Review of authconfig replacement
by Florence Blanc-Renaud
Hi all,
I am currently reviewing the PR for authconfig replacement with
authselect (see [1]) but I am not 100% sure of the direction we should
aim for (many items were discussed in the mailing list but it's not
clear on which an agreement was reached).
1/ Deprecation of --no-sssd option:
- on non-fedora/non-rhel platforms, my understanding is that we should
keep this option and let the distros implement their specific code in
ipaplatform/<distro>/tasks.py
- what does it mean for fedora/rhel platform? we could add a check in
tasks.py called during install_check, refusing this option on
fedora/rhel (with a clean exit from ipa-client-install) and allowing
this on other distributions. Other proposals?
2/ How do we handle backup/restore:
-the server may have been installed with authconfig then upgraded, or
directly installed with authselect.
If authselect was used, we can leverage 'authselect current' to save the
current state.
If authconfig was used, we have an issue as ipa-backup is currently
calling authconfig --savebackup but this option (--savebackup) is not
supported anymore when authselect is installed. Does it mean that we
should migrate the configuration to authselect during
ipa-server-upgrade? Is it ok to migrate only servers or should we also
migrate clients?
- ipa-restore can be forced to restore a backup made on a different
version. This means we could end up in a situation where the backup was
done with authselect, but restored with authconfig. This should not be a
problem because backup/restore is done on a server and servers cannot be
installed with --no-sssd, but it means that there will be a migration to
the authselect sssd profile.
3/ How do we handle uninstall:
the client may have been installed with authconfig then upgraded. When
the pre-install config does not correspond to a supported authselect
profile, how should we react (because we won't be able to restore
exactly the same conf)? Simply log a warning, exit on error?
Thanks for your opinions/suggestions.
Flo
[1] https://github.com/freeipa/freeipa/pull/1603
6 years
Re: Web assets in Fedora
by Rob Crittenden
Just saw this on the Fedora development list. Not sure if this would
make sense for IPA to try to use. Doing so could impact other distros
(it could make more work for them).
rob
Jakub Kadlcik wrote:
> Hello,
> I've written a blog post about web assets in Fedora.
>
> Do you bundle third-party libraries/frameworks like jQuery, Bootstrap or
> Patternfly into your project and commit them to the git repository?
>
> There is a much better solution how to do it. If you are interested,
> please read the article http://frostyx.cz/posts/web-assets-in-fedora
>
6 years
FreeIPA PR CI GraphQL change
by Aleksei Slaikovskii
Hello, good people of FreeIPA!
I have a pull request to make the life of our CI runners easier [1].
So the change simply adds the usage of GraphQL GitHub API but it also
has some functionality removal. The crucial points are removing the
reboot in every 3 hours and removing auto updates.
As you can read in the pull request's conversation on GitHub I've
got my reasons to remove them [2]. But we are having some troubles
to reach the consensus and make an actual decision on should we
keep it or not.
Please share your thoughts on this one with me if you're interested
in this project.
Thanks.
[1] https://github.com/freeipa/freeipa-pr-ci/pull/168
[2] https://github.com/freeipa/freeipa-pr-ci/pull/168#issuecomment-378533583
6 years
[freeipa PR#1766][opened] Change remove_segment to take a config object
by rcritten
URL: https://github.com/freeipa/freeipa/pull/1766
Author: rcritten
Title: #1766: Change remove_segment to take a config object
Action: opened
PR body:
"""
This is to handle the case where there is no integration test
YAML provided where config.domains is an empty list.
https://pagure.io/freeipa/issue/7483
Note that I considered populating config with an empty set of domains and replicas but that would have required much more code and IMHO been more fragile. Given there is only a single caller to remove_segment I think this is fastest, safest route. If we end up with more callers needing it we can revisit.
The use-case for this is to:
- Install IPA
- Install the test pkgs
- mkdir ~/.ipa
- ln -s /etc/ipa/default.conf ~/.ipa/default.conf
- ln -s /etc/ipa/ca.crt ~/.ipa/ca.crt
- kinit admin
- ipa-run-tests
The simplest possible way to execute the tests in IPA.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1766/head:pr1766
git checkout pr1766
6 years
