On Mon, Aug 22, 2016 at 07:35:07AM +0200, Jan Cholasta wrote:
On 22.8.2016 01:58, Fraser Tweedale wrote:
> On Fri, Aug 19, 2016 at 10:00:06AM -0400, Nalin Dahyabhai wrote:
> > On Fri, Aug 19, 2016 at 04:15:27PM +1000, Fraser Tweedale wrote:
> > > On Fri, Aug 19, 2016 at 07:50:45AM +0200, Jan Cholasta wrote:
> > > > Hi Fraser,
> > > >
> > > > On 18.8.2016 13:33, Fraser Tweedale wrote:
> > > > > The attached patch fixes the argument name certmonger uses to
> > > > > indicate a particular issuer when requesting a cert from IPA.
> > > >
> > > > if issuer is specified and the IPA server does not support the
'cacn'
> > > > option, shouldn't the request fail rather than be retried without
the
> > > > option?
> > > >
> > > IMO yes. The "profile" option code does the same thing, and I
> > > followed this pattern. IMO neither should be retried in the current
> > > fashion.
> > >
> > > Nalin, is there an important reason it's done this way? If not, we
> > > should change code to not retry without profile or cacn option.
> >
> > The client doesn't have a way to enforce that the server is going to be
> > new enough to understand the option. The alternative is to accept the
> > failure, wait for the client user to notice that it's failed, and make
> > them guess which flag they shouldn't have used because the server
isn't
> > new enough to understand it.
> >
> > Personally, I think that's a rough user experience.
> >
> > Nalin
> >
> It is rough, but IMO getting a cert with a profile you didn't ask
> for, or especially from the issuer you didn't ask for, is just as
> bad or perhaps worse, and may cause higher support load support load
> than failing with a message explaining that server didn't understand
> the option.
+1, IMO it's preferrable to fail rather than to silently do the wrong thing.
OK, I filed this as a separate ticket:
https://fedorahosted.org/certmonger/ticket/56
Let's at least push this uncontroversial change through :)
Cheers,
Fraser