On 22.8.2016 01:58, Fraser Tweedale wrote:
On Fri, Aug 19, 2016 at 10:00:06AM -0400, Nalin Dahyabhai wrote:
> On Fri, Aug 19, 2016 at 04:15:27PM +1000, Fraser Tweedale wrote:
>> On Fri, Aug 19, 2016 at 07:50:45AM +0200, Jan Cholasta wrote:
>>> Hi Fraser,
>>>
>>> On 18.8.2016 13:33, Fraser Tweedale wrote:
>>>> The attached patch fixes the argument name certmonger uses to
>>>> indicate a particular issuer when requesting a cert from IPA.
>>>
>>> if issuer is specified and the IPA server does not support the
'cacn'
>>> option, shouldn't the request fail rather than be retried without the
>>> option?
>>>
>> IMO yes. The "profile" option code does the same thing, and I
>> followed this pattern. IMO neither should be retried in the current
>> fashion.
>>
>> Nalin, is there an important reason it's done this way? If not, we
>> should change code to not retry without profile or cacn option.
>
> The client doesn't have a way to enforce that the server is going to be
> new enough to understand the option. The alternative is to accept the
> failure, wait for the client user to notice that it's failed, and make
> them guess which flag they shouldn't have used because the server isn't
> new enough to understand it.
>
> Personally, I think that's a rough user experience.
>
> Nalin
>
It is rough, but IMO getting a cert with a profile you didn't ask
for, or especially from the issuer you didn't ask for, is just as
bad or perhaps worse, and may cause higher support load support load
than failing with a message explaining that server didn't understand
the option.
+1, IMO it's preferrable to fail rather than to silently do the wrong thing.
--
Jan Cholasta