On Fri, Aug 19, 2016 at 04:15:27PM +1000, Fraser Tweedale wrote:
On Fri, Aug 19, 2016 at 07:50:45AM +0200, Jan Cholasta wrote:
> Hi Fraser,
>
> On 18.8.2016 13:33, Fraser Tweedale wrote:
> > The attached patch fixes the argument name certmonger uses to
> > indicate a particular issuer when requesting a cert from IPA.
>
> if issuer is specified and the IPA server does not support the 'cacn'
> option, shouldn't the request fail rather than be retried without the
> option?
>
IMO yes. The "profile" option code does the same thing, and I
followed this pattern. IMO neither should be retried in the current
fashion.
Nalin, is there an important reason it's done this way? If not, we
should change code to not retry without profile or cacn option.
The client doesn't have a way to enforce that the server is going to be
new enough to understand the option. The alternative is to accept the
failure, wait for the client user to notice that it's failed, and make
them guess which flag they shouldn't have used because the server isn't
new enough to understand it.
Personally, I think that's a rough user experience.
Nalin