sssd-devel April 2010

sssd-devel@lists.fedorahosted.org

17 participants
63 discussions

[PATCH] Remove the NSS_LIBS and KRB5_LIBS variables from sssd.spec
by Stephen Gallagher 30 Apr '10

30 Apr '10

Due to the way RPM processes the %configure macro, these variables were not actually being passed down to recursive configure invocations. In other words, they were useless. Futhermore, in more recent Fedora versions (13+), some of the dependencies have moved from -lnss to -lnspr4. As a result, it is safer to rely on the complete output of 'pkg-config nss --libs' instead of restricting to -lnss. The downside to this is that it may result in linking unnecessarily against other NSS components such as libsmime3 and libplc4 (among others). However, since these are already dependencies of libnss itself, there should be no risk of them being unavailable on the platform when installed. -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/

2 3

pam_pkcs11.so is missing for LOCAL domain?
by David O'Brien 29 Apr '10

29 Apr '10

I'm using the authconfig gui on rhel6 beta to set up SSSD, and I get the following message: Authentication module /lib/security/pam_pkcs11.so is missing. Authentication process might not work correctly. /var/log/sssd/sssd_pam.log is empty /var/log/messages has nothing significant The sssd service is running, but I don't know what's going to work (or not). Is there something else I need to install for this? I'll provide more info if I get it. thanks -- David O'Brien Red Hat Asia Pacific Pty Ltd He who asks is a fool for five minutes, but he who does not ask remains a fool forever." ~ Chinese proverb

3 12

[PATCH] Make sss_userdel check for logged in users
by Jakub Hrozek 29 Apr '10

29 Apr '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 sss_userdel now refuses to delete users who are logged in unless --force is used. Fixes: #229 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkujfbIACgkQHsardTLnvCX4sACfZOYnwyRdRwP3vp6bSZXl0DbA 1oQAoK0FJuq6nnLl2pW4apXLhqK86PDS =OKSx -----END PGP SIGNATURE-----

6 23

[Fwd: Re: #456: Register with NetworkManager for notifications]
by Dmitri Pal 28 Apr '10

28 Apr '10

Is there any way to determine is this is a primary interface or not? I think we should treat interface through which we established connection th the server (in my terms "primary" interface) differently from other interfaces. If we get notification from the NM about the interface that we used to talk to server (i.e. "primary interface) we should go offline. If we get notification from a different interface we should ignore it. Thoughts? Thanks Dmitri -------- Original Message -------- Subject: Re: [SSSD] #456: Register with NetworkManager for notifications Date: Wed, 28 Apr 2010 15:02:49 -0000 From: SSSD <trac(a)fedorahosted.org> Reply-To: nobody(a)fedoraproject.org To: undisclosed-recipients:; References: <048.d00731159f061af1a3cdebde3f0f8c95(a)fedorahosted.org> #456: Register with NetworkManager for notifications ------------------------------+--------------------------------------------- Reporter: sgallagh | Owner: somebody Type: enhancement | Status: new Priority: major | Milestone: NEEDS_TRIAGE Component: Data Provider | Version: 1.1.1 Resolution: | Keywords: Fixedin: | Doc: 0 Tests: 1 | Docupdated: 0 Testsupdated: 0 | ------------------------------+--------------------------------------------- Comment (by simo): Note: this maybe harder then it seem at a first sight. We can really force offline mode only if *all* interfaces have been shut down. If only one of many is stopped we can't just blindly go oflline. Same sort of consideration for trying to go online apply. -- Ticket URL: <https://fedorahosted.org/sssd/ticket/456#comment:2> SSSD <http://fedorahosted.org/sssd> System Security Services Daemon -- Thank you, Dmitri Pal Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 2

[PATCH] Check for root in sysv init script
by Stephen Gallagher 26 Apr '10

26 Apr '10

If the user running the init script is not root, immediately report "Permission denied" and exit with EPERM. Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=584575 This works around a bug in killproc() that returns success even when it encounters a permission error. -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/

2 2

[PATCH] Two enhancements for PAM client
by Sumit Bose 26 Apr '10

26 Apr '10

Hi, the two patches attached should fix #446 and #417 respectively. For #417 a different solution, where the message is generated by SSSD and send to the client, would be possilbe. But I decided against it, because with the attached patch it is possilbe to support localized messages. bye, Sumit

4 10

[PATCH] IPA password migration (sssd-1-2 only)
by Sumit Bose 26 Apr '10

26 Apr '10

Hi, these two patches provides a new attempt for the IPA password migration feature. The first one wraps the Kerberos authentication in the Kerberos provider into a tevent request to make it easy accessible for IPA authentication. The LDAP provider already has all needed features as tevent requests. The second patch changes IPA auth to use only tevent request from the LDAP and Kerberos provider. The ipaMigrationEnabled flag is read from the server, too. Both patches only apply to sssd-1-2. Because of the sync sysdb patches in master it is not easy to merge the first patch. I will rewrite the first patch and provider the patches for master if we agree that the way the two patches here handle password migration is the way we want to go. bye, Sumit

2 5

[PATCH] Make the handling of fd events opaque
by Sumit Bose 26 Apr '10

26 Apr '10

Hi, to support the current effort to make the LDAP provider more robust this patch removes all the #ifdef HAVE_LDAP_CONNCB calls from the main code into a separate file which provides generic helper functions. bye, Sumit

4 9

[PATCH] Treat server names as case-insensitive in failover code
by Jakub Hrozek 26 Apr '10

26 Apr '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It didn't cause any issues, but I think hostnames should be treated as case-insensitive -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkvQKJ4ACgkQHsardTLnvCXZ2ACfaK7vjNCHbKXjJ/EBjiuuxY9m HKEAoNXLwycpG0qcXOcorbg0Yf6XUE1x =uABF -----END PGP SIGNATURE-----

3 4

[PATCH] Do not mark a request as failed twice
by Jakub Hrozek 26 Apr '10

26 Apr '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This was causing occasional crashes during SRV testing as the callback got called twice -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkvQeNIACgkQHsardTLnvCX2NgCg4Fn5QDHx1gU5eS+gq8W8QYlu 55AAnRPTE0psFK47QGeD8h+YazGmpXSt =Jhz0 -----END PGP SIGNATURE-----

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel April 2010