February 2010 - sssd-devel - Fedora mailing-lists

[PATCH] Remove ELAPI from the SSSD repo
by Stephen Gallagher 12 Feb '10

12 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ELAPI now lives at https://fedorahosted.org/ELAPI This patch removes the ELAPI source from the tree (and build). The patch is gzipped because all the deleted text is included (making the patch very large) - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktxz0IACgkQeiVVYja6o6NX1gCcDSUz41/SlanwKcQC2rOYUgKi MYoAoKwN8MTgImVWJTCx+Pr9wNxP3AGH =Oxgf -----END PGP SIGNATURE-----

2 2

[PATCH] gitignore additions
by Jakub Hrozek 12 Feb '10

12 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 add some binaries to .gitignore -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt1Ru8ACgkQHsardTLnvCUSHwCZAbA8V4tNRAHaeTxAhFC57pKh eF0AnR1HMffb39h9v7Ug//OQboCjIFCe =J+G/ -----END PGP SIGNATURE-----

2 2

[PATCH] Make change password errors more transparent
by Sumit Bose 12 Feb '10

12 Feb '10

Hi, this patch send the error message from an LDAP or Kerberos server back to the user if a password change fails. I think we do not disclose information here, because the user is already authenticated with his old password during this operation. Currently thers is no easy way to translate these messages. bye, Sumit

2 2

[PATCH] Don't pass a variable as format to talloc_asprintf()
by Martin Nagy 12 Feb '10

12 Feb '10

Hi, SSIA. Martin

2 2

Developing custom SSSD data provider backends
by Stephen Gallagher 11 Feb '10

11 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For the last week, I've been working on developing a set of guidelines on how to create a custom SSSD data provider backend. These backends would be capable of performing identification and/or authentication to custom mechanisms (such as winbind, NIS, SecurID, etc.) First, I'd like to describe the way things work internally (for the benefit of anyone not intimately familiar), then I'll go into the issues we're facing with allowing custom backends. Currently, the SSSD provides two services that face the system: NSS and PAM. This is done by way of very lightweight NSS and PAM modules that can be loaded automatically by nsswitch.conf or the PAM stack and that then pass the request across a privileged pipe to the sssd_nss or sssd_pam services (as appropriate). Each time a request comes in, the service first queries the internal sysdb to determine whether the entry already exists in an unexpired cache entry. If it does not exist (or is expired), the service then must communicate directly with a backend provider to update the cache. This is done over a private pipe using the D-BUS protocol (we refer to communications over this pipe as SBUS communications, so as not to be confused with communications going over the system bus). When a data provider backend receives the request, it then contacts its own information source (LDAP, NIS, etc.) in an appropriate manner, retrieving the information and updating the sysdb cache. It then returns a message to the NSS/PAM service stating only whether the communication succeeded (and if not, an error message describing the problem). Assuming that it succeeded, the service will then query the sysdb again, this time receiving an updated entry. Now, it is important to note here that at no time does the communication on the SBUS carry the result of the lookup that is performed by the provider backend. It only carries the success/failure message. The true final result is only returned from the sysdb, when it is queried after the provider replies. Because of this design, it is necessary for all data providers to be capable of writing directly to the sysdb. This introduces some serious concerns for potential backend implementers. The sysdb is designed to be an asynchronous interface using the tevent mainloop. There is currently no way to integrate the sysdb with any other mainloop, because at its heart, the sysdb operates on an LDB database, which also mandates the use of tevent for asynchronous operation. So, in order to implement a backend provider, the provider must be written in C and built around libtevent. This is not likely to be an acceptable set of requirements for many implementers. I've been trying to work around this, and I have come up with a few potential approaches to this problem. 1) We can create a sync wrapper around all calls to the sysdb and hides the requirement for tevent. Internally, all calls to the actual LDB are effectively synchronous, so the performance shouldn't be too poor, though there is still a chance that some of the longer operations (like initgroups commands with large user bases) may block for an extended period of time. 2) We can fork a process/spawn a thread to do the processing outside of main execution and signal our completion. As I understand it, this is the approach SELinux takes to asynchronous operation. This would likely be a tremendous amount of work. 3) We can create a new SSSD service (sssd_sysdb?) that exposes the sysdb over the SBUS(or even the system bus) restricted to root processes. This might be the most future-compatible approach, but it too is a lot of work (though I believe it to be less work than option 2) 4) We can go back to our original plan of having third-party implementers follow our internal example and write shared objects that can be loaded by the sssd_be process. This approach handles the mainloop integration internally, thereby simplifying it for the implementers, but it carries potential licensing issues. Since the sssd_be is licensed as GPL, any shared object that it loads needs to be GPL-compatible. This won't fly for companies that want to create a closed-source backend. This is the least amount of work (almost none). - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkt0Rr4ACgkQeiVVYja6o6PjbACfUFDIqTNHDiduguFv+lrIGbrZ LgwAoKPmPp6GZYsydREqPz9/J2EhKVhX =nmc3 -----END PGP SIGNATURE-----

2 3

extent of doc change for bug #167
by David O'Brien 11 Feb '10

11 Feb '10

https://fedorahosted.org/sssd/ticket/167 Again, I don't know what notifications are sent out for closed bugs, hence the email. cheers -- David O'Brien Red Hat Asia Pacific Pty Ltd He who asks is a fool for five minutes, but he who does not ask remains a fool forever." ~ Chinese proverb

1 0

[PATCH] sss_groupshow improvements
by Jakub Hrozek 10 Feb '10

10 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This patch fixes the following issues: * man page issues (#395) * show info on MPGs (#396) * recursively print indirect members (#397) * the list of groupnames is comma separated (#398) * output inconsistencies (#399) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktwbZkACgkQHsardTLnvCUl6gCffDSrlRrfr955H9o8Y55PteLz Kk8AoOk4Y1CgJuXXT4KcVulQDfMrkCko =38ve -----END PGP SIGNATURE-----

3 8

[PATCH] Make collection_queue.h and collection_stack.h into public headers
by Stephen Gallagher 10 Feb '10

10 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When we turned libcollection into a shared library, I neglected to include collection_queue.h and collection_stack.h in the list of installed public headers. These are necessary for the elapi split. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktywoQACgkQeiVVYja6o6O4PACfU3HZ5HBK0g3SqWKxDW7csgZ1 R2IAn0Gr3qccih/DhfOQslPgTVKmQg/C =JXTL -----END PGP SIGNATURE-----

2 4

[PATCH] Fix other memory alignment issues
by Jakub Hrozek 10 Feb '10

10 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Similar to George McCollister's patch to the pam code, this patch fixes other places in the code where we forced data into 32-bit alignment. Fixes: #390 George was testing KRB authentication with this patch and confirmed[1] it was working for him on ARM. I was running SSSD with this patch on x86_64 and did not spot any regressions. [1] https://fedorahosted.org/sssd/ticket/390#comment:3 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktx1hcACgkQHsardTLnvCUADwCgt9M05Clp45G7IUVLe/sFiJ1n ov8AoKSP2QGpoFXvAGGyEbmjfmBlG5sP =a2Yy -----END PGP SIGNATURE-----

3 4

[PATCH] Few misc minor man page bugs
by Jakub Hrozek 10 Feb '10

10 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 * sssd.conf * sbus_timeout was used in an example but explained nowhere * enum_cache_timeout unit was not defined * same for entry_cache_timeout * store_legacy_passwords option does not exist anymore * better example than domain/LOCAL - domain/LDAP which uses krb5/ldap * sssd.conf(5) listed sssd.conf(5) in SEE ALSO section * sssd-krb5, sssd-ldap * these include each other in SEE ALSO section -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktwbZMACgkQHsardTLnvCWosACdGFeykoTyFbiK8ELd6jjRcejA i7IAoJoR+Rm7tuvzqIs/ob2r6tP8vKgz =1Qkg -----END PGP SIGNATURE-----

2 4

[PATCH] Make return values more specific during password change
by Sumit Bose 10 Feb '10

10 Feb '10

Hi, with this patch a user should get a better hint what went wrong if a password change operation failed. bye, Sumit

2 4

[Transifex] File submitted via email to SSSD | master
by admin＠transifex.net 10 Feb '10

10 Feb '10

Hello sssd, this is Transifex at http://www.transifex.net. The following attached files were submitted to SSSD | master by raven <piotrdrag(a)gmail.com> Please, visit Transifex at http://www.transifex.net/projects/p/sssd/c/master/ in order to see the component page. Thank you, Transifex

2 2

[PATCH] Send a message to the user if the login is delayed
by Sumit Bose 10 Feb '10

10 Feb '10

Hi, if the option offline_failed_login_delay is set the authentication is denied for the specified number of minutes if the user the given a wrong password for offline_failed_login_attempts times. This patch sends a message to the user telling him when a new authentication will be accepted. bye, Sumit

2 2

[PATCH] Fix handling of the global context in the leak detector
by Sumit Bose 10 Feb '10

10 Feb '10

Hi, this patch fixes the handling of the global context in the leak test routine of some unit tests. Now it is initialize only once. bye, Sumit

3 2

[Transifex] File submitted via email to SSSD | master
by admin＠transifex.net 08 Feb '10

08 Feb '10

Hello sssd, this is Transifex at http://www.transifex.net. The following attached files were submitted to SSSD | master by raven <piotrdrag(a)gmail.com> Please, visit Transifex at http://www.transifex.net/projects/p/sssd/c/master/ in order to see the component page. Thank you, Transifex

2 1

[PATCH] Add some more .gitignore entries
by Stephen Gallagher 05 Feb '10

05 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 config.rpath: Automatically generated autoconf/libtool file .pyc, .pyo: Compiled python file .pydevproject: Python project file from Eclipse. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktsKRQACgkQeiVVYja6o6MQXwCfXqYqvxs4tBLFJdN0QtZhcZ83 UioAnRFzE8m7gr6oqPBpne7fRZnOZpbV =MDxw -----END PGP SIGNATURE-----

2 2

[PATCH] Add mandatory flag to SSSD config schema
by Stephen Gallagher 05 Feb '10

05 Feb '10

Also add list_mandatory_options() to both SSSDService and SSSDDomain objects. There is a new list_options_with_mandatory() function that will return a longer tuple than list_options(), including the mandatory flag directly. list_options() will still return the shorter tuple, for backwards-compatibility. This feature will allow authconfig (a consumer of the SSSDConfig API) to produce a simpler interface listing only the mandatory options for each provider. This should result in a less confusing GUI.

4 11

[PATCH] Added option to use libcrypto from OpenSSL instead of NSS.
by George McCollister 05 Feb '10

05 Feb '10

crypto_sha512crypt.c is a clone of nss_sha512crypt.c with the exception that all usage of NSS and related libraries has been switched to libcrypto. I renamed nss_sha512crypt.h to sha512crypt.h since it is common to both crypto_sha512crypt.c and nss_sha512crypt.c. Note that the random number generator is not seeded manually and thus relies on seeding done automatically by libcrypto. On some systems without /dev/urandom seeding may not be performed. See http://www.openssl.org/docs/crypto/RAND_add.html. Signed-off-by: George McCollister <georgem(a)novatech-llc.com> --- server/Makefile.am | 28 ++- server/configure.ac | 14 +- server/db/sysdb_ops.c | 2 +- server/responder/pam/pam_LOCAL_domain.c | 2 +- server/util/crypto_sha512crypt.c | 380 +++++++++++++++++++++++++++++++ server/util/nss_sha512crypt.h | 4 - server/util/sha512crypt.h | 4 + 7 files changed, 423 insertions(+), 11 deletions(-) create mode 100644 server/util/crypto_sha512crypt.c delete mode 100644 server/util/nss_sha512crypt.h create mode 100644 server/util/sha512crypt.h

3 7

[PATCH] Reactivate old fd handling conditionally
by Sumit Bose 05 Feb '10

05 Feb '10

Hi, this path reintroduces the old way of handling the file description of a LDAP connection if the connection callback is not available. Using the old way we cannot handle LDAP referrals and I think we should generate a DEBUG message if ldap_referrals is set to 'true' and add a hint to the man page. Do you agree? I didn't put these changes in the patch to make the review easier because if can be compared line by line with commit 7c8f422495347e6ff829246ebf5d7faad9f6d160 'Use ldap connection callbacks to get file descriptors'. bye, Sumit

2 5

[PATCH] Internationalize help messages
by Stephen Gallagher 05 Feb '10

05 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I discovered this while working on https://fedorahosted.org/sssd/ticket/389. We are not currently translating the help messages printed when 'sssd - --help' (or similar) is run. This patch depends on the "Enable debug_timestamps by default" patch. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktoedoACgkQeiVVYja6o6OT4gCdG5olOACApFewLDZhUSxPByAo BYYAoKbUqkcPbyE8PVld6sat+GGe00ig =Z/Aq -----END PGP SIGNATURE-----

2 2

[PATCH] Enable debug_timestamps by default
by Stephen Gallagher 05 Feb '10

05 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We will use timestamps unless they are explicitly disabled in the sssd.conf. I am not removing the --debug_timestamps option to the services so as to maintain backwards compatibility. This patch resolves https://fedorahosted.org/sssd/ticket/389 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktoO8QACgkQeiVVYja6o6PZYgCeN6yKUjsC49H3g4RCenpZhKeb SF4AnRaISQomzqGHbVXfv3wBggDf5pUp =Mkpi -----END PGP SIGNATURE-----

3 7

[PATCH] Add missing include
by Jakub Hrozek 05 Feb '10

05 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A one liner - I noticed that pam_sss.c uses snprintf but does not include stdio.h (vsnprintf is used elsewhere which is declared in correctly included stdarg.h) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEUEARECAAYFAktrGEYACgkQHsardTLnvCVC+wCeJ/UajRIbHg9uTkHZ8B9Iz3IG zkwAmMtYvjJW8tBM4W435ORBME0Ow0o= =EwMg -----END PGP SIGNATURE-----

3 2

[PATCH] Make resolve and failover test work with CK_FORK=no
by Sumit Bose 04 Feb '10

04 Feb '10

Hi, the resolver and failover unit test are using a leak checker which calls 'talloc_free(talloc_autofree_context());'. This is not recommended and makes the test fail it CK_FORK is set to 'no'. The attached patch introduces a global talloc context which should be used by the test instead of NULL for root of the memory hierarchy. bye, Sumit

3 3

[PATCH] Make krb5 and open checks work if forking is disabled
by Sumit Bose 03 Feb '10

03 Feb '10

Hi, this patch fixes two unit tests which failed of CK_FORK is set to no. bye, Sumit

2 3

[PATCHES] Split off helper libraries into their own packages
by Stephen Gallagher 03 Feb '10

03 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patches 0001-0003: License and package libpath_utils Patches 0004-0007: License and package libcollection. (Patch 0005 fixes an incorrect #include in collection.h) Patch 0008-0011: License and package libini_config. (Patch 0009 fixes an array index mistake that was throwing a compiler warning and would have been a potential memory-corruption bug.) Patch 0012-0014: License and package libref_array These are all very simple patches, there are just a bunch of them :) It should be an easy review. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktnHnYACgkQeiVVYja6o6NMbQCfVEgQD9IGBaWsy8kdaO3sESGR p+sAoJK6Cp4iThTI0JfhcUpCo8QnLELT =TSTp -----END PGP SIGNATURE-----

3 10

[PATCH] Warn the user if authentication happens offline
by Sumit Bose 02 Feb '10

02 Feb '10

Hi, this patch should fix #239. All translatable strings are in the pam client and now it should be quite easy to add new messages which should be presented to the user. It is quite easy to see this message for a console user, but currently a GUI user needs a very fast eye to catch the message in the gdm or screensaver window. Maybe we should ask the desktop people to send a PAM_TEXT_INFO message e.g. with libnotify to the user's desktop. bye, Sumit

3 5

sssd.spec for SLES
by Sergei V. Kovylov 02 Feb '10

02 Feb '10

Here you may find a patch for sssd.spec file which provide correct build sssd for SLES (testes on SLES10SP1). In brief: There are 3 essences: redhat fedora sles which are detected by /etc/<vendor release file> existence (ex. /etc/SuSE-release) in spec and all necessary actions are doing along the OS detection. Additionally for SLES there is "--without-selinux" flag while configuring, as SLES doesn't support SELinux.

3 16

[PATCH] Check cache_credentials in sysdb_cache_auth_send()
by Sumit Bose 02 Feb '10

02 Feb '10

Hi, although it might be good practice to check cache_credentials before calling sysdb_cache_auth_send() I think it make sense to add it here, too. E.g. if someone forgets to check before calling sysdb_cache_auth_send() and for some reason the configuration is changed from cache_credentials=true to false. Then we might access some old chached passwords although it is expected that offline authentication does not work anymore. bye, Sumit

2 4

[PATCH] First step to handle LDAP referrals
by Sumit Bose 02 Feb '10

02 Feb '10

Hi, these two patches are a first step to handle LDAP referrals. The first patch changes the way we add a file descriptor event to the event loop. Currently it was extracted from the LDAP handle. But here only the fd to the 'primary' LDAP server is stored. If a referral is found and LDAP_OPT_REFERRALS is set to LDAP_OPT_ON the openLDAP library will open new connections to the new LDAP servers automatically. To keep track of the activity on these connection we need to add the new fds to the event loop, too. To get the fds this patch introduces a connection callback where the fd is extracted from the provided data and added to the event loop. There is another callback which removes the fd from the event loop when ldap_unbind is called. The second patch adds the config option ldap_referrals to switch the referral chasing on and off. Authentication with referrals currently work under the following conditions: - the DN of the user is the same on both LDAP servers - the LDAP server is RHDS/FDS/389, openLDAP does not return the 'Referral' error code when binding to a referral object bye, Sumit

2 4

[PATCH] Add offline failed login counter
by Sumit Bose 02 Feb '10

02 Feb '10

Hi, this patch adds a counter for failed login attempts when offline. This should fix https://fedorahosted.org/sssd/ticket/78. bye, Sumit

2 8

On FAST support in SSSD
by Stephen Gallagher 02 Feb '10

02 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I think this discussion deserves wider exposure, so I'm forwarding it to the sssd-devel list. This pertains to https://fedorahosted.org/sssd/ticket/237 - Kerberos client functionality should be able to use FAST if available - -------- Original Message -------- Subject: On FAST support in SSSD Date: Thu, 28 Jan 2010 17:19:09 -0500 From: Nalin Dahyabhai <nalin(a)redhat.com> Organization: Red Hat, Inc. To: Stephen Gallagher <sgallagh(a)redhat.com> Stephen, I took a closer look at it, and here's what I can tell you: FAST uses a previously-obtained ticket, and an authenticator that's built using it, to encrypt AS requests and replies traded between the client and the KDC. This yields a few useful benefits: * The entire AS exchange is encrypted: eavesdroppers have to crack the armor ticket's key to even figure out who the client of the AS request is. Additionally, as the ticket's key is usually random rather than password-based, so dictionary attacks should be harder. * If the armor ticket was issued by a KDC whose identity was verified, then the AS reply is also verified (for example, the armor ticket could have been obtained using PKINIT, in which the client can verify the KDC's identity using the KDC's certificate). * The client and KDC can jointly select a key which is not based on the client's long-term password. * The authentication can be performed with a mechanism that doesn't yield a key, for example with an OTP token (in the current draft, the key used for encrypting the TGT is based on the armor key, possibly in combination with the OTP token). In the implementation we use, when the client software calls krb5_get_init_creds_opt_set_fast_ccache_name() to set the location of a ccache containing a suitable ticket, before calling krb5_get_init_creds_password(), the client uses FAST. If the client tries to use FAST and the server doesn't support it, then the client will treat that as an error and fail to obtain a TGT. If SSSD already has a credential cache when it goes to obtain a TGT for a user, this is probably a trivial addition, but I'd suggest it not be turned on by default. Hopefully it'd be available as an option for situations where it's already known that the KDC supports FAST (either beforehand or out-of-band, most likely). HTH, Nalin -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAktnHTkACgkQeiVVYja6o6MNUgCeKWkk2Oh5m0DIMmxa21qPHcMJ yqAAnixWTbRG2sMxb3wI4hOtoWWZir6j =FMRt -----END PGP SIGNATURE-----

3 2

[PATCH] Force offline operation with SIGUSR1
by Stephen Gallagher 01 Feb '10

01 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 If the monitor receives SIGUSR1, it will instruct all providers to enter offline operation. If any individual provider receives SIGUSR1, it alone will enter offline operation. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkte/2wACgkQeiVVYja6o6PDgwCcCxuD8wots8zmop4zJLTsuq9k pqYAn30Am/r2UXkmHxw1BDEgITEI7hEp =Hf4R -----END PGP SIGNATURE-----

2 3

[PATCH] Updated collection patch
by Dmitri Pal 01 Feb '10

01 Feb '10

Hi, I removed semicolons. For the env var I opened a new issue. https://fedorahosted.org/sssd/ticket/394 I want to handle it separately and in one patch across all unit tests in "common". BTW I do not think we have any for path_utils, right? -- Thank you, Dmitri Pal Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

3 3

[PATCH] Rename PAM_USER_INFO to PAM_SYSTEM_INFO
by Sumit Bose 01 Feb '10

01 Feb '10

Hi, this patch just renames PAM_USER_INFO to PAM_SYSTEM_INFO. Currently PAM_USER_INFO is only used to send messages which are written to syslog by the PAM client. It is planned to add new messages which will be displayed to the user, e.g. if offline authentication was used. To avoid confusion I think this name change makes sense. bye, Sumit

3 7

[PATCH] Improve logging of pam_sss
by Sumit Bose 01 Feb '10

01 Feb '10

Hi, this patch makes the logging of pam_sss a bit clearer and less verbose. This should fix bz556534. This patch might affect testing, because some log messages are changed. bye, Sumit

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel February 2010