12:26 a.m.
Attached patches implement LWCA renewal support
(https://fedorahosted.org/pki/ticket/2327).
It includes REST API
POST /ca/rest/authorities/<id>/renew
But not implemented in CLI tool yet. If we decide to make it a
first-class CLI feature (cf certmonger, IPA, etc managing the
renewal) then I'll file the ticket and implement it at that time.
Cheers,
Fraser
10:28 p.m.
On 5/17/2016 12:26 AM, Fraser Tweedale wrote:
Attached patches implement LWCA renewal support
(https://fedorahosted.org/pki/ticket/2327).
It includes REST API
POST /ca/rest/authorities/<id>/renew
But not implemented in CLI tool yet. If we decide to make it a
first-class CLI feature (cf certmonger, IPA, etc managing the
renewal) then I'll file the ticket and implement it at that time.
Cheers,
Fraser
Some comments:
1. This is related to patch #111 too. Suppose an authority is
added/deleted/renewed in one replica while another replica is down, when
the second replica is brought back up will it know that it's missing the
changes and be able to update the NSSDB accordingly?
I'm thinking when the server is started there should be a process to
synchronize the NSSDB with the authorities in LDAP. Do we have something
like that already, or is this not an issue?
2. The locale object for the RenewalProcessor should be obtained from
the client, not from the server. See PKIService.getLocale(). In this
case you probably need to pass HttpServletRequest to the renewAuthority().
3. The HttpServletRequest can be used to call processRenewal() as well.
I think #1 can be done separately later. The patches are ACKed assuming
#2 and #3 are addressed.
--
Endi S. Dewata
7:43 a.m.
On Thu, Jun 02, 2016 at 10:28:00PM -0500, Endi Sukma Dewata wrote:
On 5/17/2016 12:26 AM, Fraser Tweedale wrote:
> Attached patches implement LWCA renewal support
> (https://fedorahosted.org/pki/ticket/2327).
>
> It includes REST API
>
> POST /ca/rest/authorities/<id>/renew
>
> But not implemented in CLI tool yet. If we decide to make it a
> first-class CLI feature (cf certmonger, IPA, etc managing the
> renewal) then I'll file the ticket and implement it at that time.
>
> Cheers,
> Fraser
Some comments:
1. This is related to patch #111 too. Suppose an authority is
added/deleted/renewed in one replica while another replica is down, when the
second replica is brought back up will it know that it's missing the changes
and be able to update the NSSDB accordingly?
I'm thinking when the server is started there should be a process to
synchronize the NSSDB with the authorities in LDAP. Do we have something
like that already, or is this not an issue?
Nice pickup - this will be an issue (I agree it can be addressed
later; I'll create a ticket).
2. The locale object for the RenewalProcessor should be obtained from
the
client, not from the server. See PKIService.getLocale(). In this case you
probably need to pass HttpServletRequest to the renewAuthority().
3. The HttpServletRequest can be used to call processRenewal() as well.
I think #1 can be done separately later. The patches are ACKed assuming #2
and #3 are addressed.
Updated patch attached. I pass in the HttpServletRequest to
processRenewal() and use the authToken from the principal if
available (I also removed the method signature with the IAuthToken
argument, which was added in the first patch).
If you're happy with the updated patch and I'm not around, would you
kindly merge it on my behalf?
Thanks for your many reviews this week, Endi.
Fraser
7:46 a.m.
On Sat, Jun 04, 2016 at 10:43:48PM +1000, Fraser Tweedale wrote:
On Thu, Jun 02, 2016 at 10:28:00PM -0500, Endi Sukma Dewata wrote:
> On 5/17/2016 12:26 AM, Fraser Tweedale wrote:
> > Attached patches implement LWCA renewal support
> > (https://fedorahosted.org/pki/ticket/2327).
> >
> > It includes REST API
> >
> > POST /ca/rest/authorities/<id>/renew
> >
> > But not implemented in CLI tool yet. If we decide to make it a
> > first-class CLI feature (cf certmonger, IPA, etc managing the
> > renewal) then I'll file the ticket and implement it at that time.
> >
> > Cheers,
> > Fraser
>
> Some comments:
>
> 1. This is related to patch #111 too. Suppose an authority is
> added/deleted/renewed in one replica while another replica is down, when the
> second replica is brought back up will it know that it's missing the changes
> and be able to update the NSSDB accordingly?
>
> I'm thinking when the server is started there should be a process to
> synchronize the NSSDB with the authorities in LDAP. Do we have something
> like that already, or is this not an issue?
>
Nice pickup - this will be an issue (I agree it can be addressed
later; I'll create a ticket).
> 2. The locale object for the RenewalProcessor should be obtained from the
> client, not from the server. See PKIService.getLocale(). In this case you
> probably need to pass HttpServletRequest to the renewAuthority().
>
> 3. The HttpServletRequest can be used to call processRenewal() as well.
>
> I think #1 can be done separately later. The patches are ACKed assuming #2
> and #3 are addressed.
>
Updated patch attached. I pass in the HttpServletRequest to
processRenewal() and use the authToken from the principal if
available (I also removed the method signature with the IAuthToken
argument, which was added in the first patch).
If you're happy with the updated patch and I'm not around, would you
kindly merge it on my behalf?
Thanks for your many reviews this week, Endi.
Fraser
Now with patches!
1:11 p.m.
On 6/4/2016 7:46 AM, Fraser Tweedale wrote:
> Updated patch attached. I pass in the HttpServletRequest to
> processRenewal() and use the authToken from the principal if
> available (I also removed the method signature with the IAuthToken
> argument, which was added in the first patch).
>
> If you're happy with the updated patch and I'm not around, would you
> kindly merge it on my behalf?
>
> Thanks for your many reviews this week, Endi.
> Fraser
Now with patches!
ACK. Pushed to master.
--
Endi S. Dewata
2883
days inactive
2902
days old
4 comments
2 participants
participants (2)
-
Endi Sukma Dewata -
Fraser Tweedale