sssd-devel October 2010

sssd-devel@lists.fedorahosted.org

14 participants
65 discussions

[PATCH] Do not remove man pages in released tar balls
by Sumit Bose 11 Oct '10

11 Oct '10

Hi, make clean removes the generated man pages even in the distributed version where they cannot be recreated because we do not ship the xml sources. This patch checks if src/man/include, which we do not ship either, exists before removing the files. bye, Sumit

2 2

Announcing SSSD 1.2.4
by Stephen Gallagher 08 Oct '10

08 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The SSSD team is proud to announce the immediate release of version 1.2.4 of the System Security Services Daemon. This update fixes several serious bugs in the 1.2.x line of SSSD and is a recommended update for all users. It can be downloaded at https://fedorahosted.org/sssd == Highlights == * Resolves long-standing issues related to group processing with RFC2307bis LDAP servers * Fixed bugs in RFC2307bis group memberships related to initgroups * Fix tight-loop bug on systems with older OpenLDAP client libraries (such as Red Hat Enterprise Linux 5) == Detailed Changelog == Héctor Daniel Cabrera (1): * Updating ES translation Jakub Hrozek (9): * Fix sysdb_group_dn_name * Fix sysdb_attrs_to_list * Request the correct attribute name * End update_members request if there's nothing to do * sysdb interface for adding incomplete group entries * Add fake groups during initgroups * sysdb interface for adding expired user entries * Shortcut for save_group() to accept sysdb DNs as member attributes * Add fake users during saving of RFC2307 group Jan Zeleny (1): * Disable events on ldap fd when offline. Simo Sorce (1): * Add option to limit nested groups Stephen Gallagher (8): * Request all group attributes during initgroups processing * Add common hash table setup * Make sdap_save_users_send handle zero users gracefully * Handle nested groups in RFC2307bis * Make user argument of sysdb_update_members_send a const * Modify sysdb_add_group_member_send to accept users and groups * Add proper nested initgroup support for RFC2307bis servers * Releasing version 1.2.4 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyvrhwACgkQeiVVYja6o6NG/gCgsIiRGlDSipnZJe9fr8wZAxaD osIAoJKRu9XeY5y7BjBf8GMc1WyNHLjq =fo2a -----END PGP SIGNATURE-----

1 0

[PATCHES] Initgroups support for RFC2307bis nested groups (sssd-1-2)
by Stephen Gallagher 08 Oct '10

08 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 These patches must be applied atop my patches in the thread "Handle nested groups in RFC2307bis (sssd-1-2)", which in turn must be applied atop Jakub's patches in the thread "Fix initgroup processing for RFC2307 (sssd-1.2)". These patches rely on the fake group functionality added by Jakub's patches. Patch 0001: Make user argument of sysdb_update_members_send a const This argument should have been const to begin with, as the function should not modify it. This removes a const pointer issue from patch 3 (since it was more sensible to just send a const string than make a useless copy) Patch 0002: Modify sysdb_add_group_member_send to accept users and groups Previously, it assumed that all members were users. This changes the interface so that either a user or a group can be specified. Patch 0003: Add proper nested initgroup support for RFC2307bis servers This patch handles the general case, that of any RFC2307bis server. The memberOf optimizations that we were previously relying on are still available if ldap_schema=IPA is set in the sssd.conf. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyuctsACgkQeiVVYja6o6P6fwCfZnXU1vD7YoUw+pwIo39G8TlA 56gAmwcR7hLw20DTerjis+N/fpeQNv8D =6AP4 -----END PGP SIGNATURE-----

3 7

[PATCHES] Handle nested groups in RFC2307bis (sssd-1-2)
by Stephen Gallagher 08 Oct '10

08 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 These patches apply atop Jakub's "Fix initgroup processing for RFC2307 (sssd-1.2)" patches. Patch 0002: Add option to limit nested groups Patch 0003: Handle nested groups in RFC2307bis This first approach handles the non-optimized "pure" RFC2307bis case. It recursively calls into nested groups until it it has found them all or hits the pre-defined nesting limit. It then saves all member users first, then all groups to the sysdb This patch only handles the general case of RFC2307bis nested groups. It contains no optimizations for memberOf implementations. Given that we have time constraints, this patch should handle all implementations of RFC2307bis correctly (if not high-performance). Support for partial (AD) and complete (IPA) memberOf will be added to the master branch later. Still to do: initgroups for RFC2307bis using Jakub's fake groups. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkysmk8ACgkQeiVVYja6o6MQRACfTOiHz0JwvJ5C1P2iaiMKXz7g eS0An21yo8giW5uVR92mN+zeYwQFU3nK =Qx3A -----END PGP SIGNATURE-----

3 9

[PATCH] Return all user members for RFC2307 groups (sssd-1.2)
by Jakub Hrozek 08 Oct '10

08 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [PATCH 1/3] sysdb interface for adding expired user entries These are added instead of looking up the members. [PATCH 2/3] Shortcut for save_group() to accept sysdb DNs as member attributes This patch is a backport of original written by Ralf Haferkamp. [PATCH 3/3] Add fake users during saving of RFC2307 group Instead of looking up the user entries, we just add dummy expired users that are refreshed when they are requested with getpwnam/getpwuid -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyrXCUACgkQHsardTLnvCWpwACg33dycv5TL1CZsVwvl9SFyJIK W4gAoL+FaNyFUJG155eM63df5C9xq9CT =lvCd -----END PGP SIGNATURE-----

3 10

[PATCH] Fix initgroup processing for RFC2307 (sssd-1.2)
by Jakub Hrozek 08 Oct '10

08 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, these patches supersede those in threads: [PATCH] Save dummy groups to cache during initgroup (sssd-1.2) and: [PATCH] End update_members request if there's nothing to do(sssd-1.2) I am sending them separately so that it's easier to test and apply them. Patch #1 has already been acked, patches #2 and #3 were nacked on IRC for a minor issue, so hopefully should be OK, too. They apply directly on top of origin/sssd-1-2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyskS8ACgkQHsardTLnvCVLNACg6m+nl1rUCUF45JiQJEvhCRCW 7i4An3J5SMfQZzuOOIzrbnW6j7KcKUZ7 =2ZDi -----END PGP SIGNATURE-----

2 5

[PATCH] Add common hash table setup
by Stephen Gallagher 08 Oct '10

08 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 sss_hash_create() produces a dhash table living in the talloc hierarchy. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkysmOoACgkQeiVVYja6o6NhBwCcCbhvJ/df1qtYRIqoGHvW0nIP oFQAnAxd3MNFlg0tkYR91/cwIyEA22N1 =swMP -----END PGP SIGNATURE-----

2 4

[PATCH] Fix log filling with error message
by Jan Zelený 08 Oct '10

08 Oct '10

I'm sending a patch solving ticket #599 for review. After I tried some other solutions, this one seemed to be the most simple one which didn't cause any problems. My only concern was whether monitoring the LDAP socket will be restored once the backend goes online. Looking at the code, it should, because sdap_install_callbacks is called every time sh->connected is set to true. But still I wanted to be sure. From testing performed by Dmitri, it seems that I was right and the backend is correctly restored. Here is a complete test case: 1. Disconnect from the network 2. Try to log in -- the data provider should now go offline 3. Connect to the network 4. Wait for the log filling message to appear in the log -- ! The messsage should appear only once ! 5. If the message doesn't appear, repeat from step 1 6. If the message appeared, try to log in 7. If successful, check that the login was performed online and not from cached credentials 8. Step 7 might need to be repeated a couple times, it takes some time for SSSD to go online again Note: the reproduction of this issue might not be that easy. To achieve the message appearing in the log, you would have to try different scenarios (NB connected using VPN -> suspended -> woke up in the company network -> suspended -> ...) Jan

5 6

Hash table for PAM requests
by Jan Zelený 07 Oct '10

07 Oct '10

Hi, I have a question regarding PAM responder. I'm currently working on implementation of a hash table for PAM requests (ticket #533). I have done a large part, but now I found something which made me curios about the whole concept of my implementation. I'm assuming PAM responder works this way: 1) Receive PAM request 2) Delegate it to all domains 3) If any domain is marked as offline, ask the domain cache for that record I've implemented the hash table to be used for requests going to domain providers, not the local ones (i.e. those which are going to cache). I think in the context of the ticket #533 this is the right approach, because when the domain is offline, I won't get a kerberos ticket anyway, so there is no way that two users simultaneously logging in will get two credential cache files. Or do you think I should implement it for both domain and cache requests in case the domain goes online after the first but before the second request? Thanks for any advice Jan

2 1

Ordering of the group info and initgr patches for 1.2
by Jakub Hrozek 06 Oct '10

06 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, as there are already many patches on the list, here is a simple dependency chain between them: 3) group info fixes: [PATCH 1/3] sysdb interface for adding expired user entries [PATCH 2/3] Shortcut for save_group() to accept sysdb DNs as member attributes [PATCH 3/3] Add fake users during saving of RFC2307 group 2) initgroup fixes: [PATCH 1/2] sysdb interface for adding expired group entries [PATCH 2/2] Add fake groups during initgroups 1) [PATCH] End update_members request if there's nothing to do 0) origin/sssd-1-2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkysfc0ACgkQHsardTLnvCVFIwCgpoovwksxXCQn4x0mDV5+HsVv l68An3BpvSwpnVeL8IHn9YOGNe4EeIyM =WBc3 -----END PGP SIGNATURE-----

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel October 2010