September 2017 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#1117][opened] Testing ipatests with py3 and new template
by felipevolpone 02 Oct '17

02 Oct '17

URL: https://github.com/freeipa/freeipa/pull/1117 Author: felipevolpone Title: #1117: Testing ipatests with py3 and new template Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1117/head:pr1117 git checkout pr1117

1 1

[freeipa PR#894][opened] Fixing ipa-replica-install --setup-kra if it's the first KRA in topology
by felipevolpone 02 Oct '17

02 Oct '17

URL: https://github.com/freeipa/freeipa/pull/894 Author: felipevolpone Title: #894: Fixing ipa-replica-install --setup-kra if it's the first KRA in topology Action: opened PR body: """ I'm trying to fix the ticket, but I'm not quite sure of how to do it. Until now, I removed the exception and called the api in kra to install it. However, I'm getting an exception: ``` bash-4.3$ sudo python /usr/sbin/ipa-replica-install -r DOM-116.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM --setup-kra --setup-ca WARNING: conflicting time&date synchronization service 'chronyd' will be disabled in favor of ntpd IPA client is already configured on this system, ignoring the --domain, --server, --realm, --hostname, --password and --keytab options. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR Timed out trying to obtain keys. ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information ``` from /var/log/ipareplica-install.log ``` 2017-06-23T18:38:44Z DEBUG stderr= 2017-06-23T18:38:44Z DEBUG Destroyed connection context.ldap2_140135237350736 2017-06-23T18:38:44Z DEBUG Created connection context.ldap2_140135237350736 2017-06-23T18:38:44Z DEBUG raw: hostgroup_show(u'ipaservers', rights=True, all=True, version=u'2.228') 2017-06-23T18:38:44Z DEBUG hostgroup_show(u'ipaservers', rights=True, all=True, raw=False, version=u'2.228', no_members=False) 2017-06-23T18:38:44Z DEBUG flushing ldaps://vm-116.abc.idm.lab.eng.brq.redhat.com from SchemaCache 2017-06-23T18:38:44Z DEBUG retrieving schema for SchemaCache url=ldaps://vm-116.abc.idm.lab.eng.brq.redhat.com conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f73c6769f38> 2017-06-23T18:38:44Z DEBUG Destroyed connection context.ldap2_140135237350736 2017-06-23T18:38:44Z DEBUG Created connection context.ldap2_140135237350736 2017-06-23T18:38:44Z DEBUG flushing ldaps://vm-116.abc.idm.lab.eng.brq.redhat.com from SchemaCache 2017-06-23T18:38:44Z DEBUG retrieving schema for SchemaCache url=ldaps://vm-116.abc.idm.lab.eng.brq.redhat.com conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f73c6769c20> 2017-06-23T18:38:44Z DEBUG No IPA DNS servers, skipping forward/reverse resolution check 2017-06-23T18:38:44Z DEBUG Initializing principal host/vm-058-064.abc.idm.lab.eng.brq.redhat.com(a)DOM-116.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM using keytab /etc/krb5.keytab 2017-06-23T18:38:44Z DEBUG using ccache /tmp/krbcc9omA2g/ccache 2017-06-23T18:38:44Z DEBUG Attempt 1/1: success 2017-06-23T18:38:44Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-06-23T18:38:44Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2017-06-23T18:38:44Z INFO Waiting up to 300 seconds to see our keys appear on host: None 2017-06-23T18:38:45Z DEBUG Transient error getting keys: '{'desc': "Can't contact LDAP server"}' 2017-06-23T18:43:45Z DEBUG Destroyed connection context.ldap2_140135237350736 2017-06-23T18:43:45Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 333, in run cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 366, in run self.validate() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 375, in validate for _nothing in self._validator(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 636, in _configure next(validator) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install for _nothing in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 613, in main replica_promote_check(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 386, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 408, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1270, in promote_check raise ScriptError(e) 2017-06-23T18:43:45Z DEBUG The ipa-replica-install command failed, exception: ScriptError: Timed out trying to obtain keys. 2017-06-23T18:43:45Z ERROR Timed out trying to obtain keys. 2017-06-23T18:43:45Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information ``` There is a high chance that I'm getting the wrong path here, so if there is someone able to help me (pointing to some docs or explaining more details of it), it would be great. Ticket https://pagure.io/freeipa/issue/7008 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/894/head:pr894 git checkout pr894

2 1

[freeipa PR#937][opened] Configuring log handlers during the input parameters validation phase
by felipevolpone 02 Oct '17

02 Oct '17

URL: https://github.com/freeipa/freeipa/pull/937 Author: felipevolpone Title: #937: Configuring log handlers during the input parameters validation phase Action: opened PR body: """ Previously, a log handler would be configured only after all the input parameters be validated, as can be checked in `ipapython/admintool.py::AdminTool::main`. So, any call to `logger.[warning,info,error,debug]`, during that phase, doesn't work and it also raises an exception. Now, log handlers are setup before the input parameters validation phase. Fixes: https://pagure.io/freeipa/issue/7071 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/937/head:pr937 git checkout pr937

2 1

[freeipa PR#1053][opened] test_external_ca: switch to python-cryptography
by Rezney 27 Sep '17

27 Sep '17

URL: https://github.com/freeipa/freeipa/pull/1053 Author: Rezney Title: #1053: test_external_ca: switch to python-cryptography Action: opened PR body: """ Switch external CA generation from certutil to python-cryptography as this way of handling the certificates should be more readable, maintainable and extendable (e.g. extensions handling). Also as external CA is now a separate module we can import it and use elsewhere. E.g. add ca-less to ca-external-full... """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1053/head:pr1053 git checkout pr1053

2 1

Revisit ipaplatform proposal
by Rob Crittenden 25 Sep '17

25 Sep '17

TL;DR Should ipaplatform be dynamic or fixed at build time? Last November a ticket was proposed to change the platform detection from being done at build time (via autoconf) to runtime in ticket https://pagure.io/freeipa/issue/6474 This was inspired somewhat by http://www.freeipa.org/page/V4/Integration_Improvements This consisted of two main proposals: 1. Let one specify the location of the IPA configuration so that clients not enrolled via ipa-client-install can still work (e.g. you can use it completely as non-root). 2. Make ipaplatform dynamically detect the underlying OS for use in PyPi. Discussion on this proposal happened in thread https://www.redhat.com/archives/freeipa-devel/2016-November/msg00391.html Discussion continued in the PR, https://www.redhat.com/archives/freeipa-devel/2016-November/msg00887.html From my reading no firm decision (beyond pushing the code) was made except that there was resistance to both of these proposals. The relevant part for now is ipaplatform. Moving around a bunch of code ended up being quite disruptive internally and wasn't ultimately completely successful, see https://github.com/freeipa/freeipa/pull/1036 The boat has sailed on moving the code around but the moves were disruptive to anything that was using ipalib (another discussion altogether is the supportabilty/stability of ipalib). What we're left with is that the PyPi build is currently broken and has been for several weeks. The current proposed fix is to duplicate values which while undesirable generally is a quick and dirty way to get PyPi working. Felipe agreed to update his PR to use a _ prefix to indicate the constants are for internal-use only. This should buy us time to work on a more complete solution. So to me the question is dynamic vs build-time detection of the underlying OS. If one lives in the world of only OS-distributed packages then build-time detection makes perfect sense and leaves no room for error on deployed systems. PyPi is another story though. The PyPi version doesn't ship ipaplatform at all which makes PyPi a bit of a second-class citizen. This could impact future systems like ansible that might want to deploy from PyPi, and tox which often installs its own dependencies during testing. PyPi also lets one easily install different versions of packages in different virtual environments for expanded testing without requiring root. IMHO something needs to change. Felipe's PR has the feeling of the first of a thousand cuts. I'm in favor of runtime detection with extreme, if not ridiculous logging. The major downside of runtime detection, which wasn't discussed previously, is opaqueness: you can't tell why things are behaving as they are because the runtime choice was opaque. With copious debug-level logging I think this would be a moot point. Bugs may still occur with detection but they will hopefully be painfully obvious and easily fixable. The main opposition to runtime dependency seemed to me to be related to handling failures gracefully. I think a hard stop with tons of output is sufficient to handle this case. All major distros already do a lot of testing pre-release which would catch any issues. There remains some risk for bleeding-edge releases that could make changes post-release. If /etc/os-release goes away then this would have to be dealt with in the installer anyway, the impact will just be broader (and therefore likely fixed faster). It may be worthwhile to collect /etc/os-release from as many Linux distros as possible to ensure the best level of compatibility. A final else "Your distro is not supported" will handle things we have not encountered yet, or targeted (e.g. win32, Solaris, etc). Support for these could be contributed. rob

1 0

Self Introduction: Brian Gribble
by Brian Gribble 25 Sep '17

25 Sep '17

Good morning, My name is Brian Gribble and I am a Consultant at Red Hat. I would like to contribute to the FreeIPA project by testing and helping with documentation (wiki edits, etc). The testing part is self-explanatory but I would like to know what I need to do to help with wiki edits. I am following the guidelines from the "Contribute" wiki page. I hope it's up to date. My IRC nick is brian83. Thanks, Brian -- Brian Gribble Platform Consultant Red Hat Consulting <https://www.redhat.com> bgribble(a)redhat.com <https://red.ht/sig>

2 2

[freeipa PR#1112][opened] ipatests: use python3 if built with python3
by stlaz 25 Sep '17

25 Sep '17

URL: https://github.com/freeipa/freeipa/pull/1112 Author: stlaz Title: #1112: ipatests: use python3 if built with python3 Action: opened PR body: """ Change the default python version for test scripts https://pagure.io/freeipa/issue/7131 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1112/head:pr1112 git checkout pr1112

1 0

[freeipa PR#1111][opened] ipalib.x509 autumn cleanup
by stlaz 25 Sep '17

25 Sep '17

URL: https://github.com/freeipa/freeipa/pull/1111 Author: stlaz Title: #1111: ipalib.x509 autumn cleanup Action: opened PR body: """ This is a cleanup of the x509 module which removes an ugly hack that prevents a circular dependency and the `strip_header()` function which is properly replaced by the `load_unknown_x509_certificate()` function where needed. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1111/head:pr1111 git checkout pr1111

1 0

[freeipa PR#1057][opened] py3: fix ipa cert-request --database ...
by flo-renaud 25 Sep '17

25 Sep '17

URL: https://github.com/freeipa/freeipa/pull/1057 Author: flo-renaud Title: #1057: py3: fix ipa cert-request --database ... Action: opened PR body: """ Fix bytes vs str issues in ipa cert-request https://pagure.io/freeipa/issue/7148 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1057/head:pr1057 git checkout pr1057

2 1

[freeipa PR#1110][opened] csrgen: Introduce CertificateSigningRequest parameter
by stlaz 25 Sep '17

25 Sep '17

URL: https://github.com/freeipa/freeipa/pull/1110 Author: stlaz Title: #1110: csrgen: Introduce CertificateSigningRequest parameter Action: opened PR body: """ This pull request tries to introduce a new parameter for CSRs so that these are handled properly in Python 3 and are backward-compatible with the older API which will try to send strings to the server. **NOTE**: tests for the new parameter are currently not included, it's here for the sole purpose of a review of the code and should not be pushed until the tests arrive. - [x] do the code - [ ] do the tests ----------------------- This PR includes code @flo-renaud's fix from https://github.com/freeipa/freeipa/pull/1057 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1110/head:pr1110 git checkout pr1110

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel September 2017