December 2011 - sssd-devel - Fedora mailing-lists

[PATCH] Allow more libldap debugging
by Jakub Hrozek 28 Nov '12

28 Nov '12

This patch should not be pushed to master, but I would like to get it reviewed anyway. It should be used to provide a custom build for users experiencing cases where ldap_search_ext would block (c.f. https://bugzilla.redhat.com/show_bug.cgi?id=728343) For example: export SSSD_DEBUG_LDAP_SEARCH="0xffff" would set LDAP_DEBUG_ANY The attached patch applies cleanly on the RHEL6.1 branch. I also have a version that applies on master/1.5 if needed.

4 7

[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal 05 Apr '12

05 Apr '12

Please see the attached patches. I tried to split the patches logically into manageable sets. Unfortunately I made a minor mistake and I am afraid I will do something wrong to fix it. I merged two wrong patches. Fortunately it was three liner with 1 liner so it is not a big of the deal but I am really scared that I will do something wrong and loose the work I have done. So I hope it is Ok to send it as is. 0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted earlier that I merged by mistake. I was supposed to merge it with patch 25 but picked the wrong one instead. Patch 25 addresses the real issue found by Coverity as mentioned in Stephen's review mail but it did not apply cleanly since it relies on some code from the patches in the middle. 0002--INI-Adding-missing-function-declararion.patch <- this is the patch that was rejected from the second set sent earlier. Fixed according to review comment. 0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing per component The following set of patches introduces the merging of sections during the reading of the file: 0004--INI-New-error-codes-and-messages.patch 0005--INI-New-merge-flags.patch 0006--INI-Add-new-vars-to-parse-structure.patch 0007--INI-Add-save_error-function.patch 0008--INI-Change-parse_error-to-use-save_error.patch 0009--INI-Preparing-for-merging-sections.patch 0010--INI-Enhance-value-processing.patch 0011--INI-Use-section-line-number.patch 0012--INI-Refactor-section-processing.patch 0013--INI-Return-error-in-DETECT-mode.patch 0014--INI-New-test-files-for-section-merge.patch 0015--INI-Test-DETECT-mode-and-use-new-file.patch 0016--INI-Test-for-all-section-merge-modes.patch Patches related porting of the meta data from old way of doing things to the new way of doing things: 0017--INI-Separate-close-and-destroy.patch 0018--INI-Function-to-reopen-file.patch 0019--INI-Metadata-collection-is-gone.patch 0020--INI-Check-access-function.patch 0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check) 0022--INI-Function-to-check-for-changes.patch 0023--INI-Tests-for-access-and-changes.patch 0024--INI-Rename-error-print-function.patch <- rename error printing function for consistency with new interface 0025--INI-Initialize-variables-in-loops.patch <- Coverity issue addressed. Related to patch 0001. 0026--INI-Exposing-functions.patch <- Make some internal functions reusable There is also patch 27. It is a piece of new functionality. It is a preview. Please see the comment before reviewing it. Do I need to split it into multiple patches or it is Ok as is? It is pretty big but all changes are in one file and logically related. The UNIT test is missing so I am not claiming it actually works as expected. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 30

[PATCHES] SUDO Integration
by Pavel Březina 17 Jan '12

17 Jan '12

https://fedorahosted.org/sssd/ticket/1105 (review ticket) https://fedorahosted.org/sssd/ticket/623 (sudo integration) Hello, it is finally here. These patches *assume* that "Responders: Split getting domain by name into separate function" patch has been applied, it can be found in "Ability to set a domain as case sensitive or insensitive" thread. Design page: https://fedorahosted.org/sssd/wiki/DesignDocs/SUDOIntegrationNewApproach What's left: 1. implementing support of sssd in sudo sudoers plugin 2. periodical update of all rules 3. provide documentation 4. in memory cache in responder 5. refactor DP request using "RESPONDER: Refactor DP requests into tevent_req style" patch 6. provide few more configuration options 7. support the IPA scheme How to configure it: 1. configure --enable-all-experimental-features 2. sssd.conf: services += sudo domain options: sudo_provider, ldap_sudo_search_base How to test it: > sss_sudo_cli username This will display rules for %username. It performs two lookups: 1. using native sssd api to get and display raw date (it prints every byte as char so don't be scared of silly characters that are shown instead of numbers) 2. using api that we provide to sudo and use it to display data in user readable format Big thanks to Jakub, who has written whole sysdb api and a big part of responder. Regards, Pavel Březina.

4 23

[PATCHES] SUDO Integration - periodical update
by Pavel Březina 17 Jan '12

17 Jan '12

https://fedorahosted.org/sssd/ticket/1110 [PATCH 1/4] I've removed FIXME and move the DEBUG message to a better place. [PATCH 2/4] I've wrapped the data provider part with tevent request so I can reuse the code in periodical updates. [PATCH 3/4] Adds two new functions in sudo sysdb api that can set/retrieve the value of 'refreshed' attribute (equivalent to 'has_enumerated' attribute in domain enumeration). If it is true, the first schedule will be delayed for a few seconds so we don't slow down the start up process. [PATCH 4/4] Periodical update itself. It adds two new options: ldap_sudo_refresh_enabled (bool) - equivalent to 'enumerate' ldap_sudo_refresh_timeout (number) - equivalent to 'ldap_enumeration_refresh_timeout'

4 10

SSSD and Kerberos
by Alexander Blair 11 Jan '12

11 Jan '12

Hello, I've been working with FC 16 and SSSD for about two days now trying to get SSSD to properly talk to our Kerberos server, and it seems to continually ignore the fact I've got it configured to do so at this time. Tracking the logs has shown me nothing useful as of yet, and monitoring network traffic on the Krb server itself shows that there's no network communication happening. I've even gone as far as to completely purge the working directory for it's caches, and force them to rebuild, restarting the box, nothing I've done so far seems to force SSSD to contact Krb for auth information, any ideas on where to take this would be most excellent. I'm currently using SSSD 1.6.3 from the main FC repos. I've gone though as much troubleshooting information as I can, but as there does not appear to be any errors in my krb5_child.log log, or much else that appears to be useful, so I'm a bit stumped. /etc/sssd/sssd.conf: [domain/domain] ldap_id_use_start_tls = False cache_credentials = True ldap_search_base = dc=dc,dc=dc,dc=dc krb5_realm = this.is.a.valid.realm krb5_server = 192.168.100.100 id_provider = ldap auth_provider = krb5 chpass_provider = krb5 ldap_uri = ldap://192.168.100.200/ krb5_kpasswd = 192.168.100.100 ldap_tls_cacertdir = /etc/openldap/cacerts [sssd] services = nss, pam config_file_version = 2 domains = domain [nss] [pam] /var/log/sssd/sssd_nss.log -- Debug level 4: (Fri Dec 30 01:46:35 2011) [sssd[nss]] [accept_fd_handler] (4): Client connected! (Fri Dec 30 01:46:35 2011) [sssd[nss]] [nss_cmd_getpwnam] (4): Requesting info for [user] from [<ALL>] (Fri Dec 30 01:46:35 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4): Requesting info for [user@default] (Fri Dec 30 01:46:35 2011) [sssd[nss]] [nss_cmd_initgroups] (4): Requesting info for [user] from [<ALL>] (Fri Dec 30 01:46:35 2011) [sssd[nss]] [nss_cmd_initgroups_search] (4): Requesting info for [user@default] (Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam] (4): Requesting info for [user] from [<ALL>] (Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4): Requesting info for [user@default] (Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam] (4): Requesting info for [user] from [<ALL>] (Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4): Requesting info for [user@default] (Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam] (4): Requesting info for [user] from [<ALL>] (Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4): Requesting info for [user@default] Thank you, Alexander Blair

3 7

Announcing SSSD 1.6.2
by Stephen Gallagher 04 Jan '12

04 Jan '12

The SSSD team is proud to announce the version 1.6.2 enhancement and bugfix release of the System Security Services Daemon. As always, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Improved handling of users and groups with multi-valued name attributes (aliases) * Performance enhancements * Initgroups on RFC2307bis/FreeIPA * HBAC rule processing * Improved process-hang detection and restarting * Enabled the midpoint cache refresh by default (fewer cache misses on commonly-used entries) * Cleaned up the example configuration == Detailed Changelog == Jakub Hrozek (23): * Improve error message for LDAP password constraint violation * Keep deref controls until the whole request is finished * Fix uninitialized pointer read in sdap_gssapi_get_default_realm() * IPA access: hostname comparison should be case-insensitive * Add sysdb interface to get name aliases * Add a sysdb_get_direct_parents function * Store name aliases for users, groups * Return users and groups based on alias * Use explicit base 10 for converting strings to integers * Fix typo in sysdb_get_direct_parents * Add option to follow symlinks to check_file() * Append PID to sbus server socket name, let clients use a symlink * Streamline the example config * Do not delete requests inside hash_iterate loop * Check if dp_requests hash table exists before using it * Fix off-by-one error in remove_socket_symlink() * Report on errno, not return code in create_socket_symlink * Add a missing break * Sanitize DN in sysdb_get_direct_parents * gitignore additions * Utility functions for LDAP nested schema initgroups * Use fewer transactions during RFC2307bis initgroups * Use fewer transactions during IPA initgroups Jan Zeleny (2): * man page fix (lists are comma-separated) * Fixed timeout handling in responders Marko Myllynen (3): * Add missing options to sssd.api.conf * Unbreak ./configure * Update sssd-example.conf Pavel Březina (3): * sss_ldap_err2string() - function created * sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string() * Added quiet option to pam_sss Pavel Zuna (1): * Fix small bug where TALLOC_CTX could end up unfreed. Stephen Gallagher (18): * Bumping version to 1.6.2 * Add option to specify the kerberos replay cache dir * Fix typo in %configure * Remove all libtool .la files from RPM * Improve documentation of libipa_hbac * Add libipa_hbac documentation to the -devel package * MONITOR: Correctly detect lack of response from services * Do not build documentation on RHEL 5 * Fix typo in specfile * MAN: Add more information about internal credential storage * Enable the midpoint cache update by default * HBAC: fix typos preventing proper hostgroup evaluation * HBAC: Do not save member/memberOf links * HBAC: Use originalMember for identifying servicegroups * HBAC: Use originalMember for identifying hostgroups * BUILDSYS: Fix --without-manpages * MONITOR: fix timeout conversion * Updating translation files for string freeze Sumit Bose (1): * Do not access memory out of bounds

5 32

ldap shadow policy
by Patrick Hemmer 31 Dec '11

31 Dec '11

Firstly, apologies if this isnt appropriate for this mailing list. This was the only sssd mailing list I could find. I'm trying to migrate a RHEL5 box from pam_ldap to sssd (version 1.5.1, official redhat package) and am having an issue getting shadow attributes working. For testing I set a shadowExpire attribute on my account in LDAP. pam_ldap obeys this correctly and will not let me log in (trying with ssh public key as the server enforces the password policy). I have added the following settings to the ldap domain to try and get this to work; access_provider = ldap ldap_access_order = expire ldap_account_expire_policy = shadow But the box sill lets me log in. For testing to make sure pam was working, I set 'ldap_access_order=filter' without setting ldap_access_filter, and it properly rejected my login. Googling the subject only turns up the man page and the patch set where these settings were added. Any ideas what I'm missing here? Thanks

2 1

request for Heimdal support
by lists 23 Dec '11

23 Dec '11

Hi, Would it be possible to extend SSSD and also support Heimdal as Kerberos client implementation? This patch seems to provide just that: http://cvs.pld-linux.org/cgi-bin/viewvc.cgi/cvs/packages/sssd/sssd-heimdal.… My setup is as follows: - server with - Heimdal KDC - openldap - pam_ldap / nss_ldap - laptops/workstations with - mit kerberos clients - SSSD I would like to use SSSD on all my machines, but because SSSD does not support Heimdal I cannot replace pam_ldap/nss_ldap on the server. Maybe you could consider this patch and add it to SSSD? Thanks, J.

4 15

Announcing SSSD 1.7.0
by Stephen Gallagher 22 Dec '11

22 Dec '11

The SSSD team is proud to announce the version 1.7.0 enhancement release of the System Security Services Daemon. As always, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Support for case-insensitive domains * Support for multiple search bases in the LDAP provider * Support for the native FreeIPA netgroup implementation * Reliability improvements to the process monitor * New DEBUG facility with more consistent log levels * New tool to change debug log levels without restarting SSSD * SSSD will now disconnect from LDAP server when idle * FreeIPA HBAC rules can choose to ignore srchost options for significant performance gains * Assorted performance improvements in the LDAP provider (reducing disk-writes to the cache) * '''Experimental''' support for looking up SUDO rules in ldap * Not built by default * Requires unreleased sudo binary. Very preliminary functionality. * '''Experimental''' support for Heimdal Kerberos implementation (buggy) == Detailed Changelog == Jakub Hrozek (89): * pyhbac: Do not convert int to bool * Fix returning groups when gidNumber attribute is not ordered * Prevent segfault if vetoed_shells are specified without allowed_shells * Remove unused temporary context * Handle errno properly in set_debug_file_from_fd() * Do not delete requests inside hash_iterate loop * Handle timeout during sss_ldap_init_send * IPA dyndns: do not segfault if the server cannot be resolved * Return the first value of name if the multivalued name attribute does not match RDN * Add LDAP provider option to set LDAP_OPT_X_SASL_NOCANON * Use the default Kerberos realm for LDAP with GSSAPI auth * Fix moving to next entry in deref code * Allow turning dereference off by setting the threshold to 0 * Change libnl monitor callback to only signal going online * Discard carrier messages from non-ethernet devices * Subscribe to netlink route and addr messages * Improve error message for LDAP password constraint violation * Keep deref controls until the whole request is finished * Fix uninitialized pointer read in sdap_gssapi_get_default_realm() * Fix wrong buffer size in has_phy_80211_subdir() * Multiline macro cleanup * IPA access: hostname comparison should be case-insensitive * Add sysdb interface to get name aliases * Add a sysdb_get_direct_parents function * Store name aliases for users, groups * Return users and groups based on alias * Use explicit base 10 for converting strings to integers * Fix typo in sysdb_get_direct_parents * Add option to follow symlinks to check_file() * Append PID to sbus server socket name, let clients use a symlink * Streamline the example config * Check if dp_requests hash table exists before using it * Fix off-by-one error in remove_socket_symlink() * Report on errno, not return code in create_socket_symlink * Add a missing break * Sanitize DN in sysdb_get_direct_parents * gitignore additions * Utility functions for LDAP nested schema initgroups * Use fewer transactions during RFC2307bis initgroups * Use fewer transactions during IPA initgroups * Cancel transactions correctly during initgroups * Plug memory leaks in LDAP provider * Plug memory leaks in sysdb_ops * Do not leak hash table iterator during proxy auth * resolver: Free the whole hostent structure * RFC2307bis initgroups: fix nested groups processing * Steal result onto mem_ctx in sdap_initgr_nested_get_direct_parents * Use LDAPDerefSpec properly * Remove confusing do-while loop * Fix segfault in sdap_get_initgr_user * Use correct state struct in sdap_initgr_rfc2307bis_next_base * configAPI: Fix removing in old domain when saving a new domain * Squash transactions in sdap_initgr_common_store * Use one transaction instead of two during RFC2307bis group processing * Prevent printing NULL in several places of LDAP provider * Cleanup: Remove unused parameters * Fix sdap_id_ctx/ipa_id_ctx mismatch in IPA provider * Provide means of forcing TLS and GSSAPI enabled/disabled for sdap connections * IPA migration fixes * Fix two small bugs in group dereferencing * Use dereference during IPA provider initgroups * Pass the correct private data into Data Provider callback * Always attempt to connect in sdap_async_sys_connect_done * LDAP provider: Error while setting the nocanon option should not be fatal * Cancel ping_check if service goes away * sss_utf8_tolower utility function+unit tests * Responders: Split getting domain by name into separate function * Canonicalize username in PAM provider * Use the case sensitivity flag in responders * Refactor saving sdap entities * sysdb_get_real_name helper function * Use the case sensitivity flag in the LDAP provider * Use the case sensitivity flag in the simple access provider * Use the case sensitivity flag in the proxy provider * Export the function to convert ldb_result to sysdb_attrs * SUDO Integration - sysdb interface * SUDO Integration - LDAP provider - save sudo rules functions * SUDO Integration - responder - get sudo rules logic * DP: Remove processed callbacks * Pass client context to sss_dp_get_account_send * Pass sdap_id_ctx to online check from IPA provider * Error out if local domain is case insensitive * Resolver: Introduce a per-request timeout * Do not touch resolve_service_state in fo_resolve_service_done * Failover: Introduce a per-service timeout * Save original memberof, not memberof * sss_get_cased_name utility function * Return user and group names lowercased in case insensitive domains * Honor case sensitive flag when creating the ccname template Jan Zeleny (37): * sysdb refactoring: renamed ctx variable to sysdb * Added sysdb_ctx_get_domain function * sysdb refactoring: deleted domain variables in sysdb API * sysdb refactoring: memory context deleted * Remaining memory context variables renamed * sdap_async_accounts.c split * Confusing part of code cleared out * Moved some functions in sdap_async_groups * Moved some functions in sdap_async_initgroups * Fixed bad logic in processing netgroups in LDAP provider * man page fix (lists are comma-separated) * Fixed timeout handling in responders * Added krb5_fast_principal to SSSDConfig API * Cleanup of unused function in ldap access provider * Add wrapper for krb5_get_init_creds_opt_set_canonicalize * Add support to request canonicalization on krb AS requests * Support to request canonicalization in LDAP/IPA provider * Handle group renaming correctly * Fixed possible resource leak in get_uid_from_pid() * Fixed possible resource leak in create_mail_spool() * Fixed empty loginShell in proxy provider * Fixed unchecked value of setenv() in check_and_export_options() * Renamed some LDAP routines * Modified sdap_parse_search_base() * Added and modified options for IPA netgroups * New IPA ID context * Added support for fetching netgroups in IPA provider * Added IPA account info handler * Fixed a typo in sysdb_upgrade_07() declaration * Fixed uninitialized pointer read in netgroups processing * Fixed logically dead code in netgroup processing * Add ipa_hbac_support_srchost option to IPA provider * Fixed an error in macro for merging double linked lists * Fixed incorrect return code in PAM client * Add ldap_sasl_minssf option * Fixed IPA netgroup processing * Deleted declaration of nss_get_dom() Krzysztof Klimonda (1): * Fix FTBFS related to -Werror=format-security Marko Myllynen (4): * Add missing options to sssd.api.conf * Unbreak ./configure * Update sssd-example.conf * Typo fixes Pavel Březina (35): * debug_timestamps fixes * Fixed implicit declaration of function 'time' in src/sss_client/common.c. * New DEBUG facility - new levels * New DEBUG facility - modified DEBUG * New DEBUG facility - conversion * New DEBUG facility - man pages * New DEBUG facility - unit tests * New DEBUG facility - SSSDBG_UNRESOLVED changed from -1 to 0 * --debug-timestamps=1 is not passed to providers * sss_ldap_err2string() - function created * sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string() * sss_debuglevel - change the debug levels on the fly * DEBUG timestamps offer higher precision * DEBUG timestamps offer higher precision - man page updated * DEBUG timestamps offer higher precision - unit tests updated * DEBUG timestamps offer higher precision - SSSDConfig updated * Added quiet option to pam_sss * SysDB commands that save lastUpdate allows this value to be passed in * Fixes debug-tests.c coverity issues: NEGATIVE_RETURNS, FORWARD_NULL * sss_cli.h - fix: function declaration after the header guard * Added sssd --version option * Added sss_ldap_dn_in_search_bases() * Support search bases in RFC2307bis enumeration * Support search bases in netgroup members translation * SUDO integration - client common interface * SUDO integration - data provider backend handler * SUDO Integration - LDAP configuration options * SUDO integration - LDAP provider * SUDO Integration - responder * SUDO Integration - API for sudo * SUDO Integration - pseudo client for testing * Logically dead code in sdap_nested_group_lookup_group * Use of uninitialized value in sss_ldap_dn_in_search_bases * SUDO Integration - be_sudo_req removed from sudo_ctx * SUDO Integration - fixed memory leak in sdap_sudo_handler() Pavel Zuna (2): * Fix small bug where TALLOC_CTX could end up unfreed. * Add common SIGCHLD handling for providers. Ralf Haferkamp (1): * Allow the O_NONBLOCK flag to be reset correctly Simo Sorce (1): * Set more strict permissions on keyring Stephen Gallagher (74): * Bumping version to 1.7.0 * Revert "Allow LDAP to decide when an expiration warning is warranted" * Rename sssd.conf to sssd-example.conf * Include the configuration file as a %ghost entry * Remove private shared object Provides: for pysss.so and pyhbac.so * Cancel sysdb upgrade transaction if commit fails * Fix potential double-free issue * Fix broken RHEL5 build * Use sysdb attribute name for GID, not LDAP attribute * HBAC: Handle saving groups that have no members * HBAC: Use of hostgroups for targethost or sourcehost was broken * HBAC: Properly skip all non-group memberOf entries * Add option to specify the kerberos replay cache dir * Fix typo in %configure * Remove all libtool .la files from RPM * Improve documentation of libipa_hbac * Add libipa_hbac documentation to the -devel package * MONITOR: Correctly detect lack of response from services * Do not build documentation on RHEL 5 * Fix typo in specfile * MAN: Add more information about internal credential storage * Enable the midpoint cache update by default * HBAC: fix typos preventing proper hostgroup evaluation * SYSDB: New source file for sysdb upgrade routines * HBAC: Do not save member/memberOf links * HBAC: Use originalMember for identifying servicegroups * HBAC: Use originalMember for identifying hostgroups * BUILDSYS: Fix --without-manpages * TOOLS: Do not leak pid_file handle on error * MONITOR: fix timeout conversion * Updating translation files * SSSDConfig: Handle integer parsing more leniently * Remove unused sdap_options attributes * Fix size return for split_on_separator() * Make sdap_get_id_specific_filter() more strict * LDAP: Add parser for multiple search bases * LDAP: Support multiple user search bases (non-enumeration) * LDAP: Support multiple netgroup search bases * LDAP: Support multiple group search bases (non-enumeration, RFC2307) * LDAP: Add multiple search bases for initgroups (users) * LDAP: Add multiple search bases for initgroups (RFC2307 groups) * LDAP: Add multiple search bases for initgroups (RFC2307bis groups) * LDAP: Update manpages with multiple search base information * LDAP: Convert ldap_*_search_filter * LDAP: Add support for multiple search bases for user enumeration * LDAP: Add support for multiple search bases for group enumeration * RESPONDER: Fix segfault in sss_packet_send() * SYSDB: add index for nameAlias * Periodic translation file update * LDAP: Remove redundant groups from the lookup list * SBUS: Fix DEBUG log matching * RESPONDER: Ensure that all input strings are valid UTF-8 * SYSDB: Make ENOENT log messages less threatening * Fix broken build due to commit of IPA netgroup support * Add -fno-strict-aliasing * LDAP: Try next failover server on any error * RESPONDER: Refactor DP requests into tevent_req style * Allow using Glib for UTF8 support * Ignore NULL-terminator when checking UTF8-validity * LDAP: Fix missing break statements in force_tls * Ignore NULL-terminator when checking UTF8-validity for netgroups * Fix potential resource leak in backup_file.c * Fix uninitialized value error in ipa_netgroups.c * Add sdap_connection_expire_timeout option * Update spec file to build with Glib on RHEL 5 * Fix typo in IPA SSSDConfig file * Move child_common routines to util * Reorder pidfile() function to guarantee NULL-termination * Securely set umask when using mkstemp * Update translations for string freeze * MONITOR: use sigchld handler for monitoring SSSD services * PAM: make initgroups timeout work across multiple clients * Add compatibility layer for Heimdal Kerberos implementation * Importing new translations for 1.7.0 release Sumit Bose (2): * Improve password policy error code and message * Do not access memory out of bounds Thorsten Scherf (1): * Fixed translation bug Yuri Chornoivan (2): * Fix two man page typos * Fix typos in manual pages

1 0

[PATCH] Return user and group names lowercased in case insensitive domains
by Jakub Hrozek 21 Dec '11

21 Dec '11

The attached three patches reflect the discussion we had on #sssd and sssd-devel mailing list. They also fix https://fedorahosted.org/sssd/ticket/1123 [PATCH 1/3] sss_get_cased_name utility function I moved the ternary operator expression into a separate function. It's being used all over the place now. [PATCH 2/3] Return user and group names lowercased in case insensitive domains Does what it says on the box. Is there a way to force the same for initgroups? As far as I can see, we don't even send the netgroup name back to the NSS module.. [PATCH 3/3] Honor case sensitive flag when creating the ccname The homedir template is handled automatically in patch #2, but we need to handle the ccname templates as well.

2 2

Case insensitivity behaviour
by Jakub Hrozek 21 Dec '11

21 Dec '11

Hi, SSSD 1.7 will bring a new feature - the ability to mark a domain as "case insensitive". As implemented currently, if a domain is case-insensitive, SSSD would store a lowercased alias in addition to the real name and lowercase all queries for that domain so that they match on the alias. However, SSSD would still return the original case sensitive name from the NSS provider. For example, it is possible to look up a user "Foo" with "getent passwd foo", but getent would still return "Foo:*:uid:gid:Foo:/home/Foo:/bin/bash". One of our users logged https://fedorahosted.org/sssd/ticket/1123 requesting that we also lowercase the *result*. I'm not sure it's the right thing to do, I implemented the case sensitivity feature the way I did on purpose, thinking that we still want to return the *real* user name much like we do for multiple CN attributes. I would appreciate more opinions on this. One of the reasons for implementing this feature in the first place was Windows SSO[1] - I admit I haven't tested this particular scenario, but I think what we have now would suffice so that name lookups would work regardless of case.

3 4

[PATCH] Save original memberof, not memberof
by Jakub Hrozek 21 Dec '11

21 Dec '11

The sdap_save_* refactoring brought one bug where instead of saving into SYSDB_ORIG_MEMBEROF we would save into SYSDB_MEMBEROF. I rechecked all other attribute names and this was the only one that was changed.

3 7

SSSD 1.7.0 release plans and branching information
by Stephen Gallagher 20 Dec '11

20 Dec '11

SSSD 1.7.0 is dev-complete to the best of our knowledge. We will be releasing the 1.7.0 tarball on Thursday, to give translators a few more days to provide updated strings, as well as a few more days of testing. I have now created the sssd-1-7 branch and updated the version on the master branch. All pushes that go to master are now targeted for SSSD 1.8.0. If an urgent fix is discovered that needs to go to 1.7.0 as well, it will need to be merged to the sssd-1-7 branch.

1 0

[PATCH] PAM: make initgroups timeout work across multiple clients
by Stephen Gallagher 20 Dec '11

20 Dec '11

Instead of timing out the initgroups lookup on a per-cctx basis, we will maintain a hash table of recently-seen users and use this instead. This will allow SSSD to handle user's logging into multiple services simultaneously more graciously, as well as playing nicer with SSH (which makes calls to PAM both before and after a fork). Fixes: https://fedorahosted.org/sssd/ticket/1063

2 2

[PATCH] Improve handling of DNS timeout
by Jakub Hrozek 20 Dec '11

20 Dec '11

Hi, I'm not sure if it's still time to include this change in 1.7 since we froze the strings yesterday, but if not, feel free to postpone to 1.8. [PATCH 1/3] Resolver: Introduce a per-request timeout In addition to passing a timeout to c-ares (which controls how long would c-ares talk to an individual name server), also set up a tevent timeout for the whole request. The rationale is that the user of the async interface does not know or case how many name servers there are and would like to just limit how long the whole request could take. This should help in situations where the DNS server is very slow or drops packets. [PATCH 2/3] Do not touch resolve_service_state in fo_resolve_service_done In the fail over code, we correctly used the "server->common" pointer as memory context for the resolving but then passed a service resolving state as a private context. If the service resolving request was canceled before the resolving request finished, fo_resolve_service_done would access freed memory. This was a long-standing bug in the fail over code we never hit because the service resolve request could end only when the resolve request ended. I hit the bug when I introduced the timeouts in the later patch. [PATCH 3/3] Failover: Introduce a per-service timeout Changes the semantics of dns_resolver_timeout to be "how long a service resolution can take" from "how long a name resolution can take". I think it is better from the point of view of the fail over user. Also introduces a new option dns_resolver_op_timeout which controls the resolver timeout (which is what dns_resolver_timeout used to do). It is intentionally undocumented. https://fedorahosted.org/sssd/ticket/976

2 2

[PATCH] Error out if local domain is case insensitive
by Jakub Hrozek 20 Dec '11

20 Dec '11

https://fedorahosted.org/sssd/ticket/1104

2 2

[PATCH] MONITOR: use sigchld handler for monitoring SSSD services
by Stephen Gallagher 20 Dec '11

20 Dec '11

This patch depends on the SIGCHLD patches currently under review. This is the first consumer of those patches, and therefore can be used to test them. This changes the behavior of the monitor's child-monitoring code to use the new sigchld handler. It also replaces some useless loop-checks that we were doing to verify that the process was still up using waitpid(). It's less wasteful to simply rely on SIGCHLD. I also revamped the restart logic so that now it will always restart when the SIGCHLD handler is hit. To that end, I changed it so that the ping timeout limit would kill the PID (thereby triggering the SIGCHLD handler to take over). Finally, I also added a 60s timer on monitor_kill_service() so that it will send a SIGKILL to the process if it hasn't exited gracefully a minute after receiving SIGTERM. This is probably the most controversial piece of this patch. In theory, if we SIGKILL during an ldb_transaction_commit(), we could end up with corrupted data in the LDB cache. But I think that if we're still writing after 60s, we have bigger issues to address. I'm certainly willing to entertain counter-arguments here.

3 6

Re: [SSSD] Announcing SSSD 1.5.14
by GOLLSCHEWSKY, Tim 20 Dec '11

20 Dec '11

> > I'm not sure if artificially trimming the group list is a good idea. > > It wouldn't work for everyone and I would be wary of breaking access > > control mechanisms. > > Noted. And yes I agree this (non-mandatory) config option wouldn't be useful for everyone, it's just something > that fixes my particular problem (reduces ssh login times from 30 seconds to <5). > > I may have to write my own patch and apply it to the SRPM as each official version of SSSD is released. It won't be > supported by Red Hat obviously but my users won't be complaining about slow login times anymore. So partial win. :) Just thought I'd contribute my results in case this helps with your investigation of the larger problem. I assume there are other organisations with huge AD/LDAP directories that are having similar issues with ssh authentication times. I've finished my local patch and added a config option called: ldap_rfc2307bis_initgroups_filter If not specified, sssd just reverts to normal behaviour (cn=*) during the initgroups run. With no ldap_rfc2307bis_initgroups_filter: # time ssh myhost groups xxxxdm xxxxdef xxxxgmt xxxx002 xxxx003 xxxxp xxxx001 xxxx002 xxxxt xxxxp xxxxange xxxxra xxxxb2 xxxxp xxxxd xxxxt xxxxp xxxxp xxxxp xxxxp xxxxd xxxxd xxxxp xxxxd xxxxd xxxxd xxxxp xxxxp xxxxd xxxxd xxxxp xxxxt xxxxd xxxxlemr xxxxp xxxxd xxxxp xxxxp xxxxd xxxxt xxxxd xxxxp xxxxd xxxxd xxxxt xxxxp xxxxt xxxxp xxxxd xxxxd xxxxt xxxxp xxxxd xxxxu xxxxp xxxxp xxxxp xxxxp xxxxd xxxxp xxxxp xxxxu xxxxp xxxxp xxxxt xxxxp xxxxd xxxxd xxxxt xxxxp xxxxd xxxxt xxxxt xxxxd xxxxt xxxxp xxxxp xxxxi xxxxd xxxxd xxxxp xxxxd xxxxp xxxxp xxxxd xxxxd xxxxp xxxxp xxxxd xxxxp xxxxd xxxxp xxxxd xxxxp xxxxp xxxxp xxxxp xxxxd xxxxd xxxxd xxxxd xxxxp xxxxp xxxxp xxxxd xxxxd xxxxd xxxxd xxxxd xxxxp xxxxp xxxxd xxxxd xxxxd xxxxd xxxxd xxxxd xxxxp xxxxp xxxxd xxxxp xxxxd xxxxd xxxxp xxxxd xxxxd xxxxd xxxxd xxxxd xxxxp xxxxd xxxxd xxxxd xxxxd xxxxd xxxxd xxxxd xxxxp xxxxd xxxxd xxxxp xxxxt xxxxp xxxxd xxxxd xxxxp xxxxd xxxxd xxxxd xxxxp xxxxd xxxxd real 0m48.47s user 0m0.15s sys 0m0.02s With ldap_rfc2307bis_initgroups_filter = (|(cn=xxxrd)(cn=xxxxp)(cn=xxxxd)) # time ssh myhost groups xxxxdm xxxxgmt xxxxd xxxxp xxxxd real 0m5.11s user 0m0.15s sys 0m0.03s This hack will have to do until a better solution is found. I'm hoping the fixes coming in 1.7.0 will do the trick. :) Thanks to everyone who helped me get to this point. Best regards, Tim Gollschewsky. This e-mail is sent by Suncorp Group Limited ABN 66 145 290 124 or one of its related entities "Suncorp". Suncorp may be contacted at Level 18, 36 Wickham Terrace, Brisbane or on 13 11 55 or at suncorp.com.au. The content of this e-mail is the view of the sender or stated author and does not necessarily reflect the view of Suncorp. The content, including attachments, is a confidential communication between Suncorp and the intended recipient. If you are not the intended recipient, any use, interference with, disclosure or copying of this e-mail, including attachments, is unauthorised and expressly prohibited. If you have received this e-mail in error please contact the sender immediately and delete the e-mail and any attachments from your system.

4 5

GSSAPI and Kerberos - understanding question
by Josh Geisser 20 Dec '11

20 Dec '11

Hi list I'm sure I have gabs of understanding of how to use SSSD without using plain binding-user credentials in the configfile. I followed the guide for Win2008 allthough I only have 2003 SFU - would that work? - I see it right that GSSAPI should enable looking up stuff in the LDAP using a machine-account instead of the binding-user/passwd? - Kerberos (which has the machine-auth-ticket) comes into play for LDAP, but this exceeds the basic LDAP authentication (eg. Auth via Kerberos on the LDAP server)? Is this enough to feed nsswitch (e.g. getent) or is an additional valid user/pass still required? The trouble I'm having here is the ktpasswd.exe generated-key is always dated at 01/01/70 01:00:00 which I guess is also the reason why ldapsearch -Y GSSAPI and kinit fail? 2003 behaviour? The krb and ldap configuration works quite fine with bind-dn, just struggeling with SASL/GSSAPI. Cheers Josh -- ---- ASG at hnet

7 28

[www.transifex.net] New announcement created: SSSD
by admin＠transifex.net 19 Dec '11

19 Dec '11

Hello sssd, this is Transifex at https://www.transifex.net. A new announcement has been just created for the project 'SSSD'. You can check it out bellow: ---------------------------- String Freeze for SSSD 1.7.0 As of Dec 19, 2011, we are in string freeze for the SSSD 1.7.0 release. ---------------------------- If you'd like to see it at Transifex, please visit the following link: http://www.transifex.net/projects/p/sssd/announcement/1423/ Always at your service. -- Transifex -- Open Translation Platform To change your notification settings, please visit your profile page at http://www.transifex.net/notices/.

1 0

[PATCH] Pass sdap_id_ctx to online check from IPA provider
by Jakub Hrozek 19 Dec '11

19 Dec '11

Patch attached.

3 2

[PATCH] Deleted declaration of nss_get_dom()
by Jan Zelený 19 Dec '11

19 Dec '11

This function has been renamed to responder_get_domain() in recent sudo patch set but this declaration hasn't been deleted in the process. Thanks Jan

2 2

[PATCHES] Fix two simple Coverity issues
by Stephen Gallagher 19 Dec '11

19 Dec '11

Patch 0001: Guarantee NULL-termination when reading the pidfile Patch 0002: Always set umask when using mkstemp()

2 4

[PATCH] Add common SIGCHLD handling.
by Pavel Zuna 19 Dec '11

19 Dec '11

Base on the second proposal: https://fedorahosted.org/sssd/wiki/DesignDocs/SigChld There is some old SIGCHLD handling code in src/providers/child_common.[ch], that should probably go away if this gets accepted. There was also a naming conflict with the sss_child_ctx structure. This structure is only used internally by functions defined src/providers/child_common.c. I renamed the original structure to sss_child_ctx_old for now. Pavel

3 18

[PATCH] Pass client context to sss_dp_get_account_send
by Jakub Hrozek 19 Dec '11

19 Dec '11

My recent fix "DP: Remove processed callbacks" uncovered another bug which needs immediate attention - any NSS operation currently aborts in git HEAD. That's my fault, I only tested my previous fix with cached user data inside the PAM responder where the new bug does not hit. Sorry for that. The problem is memory hierarchy. When user data update is requested from check_cache(), the sss_dp_callback structures are created on sss_domain_context. However, when the callback is called, it goes all the way into nss_cmd_getpw_send_reply() where the command context is freed, freeing also sss_domain_context and the sss_dp_callback data. That's a problem because we are still looping over the callback data. Attached is a patch that changes the memory context for the sss_dp_callback to the client context so it's kept even when the command finishes. The callbacks are freed in the sss_dp_get_account_int_done() function after the callback finishes so we're not keeping them for long. The other solution I was thinking about was to not call the callbacks directly, but only schedule them with tevent_schedule_immediate() so that we can safely loop over all the callbacks, free the sdp_req and then let the clients do whatever they need to.

3 3

Question about sssd and dns
by Marco Pizzoli 19 Dec '11

19 Dec '11

Hi, I started to look at the documentation of FreeIPA and SSSD. Now I'm curious to know about the relationship between sssd and the dns servers. As I can see, obviously, the deployment of all windows-style services are led by a query/response by sssd to dns servers, possibly directly to the FreeIPA dns server. When deploying sssd I have to configure the resolv.conf file. Is hereafter sssd the only service which is *required* to use that file? I'm thinking to the unix/linux farm of my office in which, by taking a weighted choice, they decided to not use the dns servers, relying only on /etc/hosts files. If you confirm this, do you think it would be a good idea the filing of a feature request asking to have an option for sssd to choose the resolv.conf file to point to? So I could use a file called, for example, "/etc/resolv.conf.FreeIPA". So I can be sure that no other services will use that dns's. Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

4 9

Comment about SSSD LDAP Provider vs. Winbind
by Pasi Kärkkäinen 18 Dec '11

18 Dec '11

Hello, Feedback about: "[SSSD] IMPORTANT: Your input requested: SSSD LDAP Provider vs Winbind": https://fedorahosted.org/pipermail/sssd-devel/2011-December/007721.html Sorry, I wasn't subscribed to the list earlier, so I couldn't reply to the original thread.. Why people use Winbind: - Allows integration between Linux and Active Directory easily. - No changes/modifications needed to AD or AD schemas. - No changes/modifications needed to AD users. - UID/GID generation/mapping on Linux side, no need to add UNIX attributes to AD users. - Linux computers using Winbind auth (joined to AD) show up as computer objects in AD. So in short.. if you want/need to easily and quickly integrate a couple of Linux servers/computers with AD, it's very simple and straight-forward with Winbind. (Yes I realize using krb5+LDAP instead, and configuring UNIX attributes for users in AD, is much better, but it's also more complicated to set up and might be "overkill" for some smaller environments). So I think as long as SSSD LDAP Provider allows "Winbind style" easy setup, mainly UID/GID generation/mapping on Linux side, it's good to replace Winbind.. My 2 (euro) cents.. -- Pasi

1 0

Building for Red Hat/CentOS 4
by Juan Asensio Sánchez 16 Dec '11

16 Dec '11

Hi I am trying to build SSSD in Red Hat 4U5 (perhaps something impossible), but when I try to run "make rpms", as the howto says, I get this error: [root@rh4 sssd.git]# LANG=C make rpms make: *** No rule to make target `rpms'. Stop. I have no much experience compiling packages, but I have revised Makefile.am ans there is a section about building that rule: rpms: dist-gzip rpmroot cp $(builddir)/contrib/sssd.spec $(RPMBUILD)/SPECS cp $(distdir).tar.gz $(RPMBUILD)/SOURCES cd $(RPMBUILD); \ rpmbuild --define "_topdir $(RPMBUILD)" -ba SPECS/sssd.spec Perhaps I need a more recent version of compiling tools? Regards and thanks in advance.

2 1

[PATCH] Ability to set a domain as case sensitive or insensitive
by Jakub Hrozek 16 Dec '11

16 Dec '11

[PATCH 1/6] sss_utf8_tolower utility function+unit tests This will be used later on to lowercase the usernames. Also includes unit tests for the whole sss_utf8 module. [PATCH 2/6] Responders: Split getting domain by name into separate function A utility function originally written for the SUDO responder, but it turns out it's useful earlier [PATCH 3/6] Use the case sensitivity flag in responders Reads the configuration option and includes its handling in the responders. Unfortunately some parts like negative cache are more complex because one domain can be case sensitive and another insensitive during multidomain searches. [PATCH 4/6] Refactor saving sdap entities There was too much code duplication between sdap_save_{user,group,netgroup} and my later patch would add even more. This patch removes the most egregious cases. [PATCH 5/6] Use the case sensitivity flag in the LDAP provider When saving users,groups and netgroups, saves the lowercase version of the name as an alias in addition to the original name that is still stored as name as well as part of RDN. [PATCH 6/6] Use the case sensitivity flag in the simple access provider Performs string comparisons in case sensitive or insensitive manner depending on the configuration.

4 15

[PATCH] Use of uninitialized value in sss_ldap_dn_in_search_bases
by Pavel Březina 16 Dec '11

16 Dec '11

https://fedorahosted.org/sssd/ticket/1112

3 3

[PATCH] Logically dead code in sdap_nested_group_lookup_group
by Pavel Březina 16 Dec '11

16 Dec '11

https://fedorahosted.org/sssd/ticket/1113

2 2

[PATCH] DP: Remove processed callbacks
by Jakub Hrozek 16 Dec '11

16 Dec '11

I noticed that sss_dp_get_account_int_done() would free sdp_req but then the callback destructor would dereference sdp_req as well. When the destructor is called, sdp_req is already gone. It looks that the callback is not needed after it has called the request it links to so I think we can just free it and let the destructor remove it from the list.

2 2

Emails lost for the last 14 hours
by Stephen Gallagher 15 Dec '11

15 Dec '11

Due to a glitch in the upgrade of Fedora Infrastructure, some emails sent in the last fourteen hours did not (and may never) reach the sssd-devel list. Please resend them.

1 1

[PATCHES] ldap_*_search_base doesn't fully limit the group / netgroup
by Pavel Březina 14 Dec '11

14 Dec '11

https://fedorahosted.org/sssd/ticket/960

3 6

Design discussion: autofs integration
by Jakub Hrozek 14 Dec '11

14 Dec '11

Hi, I have created a wiki page summarizing my design proposal on integrating SSSD with automounter: https://fedorahosted.org/sssd/wiki/DesignDocs/AutofsIntegration Feedback is much appreciated - a reply to this email would probably work best. The target of this work is 1.8 Thank you!

4 7

[PATCH] Guard against segfault in ping_check()
by Jakub Hrozek 13 Dec '11

13 Dec '11

https://fedorahosted.org/sssd/ticket/1090 Unfortunately there is not enough info in rhbz #754114 where the bug originated, so just band-aid the crash for now.

3 8

[PATCH] Fix typo in IPA SSSDConfig file
by Stephen Gallagher 13 Dec '11

13 Dec '11

Pushed to master under the one-liner rule. This was breaking ipa-client-install because it was impossible to validate the configuration.

1 0

[PATCH] Fix uninitialized value error in ipa_netgroups.c
by Stephen Gallagher 12 Dec '11

12 Dec '11

DEBUG message can print an unitialized value if the first netgroup has no members. Coverity 12382 Pushed to master under the one-liner rule

1 0

[PATCH] Add sdap_connection_expire_timeout option
by Stephen Gallagher 12 Dec '11

12 Dec '11

Fixes https://fedorahosted.org/sssd/ticket/1036 We need to make sure that SSSD doesn't hold on to connections until the LDAP server issues an idle disconnect. With this patch, we set the default time that we'll maintain a connection to be 15 minutes. After that, the connection will be released and SSSD will need to recreate it. This code takes advantage of the code we had in place for SASL/GSSAPI, to ensure that we didn't maintain an LDAP connection beyond the lifetime of the TGT. So all this patch does is set the same expiration value (checking for the presence of the SASL/GSSAPI-set version and using the sooner of the two).

2 2

[PATCH] Update spec file to build with Glib on RHEL 5
by Stephen Gallagher 12 Dec '11

12 Dec '11

Does what it says on the box. If SSSD is being built on RHEL 5, switch the BuildRequires to glib2-devel and pass --with-unicode-lib=glib2 to configure. This will make it possible to build RHEL 5 with 'make rpms'

3 3

[PATCH] Fix potential resource leak in backup_file.c
by Stephen Gallagher 09 Dec '11

09 Dec '11

Pushed to master under the one-liner rule. Fixes https://fedorahosted.org/sssd/ticket/1070

1 0

Announcing SSSD 1.6.4
by Stephen Gallagher 09 Dec '11

09 Dec '11

The SSSD team is proud to announce the version 1.6.4 bugfix release of the System Security Services Daemon. As always, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Fix for older openldap libraries that can fail setting the "no canonicalization" option * pam_sss will now return authinfo_unavail when the SSSD daemon is shut down, instead of PAM_SYSTEM_ERR * Fixes a regression in LDAP failover handling * Adds support for using Glib to provide unicode support instead of libunistring * SSSD must be built with the configure flag --with-unicode-lib=glib2 * All user/group/netgroup names passed to NSS/PAM are now validated to be valid UTF-8 strings == Detailed Changelog == Jakub Hrozek (2): * configAPI: Fix removing in old domain when saving a new domain * LDAP provider: Error while setting the nocanon option should not be fatal Jan Zeleny (2): * Fixed an error in macro for merging double linked lists * Fixed incorrect return code in PAM client Krzysztof Klimonda (1): * Fix FTBFS related to -Werror=format-security Stephen Gallagher (9): * Bumping version to 1.6.4 * RESPONDER: Ensure that all input strings are valid UTF-8 * Add -fno-strict-aliasing * LDAP: Try next failover server on any error * Allow using Glib for UTF8 support * Ignore NULL-terminator when checking UTF8-validity * DEBUG: fix bad backport containing new DEBUG representation * Ignore NULL-terminator when checking UTF8-validity for netgroups * Updating translation files

1 0

Announcing SSSD 1.5.16
by Stephen Gallagher 09 Dec '11

09 Dec '11

The SSSD team is proud to announce the version 1.5.16 bugfix release of the System Security Services Daemon. As always, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Fix for older openldap libraries that can fail setting the "no canonicalization" option * pam_sss will now return authinfo_unavail when the SSSD daemon is shut down, instead of PAM_SYSTEM_ERR * Fixes a regression in LDAP failover handling * Adds support for using Glib to provide unicode support instead of libunistring * SSSD must be built with the configure flag --with-unicode-lib=glib2 * All user/group/netgroup names passed to NSS/PAM are now validated to be valid UTF-8 strings == Detailed Changelog == Jakub Hrozek (1): * LDAP provider: Error while setting the nocanon option should not be fatal Jan Zeleny (2): * Fixed an error in macro for merging double linked lists * Fixed incorrect return code in PAM client Krzysztof Klimonda (1): * Fix FTBFS related to -Werror=format-security Simo Sorce (1): * Use neutral name for functions used by both pam and nss Stephen Gallagher (10): * Bumping version to 1.5.16 * RESPONDER: Ensure that all input strings are valid UTF-8 * Add -fno-strict-aliasing * LDAP: Try next failover server on any error * Allow using Glib for UTF8 support * Ignore NULL-terminator when checking UTF8-validity * DEBUG: fix bad backport containing new DEBUG representation * Ignore NULL-terminator when checking UTF8-validity for netgroups * Translation update * Adding new translation files

1 0

[PATCH] Fixed incorrect return code in PAM client
by Jan Zelený 09 Dec '11

09 Dec '11

The original return code of the PAM plugin in case of SSSD was not running was system_err, now it is authinfo_unavail. https://fedorahosted.org/sssd/ticket/1011 I also checked the sss_pam_make_request and its return codes as suggested in the ticket and everything seems to be correct. Thanks Jan

2 3

[PATCH] Fixed IPA netgroup processing
by Jan Zelený 09 Dec '11

09 Dec '11

In case IPA netgroup had indirect member hosts, they wouldn't be detected. This patch also modifies debug messages for easier debugging in the future. Thanks Jan

2 1

[PATCHES] Support native IPA netgroups
by Jan Zelený 09 Dec '11

09 Dec '11

I'm sending couple patches which add support for IPA netgroups: #53 These routines were not static, so I renamed them in order to avoid confusion and possible collision with equivalent routines in IPA provider #54 Some new config options, please focus on this patch, I'm not entirely sure if my approach was the correct one. #55 This new context was necessary so I can pass ipa options to routine determining host search base. #56 This is netgroups support itself #57 IPA id provider which is utilizing previously added support of netgroup fetching Thanks Jan

3 15

[PATCH] Ignore NULL-terminator when checking UTF8-validity
by Stephen Gallagher 08 Dec '11

08 Dec '11

Glib fails if the NULL-terminator is included when a length is specified. I recently pushed "Allow using Glib for UTF8 support" after doing excessive negative testing. However, I forgot to do positive testing and therefore failed to discover that Glib treats a NULL-terminator as an error in validation. This patch changes our consumers to drop the NULL-terminator before passing it to validation. This works properly on both Glib and libunistring.

1 2

[PATCH] Added sssd --version option
by Pavel Březina 08 Dec '11

08 Dec '11

https://fedorahosted.org/sssd/ticket/953

5 11

[PATCH] Add ldap_sasl_minssf option
by Jan Zelený 08 Dec '11

08 Dec '11

https://fedorahosted.org/sssd/ticket/1075 The only thing is that I'm not sure if 72 is the right default minssf value for IPA provider, as default IPA installation works with 56 as the highest possible value for me. In default SSSD installation, this means that communication with IPA server will be rejected with no information about the reason being min SSF. I think this will be very confusing to SSSD users. Can anyone give me a hint how to proceed? Lower the default value in SSSD or do the change in IPA? Thanks Jan

5 12

[PATCH] LDAP: Fix missing break statements in force_tls
by Stephen Gallagher 08 Dec '11

08 Dec '11

Also add a default case to protect against bad input Detected by Coverity.

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel December 2011