On Mon, Aug 22, 2016 at 07:35:07AM +0200, Jan Cholasta wrote:
> On 22.8.2016 01:58, Fraser Tweedale wrote:
>> On Fri, Aug 19, 2016 at 10:00:06AM -0400, Nalin Dahyabhai wrote:
>>> On Fri, Aug 19, 2016 at 04:15:27PM +1000, Fraser Tweedale wrote:
>>>> On Fri, Aug 19, 2016 at 07:50:45AM +0200, Jan Cholasta wrote:
>>>>> Hi Fraser,
>>>>>
>>>>> On 18.8.2016 13:33, Fraser Tweedale wrote:
>>>>>> The attached patch fixes the argument name certmonger uses to
>>>>>> indicate a particular issuer when requesting a cert from IPA.
>>>>>
>>>>> if issuer is specified and the IPA server does not support the
'cacn'
>>>>> option, shouldn't the request fail rather than be retried without
the
>>>>> option?
>>>>>
>>>> IMO yes. The "profile" option code does the same thing, and I
>>>> followed this pattern. IMO neither should be retried in the current
>>>> fashion.
>>>>
>>>> Nalin, is there an important reason it's done this way? If not, we
>>>> should change code to not retry without profile or cacn option.
>>>
>>> The client doesn't have a way to enforce that the server is going to be
>>> new enough to understand the option. The alternative is to accept the
>>> failure, wait for the client user to notice that it's failed, and make
>>> them guess which flag they shouldn't have used because the server
isn't
>>> new enough to understand it.
>>>
>>> Personally, I think that's a rough user experience.
>>>
>>> Nalin
>>>
>> It is rough, but IMO getting a cert with a profile you didn't ask
>> for, or especially from the issuer you didn't ask for, is just as
>> bad or perhaps worse, and may cause higher support load support load
>> than failing with a message explaining that server didn't understand
>> the option.
>
> +1, IMO it's preferrable to fail rather than to silently do the wrong thing.
>
OK, I filed this as a separate ticket:
https://fedorahosted.org/certmonger/ticket/56
Let's at least push this uncontroversial change through :)