Re: [Freeipa-users] Certificate profiles and CA ACLs for service principals

2016-03-23 Thread Fraser Tweedale
On Wed, Mar 23, 2016 at 04:37:43PM +1100, a.fed...@earsdown.com wrote: > Some excellent points, and thank you for being open to having the > conversation - I know you don't have to, and it is appreciated. > > > Profiles which are allowed for a host principal (representing > > physical or virtual

Re: [Freeipa-users] Certificate profiles and CA ACLs for service principals

2016-03-23 Thread a . fedora
Some excellent points, and thank you for being open to having the conversation - I know you don't have to, and it is appreciated. > Profiles which are allowed for a host principal (representing > physical or virtual machines) are not necessarily the same profiles > that should be used for

Re: [Freeipa-users] Certificate profiles and CA ACLs for service principals

2016-03-22 Thread earsdown
Hi Fraser, Martin and Alexander, Thanks for looking into this! For what it's worth, I think for this particular use case, I'm leaning more towards Alexander when he said: I don't think you need to group services this way. For managing services, and this means being able to issue

Re: [Freeipa-users] Certificate profiles and CA ACLs for service principals

2016-03-22 Thread Fraser Tweedale
On Tue, Mar 22, 2016 at 09:59:58AM +0100, Martin Kosek wrote: > On 03/22/2016 05:55 AM, Fraser Tweedale wrote: > > On Fri, Mar 18, 2016 at 08:12:44PM +1100, earsdown wrote: > ... > > To my fellow FreeIPA developers: are service groups a sensible RFE? > > Is there a reason why they have not been

Re: [Freeipa-users] Certificate profiles and CA ACLs for service principals

2016-03-22 Thread Martin Kosek
On 03/22/2016 05:55 AM, Fraser Tweedale wrote: > On Fri, Mar 18, 2016 at 08:12:44PM +1100, earsdown wrote: ... > To my fellow FreeIPA developers: are service groups a sensible RFE? > Is there a reason why they have not been implemented? It *is* sensible RFE and it was actually already filed!

Re: [Freeipa-users] Certificate profiles and CA ACLs for service principals

2016-03-21 Thread Alexander Bokovoy
On Tue, 22 Mar 2016, Fraser Tweedale wrote: On Fri, Mar 18, 2016 at 08:12:44PM +1100, earsdown wrote: Hi all, Firstly, a big thank you to everyone who works on the FreeIPA project - you guys are my heroes. Let's talk about the new Certificate Profile and CA ACL feature and some use cases that