sssd-devel April 2011

sssd-devel@lists.fedorahosted.org

11 participants
47 discussions

[PATCH] Fix IPA config bug with SDAP_KRB5_REALM
by Stephen Gallagher 28 Apr '11

28 Apr '11

The wrong enum value was being used to look up the kerberos realm here. This caused SSSD to fail to start the IPA provider. Pushed to master under the one-liner rule.

1 0

[PATCH] Do not leak LDAP paging controls
by Jakub Hrozek 28 Apr '11

28 Apr '11

I'm sorry I haven't seen the leaks during review, only when I was rebasing my dereference code on top of the paging patches.

2 2

[PATCH]simple provider: Don't treat primary GID lookup failures as fatal
by Stephen Gallagher 27 Apr '11

27 Apr '11

If the user's primary GID was not provided by the SSSD domain, we would throw an error and fail the access check. This is not a security vulnerability, as it would never allow an unauthorized user access, it would only deny access to valid users.

4 3

[PATCH] Add "description" option to SSSDConfig API
by Stephen Gallagher 27 Apr '11

27 Apr '11

Fixes https://fedorahosted.org/sssd/ticket/850 Consumers of the SSSDConfig API like authconfig need an option they can set to provide a comment. The easiest way to do this would be to provide a description option that does nothing. This way, authconfig can notify users that a particular domain is under authconfig's control and that users should change its name if they don't want it to be modified by subsequent authconfig runs. Also related to https://bugzilla.redhat.com/show_bug.cgi?id=697893

2 3

[PATCHES] Add support for paged LDAP results
by Stephen Gallagher 27 Apr '11

27 Apr '11

Patch 0001: Added a debug message to see which record type we're processing on each loop through sdap_process_message(). This is purely informational. Patch 0002: Add support for paged LDAP results. I changed the internals of sdap_get_generic_send() somewhat here and added a new sdap_get_generic_internal() routine that can be used to handle multiple calls to LDAP for a single request. We should be able to use this in the future to handle Active Directory's non-standard attribute-level paging as well (though that's not addressed in this patch). Patch 0003: Add ldap_page_size configuration option I made this a separate patch for simplicity of review. I set 1000 records as the default, as this seemed to be the most-compatible value among 389, OpenLDAP and ActiveDirectory as best I could determine.

3 8

[PATCH] Require openssl-devel is libcrypto backend is selected
by Jakub Hrozek 27 Apr '11

27 Apr '11

[PATCH 1/2] Require openssl-devel is libcrypto backend is selected I've changed the configure flags a little. The previous --enable-crypto sounded like something you should enable to get the functionality compiled in rather than a selection of alternative crypto back end. https://fedorahosted.org/sssd/ticket/844 [PATCH 2/2] BUILD.txt: Warn that all crypto features are implemented Note that the recommended default is NSS.

2 5

Re: [SSSD] GSOC 2011 : SUDO in SSSD
by Stephen Gallagher 26 Apr '11

26 Apr '11

On Tue, 2011-04-26 at 04:52 +0530, arun scaria wrote: > Dear Stephen, > > I'm so thrilled that i got in. Thanks for your faith in me. We're glad to have you with us. It's going to be an exciting summer! > So whats the next step? Do I need to take any official procedures. I > hope we don't want to wait for the official call. There's no need to wait for the official call, no. If you're ready to get started, let's not allow bureaucracy to stand in the way. I'm also a first-time mentor, so I'm learning the process along with you. > I installed fedora 15 alpha on my machine. I hope i need to hang > around there to get an idea about how it works. > > > Anyway I've some doubts. How should i contact you? Through > mail or IRC. It's a good idea to hang out in IRC whenever you're working on SSSD. There are usually SSSD devs active in there between 0500 and 1800 EST (we have devs in Germany and the Czech Republic, as well as in the USA). Ideally, all design discussions should happen on the sssd-devel mailing list, so they're saved for future reference. We'll also want you to set up a Fedora Account so you can use the SSSD Trac wiki for your design documents. I'm CCing the sssd-devel list on this reply, so please continue this discussion there. > Is there any need to be highly formal while in SSSD channel? Not at all. Most of us are highly informal :) > Is there any documents or related technologies I need to follow in > order to understand the SSSD source? The biggest two would be: http://www.freeipa.org/page/IPA_Client_Design_Overview This gives a high-level overview of how the SSSD is designed (it's a little out of date now, but still mostly correct) Also http://blogs.fedoraproject.org/wp/sgallagh/2010/03/17/why-you-should-use-ta… will give you a quick primer in talloc, the hierarchical memory allocator that we use in the SSSD. There's also https://fedorahosted.org/sssd/wiki/Backends101 which will give you a little bit of a view on how the backends are implemented (though the example there is more about writing a new backend for the existing provider types, while you're going to be writing a new provider type). Welcome aboard! > > with **WARM** regards, > > Arun Scaria (r00tkit) > > > -- > Arun Scaria > Project Head | MEC Association of Computer Students > Resource Head | MACS Forum > Computer Science and Engineering (2008-2012) > Govt. Model Engineering College > Cochin-21. > (M) +918089528527. > arunscaria91(a)gmail.com

2 1

[PATCH] Added originalDN to attributes with case-insensitive search
by Jan Zelený 25 Apr '11

25 Apr '11

https://fedorahosted.org/sssd/ticket/808 Jan

4 14

[PATCH] Select principal for GSSAPI authentication
by Jan Zelený 25 Apr '11

25 Apr '11

I'm sending two patches solving selection of appropriate principal for GSSAPI authentication from keytab file. A part of the first patch is a fix of an error present in the documentation. I did that early in the development phase of the patch and I didn't want to tamper with the finished patch any more. Sorry for this inconsistency. Jan

2 13

[PATCH] Configuration parsing modifications
by Jan Zelený 25 Apr '11

25 Apr '11

These changes are all related to the following ticket: https://fedorahosted.org/sssd/ticket/763 Changes in SSSDConfig.py merge old and new domain record instead of just deleting the old and inserting the new one. The old approach let to loss of some information like comments and blank lines in the config file. Changes in API config were performed so our Python scripts (like sss_obfuscate) don't add extra config options to the config file. Jan

3 9

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel April 2011