[PATCHES] Fixes for async resolver
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Patch 00001: Fix timeouts for DNS resolver
options.tries specifies the number of retries. Setting this to
zero means to try exactly once. Previously we were always trying
twice (internally). We want to simply honor the SSSD configuration
and fail over to the next server (or go offline) after one try.
Patch 0002: Reschedule the fd timeout for secondary lookups
We were unscheduling the timeout handler after the first lookup
(A or AAAA) returned, but not rescheduling it if we went on to
check the secondary record type. This resulted in the resolver
never returning a result for the secondary lookup, which can mean
that logins/screen unlocks after VPN drop or suspend/resume might
never complete.
Fixes https://fedorahosted.org/sssd/ticket/729
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk0HlwYACgkQeiVVYja6o6NChgCfaAh7e2tZLqfojBQXpXhxrTl6
F9cAn1JMPyyKv6TTzoej6BoiNsQ3n4F2
=UPAJ
-----END PGP SIGNATURE-----
13 years, 4 months
SSSD and krb5.
by Patrik Martinsson
Hello,
Quick question, in our krb5.conf we have defined
pkinit_identities = PKCS11:/path_to_smartcard_lib
pkinit_anchors = FILE:/path_to_cert
to allow people to get a kerberos ticket whenever they login.
Now, we also configured sssd to use kerberos as authentication method,
which means sssd will try to do a pkinit to get the kerberos ticket
(that is, when sssd makes a kinit to get a ticket, it will use the
krb5.conf defaults and try to do a kinit with pkinit enabled, which will
fail).
Now, my question is, can i make sssd to not use pkinit when doing a kinit ?
Does that makes sense ?
Any suggestions are welcome.
Best regards,
Patrik Martinsson, Sweden.
13 years, 4 months
[PATCH] Add group support to the simple access provider
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This patch adds simple_allow_groups and simple_deny_groups options
to the simple access provider. It makes it possible to grant or
deny access based on a user's group memberships within the domain.
This patch makes one minor change to previous functionality: now
all deny rules will supersede allow rules. Previously, if both
simple_allow_users and simple_deny_users were set with the same
value, the allow would win.
Fixes https://fedorahosted.org/sssd/ticket/440
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk0A86gACgkQeiVVYja6o6NElwCeI1H9O8tzCkAM++awKInGJr9R
l0QAn20A7tbxmfOKdBuhXC4aMsyTes3V
=K45L
-----END PGP SIGNATURE-----
13 years, 4 months
Group results.
by Patrik Martinsson
Hello,
I've almost managed to get sssd to work as I want, however I have this
problems with groupmembers.
If I do an ldapsearch on a group I get this result,
---------
member: CN=x1,OU=People,DC=x,DC=x,DC=x
member: CN=x2,OU=People2,OU=People,DC=x,DC=x,DC=x
member: CN=x3,OU=People,DC=x,DC=x,DC=x
member: CN=x4,OU=People,DC=x,DC=x,DC=x
member: CN=x5,OU=People,DC=x,DC=x,DC=x
memberUid: x1
memberUid: x2
memberUid: x5
memberUid: x7
memberUid: x8
memberUid: x9
---------
A college told me that the difference (between members in 'member' and
'memberUid') is because 'member' is the attribute set up for windows
accounts, and 'memberUid' is for the unixaccounts, and although these
often should be synced it could be some cases where its not (in our
setup anyway).
So what I want is getting sssd to map groupmembers to the memberUid.
Here's a snippet from my sssd.conf
---------
ldap_user_object_class = User
ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_shell = loginShell
ldap_user_gecos = mail
ldap_user_principal = userPrincipalName
ldap_user_member_of = memberOf
ldap_user_home_directory = msSFUHomeDirectory
ldap_group_object_class = Group
ldap_group_name = cn
ldap_group_gid_number = gidNumber
ldap_group_member = memberuid
# ldap_group_member = member
# ldap_group_member = memberUid
# ldap_group_uuid = memberUid
---------
I've tried different setups here but I cant really seem to figure it
out. If I run with the above settings i get no groups for users, and the
following is printed in sssd debug,
---------
[sysdb_search_entry_done] (6) Error : Entry not found!
[sdap_fill_memberships] (7) member #60 (x): not found!
---------
If I use the member instead of memberuid/Uid the users are mapped to
groups from the 'member' attribute, which seems logical, however that's
not what I want, as I said before, I want to map usergroups against the
memberUid.
I would appreciate any tips or recommendations around this matter.
Best regards,
Patrik Martinsson, Sweden.
13 years, 4 months
test
by Stephen Gallagher
13 years, 4 months
[PATCHES] Remove check_access_time() from IPA access provider
by Sumit Bose
Hi,
due to recent changes in the IPA project the following two patches will
remove the evaluation based on the ipa_timerules from the IPA access
provider of SSSD. If you are evaluating the IPA alpha releases with
respect to time ranges in HBAC rules please note that this patch will
change the behaviour.
The first patch removes all related calls from the IPA provider while
the second removes the implementation of the checks and the
corresponding tests.
This patch should fix trac ticket #698.
bye,
Sumit
13 years, 4 months
[PATCH] Generate ccache name at the beginning of auth process
by Jan Zelený
After some complications I finally made the patch solving ticket #533 (different
ccache files during multiple simultaneous logins of the same user). It is based
on Simo's idea to determine the ccache file name in advance and count
references to it.
Jan
13 years, 4 months
