May 2011 - sssd-devel - Fedora mailing-lists

[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal 05 Apr '12

05 Apr '12

Please see the attached patches. I tried to split the patches logically into manageable sets. Unfortunately I made a minor mistake and I am afraid I will do something wrong to fix it. I merged two wrong patches. Fortunately it was three liner with 1 liner so it is not a big of the deal but I am really scared that I will do something wrong and loose the work I have done. So I hope it is Ok to send it as is. 0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted earlier that I merged by mistake. I was supposed to merge it with patch 25 but picked the wrong one instead. Patch 25 addresses the real issue found by Coverity as mentioned in Stephen's review mail but it did not apply cleanly since it relies on some code from the patches in the middle. 0002--INI-Adding-missing-function-declararion.patch <- this is the patch that was rejected from the second set sent earlier. Fixed according to review comment. 0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing per component The following set of patches introduces the merging of sections during the reading of the file: 0004--INI-New-error-codes-and-messages.patch 0005--INI-New-merge-flags.patch 0006--INI-Add-new-vars-to-parse-structure.patch 0007--INI-Add-save_error-function.patch 0008--INI-Change-parse_error-to-use-save_error.patch 0009--INI-Preparing-for-merging-sections.patch 0010--INI-Enhance-value-processing.patch 0011--INI-Use-section-line-number.patch 0012--INI-Refactor-section-processing.patch 0013--INI-Return-error-in-DETECT-mode.patch 0014--INI-New-test-files-for-section-merge.patch 0015--INI-Test-DETECT-mode-and-use-new-file.patch 0016--INI-Test-for-all-section-merge-modes.patch Patches related porting of the meta data from old way of doing things to the new way of doing things: 0017--INI-Separate-close-and-destroy.patch 0018--INI-Function-to-reopen-file.patch 0019--INI-Metadata-collection-is-gone.patch 0020--INI-Check-access-function.patch 0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check) 0022--INI-Function-to-check-for-changes.patch 0023--INI-Tests-for-access-and-changes.patch 0024--INI-Rename-error-print-function.patch <- rename error printing function for consistency with new interface 0025--INI-Initialize-variables-in-loops.patch <- Coverity issue addressed. Related to patch 0001. 0026--INI-Exposing-functions.patch <- Make some internal functions reusable There is also patch 27. It is a piece of new functionality. It is a preview. Please see the comment before reviewing it. Do I need to split it into multiple patches or it is Ok as is? It is pretty big but all changes are in one file and logically related. The UNIT test is missing so I am not claiming it actually works as expected. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 30

[PATCH] Add support for ADS pwdLastSet
by Pierre Carrier 06 Sep '11

06 Sep '11

Documented on http://msdn.microsoft.com/en-us/library/cc220785(v=prot.10).aspx Introduced in nss_ldap 208: * add support for native Active Directory password policy attributes (enabled if shadowLastChange is mapped to pwdLastSet) --- src/config/SSSDConfig.py | 1 + src/config/etc/sssd.api.d/sssd-ldap.conf | 1 + src/man/sssd-ldap.5.xml | 15 ++++++++++ src/providers/ldap/ldap_auth.c | 9 +++++- src/providers/ldap/ldap_common.c | 43 ++++++++++++++++++++++++++++++ src/providers/ldap/ldap_common.h | 1 + src/providers/ldap/sdap.h | 1 + 7 files changed, 70 insertions(+), 1 deletions(-) diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py index 5135174..992e1f4 100644 --- a/src/config/SSSDConfig.py +++ b/src/config/SSSDConfig.py @@ -167,6 +167,7 @@ option_strings = { 'ldap_user_modify_timestamp' : _('Modification time attribute'), #replaced by ldap_entry_usn# 'ldap_user_entry_usn' : _('entryUSN attribute'), 'ldap_user_shadow_last_change' : _('shadowLastChange attribute'), + 'ldap_user_ads_last_change' : _('pwdLastSet attribute'), 'ldap_user_shadow_min' : _('shadowMin attribute'), 'ldap_user_shadow_max' : _('shadowMax attribute'), 'ldap_user_shadow_warning' : _('shadowWarning attribute'), diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf index 5fd0cfb..6700df9 100644 --- a/src/config/etc/sssd.api.d/sssd-ldap.conf +++ b/src/config/etc/sssd.api.d/sssd-ldap.conf @@ -51,6 +51,7 @@ ldap_user_member_of = str, None, false ldap_user_modify_timestamp = str, None, false ldap_user_entry_usn = str, None, false ldap_user_shadow_last_change = str, None, false +ldap_user_ads_last_change = str, None, false ldap_user_shadow_min = str, None, false ldap_user_shadow_max = str, None, false ldap_user_shadow_warning = str, None, false diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml index 2a39732..0db3ce7 100644 --- a/src/man/sssd-ldap.5.xml +++ b/src/man/sssd-ldap.5.xml @@ -313,6 +313,21 @@ </varlistentry> <varlistentry> + <term>ldap_user_ads_last_change (string)</term> + <listitem> + <para> + When using ldap_pwd_policy=shadow, this parameter + contains the name of an LDAP attribute corresponding + to pwdLastSet in Active Directory server, fell back to + when ldap_user_shadow_last_change was not available. + </para> + <para> + Default: pwdLastSet + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>ldap_user_shadow_min (string)</term> <listitem> <para> diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c index e45d5b3..5ebd72c 100644 --- a/src/providers/ldap/ldap_auth.c +++ b/src/providers/ldap/ldap_auth.c @@ -286,7 +286,8 @@ static errno_t find_password_expiration_attributes(TALLOC_CTX *mem_ctx, return EINVAL; } } else if (strcasecmp(pwd_policy, PWD_POL_OPT_SHADOW) == 0) { - mark = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_LASTCHANGE, NULL); + mark = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_LASTCHANGE, NULL) | + ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_ADS_LASTCHANGE, NULL); if (mark != NULL) { DEBUG(9, ("Found shadow password expiration attributes.\n")) spwd = talloc_zero(mem_ctx, struct spwd); @@ -297,6 +298,12 @@ static errno_t find_password_expiration_attributes(TALLOC_CTX *mem_ctx, val = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_LASTCHANGE, NULL); ret = string_to_shadowpw_days(val, &spwd->sp_lstchg); + + /* Fallback to pwdLastSet for ADS */ + if (ret != EOK) { + val = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_ADS_LASTCHANGE, NULL); + ret = ads_pwdlastset_to_shadowpw_days(val, &spwd->sp_lstchg); + } if (ret != EOK) goto shadow_fail; val = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_MIN, NULL); diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c index 9eb9cc3..22c9bb7 100644 --- a/src/providers/ldap/ldap_common.c +++ b/src/providers/ldap/ldap_common.c @@ -163,6 +163,7 @@ struct sdap_attr_map rfc2307bis_user_map[] = { { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL }, { "ldap_user_entry_usn", NULL, SYSDB_USN, NULL }, { "ldap_user_shadow_last_change", "shadowLastChange", SYSDB_SHADOWPW_LASTCHANGE, NULL }, + { "ldap_user_ads_last_change", "pwdLastSet", SYSDB_SHADOWPW_ADS_LASTCHANGE, NULL }, { "ldap_user_shadow_min", "shadowMin", SYSDB_SHADOWPW_MIN, NULL }, { "ldap_user_shadow_max", "shadowMax", SYSDB_SHADOWPW_MAX, NULL }, { "ldap_user_shadow_warning", "shadowWarning", SYSDB_SHADOWPW_WARNING, NULL }, @@ -878,6 +879,48 @@ errno_t string_to_shadowpw_days(const char *s, long *d) return EOK; } +errno_t ads_pwdlastset_to_shadowpw_days(const char *s, long *d) +{ + long long ll; + long days; + char *endptr; + + if (s == NULL || *s == '\0') { + *d = -1; + return EOK; + } + + errno = 0; + ll = strtoll(s, &endptr, 10); + if (errno != 0) { + DEBUG(1, ("strtoll failed [%d][%s].\n", errno, strerror(errno))); + return errno; + } + + if (*endptr != '\0') { + DEBUG(1, ("Input string [%s] is invalid.\n", s)); + return EINVAL; + } + + /* Magic value for password reset */ + if (ll = 0LL) { + DEBUG(9, ("Magic pwdLastSet date 0, password change forced.\n")); + *d = 0L; + return EOK; + } + + days = ll / 864000000000LL - 134774LL; + + if (days < 0L) { + DEBUG(1, ("Date is before Jan 1, 1970 [%d].\n", ll)); + return EINVAL; + } + + *d = days; + + return EOK; +} + errno_t get_sysdb_attr_name(TALLOC_CTX *mem_ctx, struct sdap_attr_map *map, size_t map_size, diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h index 9146da5..cf301de 100644 --- a/src/providers/ldap/ldap_common.h +++ b/src/providers/ldap/ldap_common.h @@ -146,6 +146,7 @@ int setup_child(struct sdap_id_ctx *ctx); errno_t string_to_shadowpw_days(const char *s, long *d); +errno_t ads_pwdlastset_to_shadowpw_days(const char *s, long *d); errno_t get_sysdb_attr_name(TALLOC_CTX *mem_ctx, struct sdap_attr_map *map, diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h index 32dc344..fdd5b7a 100644 --- a/src/providers/ldap/sdap.h +++ b/src/providers/ldap/sdap.h @@ -115,6 +115,7 @@ struct sdap_ppolicy_data { }; #define SYSDB_SHADOWPW_LASTCHANGE "shadowLastChange" +#define SYSDB_SHADOWPW_ADS_LASTCHANGE "pwdLastSet" #define SYSDB_SHADOWPW_MIN "shadowMin" #define SYSDB_SHADOWPW_MAX "shadowMax" #define SYSDB_SHADOWPW_WARNING "shadowWarning" -- 1.7.4.4

4 11

[PATCH] Add experimental support to receive PAC via GSSAPI
by Sumit Bose 01 Jul '11

01 Jul '11

Hi, this series of patches adds support to receive a windows PAC via GSSAPI and to create a user based on the data in the PAC. This is useful because in an environment with lots of trust relationships between AD server it might be quite time consuming to find out about all the group memberships of a domain user by querying the domain controllers. But the PAC contains all information about group memberships of the corresponding user. The general idea is to add the user, if it doesn't exist in the cache, to the cache of the corresponding domain (see thread about sub-domains, currently this patch add the user to the local domain for simplicity) and to add all group memberships (currently not implemented). If one of the groups cannot be found in the cache a dummy entry with all data needed to resolve this group quickly is added to the cache. Currently there are a couple of loose end, e.g. - groups and group memberships are not handled - PAC is not validated - missing sub-domains - no real SID to uid/gid mapping etc, but I like to start the discussion about the code and the general direction as soon as possible. Currently sssd with these patches can only be build on rawhide, because of the dependencies to the samba4 package (libndr-krb5pac). Patch 0007 contains a little example that demonstrates that the pac responder can also be used to add user and groups based on other input, e.g. it can be used as a backend for the sss_* utilities. This would allow a much better control about which user is allowed to do what kind of operation. Currently only the root user can add and modify user and group entries with the sss_* tools. I have used 'pac' as a part of names here because this was the original target, but I would be happy to change it to a more generic keyword if anyone has a good suggestion. bye, Sumit

2 3

[PATCH] Make parse_args skip extra spaces
by Jakub Hrozek 15 Jun '11

15 Jun '11

https://fedorahosted.org/sssd/ticket/871 The second patch adds a couple of unit tests to exercise both the old behaviour and the multiple spaces.

3 6

[PATCH] AD non-posix group handling
by Jan Zelený 02 Jun '11

02 Jun '11

Hi, since Jakub's RFC2307bis patches are already pushed, I've revisited my AD non- posix group handling patch: 027 Added function for retrieving boolean value from sysdb attributes. This function is then utilized in the second patch 028 This is the patch I sent before with all modifications which were discussed Jan

2 5

[PATCH] Add online callback only once for TGT renewal
by Sumit Bose 02 Jun '11

02 Jun '11

Hi, I confused the online callbacks with tevent timers when adding them to the TGT renewal task with the effect that a new renewal timer was added every time the system switched back from offline to online. Thanks to Kaushik for catching this. The attached patch should fix it. bye, Sumit

3 5

[PATCH] Escape IPv6 address in IPA provider callback
by Jakub Hrozek 02 Jun '11

02 Jun '11

Escaping the IPv6 address with "[" and "]" makes it compliant with RFC2732 and allows the URI to be parsed with libldap routines. https://fedorahosted.org/sssd/ticket/880

2 4

[PATCH] Ensure that SSSD always Requires: the primary-arch sssd-client
by Stephen Gallagher 31 May '11

31 May '11

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=709333 Pushed to master and sssd-1-5 under the one-liner rule.

1 0

[PATCH] Fix typo in initgroups negative cache check
by Stephen Gallagher 31 May '11

31 May '11

Pushed to master and sssd-1-5 under the one-liner rule.

1 0

[PATCH] Change default to Default for consistency in sssd-ldap man page
by Kaushik Banerjee 31 May '11

31 May '11

Hi, Attaching a one-liner patch to change "default: password" to "Default: password" for maintaining consistency in man pages. Thanks, Kaushik

2 1

Announcing the release of SSSD 1.5.8
by Stephen Gallagher 27 May '11

27 May '11

The SSSD team is proud to announce the release of the version 1.5.8 bugfix and enhancement release of the System Security Services Daemon. This release fixes several bugs and is a recommended update for all users of the 1.5.x series. As always, it can be downloaded at https://fedorahosted.org/sssd == Highlights == * Support for the LDAP paging control * Support for multiple DNS servers for name resolution * Fixes for several group membership bugs * Fixes for rare crash bugs == Detailed Changelog == Jakub Hrozek (2): * Set c-ares to retry nameservers * Only save members for successfully saved groups Simo Sorce (1): * clients: use poll instead of select Stephen Gallagher (5): * Make "password" the default for ldap_default_authtok_type * simple provider: Don't treat primary GID lookup failures as fatal * Enable paging support for LDAP * IPA Provider: don't fail if user is not a member of any groups * Add more detail to ldap_uri manpage entry Sumit Bose (2): * Return pam data to the renewal item if renewal fails * Sanitize username during initgroups call

1 0

[PATCH] Add more detail to ldap_uri manpage entry
by Stephen Gallagher 27 May '11

27 May '11

Addresses https://bugzilla.redhat.com/show_bug.cgi?id=707627 and https://bugzilla.redhat.com/show_bug.cgi?id=694580

2 2

[PATCH] Sanitize username during initgroups call
by Sumit Bose 25 May '11

25 May '11

Hi, Kaushik found a code path where we didn't sanitize the user name. To reproduce it try to authentication as an LDAP user with a user name like 'user\01'. It is important to have '\0' followed by other characters in the name. The attached patch should fix the issue. The related trac ticket is #639. bye, Sumit

3 2

[PATCH] Separate return paths for success and failure in sdap_nested_group_check_cache
by Jakub Hrozek 25 May '11

25 May '11

This patch is related to https://fedorahosted.org/sssd/ticket/878 Although with how our code currently works, there is no way the uninitialized variable could be returned to user, we might in future add new calls that return arbitrary errno values. In that case the check for value of ret would not be sufficient. The attached patch adds a separate fail: label used for failure exits from the function.

2 1

[PATCH] Make "password" the default for ldap_default_authtok_type
by Stephen Gallagher 25 May '11

25 May '11

Fixes a regression, https://bugzilla.redhat.com/show_bug.cgi?id=707282 Pushed to master and sssd-1-5 under the one-liner rule.

2 3

[PATCH] Fixed for Coverity bugs in dereference code
by Jakub Hrozek 24 May '11

24 May '11

Attached are patches for three new issues found by Coverity. These issues were introduced by the recent dereference patches.

2 1

sssd and sub-domains
by Sumit Bose 24 May '11

24 May '11

Hi, with this email I would like to start some discussion and collect ideas and use-cases about a new concept for sssd, namely sub-domains. Currently in sssd a domain is like a single namespace which has to be defined in sssd.conf and only users from explicitly known domains are supported. E.g. if you have only domains A and B configured then every request for a user from domain C is already rejected by the nss responder. But what if, e.g. the server for domain A is an Active Directory server and the AD admin decides to create a trust to a new Active Directory domain C? Since the server trust domain C every member of his domain should trust members from domain C as well. Currently we have to add domain C to sssd.conf to allow users from domain C to access services on the client running sssd. But this will get cumbersome if domain C already trusts other domains like D and E and if the admin of domain E decides later on to create a new trust do domain F. Wouldn't is be nice if user and groups from these domains can be accessed by sssd without being configured explicitly? Currently there is work in progress to solve https://fedorahosted.org/sssd/ticket/364 . A winbind based provider would be able to enumerate and authenticate users and groups from trusted AD domains, but as mentioned earlier a request for a user from domain F (user@F) will be rejected by the nss responder, because it is not configured explicitly and so sssd does not know anything about domain F. So it would be nice if sssd can handle the domains C, D, E and F as sub-domains of the configured domain A without an explicit configuration. To solve this we might need to implement a new method to the providers to return the names of the domains the backend can handle. Then the frontends (pam and nss) can query the backends for the list of supported domains and can decided which backend shall handle the request. If you have different ideas about how to handle sub-domains or can think of different use-cases other then the Active Directory one mentioned above, please let me know. I would like to collect the ideas and write up a design for sub-domains based on your input. Thank you very much for your help. bye, Sumit

6 11

[PATCH] Import config.h earlier
by Stephen Gallagher 23 May '11

23 May '11

On RHEL 5 and other older platforms, failing to set _GNU_SOURCE early would cause some functions - such as strndup() - to be unavailable. This patch fixes the broken RHEL 5 automated build.

2 2

[PATCH] Only set _GNU_SOURCE if not already set
by Sumit Bose 23 May '11

23 May '11

Hi, there are a couple of places where we set _GNU_SOURCE in the source files to enable glibc specific extensions. If by chance '-D_GNU_SOURCE=1' is set on the gcc command line, e.g. by using the CFLAGS from a pkg-config output (yes, there are examples :-), we get '"_GNU_SOURCE" redefined' message during compilation. With the attached patch _GNU_SOURCE is only defined in the sources if not already set. An alternative fix would be to remove all defines of _GNU_SOURCE from the source code and add AC_USE_SYSTEM_EXTENSIONS/AC_GNU_SOURCE to configure.ac . I'm not sure if there is a recommended way how to handle _GNU_SOURCE and friends. bye, Sumit

3 7

[PATCHES] Build-system improvements
by Stephen Gallagher 23 May '11

23 May '11

Patch 0001: Stop building a fake interface version into the backend plugins. This is not the correct way to create a plugin module with libtool. Since the interface and the plugins are built at the same time, the correct method is to produce an unversioned .so. Patch 0002: Build the sssd utility sources as an internal libtool helper library. This should speed the build up quite a bit, as what we had been doing is rebuilding all of the common sources for each binary and library. We will now build them once as a helper library that is statically linked into those binaries that require them. There is one caveat with this: we now have to explicitly link this helper library to the plugins, instead of consuming them from the sssd_be binary. This is because there is no way to export the functions through sssd_be from a helper library (that I have been able to find). They stopped being visible to the plugins. I'm debating whether we should be statically linking all of this common code at all, or whether the libsss_util.la should just become a shared library in its own right. For the moment I've kept it as-is, but as of this patch, it's trivial to change over to a shared library. Comments welcome. Please test patch 0002 very carefully. I tried most of the common use-cases I could think of, but I'd prefer if it be tested in a few additional environments.

4 10

[PATCH] Include string.h in sss_cli.h
by Sumit Bose 23 May '11

23 May '11

Hi, by chance so far string.h was always included before sss_cli.h. But to be on the safe side we should include string.h in sss_cli.h because safealign_memcpy() is define here which calls memcpy(). bye, Sumit

2 2

RFC: a substitute for the hostent structure
by Jakub Hrozek 23 May '11

23 May '11

I've been working on extending our resolver code to honour TTL lately. One of the problems I'm solving is the data structure we pass from our resolver abstraction over c-ares to the failover code. Currently, the code uses "struct hostent". This is not practical as hostent does not store TTL. My current version of the patch uses a "struct resolv_hostent" quite similar to hostent, but the address itself is stored in: -------- struct resolv_in_addr { struct in_addr ipaddr; int ttl; }; struct resolv_in6_addr { struct in6_addr ipaddr; int ttl; }; union resolv_addr { struct resolv_in_addr v4_addr; struct resolv_in6_addr v6_addr; }; -------- I was also considering using "struct sockaddr_storage" because that is defined in system headers and some sources[1] recommend it, but I also think that semantics of sockaddr structures is more tied to connecting to a socket than just pure resolving. So right now I prefer the resolv_addr union, but I would like to hear other opinions before moving on with the patch. Jakub [1] http://www.akkadia.org/drepper/userapi-ipv6.html

2 2

[PATCH] Use dereference to speed up RFC2307bis group processing
by Jakub Hrozek 20 May '11

20 May '11

The attached patch set uses special dereference LDAP controls to speed up RFC2307bis group processing. In my setup, with the LDAP server being in Boston and client in Brno, the time for "getent group ipausers" consisting of 2000 entries went down from 1.5 minute to 4 seconds. One part of the patchset I'd like to draw attention to is the heuristics in patch #9. Dereference can potentially provide huge savings, but it's an all-or-nothing operation. As far as I know, you can't only say "only dereference entries matching this filter", at least not using the OpenLDAP dereference. This could actually slow down the processing - consider if a single IPA user being created triggered a full dereference of "ipausers" group. In order to overcome this, the code includes a simple heuristics that either issues a full dereference or a series of single lookups. The heuristics itself was pulled out of thin air, really. If there are any suggestions on a better one, I'll be glad to hear them. And now the patches: [PATCH 1/9] sdap_get_generic_ext Add a private sdap_get_generic_ext_send()/_recv() request that exposes more of ldap_search_ext options, in particular the server contols. The existing sdap_generic_search_send()/_recv() request is now a thin wrapper around the new _ext request. The other important change is that an entry parsing is a callback now. That was done in order to allow custom parsing for results such as OpenLDAP deref or Attribute Scoped Queries. [PATCH 2/9] Add support for Attribute Scoped Queries For more details on ASQ, see: http://msdn.microsoft.com/en-us/library/aa366976%28VS.85%29.aspx http://msdn.microsoft.com/en-us/library/aa746418%28v=VS.85%29.aspx [PATCH 3/9] OpenLDAP dereference searches For more details, see: http://tools.ietf.org/html/draft-masarati-ldap-deref-00 [PATCH 4/9] Generic dereference search A generic wrapper around ASQ and OpenLDAP dereference searches. https://fedorahosted.org/sssd/ticket/635 [PATCH 5/9] append_attrs_to_array allocs on a memory context A convenience function [PATCH 6/9] Change sysdb_add_fake_user to add OriginalDN RFC2307bis code relies heavily on originalDN, so the fake users need to have an option to store it, too. [PATCH 7/9] Use fake users during RFC2307bis nested group processing Instead of downloading complete user data which is potentionally very slow, only download the necessary minimum information and store the users as dummy entries. [PATCH 8/9] Refactor RFC2307bis nested group processing This patch splits checking cache and hash tables into standalone functions. This will make it easy to reuse the code in a new branch that uses dereferencing. [PATCH 9/9] Use dereference in processing RFC2307bis nested groups Instead of issuing N LDAP requests when processing a group with N users, utilize the dereference functionality to pull down all the members in a single LDAP request. https://fedorahosted.org/sssd/ticket/799

3 7

[PATCH] Add options to override GID, homedir and shell
by Jakub Hrozek 20 May '11

20 May '11

[PATCH 1/2] Add a confdb_get_uint32_t convenience function A convenience function to fetch the gid override from confdb [PATCH 2/2] Add options to override GID, homedir and shell The functionality to override the shell is a little different than described in the ticket -- it was adjusted after a discussion on #sssd on IRC. https://fedorahosted.org/sssd/ticket/742 https://fedorahosted.org/sssd/ticket/551

2 14

[PATCH] two cleanup patches
by Jakub Hrozek 20 May '11

20 May '11

[PATCH 1/2] Remove append_attrs_to_array This used to be part of the deref patchset. Since the function is not used, I think it should be removed. [PATCH 2/2] Rename label in expand_ccname_template Simo had a comment about one of my previous patches, but came too late :-) This patch fixes the label name so it is clear that it is hit even on success.

3 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel May 2011