sssd-devel December 2011

sssd-devel@lists.fedorahosted.org

27 participants
59 discussions

Start a nNew thread

[PATCH] Pass sdap_id_ctx to online check from IPA provider
by Jakub Hrozek 19 Dec '11

19 Dec '11

Patch attached.

3 2

[PATCH] Deleted declaration of nss_get_dom()
by Jan Zelený 19 Dec '11

19 Dec '11

This function has been renamed to responder_get_domain() in recent sudo patch set but this declaration hasn't been deleted in the process. Thanks Jan

2 2

[PATCHES] Fix two simple Coverity issues
by Stephen Gallagher 19 Dec '11

19 Dec '11

Patch 0001: Guarantee NULL-termination when reading the pidfile Patch 0002: Always set umask when using mkstemp()

2 4

[PATCH] Add common SIGCHLD handling.
by Pavel Zuna 19 Dec '11

19 Dec '11

Base on the second proposal: https://fedorahosted.org/sssd/wiki/DesignDocs/SigChld There is some old SIGCHLD handling code in src/providers/child_common.[ch], that should probably go away if this gets accepted. There was also a naming conflict with the sss_child_ctx structure. This structure is only used internally by functions defined src/providers/child_common.c. I renamed the original structure to sss_child_ctx_old for now. Pavel

3 18

[PATCH] Pass client context to sss_dp_get_account_send
by Jakub Hrozek 19 Dec '11

19 Dec '11

My recent fix "DP: Remove processed callbacks" uncovered another bug which needs immediate attention - any NSS operation currently aborts in git HEAD. That's my fault, I only tested my previous fix with cached user data inside the PAM responder where the new bug does not hit. Sorry for that. The problem is memory hierarchy. When user data update is requested from check_cache(), the sss_dp_callback structures are created on sss_domain_context. However, when the callback is called, it goes all the way into nss_cmd_getpw_send_reply() where the command context is freed, freeing also sss_domain_context and the sss_dp_callback data. That's a problem because we are still looping over the callback data. Attached is a patch that changes the memory context for the sss_dp_callback to the client context so it's kept even when the command finishes. The callbacks are freed in the sss_dp_get_account_int_done() function after the callback finishes so we're not keeping them for long. The other solution I was thinking about was to not call the callbacks directly, but only schedule them with tevent_schedule_immediate() so that we can safely loop over all the callbacks, free the sdp_req and then let the clients do whatever they need to.

3 3

Question about sssd and dns
by Marco Pizzoli 19 Dec '11

19 Dec '11

Hi, I started to look at the documentation of FreeIPA and SSSD. Now I'm curious to know about the relationship between sssd and the dns servers. As I can see, obviously, the deployment of all windows-style services are led by a query/response by sssd to dns servers, possibly directly to the FreeIPA dns server. When deploying sssd I have to configure the resolv.conf file. Is hereafter sssd the only service which is *required* to use that file? I'm thinking to the unix/linux farm of my office in which, by taking a weighted choice, they decided to not use the dns servers, relying only on /etc/hosts files. If you confirm this, do you think it would be a good idea the filing of a feature request asking to have an option for sssd to choose the resolv.conf file to point to? So I could use a file called, for example, "/etc/resolv.conf.FreeIPA". So I can be sure that no other services will use that dns's. Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

4 9

Comment about SSSD LDAP Provider vs. Winbind
by Pasi Kärkkäinen 18 Dec '11

18 Dec '11

Hello, Feedback about: "[SSSD] IMPORTANT: Your input requested: SSSD LDAP Provider vs Winbind": https://fedorahosted.org/pipermail/sssd-devel/2011-December/007721.html Sorry, I wasn't subscribed to the list earlier, so I couldn't reply to the original thread.. Why people use Winbind: - Allows integration between Linux and Active Directory easily. - No changes/modifications needed to AD or AD schemas. - No changes/modifications needed to AD users. - UID/GID generation/mapping on Linux side, no need to add UNIX attributes to AD users. - Linux computers using Winbind auth (joined to AD) show up as computer objects in AD. So in short.. if you want/need to easily and quickly integrate a couple of Linux servers/computers with AD, it's very simple and straight-forward with Winbind. (Yes I realize using krb5+LDAP instead, and configuring UNIX attributes for users in AD, is much better, but it's also more complicated to set up and might be "overkill" for some smaller environments). So I think as long as SSSD LDAP Provider allows "Winbind style" easy setup, mainly UID/GID generation/mapping on Linux side, it's good to replace Winbind.. My 2 (euro) cents.. -- Pasi

1 0

Building for Red Hat/CentOS 4
by Juan Asensio Sánchez 16 Dec '11

16 Dec '11

Hi I am trying to build SSSD in Red Hat 4U5 (perhaps something impossible), but when I try to run "make rpms", as the howto says, I get this error: [root@rh4 sssd.git]# LANG=C make rpms make: *** No rule to make target `rpms'. Stop. I have no much experience compiling packages, but I have revised Makefile.am ans there is a section about building that rule: rpms: dist-gzip rpmroot cp $(builddir)/contrib/sssd.spec $(RPMBUILD)/SPECS cp $(distdir).tar.gz $(RPMBUILD)/SOURCES cd $(RPMBUILD); \ rpmbuild --define "_topdir $(RPMBUILD)" -ba SPECS/sssd.spec Perhaps I need a more recent version of compiling tools? Regards and thanks in advance.

2 1

[PATCH] Ability to set a domain as case sensitive or insensitive
by Jakub Hrozek 16 Dec '11

16 Dec '11

[PATCH 1/6] sss_utf8_tolower utility function+unit tests This will be used later on to lowercase the usernames. Also includes unit tests for the whole sss_utf8 module. [PATCH 2/6] Responders: Split getting domain by name into separate function A utility function originally written for the SUDO responder, but it turns out it's useful earlier [PATCH 3/6] Use the case sensitivity flag in responders Reads the configuration option and includes its handling in the responders. Unfortunately some parts like negative cache are more complex because one domain can be case sensitive and another insensitive during multidomain searches. [PATCH 4/6] Refactor saving sdap entities There was too much code duplication between sdap_save_{user,group,netgroup} and my later patch would add even more. This patch removes the most egregious cases. [PATCH 5/6] Use the case sensitivity flag in the LDAP provider When saving users,groups and netgroups, saves the lowercase version of the name as an alias in addition to the original name that is still stored as name as well as part of RDN. [PATCH 6/6] Use the case sensitivity flag in the simple access provider Performs string comparisons in case sensitive or insensitive manner depending on the configuration.

4 15

[PATCH] Use of uninitialized value in sss_ldap_dn_in_search_bases
by Pavel Březina 16 Dec '11

16 Dec '11

https://fedorahosted.org/sssd/ticket/1112

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel December 2011