February 2011 - sssd-devel - Fedora mailing-lists

[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal 05 Apr '12

05 Apr '12

Please see the attached patches. I tried to split the patches logically into manageable sets. Unfortunately I made a minor mistake and I am afraid I will do something wrong to fix it. I merged two wrong patches. Fortunately it was three liner with 1 liner so it is not a big of the deal but I am really scared that I will do something wrong and loose the work I have done. So I hope it is Ok to send it as is. 0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted earlier that I merged by mistake. I was supposed to merge it with patch 25 but picked the wrong one instead. Patch 25 addresses the real issue found by Coverity as mentioned in Stephen's review mail but it did not apply cleanly since it relies on some code from the patches in the middle. 0002--INI-Adding-missing-function-declararion.patch <- this is the patch that was rejected from the second set sent earlier. Fixed according to review comment. 0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing per component The following set of patches introduces the merging of sections during the reading of the file: 0004--INI-New-error-codes-and-messages.patch 0005--INI-New-merge-flags.patch 0006--INI-Add-new-vars-to-parse-structure.patch 0007--INI-Add-save_error-function.patch 0008--INI-Change-parse_error-to-use-save_error.patch 0009--INI-Preparing-for-merging-sections.patch 0010--INI-Enhance-value-processing.patch 0011--INI-Use-section-line-number.patch 0012--INI-Refactor-section-processing.patch 0013--INI-Return-error-in-DETECT-mode.patch 0014--INI-New-test-files-for-section-merge.patch 0015--INI-Test-DETECT-mode-and-use-new-file.patch 0016--INI-Test-for-all-section-merge-modes.patch Patches related porting of the meta data from old way of doing things to the new way of doing things: 0017--INI-Separate-close-and-destroy.patch 0018--INI-Function-to-reopen-file.patch 0019--INI-Metadata-collection-is-gone.patch 0020--INI-Check-access-function.patch 0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check) 0022--INI-Function-to-check-for-changes.patch 0023--INI-Tests-for-access-and-changes.patch 0024--INI-Rename-error-print-function.patch <- rename error printing function for consistency with new interface 0025--INI-Initialize-variables-in-loops.patch <- Coverity issue addressed. Related to patch 0001. 0026--INI-Exposing-functions.patch <- Make some internal functions reusable There is also patch 27. It is a piece of new functionality. It is a preview. Please see the comment before reviewing it. Do I need to split it into multiple patches or it is Ok as is? It is pretty big but all changes are in one file and logically related. The UNIT test is missing so I am not claiming it actually works as expected. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 30

[PATCHES] Various ding-lib fixes
by Sumit Bose 23 Mar '11

23 Mar '11

Hi, this series of patches fixes some issues in ding-libs. Patch 0003 should fix Coverity issues 10035-10040 and 0004 and 0005 the remaining open issues. bye, Sumit

3 6

[PATCH] Fixes for dynamic DNS update
by Sumit Bose 07 Mar '11

07 Mar '11

Hi, this patch should fix trac ticket #810 and fixes pro-actively a potential issue with the realm. bye, Sumit

4 5

[PATCH] Do not try to delete sysbd memberOf attribute
by Sumit Bose 28 Feb '11

28 Feb '11

Hi, Jakub found an issue with RFC2307bis domains without memberOf attributes on the server. This patch should fix it. bye, Sumit

2 2

[PATCH] Reset server status after timeout
by Jakub Hrozek 28 Feb '11

28 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 https://fedorahosted.org/sssd/ticket/809 When resetting a port status, check a timeout, if it passed, also reset the server status which will trigger a hostname lookup next time. I also noticed we had a bug in get_server_status() - we were always setting last_status_change to the start of the Epoch. Jakub -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1rcTwACgkQHsardTLnvCVv3ACdH20Bu5HzyT9MS9lr+CNnabYm ZIIAnAxSzV70+zNiRob6iv8Xu7udQFHQ =X9PC -----END PGP SIGNATURE-----

3 2

[PATCH] Use realm for basedn instead of IPA domain
by Jakub Hrozek 28 Feb '11

28 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 https://fedorahosted.org/sssd/ticket/807 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1lNLQACgkQHsardTLnvCXwLQCeIyfH5p8m/uHFbRvlZuoU8pam alIAoJ80vVTY6RDOdt7DzSmtxTJpzhiZ =SuLO -----END PGP SIGNATURE-----

3 8

user groups may not contain user's entry
by Sergei V. Kovylov 24 Feb '11

24 Feb '11

Hi all. I've noticed that sssd has incorrect behavior with different versions of LDAP. The issue is because of LDB store each entry in case sensitive format, but there's no difference for LDAP, so if we have in LDB database: user's entry: dn: uid=user,ou=GROUP,dc=domain ........... and user's group entry: dn: cn=group,OU=GROUP,dc=domain member: uid=user,OU=GROUP,dc=domain ..... then user "user" will never be a part of group "group" as entries "uid=user,ou=GROUP,dc=domain" and "uid=user,OU=GROUP,dc=domain" are not equal(in LDB logic). I've noticed this when had migrated from FDS v.1.2.3 to FDS v.1.2.7.5 as last one converting DN attibutes to lower case, but provide value of "uniquemember" as is. You will find a patch to fix this on sssd side in attach.

3 7

[PATCH] Fix uninitialized value error in ipa_get_id_options()
by Stephen Gallagher 22 Feb '11

22 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Previously, we were only constructing the basedn variable if the ldap_search_base was not specified (which is unlikely to be in use when using the IPA provier). However, if it did happen, constrcuction of the compat search base for netgroups would be using an uninitialized value. Fixes https://fedorahosted.org/sssd/ticket/806 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1j4CQACgkQeiVVYja6o6MMGQCgr6rQqpXCcxkCAQQNm+knqcwH VPwAn17U3bp/2Xkfhu4uPKeoIvXcpFUW =4xxN -----END PGP SIGNATURE-----

2 2

[PATCH] Allow krb5_realm to override ipa_domain
by Stephen Gallagher 22 Feb '11

22 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It is possible to set up FreeIPA servers where the Kerberos realm differs from the IPA domain name. We need to allow setting the krb5_realm explicitly to handle this. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=679082 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1ilBIACgkQeiVVYja6o6O4agCgkkuXLhmETabRb+hwWv0Rs0GX p70An2y4hEYUgMjpB9x4btKOa0IX9viC =u/46 -----END PGP SIGNATURE-----

2 8

[PATCH] Check ccache file for renewable TGTs at startup
by Sumit Bose 22 Feb '11

22 Feb '11

Hi, with this patch the credential cache files stored in the cache are checked if they contain TGTs which are still renewable. Should fix #796. bye, Sumit

2 3

[PATCH] IPA provider: remove deleted groups during initgroups()
by Stephen Gallagher 21 Feb '11

21 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The IPA provider was not properly removing groups in the cache that the user was no longer a member of. Fixes https://fedorahosted.org/sssd/ticket/803 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1e5G0ACgkQeiVVYja6o6OPjwCcDy8nDQwJqy4q0x3nPpwLRdkP UjAAn1hfFMYSjg/bIqOsbGcTTn3Mj+4y =YNsL -----END PGP SIGNATURE-----

2 2

[PATCH] Perform initgroups lookups for all domains
by Stephen Gallagher 21 Feb '11

21 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Previously, we were setting the client context PAM lookup timeout after the first domain replied. However, if the user wasn't a member of the first domain, their information wasn't being updated. This patch ensures that we only set this timeout after the user has been found or all domains were searched. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1ehNkACgkQeiVVYja6o6NnKwCfXso6jPb/uSGM48X7MnpNcPnS LGQAnRqae+r+To9i6+BDtod2Cg7UXPgO =VhnG -----END PGP SIGNATURE-----

2 3

[PATCH] Remove renewal item if it is not re-added
by Sumit Bose 18 Feb '11

18 Feb '11

Hi, this patch should fix trac ticket #800 aka https://bugzilla.redhat.com/show_bug.cgi?id=677588 . I think this issue was introduce by some changes during the review of the renewal feature. bye, Sumit

3 5

[PATCH] Remove cached user entry if initgroups returns ENOENT
by Stephen Gallagher 18 Feb '11

18 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This behavior was present for getpwnam() but was lacking for initgroups. Resolves https://bugzilla.redhat.com/show_bug.cgi?id=677768 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1dic0ACgkQeiVVYja6o6O9pgCfUvi2N0BdrM0qXHPovp/CO9SU r84AoIhkmG7dTlWlUbysUSnwo/cs5e2r =ZZgh -----END PGP SIGNATURE-----

2 2

sssd-1.5 inclusion in RHEL 6.1 ?
by Moritz Baumann 17 Feb '11

17 Feb '11

Dear Stephen, We found https://bugzilla.redhat.com/show_bug.cgi?id=644072 which indicates that this is still on QA. We would really like netgroups via sssd, renewable krb5 tickets and many of the other nice new features new new sssd offers. And since sssd-1.5-X will be the first official LTR according to this list I was hoping to see this incorporated in RHEL 6.1. Best, Moritz

2 1

[PATCH] Fix for generating lists of translated man pages
by Sumit Bose 17 Feb '11

17 Feb '11

Hi, this patch tries to fix a build issue which was seen in some automatic build environments. bye, Sumit

2 2

[PATCH] Point the IPA provider at the compat tree for netgroups
by Stephen Gallagher 17 Feb '11

17 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We don't yet have support for IPA's internal representation of netgroups, so we need to use its compatibility mode for the time being. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1b4EEACgkQeiVVYja6o6NCYgCgr4TVZFhGIbVjEyyarKgPuDXf QloAoJPHLcNvG2eKgEAQvQxANMLq+Akq =LLyB -----END PGP SIGNATURE-----

2 2

[PATCH] Change hbacservices/groups container (1-2 branch)
by Sumit Bose 17 Feb '11

17 Feb '11

Hi, this patch changes the container for the hbacservices and -groups to be able to work with the latest FreeIPA betas and RCs. bye, Sumit

3 2

[PATCH] Do not attempt to use START_TLS on SSL connections
by Stephen Gallagher 16 Feb '11

16 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Not all LDAP servers are capable of handling dual-encryption with both TLS and SSL. Fixes https://fedorahosted.org/sssd/ticket/795 Patches attached for 1.5.x/HEAD and 1.2.x - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1Vfs8ACgkQeiVVYja6o6MdSQCcDXRo/vU/WY2Weo8f9xZ0ecOu h04AoJdw0xAVDUyO0quZtTgCdnfwsiSZ =JxlI -----END PGP SIGNATURE-----

2 10

[PATCH] Fix specfile for RHEL5
by Stephen Gallagher 16 Feb '11

16 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 RHEL5 uses an old libtool. We need to forcibly remove certain m4 files before running autoreconf to ensure that they get replaced with the appropriate old versions. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1agP8ACgkQeiVVYja6o6OKPwCfbKq5/EdAm48LYK66EfXVGIeA Hq4An1t/29mnTJ18VmOl141ZW3dshWO1 =82zh -----END PGP SIGNATURE-----

2 2

[PATCHES] Assorted specfile fixes
by Stephen Gallagher 14 Feb '11

14 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patch 0001: Minor specfile changes We should be using BuildRequires: gettext-devel Also, for best compatibility across multiple RPM-based distros, we should be running autoreconf before configure. This is how SSSD is built in RHEL and Fedora, this patch is provided to bring them back into sync. Patch 0002: Detect the proper location for memberof.so Our configure script detects where the system version of libldb stores its modules. This adds a mechanism to ensure that the specfile automatically identifies this location as well (rather than requiring manual edits to the %files section). Our automated build on Fedora rawhide against libldb-1.0.0 was broken without this. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1ZjZQACgkQeiVVYja6o6O+owCggNscnfM4GaBnSbLApGybq9Nh uOEAoKEV8qVOWer+8Lq9c0bLNwan99vs =nRlq -----END PGP SIGNATURE-----

2 3

[PATCH] Verify LDAP file descriptor validity
by Stephen Gallagher 14 Feb '11

14 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We weren't verifying that the file descriptor that we get back from openldap was valid. This patch checks that the file descriptor is >= 0 before returning it. There's another (arguable) bug here in libtevent. Libtevent should probably not return success for tevent_add_fd() when fd < 0 (especially since it crashes). I'll open a bug upstream. Fixes https://fedorahosted.org/sssd/ticket/797 and https://bugzilla.redhat.com/show_bug.cgi?id=676027 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1ZRxsACgkQeiVVYja6o6N9HQCcCas4ORYpjW9PiHAvSn0Avba/ 5dYAoJOPVfWzVGB7KoZTq9uPNrEXBi7d =kWO0 -----END PGP SIGNATURE-----

2 2

[PATCH] Check LDB_MODULES_PATH for sysdb
by Sumit Bose 14 Feb '11

14 Feb '11

Hi, the recent changes to our test environment in "Make 'make check' look nice again" have revealed that older version of libldb does not support the evaluation of the LDB_MODULES_PATH enviroment variable. These two patches let sssd itself check LDB_MODULES_PATH while opening sysdb. While the first patch only refactors the current code the second set the ldb module path if LDB_MODULES_PATH is set. bye, Sumit

2 1

Problems configuring sssd for ssl/ldaps no tls
by sssd help 11 Feb '11

11 Feb '11

Hello. We are building a kickstart profile so that we can begin using RHEL 6 in our environment. However, we have run into a problem with sssd and ldaps. It seems that in RHEL 6 nss_ldap has been depreciated and replaced with sssd. I have been able to configure sssd for regular ldap without problem. When I attempt to enable ldaps by changing the ldap uri to ldaps:// authentication no longer functions. However, id and getent functionality remains. Debug level was changed to 10 and here is what I see in the logs for sssd. (Thu Feb 10 12:03:04 2011) [sssd[be[default]]] [simple_bind_send] (4): Executing simple bind as: uid=testuser,ou=people,dc=mydomain,dc=com (Thu Feb 10 12:03:04 2011) [sssd[be[default]]] [simple_bind_send] (8): ldap simple bind sent, msgid = 2 (Thu Feb 10 12:03:04 2011) [sssd[be[default]]] [sdap_process_result] (8): Trace: sh[0x1994860], connected[1], ops[0x1a5dde0], ldap[0x16d2fc0] (Thu Feb 10 12:03:04 2011) [sssd[be[default]]] [sdap_process_result] (4): ldap_result gave -1, something bad happend! (Thu Feb 10 12:03:04 2011) [sssd[be[default]]] [sdap_handle_release] (8): Trace: sh[0x1994860], connected[1], ops[0x1a5dde0], ldap[0x16d2fc0], destructor_lock[0], release_memory[0] (Thu Feb 10 12:03:04 2011) [sssd[be[default]]] [remove_connection_callback] (9): Successfully removed connection callback. Unfortunately, "Something bad happend!" isn't quite specific enough to track down the problem. Below is other pertinent information for this case. SSSD version: sssd-1.2.1-28.el6.x86_64 SSSD.conf: [sssd] config_file_version = 2 reconnection_retries = 3 sbus_timeout = 30 services = nss, pam domains = default [nss] filter_groups = root filter_users = root reconnection_retries = 3 [pam] reconnection_retries = 3 [domain/default] ldap_tls_reqcert = demand auth_provider = ldap cache_credentials = False ldap_id_use_start_tls = False debug_level = 20 enumerate = True ldap_schema = rfc2307 ldap_group_search_base = ou=posixGroups,dc=mydomain,dc=com ldap_user_search_base = ou=People,dc=mydomain,dc=com ldap_default_authtok_type = password ldap_search_base = dc=mydomain,dc=com chpass_provider = ldap id_provider = ldap ldap_default_bind_dn = uid=binduser,ou=Special Users,dc=mydomain,dc=com ldap_uri = ldaps://ldap.mydomain.com/ ldap_default_authtok = XXXXXXXXXXX ldap_tls_cacertdir = /etc/ssl/certs Please let me know if there is other information that you need. Thank you very much for any help you can provide. Ive been trying to track down this problem for three days. Brandon

4 19

[PATCH] make names nss neutral
by Simo Sorce 11 Feb '11

11 Feb '11

While looking at the previous patch I saw that we were still using the sss_nss_ prefix for a number of functions that are used by both the pam and nss responders. Changed the prefix to sss_cli_ so it is more clear those functions are not nss specific. Simo. -- Simo Sorce * Red Hat, Inc * New York

3 10

[PATCH] Fix memberof module with newer library versions
by Simo Sorce 11 Feb '11

11 Feb '11

At some point the libldb library changed how modules are loaded. This patch makes the memberof module work with the new registration methods. Simo. -- Simo Sorce * Red Hat, Inc * New York

3 6

[PATCH] Make 'make check' look nice again
by Sumit Bose 11 Feb '11

11 Feb '11

Hi, while Simo's recent patch fixed the build and the tests this patch adds a more cosmetic optimization to 'make check' with recent libldb version. bye, Sumit

2 2

[PATCH] Fix cleanup transaction
by Stephen Gallagher 11 Feb '11

11 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Without setting in_transaction=true, if the sysdb operations threw an error, we wouldn't cancel the transaction. Coverity bug 10568 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1UPewACgkQeiVVYja6o6Oo3ACdE2f1KrdVtDbSQ52SzzqS4N+e D+gAoI+W3dvMaEIV5+RwVUfH+wE15BV9 =RGlZ -----END PGP SIGNATURE-----

2 2

[PATCH] Clear up -Wunused-but-set-variable warnings
by Stephen Gallagher 11 Feb '11

11 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Some new warnings appeared in gcc 4.6.0. This patch fixes them. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1UPagACgkQeiVVYja6o6PecACggO3SfqrReP0XTBLT7bZnWxdH sGYAn3F4N6GynI9TundwSf4El+YOh6Cz =PwCL -----END PGP SIGNATURE-----

2 2

[PATCH] Disable cache cleanup in 1.2.x
by Stephen Gallagher 11 Feb '11

11 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 There are several problems with how we determine what entries to purge from the cache during the cleanup task in 1.2.x. Rather than expend the energy trying to track them down, it makes sense to disable the cleanup task by default. The only purpose of the cache cleanup is to keep disk usage down, but there should be no issue with disabling it. It's possible that there may be groups with no members hanging around, but this is not harmful. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1SzPwACgkQeiVVYja6o6MFBQCdHKjPc/Zoa3hbA61tsyMs56AX b5MAoJgn1xqO4x2SthCPpV7LtEraIROT =/VhA -----END PGP SIGNATURE-----

2 4

Re: [SSSD] git push failes for me
by Jeff Schroeder 08 Feb '11

08 Feb '11

for real this time 2011/2/8 Jeff Schroeder <jeffschroeder(a)computer.org>: > looping in sssd-devel. > > Reference bug: https://bugzilla.redhat.com/show_bug.cgi?id=675007 > > Милош, what is your username in git? I'm pretty sure I can manually > clear your entry with ldbedit for now. > > 2011/2/8 Olav Vitters <olav(a)vitters.nl>: >> On Tue, Feb 08, 2011 at 10:15:51PM +0100, Милош Поповић wrote: >>> I am coordinator of Serbian translation, but for the last days I can not >>> send any files to Git. Here is the error message: >> >> We (gnome sysadmins) made a change to the infrastructure (switched to >> sssd). This remembers which permissions you have within GNOME (meaning: >> git account). Unfortunately there is a bug in that where it sometimes >> corrupts its cache. As a result, it doesn't remember that you're allowed >> to commit to git :-( >> >> CC'ing gnome-infrastructure for latest update >> >> Quoting full for gnome-infrastructure: >> >>> milos@PotrChkO ~/.prevodi/gbrainy/po $ git push >>> Counting objects: 13, done. >>> Delta compression using up to 2 threads. >>> Compressing objects: 100% (8/8), done. >>> Writing objects: 100% (8/8), 1.10 KiB, done. >>> Total 8 (delta 6), reused 0 (delta 0) >>> error: insufficient permission for adding an object to repository >>> database ./objects >>> >>> fatal: failed to write object >>> error: unpack failed: unpack-objects abnormal exit >>> To ssh://mpopovic@git.gnome.org/git/gbrainy >>> ! [remote rejected] master -> master (n/a (unpacker error)) >>> error: failed to push some refs to >>> 'ssh://mpopovic@git.gnome.org/git/gbrainy' >> >> -- >> Regards, >> Olav >> _______________________________________________ >> gnome-infrastructure mailing list >> gnome-infrastructure(a)gnome.org >> http://mail.gnome.org/mailman/listinfo/gnome-infrastructure > > > > -- > Jeff Schroeder > > Don't drink and derive, alcohol and analysis don't mix. > http://www.digitalprognosis.com > -- Jeff Schroeder Don't drink and derive, alcohol and analysis don't mix. http://www.digitalprognosis.com

3 2

[PATCH] Be extra careful when closing our nss sockets
by Simo Sorce 08 Feb '11

08 Feb '11

This patch address bz670511/trac790 Makes sure there is less chance a broken application, on fork, closes the socket under our feet and reuses the same fd for other purposes, and then complains if we close with the socket. Simo. -- Simo Sorce * Red Hat, Inc * New York

2 4

[PATCH] Only print "no matching service rule" when appropriate
by Stephen Gallagher 04 Feb '11

04 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We were printing "no matching service rule" on all successful requests. This is obviously wrong. Thanks, Gowrishankar for catching this. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1MTS0ACgkQeiVVYja6o6MWLgCggvbGEtXO+SG5JOd4v2JT9n6I AZUAn3q1+2nGJcU0PalX6fM75QUV3TmN =sa1O -----END PGP SIGNATURE-----

2 2

[PATCHES] Performance improvements for the LDAP cleanup task
by Stephen Gallagher 03 Feb '11

03 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patch 0001: I discovered that the cleanup task was not contained in a transaction, so if there were multiple expired entries, it would take a long time (and perform many disc writes) to remove them. Patch 0002: While investigating the above, I also realized that the dataExpireTimestamp attribute (which we use as the primary search expression for expired entries) wasn't listed as an indexed attribute. This means that searches over a large sysdb database (e.g. one with enumerate = true) was significantly slower than it should be. This patch adds dataExpireTimestamp as an indexed attribute. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1CuooACgkQeiVVYja6o6O3IgCfaJyKVwabr7mYZjt5tHH+bx/i zroAoKptTdlTpYtQu4EZYUjWsQcn4ay9 =LRic -----END PGP SIGNATURE-----

2 4

[PATCH] Removing -p option from sss_obfuscate and updating man pages accordingly.
by Gowrishankar Rajaiyan 03 Feb '11

03 Feb '11

Hi Its never a good idea to have a password on the command-line. Patch 0001- removes the -p/--password option from sss_obfuscate command. Patch 0002- updated sss_obfuscate man pages accordingly. -- regards /shanks

2 2

[PATCHES] sss_obfuscate fixes
by Stephen Gallagher 03 Feb '11

03 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patch 0001: Make the domain argument mandatory in sss_obfuscate It doesn't make sense to set a "default" domain. We should require that the domain always be specified. Patch 0002: Gracefully handle permission errors in sss_obfuscate Don't show a traceback if not run as root. Replaces patch from "Fixing traceback call messages for sss_obfuscate command" - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1IeKMACgkQeiVVYja6o6NGLwCfXQnzdZcNYvonvRVG0kd7zx+X +2oAoKyjeNQs/xmy94PXVb1ZIzqAz+Hh =QCB3 -----END PGP SIGNATURE-----

2 5

Config problem or bug(?) with sssd and Windows AD 2008
by Patrick Grieshaber 02 Feb '11

02 Feb '11

Hello folks, first let me say that the sssd project is great and I am lucky that this project is available for CentOS/Redhat through the EPEL repo :-). I've installed version sssd-1.2.1-27.el5.x86_64 and I want to be able to fetch user infos plus enable login through AD 2008 - but I fail.. sssd.conf: [domain/example.com] enumerate = false id_provider = ldap chpass_provider = krb5 ldap_uri = ldap://dc1.example.com, ldap://dc2.example.com ldap_search_base = dc=example,dc=com tls_reqcert = demand ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt ldap_tls_cacertdir = /etc/pki/tls/certs ldap_default_bind_dn = CN=serviceuser,DC=example,DC=com ldap_default_authtok_type = password ldap_default_authtok = serviceuserpassword ldap_user_name = sAMAccountName ldap_search_base = OU=IT,DC=example,DC=com ldap_pwd_policy = none ldap_user_object_class = person ldap_schema = rfc2307bis ldap_user_principal = userPrincipalName ldap_user_uid_number = sAMAccountName ldap_user_gid_number = sAMAccountName ldap_user_uuid = sAMAccountName ldap_user_fullname = displayName # kerberos config auth_provider = krb5 krb5_kdcip = dc1.example.com krb5_realm = EXAMPLE.COM krb5_changepw_principle = kadmin/changepw krb5_ccachedir = /tmp krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX krb5_auth_timeout = 15 For debugging reasons I run: sssd -d9 Here the output if I attempt: su - myuser(a)example.com ...snip... (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(&(sAMAccountName=myuser)(objectclass=person))][OU=IT,DC=example,DC=com]. ...snip... (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_parse_entry] (9): OriginalDN: [CN=my,OU=IT,DC=example,DC=com]. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_generic_done] (6): Search result: Success(0), (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_users_process] (6): Search for users, returned 1 results. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[(nil)], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [ldb] (9): start ldb transaction (nesting: 0) (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_user_send] (9): Save user (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_user_send] (1): no uid provided for [myuser] in domain [example.com] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_users_process] (2): Failed to store user 0. Ignoring. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [ldb] (9): commit ldb transaction (nesting: 0) (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_users_done] (9): Saving 1 Users - Done (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success And su outputs: su: user myuser(a)example.com does not exist What is wrong? I do the mapping of a uid/gid... any help is appreciated! Thank you, pat -- Patrick Grieshaber Mobile: +41 (0)79 215 63 79 Xing: xing.com/profile/Patrick_Grieshaber Skype: patrickgrieshaber GPG Key Fingerprint 0252 0C05 410E C345 1AC7 7530 98ED B18E 62CB CF04

4 11

[PATCH]Sanitize search filters for nested group lookups
by Stephen Gallagher 01 Feb '11

01 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Marcus discovered while doing some AD testing that we were throwing errors dealing with nested groups where the group name has parentheses in it. It turned out that I missed two places where we needed to sanitize search filters. Attached patch fixes https://fedorahosted.org/sssd/ticket/785 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1G+bMACgkQeiVVYja6o6NYOgCdFpDIFZuDM9SHYL5bVPZwGMrJ kDEAn1H0wp1pAV7CW+mqup4hDOgAFPZp =CsJY -----END PGP SIGNATURE-----

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel February 2011