 09 Mar 2015, Jakub Hrozek wrote: On Mon, Mar 09, 2015 at 04:08:46PM +0100,