sssd-devel August 2010

sssd-devel@lists.fedorahosted.org

17 participants
48 discussions

[PATCH] Fix incorrect NULL check (sssd-1-2)
by Stephen Gallagher 03 Aug '10

03 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Discovered with Coverity, the recent patch for RFC2307bis had an incorrect NULL check. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxYUuwACgkQeiVVYja6o6NBcACghWI/XerS/m4pKuHNRcBurEp9 94gAn3IKGf52qYNG1SybMapdzdzR7uwO =cJMs -----END PGP SIGNATURE-----

2 2

[PATCHES] Fix severe performance problems with initgroups (master)
by Stephen Gallagher 03 Aug '10

03 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Attached are the patches to fix the initgroups performance issue for the master branch. Patches 0001-0004 applied trivially to the master, patches 0005 and 0006 had to be rewritten to take advantage of the synchronous sysdb interface, but this has made them distinctly easier to follow. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxW6yQACgkQeiVVYja6o6OyIACgkObEJVrkEP/vtfrp/fWEE9t9 Pc4An0eupHrASaNPA6Qe9I9oxK2RXc/e =KYcj -----END PGP SIGNATURE-----

2 4

[PATCH] be_pam_handler(): Fix potential NULL dereference
by Stephen Gallagher 03 Aug '10

03 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Discovered with Coverity, if we failed to allocate be_req in be_pam_handler(), we would attempt to dereference a NULL value. This patch is for both 1.2 and master. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxYUk4ACgkQeiVVYja6o6OBuQCfdq+XN9FxYHPgfzL5crb7sSOx 7LUAnA/klcFtVsUR24r/ZWqi7uD37GZJ =IeAj -----END PGP SIGNATURE-----

2 2

Fix two bugs found by clang
by Jakub Hrozek 03 Aug '10

03 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The attached patches fix two bugs found by the clang static analyser. Both of them masked potential errors, the first one when parsing of a HBAC rule fails, the second one when unexpected status of a service lookup..the routines would return EOK instead of some error code in both cases. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxYSBMACgkQHsardTLnvCXEEACfaTmUfsGD5nFuovDuqeUyL955 Y8cAoJSB5IAmf/CwDdpTl9jqbTYc48tS =adMK -----END PGP SIGNATURE-----

2 2

[PATCH] Require -ltalloc for tevent configure check
by Stephen Gallagher 03 Aug '10

03 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This configure check doesn't work when --as-needed is passed as a configure flag to LDFLAGS. We need to explicitly include -ltalloc here. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxYMZIACgkQeiVVYja6o6O+AQCgk3NogK55mQLV/AuVML9MeC8q xUUAoKuEcrkpZbj1s3gijXhZy/ggSl7H =4Ro7 -----END PGP SIGNATURE-----

2 2

[PATCH] Validate keytab at startup
by Jakub Hrozek 03 Aug '10

03 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In addition to validating the keytab everytime a TGT is requested, we also validate the keytab on back end startup to give early warning that the keytab is not usable. Fixes: #556 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxHF4YACgkQHsardTLnvCUHuwCfdvEPJkqZqAs2XYW0g/TVgUCt H5oAoKO1CG++6xQQi02dTss/Hjo5uPa2 =N5+t -----END PGP SIGNATURE-----

2 6

Announcing the release of SSSD 1.2.2
by Stephen Gallagher 02 Aug '10

02 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The SSSD team is proud to announce the bugfix release 1.2.2 of the System Security Services Daemon. As usual, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * The LDAP provider no longer requires access to the LDAP RootDSE. If it is unavailable, we will continue on with our best guess * The LDAP provider will now log issues with TLS and GSSAPI to the syslog * Significant performance improvement when performing initgroups on users who are members of large groups in LDAP. * The sss_client will now reconnect properly to the SSSD if the daemon is restarted. * This resolves an issue causing GDM to crash when logging out of a user after the SSSD had been restarted. == Detailed Release Notes == Alexander Gordeev (1): * Add explicit requests for several operational attrs Dmitri Pal (1): * Fixing types in queue and stack interfaces Stephen Gallagher (14): * Drop release requirement from versions * Bump libini_config version to 0.5.1 * Make RootDSE optional * Add sss_log() function * Add log notifications for startup and shutdown. * Add syslog messages for LDAP GSSAPI bind * Log TLS errors to syslog * Add sysdb_attrs_to_list() utility function * Add diff_string_lists utility function * Add sysdb_group_dn_name utility function * Add dup_string_list() utility function * Add sysdb_update_members function * Clean up initgroups processing for RFC2307 * Release SSSD 1.2.2 Sumit Bose (2): * Fix SASL authentication * Allow sssd clients to reconnect - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxXFE4ACgkQeiVVYja6o6NGtQCffvp/LKIXBmGyFJzYcSuIeElE b7AAn16ikvGVDald3nXSdoHasI8LbZSv =T5Iu -----END PGP SIGNATURE-----

1 0

sssd and kerberos.
by Patrik Martinsson 02 Aug '10

02 Aug '10

Hello, I've successfully setup'ed sssd on our systems to connect to our Microsoft AD with ldap authentication, now i want to use kerberos instead, and have I of course ran into some problems :) To start with, I'm not to familiar with kerberos so go easy on me here. I've successfully created a machineaccount in AD (with msktutil, also got it working with samba/net join) and obtained a kerberos keytab. A user can obtain a ticket by running 'kinit foouser', thereafter he/she can run for example 'ldapsearch -b 'ou=xx,dc=xx,dc=xx,dc=xx' -Omaxssf=0 "(&(objectclass=user)(cn=xx))" uid' successfully. Here's to my question, (maybe this rather should be in a kerberos mailinglist, or maybe i should read a book however it's easiest to ask here :)) Is the keytab used by sssd to authenticate to the kdc, is this even how it works ? Since the sssd is runned by root and root has no ticket, i figured it would work that way, but maybe I'm mistaken, maybe it's suppose to work in some other way ? Here's the krb5 part of the sssd.conf auth_provider = krb5 krb5_kdcip = 123.123.123.123 krb5_realm = foo krb5_changepw_principle = kadmin/changepw krb5_ccachedir = /tmp krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX krb5_auth_timeout = 15 krb5_keytab = /etc/krb5.keytab When i start sssd with -d10 i cant really see much messages about the kerberos authentication whether it fails or not, however i can see 'Search result: Operations error(1), 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece' which suggest that i cannot bind to ldap, right ? Any suggestions where to go from here, ? Best regards, Patrik Martinsson, Sweden.

2 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2010