<html> <head> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 08/20/2015 05:21 PM, Martin Basti wrote: </div> <blockquote cite="mid:55D5F086.7090202@redhat.com" type="cite"> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> <div class="moz-cite-prefix">On 08/20/2015 11:27 AM, Jan Cholasta wrote: </div> <blockquote cite="mid:55D59D9B.3060409@redhat.com" type="cite">On 19.8.2015 10:57, Jan Cholasta wrote: <blockquote type="cite">On 19.8.2015 10:47, thierry bordaz wrote: <blockquote type="cite">On 08/19/2015 10:34 AM, Jan Cholasta wrote: <blockquote type="cite">On 19.8.2015 09:39, thierry bordaz wrote: <blockquote type="cite">Hi, It worked like a charm. I had a problem to commit it because of the VERSION stuff that changed. Except that (changing VERSION), the fix looks good to me thanks thierry On 08/18/2015 07:21 PM, Martin Basti wrote: <blockquote type="cite">Thank you for the patch, I checked it, I just changed permission name to have all first letters in uppercase as others. Updated merged patch attached. On 08/18/2015 05:34 PM, thierry bordaz wrote: <blockquote type="cite">On 08/18/2015 04:13 PM, thierry bordaz wrote: <blockquote type="cite">On 08/18/2015 04:04 PM, Martin Basti wrote: <blockquote type="cite"> On 08/18/2015 03:49 PM, thierry bordaz wrote: <blockquote type="cite">On 08/18/2015 03:06 PM, Martin Basti wrote: <blockquote type="cite"> On 08/18/2015 11:32 AM, thierry bordaz wrote: <blockquote type="cite">On 08/18/2015 10:02 AM, Martin Basti wrote: <blockquote type="cite"> On 08/18/2015 09:59 AM, thierry bordaz wrote: <blockquote type="cite">On 08/18/2015 09:55 AM, Martin Basti wrote: <blockquote type="cite"> On 08/18/2015 09:50 AM, thierry bordaz wrote: <blockquote type="cite">On 08/17/2015 08:33 PM, Martin Basti wrote: <blockquote type="cite">Hello, the 'user-stage' command replaces 'stageuser-add --from-delete' command. <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/5041">https://fedorahosted.org/freeipa/ticket/5041</a> Thierry can you check If I don't break everything, it works for me, but the one never knows. Honza can you please check the framework side? I use self.api.Object.stageuser.add.* in user command, I'm not sure if this is right way, but it works. Patch attached. I created it in hurry, I'm expecting NACK :D Just question at the end: should I implement way Active user -> stageuser? IMHO it would be implemented internally by calling 'user-del --preserve' inside 'user-stage'. </blockquote> Hi Martin, There is a small failure with VERSION (edewata pushed his patch first ;-) ) �� git apply -v /tmp/freeipa-mbasti-0297-Add-user-stage-command.patch �� Checking patch API.txt... �� Checking patch VERSION... �� error: while searching for: �� # # ######################################################## �� IPA_API_VERSION_MAJOR=2 �� IPA_API_VERSION_MINOR=148 �� # Last change: ftweedal - add --out option to user-show �� error: patch failed: VERSION:90 �� error: VERSION: patch does not apply �� Checking patch ipalib/plugins/stageuser.py... �� Checking patch ipalib/plugins/user.py... </blockquote> There is many pending patches that may change VERSION number, I will change it to right one before push. Does code looks good for you? </blockquote> Hi Martin, Just a question, there is no additional permission. Did you test being 'admin' ? thanks theirry </blockquote> No I didn't,. I preserver all permission, the original permissions should work. Martin </blockquote> Hi Martin, Running a test script, I have an issue with �� ipa stageuser-add --first=t --last=b tb1 �� ipa: ERROR: an internal error has occurred �� [Tue Aug 18 11:16:56.440658 2015] [wsgi:error] [pid 10486] �� ipa: INFO: [jsonserver_kerb] �� <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:stageadm@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM">stageadm@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM</a>: �� stageuser_add(u'tb1', givenname=u't', sn=u'b', cn=u't b', �� displayname=u't b', initials=u'tb', gecos=u't b', krbprincipalname=u'<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:tb1@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM">tb1@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM</a>', �� random=False, all=False, raw=False, version=u'2.149', �� no_members=False): AttributeError �� [Tue Aug 18 11:21:25.198021 2015] [wsgi:error] [pid 10485] �� ipa: ERROR: non-public: AttributeError: 'DN' object has no �� attribute 'setdefault' �� [Tue Aug 18 11:21:25.198053 2015] [wsgi:error] [pid 10485] �� Traceback (most recent call last): �� [Tue Aug 18 11:21:25.198058 2015] [wsgi:error] [pid 10485] �� File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", �� line 347, in wsgi_execute �� [Tue Aug 18 11:21:25.198062 2015] [wsgi:error] [pid �� 10485]�� result = self.Command[name](*args, **options) �� [Tue Aug 18 11:21:25.198066 2015] [wsgi:error] [pid 10485] �� File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", �� line 443, in __call__ �� [Tue Aug 18 11:21:25.198070 2015] [wsgi:error] [pid �� 10485]�� ret = self.run(*args, **options) �� [Tue Aug 18 11:21:25.198081 2015] [wsgi:error] [pid 10485] �� File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", �� line 760, in run �� [Tue Aug 18 11:21:25.198133 2015] [wsgi:error] [pid �� 10485]�� return self.execute(*args, **options) �� [Tue Aug 18 11:21:25.198139 2015] [wsgi:error] [pid 10485] �� File "/usr/lib/python2.7/site-packages/ipalib/plugins/baseldap.py", �� line 1227, in execute �� [Tue Aug 18 11:21:25.198144 2015] [wsgi:error] [pid �� 10485]�� *keys, **options) �� [Tue Aug 18 11:21:25.198147 2015] [wsgi:error] [pid 10485] �� File "/usr/lib/python2.7/site-packages/ipalib/plugins/stageuser.py", �� line 373, in pre_callback �� [Tue Aug 18 11:21:25.198151 2015] [wsgi:error] [pid �� 10485]�� attrs_list, *keys, **options) �� [Tue Aug 18 11:21:25.198155 2015] [wsgi:error] [pid 10485] �� File "/usr/lib/python2.7/site-packages/ipalib/plugins/stageuser.py", �� line 277, in set_default_values_pre_callback �� [Tue Aug 18 11:21:25.198159 2015] [wsgi:error] [pid 10485] �� entry_attrs.setdefault('description', []) �� [Tue Aug 18 11:21:25.198163 2015] [wsgi:error] [pid 10485] �� AttributeError: 'DN' object has no attribute 'setdefault' �� [Tue Aug 18 11:21:25.199276 2015] [wsgi:error] [pid 10485] �� ipa: INFO: [jsonserver_session] �� <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:stageadm@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM">stageadm@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM</a>: �� stageuser_add(u'tb1', givenname=u't', sn=u'b', cn=u't b', �� displayname=u't b', initials=u'tb', gecos=u't b', krbprincipalname=u'<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:tb1@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM">tb1@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM</a>', �� random=False, all=False, raw=False, version=u'2.149', �� no_members=False): AttributeError The new set_default_values_pre_callback, can not use the set_default function. It is not clear why. entry_attrs is one of pre_callback parameter. Should set_default_values_pre_callback be a subfonction of pre_callback ? thanks thierry </blockquote> Thank you, updated patch attached. </blockquote> So far, tests are ok. Just one comment, the 'user-stage' command description is wrong, as it moves an active user into the staged area user-stage�� Move deleted user into staged area </blockquote> No, it's not doing that. user-stage is replacement of stageuser-add --from-delete, it doesn't work for active users. The support to move active user to staged area is RFE, I did not implemented it yet, and I dont know if this will fit IPA 4.2 timeframe </blockquote> Ok. thanks. Sure user-stage (active->stage) will not fit into IPA 4.2 timeframe. Running the tests being admin, there is no problem. I have a permission issue, when running as 'Stage administrator'. The 'delete' entry being moved to 'stage' container, we need the a special permission for it. </blockquote> Hello, I tested this new permission to� grant 'Stage user administrator' to do a 'user-stage'. Is it ok to add it to your patch ? thanks thierry <blockquote type="cite"> [root@vm-141 ~]# ipa user-del ttest1 --preserve --------------------- Deleted user "ttest1" --------------------- [root@vm-141 ~]# ipa user-stage ttest1 ipa: ERROR: Insufficient access: Insufficient 'moddn' privilege to move an entry to 'cn=staged users,cn=accounts,cn=provisioning,dc=abc,dc=idm,dc=lab,dc=eng,dc=brq,dc=redhat,dc=com'. [root@vm-141 ~]# klist Ticket cache: KEYRING:persistent:0:krb_ccache_hw3P667 Default principal: <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:stageadm@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM">stageadm@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM</a> Valid starting�� Expires�� Service principal 08/18/2015 15:45:43� 08/19/2015 15:45:42 <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:ldap/vm-141.abc.idm.lab.eng.brq.redhat.com@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM">ldap/vm-141.abc.idm.lab.eng.brq.redhat.com@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM</a> 08/18/2015 15:45:42� 08/19/2015 15:45:42 <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:krbtgt/ABC.IDM.LAB.ENG.BRQ.REDHAT.COM@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM">krbtgt/ABC.IDM.LAB.ENG.BRQ.REDHAT.COM@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM</a> [root@vm-141 ~]# kinit admin Password for <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:admin@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM">admin@ABC.IDM.LAB.ENG.BRQ.REDHAT.COM</a>: [root@vm-141 ~]# ipa user-stage ttest1 ---------------------------- Staged user account "ttest1" ---------------------------- [root@vm-141 ~]# ipa stageuser-find ttest1 -------------- 1 user matched -------------- � User login: ttest1 � First name: t � Last name: test1 � Home directory: /home/ttest1 � Login shell: /bin/sh � Email address: <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:ttest1@abc.idm.lab.eng.brq.redhat.com">ttest1@abc.idm.lab.eng.brq.redhat.com</a> � UID: 1814000011 � GID: 1814000011 � Password: False � Kerberos keys available: False ---------------------------- Number of entries returned 1 ---------------------------- </blockquote> </blockquote> </blockquote> </blockquote> NACK. 1) Use ADD+DEL instead of MODRDN as we agreed before: <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="https://www.redhat.com/archives/freeipa-devel/2015-August/msg00148.html"><https://www.redhat.com/archives/freeipa-devel/2015-August/msg00148.html></a>. </blockquote> Hi, I have a slight preference doing MODRDN than ADD+DEL but I think it is for corner case. Before preserving a user, the user was active and could be updated. If the user gets updated on a replica (e.g. change its phonenumer) but for some reason the update is not immediately replicated, then a later 'user-del --preserve' + 'user-stage' will stage the user without the updated phonenumber. In addition, doing 2 ops rather than one costs more and is not atomic (more complex to handle failure). </blockquote> The same problem exists for stageuser_activate, and unless you want to change it to use MODRDN as well, user_stage must use ADD+DEL. This was already discussed quite thoroughly and we reached the decision to use ADD+DEL, because it is consistent with the rest of the user code. I don't see a point in discussing this further and rehashing what was already said. <blockquote type="cite"> thank thierry <blockquote type="cite"> 2) You can't use the entry preparation code from stageuser-add in user-stage - it is supposed to normalize user input, not already normalized data from LDAP, and could lead to subtle and hard to track errors. Honza </blockquote> </blockquote> </blockquote> I have updated Martin's patch with fixes for the above. See attachment. <fieldset class="mimeAttachmentHeader"></fieldset> </blockquote> LGTM, what do you think thierry? </blockquote> I have to go outside for 45min, I will test it when I will be back.. sorry for the delay </body> </html>