sssd-devel November 2010

sssd-devel@lists.fedorahosted.org

13 participants
55 discussions

Start a nNew thread

[PATCH] Add missing error code
by Sumit Bose 18 Nov '10

18 Nov '10

Hi, this patch fixes a issue where we would return success instead of ENOMEM. bye, Sumit

2 2

sssd-1.4.1 nested groups rfc2307bis
by Sergei V. Kovylov 16 Nov '10

16 Nov '10

Hello everyone. Can you clarify the situation about nested groups? When I use rfc2307bis I'm not able to get membership from nested groups. Example: GRP-SVC-SSH-NODE |- user1 |- user2 GRP-SVC-SSH-NODE1 |- GRP-SVC-SSH-NODE Users from GRP-SVC-SSH-NODE are not members of GRP-SVC-SSH-NODE1. In previous version 1.3.1 it works, but from 1.4 version it is not working. As I may see in "src/providers/ldap/sdap_async_accounts.c": /* FIXME: we ignore nested rfc2307bis groups for now */ filter = talloc_asprintf(grp_state, "(objectclass=%s)", opts->user_map[SDAP_OC_USER].name); Also the same situation with LDAP memberOf attribute. It just create "originalMemberOf" entry, but do nothing with it. Maybe the problem is because of groups are stored in different OU: OU=COMPUTE |-OU=GROUP-ACCESS |- cn=GRP-SVC-SSH-NODE |- ou=SSH-GROUPS |-cn=GRP-SVC-SSH-NODE01 which means: GRP-SVC-SSH-NODE = cn=GRP-SVC-SSH-NODE,ou=GROUP-ACCESS,ou=COMPUTE, dc...... GRP-SVC-SSH-NODE1 = cn=GRP-SVC-SSH-NODE1,ou=SSH-GROUPS,ou=GROUP-ACCESS,ou=COMPUTE, dc.....

3 11

[PATCH] Log startup errors to syslog
by Stephen Gallagher 16 Nov '10

16 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Some users are experiencing failures when restarting SSSD during an RPM upgrade. During RPM upgrade, the output from 'service sssd restart' is suppressed, so if there are failures to restart, there is no indication of why. This patch moves the error messages into the syslog instead. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzhnp8ACgkQeiVVYja6o6Ov0wCgpbWakBa09KTDQk4EXsthH1n4 4NMAmgIFZ+QeZvscm5vLVqKoFOGlrW2e =Ludd -----END PGP SIGNATURE-----

2 2

Slight process change in Trac
by Stephen Gallagher 16 Nov '10

16 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For a while now, we've been informally following a policy of cloning bugs into other milestones if they need to be fixed in multiple places. I'd like to formalize this as part of the process. It makes tracking much easier. Since we're now doing this, the custom field "FixedIn" no longer has any value whatsoever (originally it was meant to denote the lowest released version that the fix could be seen in, unrelated to the milestone during which it was being fixed. It was a relic of when our milestones were time-based rather than release-based). Unless anyone has any strong reservations about it, I'm going to eliminate this unnecessary knob from our Trac instance. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzhoZIACgkQeiVVYja6o6NonwCfSbsDy8Y9jzdKGSQLFSMJ14RS XNsAnRTRc6vHCthw71UVjB7ymcIn2eGd =dMbL -----END PGP SIGNATURE-----

2 1

[PATCH] Fix incorrect type comparison
by Stephen Gallagher 15 Nov '10

15 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Fixes https://fedorahosted.org/sssd/ticket/657 sss_cli_check_socket returns an enum sss_status result code, but we were assigning it to an enum nss_status variable before checking it. Coincidentally, the success codes were the same, so we weren't seeing a bug here, but it throws a warning on newer gcc and is just generally wrong, so we'll fix it. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEUEARECAAYFAkzhlv4ACgkQeiVVYja6o6NedACYgEDBnCS9K3J9qIpoXaWtr2AF cACeKpSiePGfbeN6YzX/PJpI/pb+G2Y= =ymxA -----END PGP SIGNATURE-----

2 2

[PATCHES] Fix const cast warnings
by Stephen Gallagher 15 Nov '10

15 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Fixes https://fedorahosted.org/sssd/ticket/656 These warnings appear on gcc-4.5.1-4.fc14.x86_64 with -Wcast-qual - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzhljMACgkQeiVVYja6o6Pu5ACeMP6GL7RsN6cTup6boBIJQlGQ onQAn1y4vFMo60DoDeu0vrVkme4+W39U =UePw -----END PGP SIGNATURE-----

2 2

[PATCH] Introduce pam_verbosity config option
by Sumit Bose 15 Nov '10

15 Nov '10

Hi, this patch should fix ticket #604, but maybe we want to add some more levels to pam_verbosity and also handle other messages with this patch. Currently I have two questions. First, is more granularity needed for pam_verbosity or is it enough to switch between only important and all messages? Second, if offline_credentials_expiration is set, the 'Authenticated with cached credentials' messages is always display. Is this acceptable or shall we introduce a threshold parameter here? bye, Sumit

2 5

[PATCH] Properly document ldap_purge_cache_timeout
by Stephen Gallagher 15 Nov '10

15 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This option was missing from the manpage. Also, this patch allows cache cleanup to be disabled entirely by setting it to zero. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzT/5YACgkQeiVVYja6o6NPqQCglPqrNcAiy8/8ChFVU5Hdldrv uj8AoI8A0aHE5iA3X+5pJxHNVIRRFmtl =0PM8 -----END PGP SIGNATURE-----

2 4

[PATCH] Sanitize ldap attributes in the config file
by Stephen Gallagher 15 Nov '10

15 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 https://fedorahosted.org/sssd/ticket/458 Previously, it was possible to perform a sort of LDAP filter injection with careful crafting of the ldap attributes in the config file. This guarantees that any attribute specified in the config file is escaped properly, resulting in an inability to inject subfilters. Note: this was not a security issue, as it was editable only by root and even then, all checks were performed on the server, not the client. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzdWXMACgkQeiVVYja6o6OivgCfUyMajTHDR15Vx2XhLcfwXUvr sVsAniWHFXwyNjhu1Zm/WMXasA7zkg5M =hlmE -----END PGP SIGNATURE-----

2 6

[PATCHES] Sanitize search filters in the sysdb
by Stephen Gallagher 15 Nov '10

15 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is the first part of a fix for https://fedorahosted.org/sssd/ticket/639 These patches address the various search filters we're using in the sysdb. Patches for LDAP search filters will be coming later. I wanted to get these reviewed first. Patch 0001: Adds a utility function to sanitize search filters using the method described in RFC 4515. Includes a unit test. Patch 0002: Sanitize search filters internal to the public sysdb APIs. Includes unit tests. Patch 0003: Sanitize sysdb search filters in the IPA provider used with sysdb_search_custom() Patch 0004: Sanitize sysdb search filters used when processing nested groups. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzKGl0ACgkQeiVVYja6o6OSLQCeI9d1ITiVS4JcrZesZTXsyTyG zS0AoIQeKBsatVL4Ed51D2nGwxaT7PVh =qbgv -----END PGP SIGNATURE-----

2 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel November 2010