February 2010 - sssd-devel - Fedora mailing-lists

[PATCH] Add expandable sequences to krb5_ccachedir
by Sumit Bose 11 Mar '10

11 Mar '10

Hi, this patch should fix #406. bye, Sumit

4 10

[PATCH] Add simple access provider
by Sumit Bose 08 Mar '10

08 Mar '10

Hi, this is the second try to fix #392. This patch adds a new provider called simple wuth na access target which can allow/deny access based on a list of user names. bye, Sumit

3 11

[PATCH] Support logrotate for SSSD DEBUG logs
by Jakub Hrozek 08 Mar '10

08 Mar '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [PATCH 1/2] Reopen logs when SIGHUP is caught Upon receiving SIGHUP, the monitor signals all services to reopen their debug logs. It is also possible to signal individual services to reopen their particular files. Fixes: #332 [PATCH 2/2] Package example logrotate script -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuGvEIACgkQHsardTLnvCXz9QCgtgSi6Lsca+hZxtJjZCgMl4Qj 7M8AnisIAj4qSE+SOO/FIvWuMcy4PfEs =jT2M -----END PGP SIGNATURE-----

2 8

[Transifex] File submitted via email to SSSD | master
by admin＠transifex.net 08 Mar '10

08 Mar '10

Hello sssd, this is Transifex at http://www.transifex.net. The following attached files were submitted to SSSD | master by logan <logan(a)fedoraproject.org> Please, visit Transifex at http://www.transifex.net/projects/p/sssd/c/master/ in order to see the component page. Thank you, Transifex

2 2

[PATCH] Add --with-test-dir option to configure
by Stephen Gallagher 04 Mar '10

04 Mar '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All 'make check' tests will chdir() into this directory before running the suite. This provides the option of having temporary files generated in a tmpfs or ramdisk e.g. ./configure --with-test-dir=/dev/shm This is especially useful when your normal build directory is on a slow and/or encrypted filesystem. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuH86AACgkQeiVVYja6o6N4MgCfQl6Ben3h/aFZtzKy7g2oVFAL 6MYAnjz830c9o5pDIcFs0UTHdnDvrNXg =iZUn -----END PGP SIGNATURE-----

2 6

[Transifex] File submitted via email to SSSD | master
by admin＠transifex.net 04 Mar '10

04 Mar '10

Hello sssd, this is Transifex at http://www.transifex.net. The following attached files were submitted to SSSD | master by ruigo <rui.gouveia(a)gmail.com> Please, visit Transifex at http://www.transifex.net/projects/p/sssd/c/master/ in order to see the component page. Thank you, Transifex

2 2

[Transifex] File submitted via email to SSSD | master
by admin＠transifex.net 04 Mar '10

04 Mar '10

Hello sssd, this is Transifex at http://www.transifex.net. The following attached files were submitted to SSSD | master by raven <piotrdrag(a)gmail.com> Please, visit Transifex at http://www.transifex.net/projects/p/sssd/c/master/ in order to see the component page. Thank you, Transifex

2 2

[PATCH] Define _GNU_SOURCE in pam_sss.c.
by George McCollister 04 Mar '10

04 Mar '10

Hi, The latest version of sssd failed to compile for me until I applied this patch. Regards, George McCollister

3 2

[PATCH] Run 'make check' during rpmbuild
by Stephen Gallagher 04 Mar '10

04 Mar '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Regression test failures should be considered build breakages. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuIBBIACgkQeiVVYja6o6NOogCfePSlj+FwTH78szUqTLeUe158 RCIAnjkKySS0olme77tJKokrmo2xaAe/ =jQcV -----END PGP SIGNATURE-----

2 2

[PATCH] Manpage fix
by Jakub Hrozek 03 Mar '10

03 Mar '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Marko noticed an inconsistency between what sssd.conf manpage says (bigger than) and what the code enforces (>=). -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuE8IwACgkQHsardTLnvCWnSgCgpdoj8R55C7R4I+Vm2xDMhvqs BFQAoJH1zCgOK6rD+w+jYRj79o3FF0Ix =/3TI -----END PGP SIGNATURE-----

3 5

[PATCH] fix mismatched _recv function in proxy.c
by Simo Sorce 03 Mar '10

03 Mar '10

While looking at the code I found this mismatch. The error is mostly cosmetic, but it's an error nonetheless. Simo. -- Simo Sorce * Red Hat, Inc * New York

2 2

Speed hacks for testers
by Simo Sorce 02 Mar '10

02 Mar '10

I hadn't run make check in a while while and today I discovered it was horrendously slow. The problem lies almost entirely in the fact that we use fsync a lot in all tests, this is because we want a "safe" behavior for our DB, so that a system crash will not also crash the db consistency and, at most, loose the current transaction. This is all and well in production (and we may later want to discuss which databases we really want to preserve at all costs), but to perform functional test it sucks badly. Attached find a patch that I am NOT proposing for inclusion, but that will help all poor souls that need to do just tests. If someone have a good idea on how to do that same thing but only conditionally for tests (or maybe through a sssd.conf option) please let me know. Simo. -- Simo Sorce * Red Hat, Inc * New York

3 3

[PATCH] Link LDAP backend with libdhash
by Jakub Hrozek 25 Feb '10

25 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For some reason I didn't notice until I tested on 32bit system, but since we use the utils from find_uid.c we need to link the LDAP backend with libdhash -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuFrPUACgkQHsardTLnvCVTmQCfa+1dTcN9B96La2d0UtZeQuRw wfMAn1Z8G1KEcxiBR5hyPoq/SS/qAlMk =3uap -----END PGP SIGNATURE-----

1 1

Announcing SSSD Preview Release 1.0.99
by Stephen Gallagher 25 Feb '10

25 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We're closing in on our big 1.1 release, due in a few weeks. Today we release 1.0.99, our preview release of 1.1. Please keep in mind that this is not guaranteed to be a stable release, but we'd appreciate some testing to help guide us to our final 1.1 release. As always, this release can be downloaded at https://fedorahosted.org/sssd == Highlights == * Support for IPv6 * IPv6 operation is not yet supported for chpass operations on Kerberos, due to a libkrb5 bug. * Support for LDAP referrals * This is only supported on platforms running openldap libraries >= 2.4.13 * Offline failed login counter * Fix for the long-standing cache cleanup performance issues * Running with 'enumerate=false' (the default) will now be much faster * libini_config, libcollection, libdhash, libref_array and libpath_utils are now built as shared libraries for general consumption * Users get feedback from PAM if they authenticated offline * Native local backend now has a utility to show nested memberships ({{{sss_groupshow}}}) == Detailed Changelog == David O'Brien (2): * Copy-edit sssd-ipa man page * Copy-edit, mainly fixing typos and English Dmitri Pal (8): * COMMON Improvements to the trace macro * COLLECTION Create reference to the top level collection * COLLECTION: Cleaning FIXME comments * INI: Cleaning FIXME comments. * INI Correcting build warnings. * INI: Added method to get string list with empty values * REFARRAY: New referenced array object * COLLECTION: Fixing queue collection and unit tests. Domingo Becker (1): * Updating ES translation Fabian Affolter (1): * Add German translation George McCollister (2): * Pointers to non 32 bit aligned data were being cast to uint32_t * * Added option to use libcrypto instead of NSS. Göran Uddeborg (5): * Add Swedish translation for sss_client * Add Swedish translation for SSSD server * Update SV translation * Update SV translation * Update SV translation Jakub Hrozek (32): * Setup ldap child logging from IPA backend * Check the services started against a list of known services * Handle spaces in config parser * Fail on nonexistent input file * Do not start with provider=files * Reduce code duplication between LDAP child and Kerberos child * Change ares usage to be c-ares 1.7.0 compatible * Import ares 1.7.0 helpers * Don't build the SRV and TXT parsing code except for tests * Document the failover feature in manpages * Consolidate code for splitting strings by separator * sss_groupshow - a utility to print properties of a local group * document debug_timestamps * Deleting nonexistent users or groups is not a noop * Add missing include * Few misc minor man page bugs * Fix other memory alignment issues * sss_groupshow improvements * gitignore additions * sss_groupshow: separate member lists by comma * Synchronize IPA and LDAP options * Add test for number of options in IPA and LDAP backends * Supress warnings with -O2 * Use macros to hide memcpy calls * Remove Kerberos options from confdb.h * Restrict family lookups * Do not schedule enumeration after a cleanup * Do not check entries during cleanup task * Store lastLogin attribute when authenticating online * Better cleanup task handling * Remove a check that was left behind * Fix check for values of expiration limits Marina Latini (1): * Update IT translation Martin Nagy (10): * Fix egg-info file generation in the spec file * Add some debugging statements to fail_over and resolver * Correctly restart server status after the timeout * Don't consider one address with different port numbers as the same * fail over: Change the first server pick logic * Re-create c-ares channels if /etc/resolv.conf is modified * Make periodic checks for DNS timeouts * Don't recursively call ares_process_fd() from fd_event() * Make sure callbacks never retry when ares channel is destroyed * Don't pass a variable as format to talloc_asprintf() Piotr Drąg (3): * Update SV translation * Updating PL translation * Update PL translation Sergei V. Kovylov (1): * sssd.spec for SLES Sergey V. Kovylov (1): * Update suse sssd.spec Simo Sorce (20): * Fix memberof plugin * Compute and save memberuid in cache as well * Use memberuid and not member in group enumerations * Use the custom password field in groups too. * Resolve nested groups also when rfc2307bis is used * Make strdn build functions more available * Fix nested group memberships * Allow nesting to fix #310 * Fix bug #311, properly set callback attribute * Change dhash API to be talloc-friendly * dhash: Add private pointer for delete callback * Add comments to document latest changes * Add rebuild task to memberof plugin * Handle the special 02 upgrade case for 04->05 * Fix for #316 * Fix for #322, update from old database versions. * Fix upgrade bug #323 * Fix ldap child memory hierarchy and other issues * Don't free timer events within the handler. * Fix #382, a segfault bug in the memberof plugin. Stephen Gallagher (103): * Revert "Stop configuring ELAPI" * Revert "Remove ELAPI from build and tarball" * Make debug log timestamps human-readable * Raise debug log level for LDB_DEBUG_WARNING * Add allocation error check * Avoid returning uninitialized result. * Fix potential uninitialized value errors in nsssrv_cmd.c * Fix potential uninitialized value error in responder_dp.c * SSSDDomain.remove_provider() requires only the provider type * Make SSSDDomain.remove_provider() remove configured options * Run dhash tests * Add SSSDDomain.set_name() function to SSSDConfig API * Reduce the verbosity of the SSSDConfigTest * Fix broken SSSDChangeConf.set() function * Fix SSSDConfig API bugs around [de-]activation of domains * Fix RPM spec for RHEL6 * SSSDConfig API: fix deactivate_domain() * SSSDConfig.get_domain() should properly detect active state * Ensure that list_active_domains returns the real value * Properly deny id_provider=files * Add missing options to sssd-ipa configuraion * Add missing SSSDConfig file for IPA for make install * Fix processing of Boolean values in SSSDConfig * Add 'permit' and 'deny' access providers to SSSDConfig API * Remove default for ldap_use_start_tls in IPA providers * Run SSSDConfig tests during 'make check' * Fix stupid copy-paste error * Updating version to 0.99.1 * Properly close STDERR when daemonizing * Fix tight loop in monitor * Don't set explicit default for "timeout" in domains * Fix warning in server.c * Raise DEBUG level of sdap_get_generic_done() * Change default for enumeration to TRUE * Fix tight-loop in monitor part 2 * Properly handle EINTR from poll() * Updating ES translation * Add DEBUG messages to getpwnam_callback and getpwuid_callback * Clarify access_provider manpage entry * Do not blindly accept zero-length passwords * Fix broken password changes for local users * Release SSSD 1.0 * Allow debug_timestamps setting on a per-domain basis * Update translations for master * Releasing version 1.0.1 * Remove local and kerberos providers from the access_provider list * Explicitly set async DNS timeout * Update version to 1.0.2 * Updating version to 1.1 * Resetting VERSION to 1.0.99 * Fix timeout memory heirarchy * License libdhash under the LGPL * Split off libdhash into a shared library * Use version.m4 for setting the SSSD version * Add 'prerelease-srpms' target to Makefile * Add 'prerelease-rpms' target to Makefile * Add missing link for Kerberos * Fix async resolver integration with tevent * Fix release script to use version.m4 * Handle IPv6 addresses with the async resolver * Fix size error on 64-bit systems * Force offline operation with SIGUSR1 * License libpath_utils under LGPL * Split off libpath_utils into a shared library * Package libpath_utils and libpath_utils-devel * Add license files for collection * Remove private header requirements from collection_tools.h * Split off libcollection into a shared library * Package libcollection and libcollection-devel * Add license files for ini_config * Fix array index error * Split off libini_config into a shared library * Package libini_config and libini_config-devel * Add license files for refarray * Split refarray off into a shared library * Package libref_array and libref_array-devel * Enable debug_timestamps by default * Internationalize the command-line help message * Remove unnecessary explicit defaults from SSSDConfig API * Add mandatory flag to SSSD config schema * Add a few additional extensions to .gitignore * Update translatable strings * Make collection_queue.h and collection_stack.h into public headers * Remove ELAPI from the SSSD repository * Add doxygen docs for ConfDB * Make attr_type an integer * Make PAM responses more compatible with D-BUS spec * Eliminate separate build tree for sss_client * Merge sss_client and sss_daemon translations together * Remove unneeded files from sss_client * Rename server/ directory to src/ * Build all manpages from a single location * License libpath_utils under LGPL * Fix licensing issues in SSSD * Properly license libdhash * Fix licensing issues for sss_client * Fix bad merge * Disable rpath support in the linker * Remove unnecessary "domain" parameter from DP registration * Remove unnecessary domain parameter from PAM requests * Include hour in 'make prerelease-rpms' * Revert "Change default for enumeration to TRUE" * Update translations for release Sumit Bose (51): * Check LDAP structure before calling ldap_unbind_ext() * Add sysdb_search_custom request * Do not treat missing proc files as errors. * Add basic OS detection * Make packaging of *.egg-info files more flexible * Try to renew Kerberos credentials * Add checks to test the memberuid handling * Add offline support for ipa_access * Add dummy credentials to an empty ccache file * Always update sysdb to the latest version * Fix DEBUG message for sysdb_init * Use sys.exit instead of exit * Add elapi_ut.conf to the list of dist files * Check for minimal version of check * Build python modules in builddir * Use --with-ldb-lib-dir while running make distcheck * Cleanup db files after test run * disable password migration code * Handle chauthtok with PAM_PRELIM_CHECK separately * Do not overwrite valid TGTs when offline * Fix for #344 * Return an error for an unknown PAM request * Fix return value when offline and TGT is valid * Add sysdb request to authenticate against a cached password * Fix a double free bug * Update the url in the spec files * Rename PAM_USER_INFO to PAM_SYSTEM_INFO * Avoid 'PAM' at the beginning of define and enum names * Improve logging of pam_sss * Check cache_credentials in sysdb_cache_auth_send() * Use ldap connection callbacks to get file descriptors * Add new option ldap_referrals * Add offline failed login counter * Warn the user if authentication happens offline * Make resolve and failover test work with CK_FORK=no * Make krb5 and open checks work if forking is disabled * Reactivate old fd handling conditionally * Document when LDAP referral chasing is available * Send a message to the user if the login is delayed * Fix handling of the global context in the leak detector * Make return values more specific during password change * Make change password errors more transparent * Add check for broken LDAP connection callbacks * Remove replace * Fix two typos * Send Kerberos environment after password change * Remove unneeded items from struct pam_data * Add documentation for PAM response messages * Check and set permissions on SBUS sockets * Fix file permissions of config.ldb * Handle expired passwords like other PAM modules beckerde (1): * Add Spanish translation ruigo (1): * Add Portuguese translation - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuGrrIACgkQeiVVYja6o6NU3gCePs6K5sKifIHLKqB0Mwn4U89q 8toAn2LSQPzHfTxpJLUu1LD10ndzFRnO =H8uF -----END PGP SIGNATURE-----

1 0

About doxygen
by Dmitri Pal 25 Feb '10

25 Feb '10

Hi Stephen, Several questions regarding the doxygen. I managed to download, build and configure it on CSB to use with collection library. Moving on so: 1) Should the version of the library mentioned in configure.ac match the doc version - I think they should 2) HTML + man pages is what we need, right? 3) How you see it being built? Automatic as a build target "make docs" and be integrated into the build or manually using "make docs" or manually using doxygen directly? 4) Are we going to check in the doxygen configuration and generated doc output? If so where? What should be the directory structure? 5) Should the doxygen be a build requirement? 6) Should I create a separate source file(s) to have the tags and descriptions rather than generate the docs from the real reader files so that the headers are clear from tags? There might be more... -- Thank you, Dmitri Pal Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

3 5

[PATCH] Remove a check that was left behind
by Jakub Hrozek 25 Feb '10

25 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When refactoring talloc_asprintf calls a check was left behind that cased the backend to go offline immediately. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuGew0ACgkQHsardTLnvCUYyACg5p6FupDDzRzMFw3g9eEtltyk wpgAoJVE4hCMg/ysiokGvszpX7F6Gw0O =KVL7 -----END PGP SIGNATURE-----

2 2

[PATCH] Add option allowed_users to the PAM responder
by Sumit Bose 24 Feb '10

24 Feb '10

Hi, this patch should fix #392 by adding a new option to the PAM responder which holds a list of allowed users. bye, Sumit

1 1

[PATCH] Do not check entries during cleanup task
by Jakub Hrozek 24 Feb '10

24 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Do not attempt to validate expired entries in cache, just delete them. Also increase the cache timeouts. Fixes: #331 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt6jkMACgkQHsardTLnvCUYPgCg1P4zLrpByMd1Cq9n33Y7GQkj hcsAoIY0Mr0BAyBaIqBzqyyPsrozpiFv =3tYS -----END PGP SIGNATURE-----

2 8

[PATCH] Check and set permissions on SBUS sockets
by Sumit Bose 24 Feb '10

24 Feb '10

Hi, this patch should fix #403. libdbus is so nice to call chmod(0777) explicitly on a newly created socket so we have to call chmod() explicitly too to change the permissions. I would prefer the call fchmod(), but I didn't found a way to get the file descriptor of the socket out of libdbus. If anyone knows a way I would be happy to update the patch. bye, Sumit

2 4

[PATCH] Disable enumerations by default
by Stephen Gallagher 24 Feb '10

24 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This patch reverts the change we made to use enumerations by default. It should be pushed along with the patch "Do not schedule enumeration after a cleanup", now that we have identified and fixed the bug that caused the performance hit when enumeration was disabled. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuEF0EACgkQeiVVYja6o6Oj3ACeM1wY5ZoUE31EDavjuNsBK5H6 GsQAoLFgp4AZY17Eb3iPktqFgKu8M93p =O+W9 -----END PGP SIGNATURE-----

2 2

[PATCH] Better cleanup task handling
by Jakub Hrozek 24 Feb '10

24 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 These patches must be applied on top of the "Do not check entries..." one. [PATCH 1/2] Store lastLogin attribute when authenticating online This is needed for the second patch as we rely on lastLogin to decide whether to delete an entry or not. [PATCH 2/2] Better cleanup task handling Implements a different mechanism for cleanup task. Instead of just deleting expired entries, this patch adds a new option login_cache_timeout for domains. If an entry is expired and the last login was more days in the past that login_cache_timeout, the entry is deleted. Groups are deleted if they are expired and and no user references them (no user has memberof: attribute pointing at that group). The parameter login_cache_timeout is not LDAP-specific, so that other future backends might use the same timeout setting. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuDzyIACgkQHsardTLnvCVLqwCgnGRDRygVMgBA6FHkYugS0wEL HvgAoJMqPiZlYF+uPTFhP46cJ5Pa1g0o =24aw -----END PGP SIGNATURE-----

3 21

[PATCH] Include hour in prerelease timestamps
by Stephen Gallagher 24 Feb '10

24 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is a trivial patch. When I added the "make prerelease-[s]rpms" commands, I forgot to include the hour, which makes the resulting RPMs incompatible with our automated build system. This patch brings them back in line. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuEAEMACgkQeiVVYja6o6NB8ACeNTKU/OLcWFySe4H7kxe+2T11 xy0AnRy6TErLWanL9IYM5ouORBE9JFKk =8Z+y -----END PGP SIGNATURE-----

2 2

[PATCH] Do not schedule enumeration after a cleanup
by Jakub Hrozek 24 Feb '10

24 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ssia -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuD1X0ACgkQHsardTLnvCXeMwCeOcsuDT1zfnhRguXywuzjF4Hk jZgAn0LyplwYuMoEPuDxxhtt74C3e1d+ =wSYP -----END PGP SIGNATURE-----

2 2

[PATCH] Handle expired passwords like other PAM modules
by Sumit Bose 24 Feb '10

24 Feb '10

Hi, this patch changes the way we handle expired passwords to meet the PAM standards. bye, Sumit

2 2

[PATCHES] Support introspection in the SBUS
by Stephen Gallagher 23 Feb '10

23 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We already had routines in place for answering Introspection requests because the InfoPipe had previously used them. These two patches add a few simple utility routines for reading in the Introspection XML files and set up the monitor, services and data providers to proffer them correctly. Addresses task #402 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuD1pYACgkQeiVVYja6o6PVWgCfZaRye+GG8e1qSeruFTyOA7IJ dMIAn2R2H3RZSYftx/RcrCX9PhJeaFhq =n1r2 -----END PGP SIGNATURE-----

1 0

[PATCH] Restrict family lookups
by Jakub Hrozek 22 Feb '10

22 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Adds a new option that tells resolver which address family to prefer or use exclusively. Fixes: #404 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuCwHkACgkQHsardTLnvCX/NQCfa8tqnVbg4+Y2HqrWBPFiN2Ab 87QAnjon1WFcB7YoAPA5Ez3vh9betPtC =hL5R -----END PGP SIGNATURE-----

2 2

[PATCH] Remove Kerberos options from confdb.h
by Jakub Hrozek 22 Feb '10

22 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Kerberos-specific options are pulled using dp_get_opts() and defined in Kerberos subtree. There is no need to keep these in confdb. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuCwIAACgkQHsardTLnvCWTwQCfWtylCbZc+D8eTZAbsAps2Wq6 g7EAn1yzSOyj8Ig57hLZt5Bt7jnbyZoz =9QXK -----END PGP SIGNATURE-----

2 2

[PATCH] Clean up DP registration and PAM request interfaces
by Stephen Gallagher 22 Feb '10

22 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 There is no need to pass "domain" as a parameter to the data provider. We're already talking directly to the provider for that domain. Both the provider and responder are fully aware of which domain is being queried without passing this parameter. It only serves to complicate the interface. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkuCn3EACgkQeiVVYja6o6NncQCeJsCFmDW9wDebX+zYZUzeVbWt UV0AnA1vldKN74klO3MiHd2Aeq5mSzmF =N31B -----END PGP SIGNATURE-----

2 5

[PATCH] Add documentation for PAM response messages
by Sumit Bose 19 Feb '10

19 Feb '10

Hi, this patch documents the PAM response messages which can be send by the components of the sssd to the PAM client. bye, Sumit

2 4

[PATCH] Remove unneeded items from struct pam_data
by Sumit Bose 19 Feb '10

19 Feb '10

Hi, while documenting the PAM DBUS API I found that we send some needless values. This patch removes them. bye, Sumit

2 4

[PATCH] Disable rpath support in the linker
by Stephen Gallagher 19 Feb '10

19 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Fedora (and many other distributions) do not want rpath to be used. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt+2YEACgkQeiVVYja6o6NDyQCgkjH77Gl97WDzpVJ02PWy4Hia imwAoJaN5HpSx6uoliv6+8GWpRm0pbAe =cNff -----END PGP SIGNATURE-----

2 2

[Transifex] File submitted via email to SSSD | master
by admin＠transifex.net 19 Feb '10

19 Feb '10

Hello sssd, this is Transifex at http://www.transifex.net. The following attached files were submitted to SSSD | master by raven <piotrdrag(a)gmail.com> Please, visit Transifex at http://www.transifex.net/projects/p/sssd/c/master/ in order to see the component page. Thank you, Transifex

2 2

[PATCH] Send Kerberos environment after password change
by Sumit Bose 19 Feb '10

19 Feb '10

Hi, I just realized that the Kerberos environment variables are not send back to the client during a password change. This would result in missing variables if you log in while your password is expired and a new one is set. bye, Sumit

2 2

[PATCH] Fix two typos
by Sumit Bose 19 Feb '10

19 Feb '10

Hi, by change I found these two typos. bye, Sumit

2 2

[Transifex] File submitted via email to SSSD | master
by admin＠transifex.net 19 Feb '10

19 Feb '10

Hello sssd, this is Transifex at http://www.transifex.net. The following attached files were submitted to SSSD | master by beckerde <domingobecker(a)gmail.com> Please, visit Transifex at http://www.transifex.net/projects/p/sssd/c/master/ in order to see the component page. Thank you, Transifex

2 2

Announcing SSSD 1.0.5
by Stephen Gallagher 19 Feb '10

19 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In order to address some potential license issues before they become problems, the SSSD team is releasing 1.0.5, which clarifies the licenses throughout the code, and also removes some dead code. This is a non-critical update, having no effect on functionality. == Highlights == * Remove some dead code (libreplace) * Clarify licenses throughout the code == Detailed Changelog == Stephen Gallagher (6): * Remove replace * Fix licensing issues for sss_client * License libpath_utils under LGPL * Fix licensing issues in SSSD * Properly license libdhash * Releasing version 1.0.5 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt+rusACgkQeiVVYja6o6Nd4wCbBbQCAwYxxchVutY5AzAhBVCd RUoAnjjZiQYZYqdpzvsjCc9QB13Jvf0P =f9LG -----END PGP SIGNATURE-----

1 1

[PATCH] Fix bad merge with sss_client licensing
by Stephen Gallagher 18 Feb '10

18 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SSIA - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt9vEUACgkQeiVVYja6o6N11wCdEps/TEP8Hp7+MP04jCxUz41k ogEAnjqAMHE9A8mqHa/E44C0jEfzW6ha =qrp2 -----END PGP SIGNATURE-----

2 2

[PATCHES] Fix licensing issues in the stable branch
by Stephen Gallagher 18 Feb '10

18 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The attached patches correct several license oversights in the source. Additionally, patch 0001 removes libreplace and all the license issues it might entail (since we don't use it anyway) - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt9mcoACgkQeiVVYja6o6NXqgCgqtcBoMUPPbZvrsyb/PMuJaua gSMAnj7FLPxpvI30bEVW25XDXSR0Fed/ =7Byv -----END PGP SIGNATURE-----

3 4

[PATCHES] Fix licensing issues in the development branch
by Stephen Gallagher 18 Feb '10

18 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 These correct several license issues in the SSSD 1.1 development branch. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt9mgQACgkQeiVVYja6o6NfmACfeqnH00leB483yXKH8LyoTmvY hu0AnjJBz2DV7t5ssPgViggmW75GSN0O =p6R0 -----END PGP SIGNATURE-----

2 6

[PATCH] Supress warnings with -O2
by Jakub Hrozek 18 Feb '10

18 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I noticed that there were some warnings about uninitialized variables when compiling with -O2, some of them legit (sysdb.c, krb5_auth.c, pamsrv_cmd.c) some of them a little spurious but I think the extra assignments are worth the clean compile. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt1VeMACgkQHsardTLnvCWZJgCfcyj1iZfB4Hnp27V5k43vrEmg vXUAnA3YblUTP4YNOlPv1HWB7ygyAdCZ =8ow7 -----END PGP SIGNATURE-----

3 4

[PATCH] Use macros to hide memcpy calls
by Jakub Hrozek 18 Feb '10

18 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The memcpy calls introduced in the memalign patches are ugly. This patch hides them behind a set of macros. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt1RsgACgkQHsardTLnvCWSwgCdGJGbQzYd+Dj+7clmHj6gHpoY ZrQAn2iF/1a5ODmHN6HsO67lnSqewG3H =w3Jd -----END PGP SIGNATURE-----

3 2

[PATCHES] Merge sss_client into a single project with sss_daemon
by Stephen Gallagher 18 Feb '10

18 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 0001: Move sss_client into a subdirectory of server, updating the configure script and Makefile.am 0002: Merge the translation files into a single sss_daemon pot 0003: Remove any files no longer needed (build files from sss_client and the old .po[t] files - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt8HEMACgkQeiVVYja6o6NQ/wCfWl3xhB6ra+gbVt1lA9J49ySk 4H0An1zKMQclOqJ3sdR+YwIIVHy+JDku =KEdH -----END PGP SIGNATURE-----

2 5

[PATCH] Remove replace
by Sumit Bose 16 Feb '10

16 Feb '10

Hi, this patch removes the replace subdirectory. The code isn't used so far on the supported Linux platforms and is outdated compared to the upstream code in the samba tree. If we will need some replacements when porting to other platforms we might reintroduce the code, use gnulib or use some other strategy. bye, Sumit

2 2

[PATCH] Synchronize IPA and LDAP options
by Jakub Hrozek 16 Feb '10

16 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 During testing of another patch I found out that the IPA backend no longer works because we added options to the LDAP backend and IPA_OPTS_BASIC_TEST got out of sync with the SDAP_OPTS sentinel. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt1RtEACgkQHsardTLnvCWutwCg5ZVfFVRja353ZFU7LgqOhcT/ OqYAoKAzuKxCr4Zwzxv77mK4ODNYWY16 =23jO -----END PGP SIGNATURE-----

2 4

[PATCHES][ELAPI] Patches to complete repo split
by Stephen Gallagher 15 Feb '10

15 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The ELAPI has been split into a new repository at git://git.fedorahosted.org/git/ELAPI.git This was done using 'git filter-branch' to pull the common/elapi directory from the SSSD repository into the root of the new repository directory. These two patches will finish the process of separating the ELAPI from the SSSD build tree. Patch 0001: The ELAPI no longer builds against in-tree versions of libcollection and libini_config. This patch points the build at the system versions of libcollection and libini_config. It also copies in the trace.h file into the ELAPI (rather than being in a separate dircectory above ELAPI) as well as a .gitignore file. Patch 0002: Build the ELAPI as a shared library. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktxgPQACgkQeiVVYja6o6NV6wCgorcFHCxsisVuCjv0ZbOT3NOn ew4AnRU1kTZ3Pjdj4ktffJgx8lpIS1qj =LxyU -----END PGP SIGNATURE-----

2 2

[PATCH] Make PAM responses more compatible with D-BUS spec
by Stephen Gallagher 15 Feb '10

15 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Previously, the PAM responses could contain an arbitrary number of arguments. This is not acceptable by the D-BUS protocol, as there is no way to introspect it. This patch converts the response objects to be an array of D-BUS structs. It also fixes two potential memory leaks by not unref'ing the reply object if we get an error. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt1vmAACgkQeiVVYja6o6PAXACfRVdVlc0/L8/on2sjAh7fKSXM PowAoJgRVQUcxMvGnj/FkrJZRegZYNbh =oX+3 -----END PGP SIGNATURE-----

2 2

[PATCH] Make attr_type an integer
by Stephen Gallagher 15 Feb '10

15 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This patch refers to the SBUS communication for getAccountInfo. Previously it was a string being passed and converted into an integer. It will be more efficient this way (and simpler for other implementers) - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt1eNoACgkQeiVVYja6o6NApwCeKHhfWCwu24iBDBl/2zbJeIn7 KyMAn26Ab1iS8930+hJwc7w5hYBuYvlB =TkF+ -----END PGP SIGNATURE-----

2 3

[PATCHES] Turn the ConfDB into its own package
by Stephen Gallagher 15 Feb '10

15 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 These three patches are the first steps towards an sssd-devel package. Patch 0001: Build the confdb as a shared library. This is so that third-party backend implementers can access our configuration if they choose. Patch 0002: Add comprehensive doxygen docs for the confdb Patch 0003: Add a -devel subpackage to the sssd.spec for the confdb and its docs. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktsVHEACgkQeiVVYja6o6O4LQCfTI1/0NBnXW58vPUV/dr2jXDl TvgAn0OUqVA8lWp14jkhtNd0zDTtCR3m =r7rJ -----END PGP SIGNATURE-----

3 9

[PATCH] Add check for broken LDAP connection callbacks
by Sumit Bose 12 Feb '10

12 Feb '10

Hi, this patch extends the test for LDAP connection callbacks. There is a bug in OpenLDAP 2.4.12 which makes ldap_set_option() fail. Now it is first check if the ldap_conncb structure is available and then if ldap_set_option() succeeds. bye, Sumit

3 3

[PATCH] sss_groupshow: separate member lists by comma
by Jakub Hrozek 12 Feb '10

12 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For some reason I separated the member lists with colon, not comma..this simple patch fixes that and is the real fix for #398 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt1RugACgkQHsardTLnvCWAWwCdHzSIqv96/U9JTdzYIRkPGI0/ LI4An0h9BV5NIcR7X04UZL4VTDN1YIZB =oxFV -----END PGP SIGNATURE-----

2 2

[PATCH] Remove ELAPI from the SSSD repo
by Stephen Gallagher 12 Feb '10

12 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ELAPI now lives at https://fedorahosted.org/ELAPI This patch removes the ELAPI source from the tree (and build). The patch is gzipped because all the deleted text is included (making the patch very large) - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktxz0IACgkQeiVVYja6o6NX1gCcDSUz41/SlanwKcQC2rOYUgKi MYoAoKwN8MTgImVWJTCx+Pr9wNxP3AGH =Oxgf -----END PGP SIGNATURE-----

2 2

[PATCH] gitignore additions
by Jakub Hrozek 12 Feb '10

12 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 add some binaries to .gitignore -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt1Ru8ACgkQHsardTLnvCUSHwCZAbA8V4tNRAHaeTxAhFC57pKh eF0AnR1HMffb39h9v7Ug//OQboCjIFCe =J+G/ -----END PGP SIGNATURE-----

2 2

[PATCH] Make change password errors more transparent
by Sumit Bose 12 Feb '10

12 Feb '10

Hi, this patch send the error message from an LDAP or Kerberos server back to the user if a password change fails. I think we do not disclose information here, because the user is already authenticated with his old password during this operation. Currently thers is no easy way to translate these messages. bye, Sumit

2 2

[PATCH] Don't pass a variable as format to talloc_asprintf()
by Martin Nagy 12 Feb '10

12 Feb '10

Hi, SSIA. Martin

2 2

Developing custom SSSD data provider backends
by Stephen Gallagher 11 Feb '10

11 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For the last week, I've been working on developing a set of guidelines on how to create a custom SSSD data provider backend. These backends would be capable of performing identification and/or authentication to custom mechanisms (such as winbind, NIS, SecurID, etc.) First, I'd like to describe the way things work internally (for the benefit of anyone not intimately familiar), then I'll go into the issues we're facing with allowing custom backends. Currently, the SSSD provides two services that face the system: NSS and PAM. This is done by way of very lightweight NSS and PAM modules that can be loaded automatically by nsswitch.conf or the PAM stack and that then pass the request across a privileged pipe to the sssd_nss or sssd_pam services (as appropriate). Each time a request comes in, the service first queries the internal sysdb to determine whether the entry already exists in an unexpired cache entry. If it does not exist (or is expired), the service then must communicate directly with a backend provider to update the cache. This is done over a private pipe using the D-BUS protocol (we refer to communications over this pipe as SBUS communications, so as not to be confused with communications going over the system bus). When a data provider backend receives the request, it then contacts its own information source (LDAP, NIS, etc.) in an appropriate manner, retrieving the information and updating the sysdb cache. It then returns a message to the NSS/PAM service stating only whether the communication succeeded (and if not, an error message describing the problem). Assuming that it succeeded, the service will then query the sysdb again, this time receiving an updated entry. Now, it is important to note here that at no time does the communication on the SBUS carry the result of the lookup that is performed by the provider backend. It only carries the success/failure message. The true final result is only returned from the sysdb, when it is queried after the provider replies. Because of this design, it is necessary for all data providers to be capable of writing directly to the sysdb. This introduces some serious concerns for potential backend implementers. The sysdb is designed to be an asynchronous interface using the tevent mainloop. There is currently no way to integrate the sysdb with any other mainloop, because at its heart, the sysdb operates on an LDB database, which also mandates the use of tevent for asynchronous operation. So, in order to implement a backend provider, the provider must be written in C and built around libtevent. This is not likely to be an acceptable set of requirements for many implementers. I've been trying to work around this, and I have come up with a few potential approaches to this problem. 1) We can create a sync wrapper around all calls to the sysdb and hides the requirement for tevent. Internally, all calls to the actual LDB are effectively synchronous, so the performance shouldn't be too poor, though there is still a chance that some of the longer operations (like initgroups commands with large user bases) may block for an extended period of time. 2) We can fork a process/spawn a thread to do the processing outside of main execution and signal our completion. As I understand it, this is the approach SELinux takes to asynchronous operation. This would likely be a tremendous amount of work. 3) We can create a new SSSD service (sssd_sysdb?) that exposes the sysdb over the SBUS(or even the system bus) restricted to root processes. This might be the most future-compatible approach, but it too is a lot of work (though I believe it to be less work than option 2) 4) We can go back to our original plan of having third-party implementers follow our internal example and write shared objects that can be loaded by the sssd_be process. This approach handles the mainloop integration internally, thereby simplifying it for the implementers, but it carries potential licensing issues. Since the sssd_be is licensed as GPL, any shared object that it loads needs to be GPL-compatible. This won't fly for companies that want to create a closed-source backend. This is the least amount of work (almost none). - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt0Rr4ACgkQeiVVYja6o6PjbACfUFDIqTNHDiduguFv+lrIGbrZ LgwAoKPmPp6GZYsydREqPz9/J2EhKVhX =nmc3 -----END PGP SIGNATURE-----

2 3

extent of doc change for bug #167
by David O'Brien 11 Feb '10

11 Feb '10

https://fedorahosted.org/sssd/ticket/167 Again, I don't know what notifications are sent out for closed bugs, hence the email. cheers -- David O'Brien Red Hat Asia Pacific Pty Ltd He who asks is a fool for five minutes, but he who does not ask remains a fool forever." ~ Chinese proverb

1 0

[PATCH] sss_groupshow improvements
by Jakub Hrozek 10 Feb '10

10 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This patch fixes the following issues: * man page issues (#395) * show info on MPGs (#396) * recursively print indirect members (#397) * the list of groupnames is comma separated (#398) * output inconsistencies (#399) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktwbZkACgkQHsardTLnvCUl6gCffDSrlRrfr955H9o8Y55PteLz Kk8AoOk4Y1CgJuXXT4KcVulQDfMrkCko =38ve -----END PGP SIGNATURE-----

3 8

[PATCH] Make collection_queue.h and collection_stack.h into public headers
by Stephen Gallagher 10 Feb '10

10 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When we turned libcollection into a shared library, I neglected to include collection_queue.h and collection_stack.h in the list of installed public headers. These are necessary for the elapi split. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktywoQACgkQeiVVYja6o6O4PACfU3HZ5HBK0g3SqWKxDW7csgZ1 R2IAn0Gr3qccih/DhfOQslPgTVKmQg/C =JXTL -----END PGP SIGNATURE-----

2 4

[PATCH] Fix other memory alignment issues
by Jakub Hrozek 10 Feb '10

10 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Similar to George McCollister's patch to the pam code, this patch fixes other places in the code where we forced data into 32-bit alignment. Fixes: #390 George was testing KRB authentication with this patch and confirmed[1] it was working for him on ARM. I was running SSSD with this patch on x86_64 and did not spot any regressions. [1] https://fedorahosted.org/sssd/ticket/390#comment:3 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktx1hcACgkQHsardTLnvCUADwCgt9M05Clp45G7IUVLe/sFiJ1n ov8AoKSP2QGpoFXvAGGyEbmjfmBlG5sP =a2Yy -----END PGP SIGNATURE-----

3 4

[PATCH] Few misc minor man page bugs
by Jakub Hrozek 10 Feb '10

10 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 * sssd.conf * sbus_timeout was used in an example but explained nowhere * enum_cache_timeout unit was not defined * same for entry_cache_timeout * store_legacy_passwords option does not exist anymore * better example than domain/LOCAL - domain/LDAP which uses krb5/ldap * sssd.conf(5) listed sssd.conf(5) in SEE ALSO section * sssd-krb5, sssd-ldap * these include each other in SEE ALSO section -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktwbZMACgkQHsardTLnvCWosACdGFeykoTyFbiK8ELd6jjRcejA i7IAoJoR+Rm7tuvzqIs/ob2r6tP8vKgz =1Qkg -----END PGP SIGNATURE-----

2 4

[PATCH] Make return values more specific during password change
by Sumit Bose 10 Feb '10

10 Feb '10

Hi, with this patch a user should get a better hint what went wrong if a password change operation failed. bye, Sumit

2 4

[Transifex] File submitted via email to SSSD | master
by admin＠transifex.net 10 Feb '10

10 Feb '10

Hello sssd, this is Transifex at http://www.transifex.net. The following attached files were submitted to SSSD | master by raven <piotrdrag(a)gmail.com> Please, visit Transifex at http://www.transifex.net/projects/p/sssd/c/master/ in order to see the component page. Thank you, Transifex

2 2

[PATCH] Send a message to the user if the login is delayed
by Sumit Bose 10 Feb '10

10 Feb '10

Hi, if the option offline_failed_login_delay is set the authentication is denied for the specified number of minutes if the user the given a wrong password for offline_failed_login_attempts times. This patch sends a message to the user telling him when a new authentication will be accepted. bye, Sumit

2 2

[PATCH] Fix handling of the global context in the leak detector
by Sumit Bose 10 Feb '10

10 Feb '10

Hi, this patch fixes the handling of the global context in the leak test routine of some unit tests. Now it is initialize only once. bye, Sumit

3 2

[Transifex] File submitted via email to SSSD | master
by admin＠transifex.net 08 Feb '10

08 Feb '10

Hello sssd, this is Transifex at http://www.transifex.net. The following attached files were submitted to SSSD | master by raven <piotrdrag(a)gmail.com> Please, visit Transifex at http://www.transifex.net/projects/p/sssd/c/master/ in order to see the component page. Thank you, Transifex

2 1

[PATCH] Add some more .gitignore entries
by Stephen Gallagher 05 Feb '10

05 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 config.rpath: Automatically generated autoconf/libtool file .pyc, .pyo: Compiled python file .pydevproject: Python project file from Eclipse. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktsKRQACgkQeiVVYja6o6MQXwCfXqYqvxs4tBLFJdN0QtZhcZ83 UioAnRFzE8m7gr6oqPBpne7fRZnOZpbV =MDxw -----END PGP SIGNATURE-----

2 2

[PATCH] Add mandatory flag to SSSD config schema
by Stephen Gallagher 05 Feb '10

05 Feb '10

Also add list_mandatory_options() to both SSSDService and SSSDDomain objects. There is a new list_options_with_mandatory() function that will return a longer tuple than list_options(), including the mandatory flag directly. list_options() will still return the shorter tuple, for backwards-compatibility. This feature will allow authconfig (a consumer of the SSSDConfig API) to produce a simpler interface listing only the mandatory options for each provider. This should result in a less confusing GUI.

4 11

[PATCH] Added option to use libcrypto from OpenSSL instead of NSS.
by George McCollister 05 Feb '10

05 Feb '10

crypto_sha512crypt.c is a clone of nss_sha512crypt.c with the exception that all usage of NSS and related libraries has been switched to libcrypto. I renamed nss_sha512crypt.h to sha512crypt.h since it is common to both crypto_sha512crypt.c and nss_sha512crypt.c. Note that the random number generator is not seeded manually and thus relies on seeding done automatically by libcrypto. On some systems without /dev/urandom seeding may not be performed. See http://www.openssl.org/docs/crypto/RAND_add.html. Signed-off-by: George McCollister <georgem(a)novatech-llc.com> --- server/Makefile.am | 28 ++- server/configure.ac | 14 +- server/db/sysdb_ops.c | 2 +- server/responder/pam/pam_LOCAL_domain.c | 2 +- server/util/crypto_sha512crypt.c | 380 +++++++++++++++++++++++++++++++ server/util/nss_sha512crypt.h | 4 - server/util/sha512crypt.h | 4 + 7 files changed, 423 insertions(+), 11 deletions(-) create mode 100644 server/util/crypto_sha512crypt.c delete mode 100644 server/util/nss_sha512crypt.h create mode 100644 server/util/sha512crypt.h

3 7

[PATCH] Reactivate old fd handling conditionally
by Sumit Bose 05 Feb '10

05 Feb '10

Hi, this path reintroduces the old way of handling the file description of a LDAP connection if the connection callback is not available. Using the old way we cannot handle LDAP referrals and I think we should generate a DEBUG message if ldap_referrals is set to 'true' and add a hint to the man page. Do you agree? I didn't put these changes in the patch to make the review easier because if can be compared line by line with commit 7c8f422495347e6ff829246ebf5d7faad9f6d160 'Use ldap connection callbacks to get file descriptors'. bye, Sumit

2 5

[PATCH] Internationalize help messages
by Stephen Gallagher 05 Feb '10

05 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I discovered this while working on https://fedorahosted.org/sssd/ticket/389. We are not currently translating the help messages printed when 'sssd - --help' (or similar) is run. This patch depends on the "Enable debug_timestamps by default" patch. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktoedoACgkQeiVVYja6o6OT4gCdG5olOACApFewLDZhUSxPByAo BYYAoKbUqkcPbyE8PVld6sat+GGe00ig =Z/Aq -----END PGP SIGNATURE-----

2 2

[PATCH] Enable debug_timestamps by default
by Stephen Gallagher 05 Feb '10

05 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We will use timestamps unless they are explicitly disabled in the sssd.conf. I am not removing the --debug_timestamps option to the services so as to maintain backwards compatibility. This patch resolves https://fedorahosted.org/sssd/ticket/389 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktoO8QACgkQeiVVYja6o6PZYgCeN6yKUjsC49H3g4RCenpZhKeb SF4AnRaISQomzqGHbVXfv3wBggDf5pUp =Mkpi -----END PGP SIGNATURE-----

3 7

[PATCH] Add missing include
by Jakub Hrozek 05 Feb '10

05 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A one liner - I noticed that pam_sss.c uses snprintf but does not include stdio.h (vsnprintf is used elsewhere which is declared in correctly included stdarg.h) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEUEARECAAYFAktrGEYACgkQHsardTLnvCVC+wCeJ/UajRIbHg9uTkHZ8B9Iz3IG zkwAmMtYvjJW8tBM4W435ORBME0Ow0o= =EwMg -----END PGP SIGNATURE-----

3 2

[PATCH] Make resolve and failover test work with CK_FORK=no
by Sumit Bose 04 Feb '10

04 Feb '10

Hi, the resolver and failover unit test are using a leak checker which calls 'talloc_free(talloc_autofree_context());'. This is not recommended and makes the test fail it CK_FORK is set to 'no'. The attached patch introduces a global talloc context which should be used by the test instead of NULL for root of the memory hierarchy. bye, Sumit

3 3

[PATCH] Make krb5 and open checks work if forking is disabled
by Sumit Bose 03 Feb '10

03 Feb '10

Hi, this patch fixes two unit tests which failed of CK_FORK is set to no. bye, Sumit

2 3

[PATCHES] Split off helper libraries into their own packages
by Stephen Gallagher 03 Feb '10

03 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patches 0001-0003: License and package libpath_utils Patches 0004-0007: License and package libcollection. (Patch 0005 fixes an incorrect #include in collection.h) Patch 0008-0011: License and package libini_config. (Patch 0009 fixes an array index mistake that was throwing a compiler warning and would have been a potential memory-corruption bug.) Patch 0012-0014: License and package libref_array These are all very simple patches, there are just a bunch of them :) It should be an easy review. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktnHnYACgkQeiVVYja6o6NMbQCfVEgQD9IGBaWsy8kdaO3sESGR p+sAoJK6Cp4iThTI0JfhcUpCo8QnLELT =TSTp -----END PGP SIGNATURE-----

3 10

[PATCH] Warn the user if authentication happens offline
by Sumit Bose 02 Feb '10

02 Feb '10

Hi, this patch should fix #239. All translatable strings are in the pam client and now it should be quite easy to add new messages which should be presented to the user. It is quite easy to see this message for a console user, but currently a GUI user needs a very fast eye to catch the message in the gdm or screensaver window. Maybe we should ask the desktop people to send a PAM_TEXT_INFO message e.g. with libnotify to the user's desktop. bye, Sumit

3 5

sssd.spec for SLES
by Sergei V. Kovylov 02 Feb '10

02 Feb '10

Here you may find a patch for sssd.spec file which provide correct build sssd for SLES (testes on SLES10SP1). In brief: There are 3 essences: redhat fedora sles which are detected by /etc/<vendor release file> existence (ex. /etc/SuSE-release) in spec and all necessary actions are doing along the OS detection. Additionally for SLES there is "--without-selinux" flag while configuring, as SLES doesn't support SELinux.

3 16

[PATCH] Check cache_credentials in sysdb_cache_auth_send()
by Sumit Bose 02 Feb '10

02 Feb '10

Hi, although it might be good practice to check cache_credentials before calling sysdb_cache_auth_send() I think it make sense to add it here, too. E.g. if someone forgets to check before calling sysdb_cache_auth_send() and for some reason the configuration is changed from cache_credentials=true to false. Then we might access some old chached passwords although it is expected that offline authentication does not work anymore. bye, Sumit

2 4

[PATCH] First step to handle LDAP referrals
by Sumit Bose 02 Feb '10

02 Feb '10

Hi, these two patches are a first step to handle LDAP referrals. The first patch changes the way we add a file descriptor event to the event loop. Currently it was extracted from the LDAP handle. But here only the fd to the 'primary' LDAP server is stored. If a referral is found and LDAP_OPT_REFERRALS is set to LDAP_OPT_ON the openLDAP library will open new connections to the new LDAP servers automatically. To keep track of the activity on these connection we need to add the new fds to the event loop, too. To get the fds this patch introduces a connection callback where the fd is extracted from the provided data and added to the event loop. There is another callback which removes the fd from the event loop when ldap_unbind is called. The second patch adds the config option ldap_referrals to switch the referral chasing on and off. Authentication with referrals currently work under the following conditions: - the DN of the user is the same on both LDAP servers - the LDAP server is RHDS/FDS/389, openLDAP does not return the 'Referral' error code when binding to a referral object bye, Sumit

2 4

[PATCH] Add offline failed login counter
by Sumit Bose 02 Feb '10

02 Feb '10

Hi, this patch adds a counter for failed login attempts when offline. This should fix https://fedorahosted.org/sssd/ticket/78. bye, Sumit

2 8

On FAST support in SSSD
by Stephen Gallagher 02 Feb '10

02 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I think this discussion deserves wider exposure, so I'm forwarding it to the sssd-devel list. This pertains to https://fedorahosted.org/sssd/ticket/237 - Kerberos client functionality should be able to use FAST if available - -------- Original Message -------- Subject: On FAST support in SSSD Date: Thu, 28 Jan 2010 17:19:09 -0500 From: Nalin Dahyabhai <nalin(a)redhat.com> Organization: Red Hat, Inc. To: Stephen Gallagher <sgallagh(a)redhat.com> Stephen, I took a closer look at it, and here's what I can tell you: FAST uses a previously-obtained ticket, and an authenticator that's built using it, to encrypt AS requests and replies traded between the client and the KDC. This yields a few useful benefits: * The entire AS exchange is encrypted: eavesdroppers have to crack the armor ticket's key to even figure out who the client of the AS request is. Additionally, as the ticket's key is usually random rather than password-based, so dictionary attacks should be harder. * If the armor ticket was issued by a KDC whose identity was verified, then the AS reply is also verified (for example, the armor ticket could have been obtained using PKINIT, in which the client can verify the KDC's identity using the KDC's certificate). * The client and KDC can jointly select a key which is not based on the client's long-term password. * The authentication can be performed with a mechanism that doesn't yield a key, for example with an OTP token (in the current draft, the key used for encrypting the TGT is based on the armor key, possibly in combination with the OTP token). In the implementation we use, when the client software calls krb5_get_init_creds_opt_set_fast_ccache_name() to set the location of a ccache containing a suitable ticket, before calling krb5_get_init_creds_password(), the client uses FAST. If the client tries to use FAST and the server doesn't support it, then the client will treat that as an error and fail to obtain a TGT. If SSSD already has a credential cache when it goes to obtain a TGT for a user, this is probably a trivial addition, but I'd suggest it not be turned on by default. Hopefully it'd be available as an option for situations where it's already known that the KDC supports FAST (either beforehand or out-of-band, most likely). HTH, Nalin -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktnHTkACgkQeiVVYja6o6MNUgCeKWkk2Oh5m0DIMmxa21qPHcMJ yqAAnixWTbRG2sMxb3wI4hOtoWWZir6j =FMRt -----END PGP SIGNATURE-----

3 2

[PATCH] Force offline operation with SIGUSR1
by Stephen Gallagher 01 Feb '10

01 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 If the monitor receives SIGUSR1, it will instruct all providers to enter offline operation. If any individual provider receives SIGUSR1, it alone will enter offline operation. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkte/2wACgkQeiVVYja6o6PDgwCcCxuD8wots8zmop4zJLTsuq9k pqYAn30Am/r2UXkmHxw1BDEgITEI7hEp =Hf4R -----END PGP SIGNATURE-----

2 3

[PATCH] Updated collection patch
by Dmitri Pal 01 Feb '10

01 Feb '10

Hi, I removed semicolons. For the env var I opened a new issue. https://fedorahosted.org/sssd/ticket/394 I want to handle it separately and in one patch across all unit tests in "common". BTW I do not think we have any for path_utils, right? -- Thank you, Dmitri Pal Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

3 3

[PATCH] Rename PAM_USER_INFO to PAM_SYSTEM_INFO
by Sumit Bose 01 Feb '10

01 Feb '10

Hi, this patch just renames PAM_USER_INFO to PAM_SYSTEM_INFO. Currently PAM_USER_INFO is only used to send messages which are written to syslog by the PAM client. It is planned to add new messages which will be displayed to the user, e.g. if offline authentication was used. To avoid confusion I think this name change makes sense. bye, Sumit

3 7

[PATCH] Improve logging of pam_sss
by Sumit Bose 01 Feb '10

01 Feb '10

Hi, this patch makes the logging of pam_sss a bit clearer and less verbose. This should fix bz556534. This patch might affect testing, because some log messages are changed. bye, Sumit

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel February 2010