<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 05/27/2014 03:10 PM, Simo Sorce
wrote:<br>
</div>
<blockquote
cite="mid:1401196223.7561.187.camel@willson.li.ssimo.org"
type="cite">
<pre wrap="">On Tue, 2014-05-27 at 14:59 +0200, thierry bordaz wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Now if an entry was not created by FreeIPA CLI ('ipa user-add
--stage') it could be impossible to update/unstage the entry with
FreeIPA CLI .
For example with those two entries. 'ipa user-mod TestUser --stage' or
'ipa user-unstage TestUser' are unable to select the correct entry
</pre>
</blockquote>
<pre wrap="">Keep in mind that use case #1 for the staging are is "non-freeipa"
provisioning systems. So it is pretty much granted in the large majority
of cases entries will not be created by freeipa tools, which is why I
also do not want to "move" them, but only use them as templates for
actual user creation.
Simo.
</pre>
</blockquote>
<font face="Times New Roman, Times, serif">Ok. Good to know, I was
thinking 'non-freeipa' provisioning to be a corner case and I was
wrong it is the common case.<br>
<br>
Now to make a user active, 'ipa user-unstage tuser' will be the
unique way.<br>
To be able to select the appropriate entry, I think we need to
limit the RDN attribute to 'uid'. </font><br>
</body>
</html>