sssd-devel August 2009

sssd-devel@lists.fedorahosted.org

11 participants
80 discussions

[PATCH] Eliminate unnecessary explicit timeout for DP account requests
by Stephen Gallagher 12 Aug '09

12 Aug '09

D-BUS handles timeouts itself and reports DBUS_ERROR_NO_REPLY if a timeout fires, so we can rely on this instead of having an explicit timeout ourselves. Furthermore, the two timeouts present a potential race condition. -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 3

[PATCH] ticket#101
by Simo Sorce 12 Aug '09

12 Aug '09

Apparently parent and member got reversed when I rewrote some of the functions. Simo.

2 1

[PATCH] rework identification against DP too
by Simo Sorce 11 Aug '09

11 Aug '09

Change the identification sense against DP too like I did in the previous patches against the monitor. Simo.

2 2

sssd [PATCH] Make socket paths a compile-time option
by Stephen Gallagher 11 Aug '09

11 Aug '09

Previously, we had hardcoded the paths for the NSS, PAM and private PAM sockets to /var/lib/sss/pipes. With this patch, we will specify the sockets as $(localstatedir)/lib/sss/pipes. This fixes a problem builing RPMs on Red Hat Enterprise Linux. -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 9

[PATCH] Fix monitor ping timeout
by Stephen Gallagher 11 Aug '09

11 Aug '09

Our configuration specifies the monitor config timeout as seconds, but we were passing it directly to dbus commands that require milliseconds. Fixing this in get_monitor_config(). Also, the default value of -1 for the timeout resulted in a timeout much too short to be useful, so I'm making it 10s instead. This fix solves the problem where a busy backend (for example, one that is enumerating a large number of LDAP entries) would fail to respond to the ping in time. -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 2

[PATCHES] services startup and identification
by Simo Sorce 11 Aug '09

11 Aug '09

The following 3 patches changes the way services are started up and identify themselves to the monitor. The first patch is just minor or cosmetic fixes. The second patch changes the identification from monitor initiated to service initiated and acked by the monitor. This allows the service to perform the identification after it has completely set up all the dbus channel and is ready to receive a reply avoiding nasty race conditions. The third patch changes the way services are started at startup. The Data Provider service is given a 1 second advantage so that it should normally be all set up by the time other service start and try to connect to it. This way services normally avoid racing against dp and can fully initialize on the first attempt and not rely on reconnection. Initial testing seem to work pretty well and startup does not show ugly errors anymore. I may send an additional separate patch to make services identify against dp the same way they do against the monitor (ie service initiated instead of server initiated). A patch will follow if I can pull it off in a short time frame. Simo.

2 5

Proposed version and branch policy in the SSSD
by Stephen Gallagher 11 Aug '09

11 Aug '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 As the subject implies, I think we need a branch policy in the SSSD to address things like the recent security update that we released for 0.4.1. Currently there is no obvious way in the upstream tree to retrieve a safe copy of the 0.4.1 source to compile. You would have to be aware that the code tagged as 0.4.1 also requires cherry-picking a specific commit from the master branch to address a security bug. Furthermore, we don't have a consistent definition about the components of our version string. I'd like to recommend the following policy for these two things. Version components: Major version: Should reflect our current major goal. It will become 1 once we support all features necessary to replace nss_ldap, pam_ldap and pam_kerberos entirely. Minor version: These should represent feature-enhancement releases to the SSSD. For example, the major features intended in SSSD 0.5.0 will be support for the LDAP id backend and the Kerberos auth backend. Point version: These should represent bugfixes and security patches ONLY for the minor revision. Branch policy: When the master branch has reached a point where we believe it to be ready as a new minor version (e.g. 0.5.0), we should tag that point (sssd-0_5_0) and create a new branch from that tag (sssd-0_5). Development should continue on the master branch. If there are fixes needed to continue supporting 0.5.x, they should be cherry-picked into the sssd-0_5 branch and tagged as 0.5.x+1. In the case of bugfixes, they can be queued up and released as a single point release when it is convenient. In the case of security issues, on the date of the embargo lift, these should be immediately merged in and a new point release generated. Comments and criticisms welcome. - -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkp64oQACgkQeiVVYja6o6OYAQCfStMlqwb1toFD/k+lT0TSkTuF +44AoKIxPs+jV9XNgBWOBiufAXi8OKJ8 =mhG3 -----END PGP SIGNATURE-----

2 1

[PATCH] Fix startup race condition causing backend restarts
by Stephen Gallagher 11 Aug '09

11 Aug '09

When the backends start up, the monitor was immediately sending a getIdentity request. However, as we've added more processing to the initialization routines over time, we started introducing latency between when we open the connection and when we're able to process requests on that connection. I've updated the monitor to check for NoReply as an error message and queue the getIdentity check for retries until the service answers or one wallclock second (literally, ten tries at 10ms each) has passed. -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 8

[PATCH] Revert build-breaking libsss_util_la change.
by Stephen Gallagher 10 Aug '09

10 Aug '09

Moving the common utility sources into a libtool convenience library caused problems with symbols when loading the plugin libraries. This is a straight revert of 00aa07816bfd4305ac94780a8c2b9e6609be39ea except leaving the "make check" logic in place. -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 2

[PATCH] fix ldap enumeration when user are out of range
by Simo Sorce 10 Aug '09

10 Aug '09

return ERANGE and ignore if the user is to be excluded because of range filters. Simo.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2009