[Freeipa-devel] [freeipa PR#640][opened] Master replica dl0

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/640
Author: stlaz
Title: #640: Master replica dl0
Action: opened

PR body:
"""
This patchset removes the ability of setting pkinit options on domain level 0 for server/replica installs. Also fixes a usability issue with `--no-pkinit` I noticed and did not care creating ticket for.
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/640/head:pr640
git checkout pr640

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/640
Author: stlaz
Title: #640: Remove pkinit options from master/replica on DL0
Action: edited

Changed field: title
Original value:
"""
Master replica dl0
"""

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/640
Author: stlaz
Title: #640: Remove pkinit options from master/replica on DL0
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/640/head:pr640
git checkout pr640

[martbab]

URL: https://github.com/freeipa/freeipa/pull/640
Title: #640: Remove pkinit options from master/replica on DL0

martbab commented:
"""
@abbra I believe these changes are in line with our recent discussion regarding pkinit availability on DL0. Do you agree?
"""

See the full comment at https://github.com/freeipa/freeipa/pull/640#issuecomment-289033452

[abbra]

URL: https://github.com/freeipa/freeipa/pull/640
Title: #640: Remove pkinit options from master/replica on DL0

abbra commented:
"""
Good question. I think we should remove all mentioning of PKINIT options for DL0 and explicitly configure local CA there. On DL1 we already require to provide pkinit cert for CA-less setup. However, there we should treat --no-pkinit as use of local CA (certmonger's one).
"""

See the full comment at https://github.com/freeipa/freeipa/pull/640#issuecomment-289041029

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/640
Title: #640: Remove pkinit options from master/replica on DL0

MartinBasti commented:
"""
```
ipa-replica-install --no-pkinit (as negative test without master installed)

2017-03-27T17:04:09Z DEBUG Logging to /var/log/ipareplica-install.log
2017-03-27T17:04:09Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 314, in run
cfgr = transformed_cls(**kwargs)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 102, in __init__
**kwargs)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 602, in __init__
super(ServerReplicaInstall, self).__init__(**kwargs)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 338, in __init__
if self.domain_level == constants.DOMAIN_LEVEL_0:
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 611, in __getattr__
raise AttributeError(name)

2017-03-27T17:04:09Z DEBUG The ipa-replica-install command failed, exception: AttributeError: domain_level

```
"""

See the full comment at https://github.com/freeipa/freeipa/pull/640#issuecomment-289517964

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/640
Title: #640: Remove pkinit options from master/replica on DL0

stlaz commented:
"""
Ah, right, replica does not have `domain_level` option 🙄
"""

See the full comment at https://github.com/freeipa/freeipa/pull/640#issuecomment-289684664

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/640
Title: #640: Remove pkinit options from master/replica on DL0

MartinBasti commented:
"""
With this PR applied I cannot use webUI with DL0
"""

See the full comment at https://github.com/freeipa/freeipa/pull/640#issuecomment-289721101

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/640
Author: stlaz
Title: #640: Remove pkinit options from master/replica on DL0
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/640/head:pr640
git checkout pr640

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/640
Title: #640: Remove pkinit options from master/replica on DL0

stlaz commented:
"""
@MartinBasti Even though this commit basically breaks the behavior, it's not in its scope to fix it, it's somehow intended to break it, actually. It will be fixed elsewhere.

I fixed the issue with running this on replica and removed one redundant check as well.

I also noticed that DL0 replica has a usability issue where it checks for either `*-cert-file` option and requires them all, once it has it, it will say that these options can't be used with replica file. I will not fix that here, though.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/640#issuecomment-290005415

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/640
Title: #640: Remove pkinit options from master/replica on DL0

stlaz commented:
"""
@MartinBasti Even though this commit basically breaks the behavior, it's not in its scope to fix it, it's somehow intended to break it, actually. It will be fixed elsewhere.

I fixed the issue with running this on replica and removed one redundant check as well.

I also noticed that DL0 replica has a usability issue where it checks for either `*-cert-file` option and requires them all, once it has it, it will say that these options can't be used with replica file. I will not fix that here, though.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/640#issuecomment-290005415

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/640
Author: stlaz
Title: #640: Remove pkinit options from master/replica on DL0
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/640/head:pr640
git checkout pr640

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/640
Title: #640: Remove pkinit options from master/replica on DL0

stlaz commented:
"""
Pushed a cleaner version of the previous changes, thanks @HonzaCholasta for the suggestion.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/640#issuecomment-290012934

[martbab]

URL: https://github.com/freeipa/freeipa/pull/640
Title: #640: Remove pkinit options from master/replica on DL0

martbab commented:
"""
@MartinBasti WebUI not working in DL0/--no-pkinit is beyond the scope of this PR. I am working on fixing that in a separate PR.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/640#issuecomment-290052050

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/640
Title: #640: Remove pkinit options from master/replica on DL0

MartinBasti commented:
"""
master:

* 6cda1509a68d7a21578280d381a6b9e994fd4f49 Fix the order of cert-files check
* 9e3ae785ac9b62b8e0809a4aa56363c458316135 Don't allow setting pkinit-related options on DL0
* 8af884d0489d5d57895959d27ca6eb8815c6c922 replica-prepare man: remove pkinit option refs
* fe7cf1e854b7dc28861455011091df3cbe45abe9 Remove redundant option check for cert files


ipa-4-5:

* 497e766427b3ced865ff88a51cd0c2c96e8b24f9 Fix the order of cert-files check
* a1ad1ffa3540da4b5d5c1963b3818d9c9260e1a2 Don't allow setting pkinit-related options on DL0
* 85720b6bdc764b98dd471799ccc1045e1379709e replica-prepare man: remove pkinit option refs
* 8f7b6c349f4e81e88ef36f014e26de6b1f3f3e41 Remove redundant option check for cert files


"""

See the full comment at https://github.com/freeipa/freeipa/pull/640#issuecomment-290414140

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/640
Title: #640: Remove pkinit options from master/replica on DL0

Label: +ack

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/640
Title: #640: Remove pkinit options from master/replica on DL0

Label: +pushed

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/640
Author: stlaz
Title: #640: Remove pkinit options from master/replica on DL0
Action: closed

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/640/head:pr640
git checkout pr640