On Wed, Jun 18, 2014 at 04:32:11PM -0400, Dmitri Pal wrote:
 On 06/18/2014 03:15 PM, Ade Lee wrote:
 >Added my comments to the etherpad.
  
I've fleshed out and formatted the design proposal (though it is
still far from complete) and put it up on the wiki:
    
http://pki.fedoraproject.org/wiki/Lightweight_sub-CAs
And also the LDAP Profile Storage design proposal, which is in a
similar state of incompleteness.  I hope to nail down the LDAP
schema, finalise the design and begin implementing next week:
    
http://pki.fedoraproject.org/wiki/LDAP_Profile_Storage
On the bright side, I think that there are no dependencies between
these design proposals.  In FreeIPA there might or might not be a
conceptual association between the two, but that could exist only on
the FreeIPA side, and shouldn't affect the implementation of these
changes.
On the Solution 1 vs Solution 2 debate, from a cleanliness of
implementation view, I think Solution 1 is better, however the fact
that the creation of a new sub-CA must be effected on all replicas
lends much weight to Solution 2.
Anyhow, have a nice weekend and I look forward to continuing the
design process next week.
Cheers,
Fraser
 I added couple comments but have to go so I will resume on Monday.
Sorry.
 >Ade
 >
 >On Tue, 2014-06-17 at 14:19 -0400, Dmitri Pal wrote:
 >>On 06/17/2014 08:11 AM, Ade Lee wrote:
 >>>I can't access this etherpad.  It says it needs an account/password.
 >>>How do I get an account?
 >>>
 >>>My guess also will be that others in the dogtag group will have trouble
 >>>getting to this account too.  I would suggest putting this on a more
 >>>accessible etherpad - like 
http://etherpad.corp.redhat.com perhaps or
 >>>even a public etherpad.
 >>I changed access. Ade you should be able to see it now.
 >>I also added my comments.
 >>
 >>Fraser it is OK to create a design page on the IPA or Dogtag wiki and
 >>discuss this on the public list.
 >>
 >>>Ade
 >>>
 >>>On Tue, 2014-06-17 at 17:14 +1000, Fraser Tweedale wrote:
 >>>>Hi Ade,
 >>>>
 >>>>Have been working on the design document and comprehending the
 >>>>subsystem/SigningUnit implementation today.  The document so far is
 >>>>at 
http://idm.etherpad.corp.redhat.com/dogtag-sub-ca-design.  Please
 >>>>pass along to / copy in anyone else whose feedback would be valuable
 >>>>at this stage of design.
 >>>>
 >>>>Dmitri, could you please provide input on the whether no-restart of
 >>>>Dogtag is a requirement w.r.t. FreeIPA's use of Dogtag sub-CAs?
 >>>>Insights regarding the impact of replication on the proposed design
 >>>>approach would also be appreciated.
 >>>>
 >>>>Cheers,
 >>>>
 >>>>Fraser
 >>
 >
 
 
 -- 
 Thank you,
 Dmitri Pal
 
 Sr. Engineering Manager IdM portfolio
 Red Hat, Inc.