sssd-devel August 2011

sssd-devel@lists.fedorahosted.org

16 participants
68 discussions

Start a nNew thread

[PATCH] Handle errno properly in set_debug_file_from_fd()
by Jakub Hrozek 15 Aug '11

15 Aug '11

set_debug_file_from_fd would return NULL if fdopen failed as the DEBUG() macro would overwrite errno.

3 2

[PATCH 029-032] Refactoring of sdap_async_accounts
by Jan Zelený 15 Aug '11

15 Aug '11

So here it is, a set of patches splitting file sdap_async_accounts and making some subsequent changes. If anyone has other ideas what could be changed, let me know. I was in favor of splitting the file into 3, as Simo suggested: sdap_async_users.c sdap_async_groups.c sdap_async_initgroups.c This way three basic operations are separated, but they are not separated too much (otherwise a _common.c file would have to be present, since some routines are shared by code paths in different schemas). Thanks Jan

3 7

[PATCHES] Sysdb refactoring
by Jan Zelený 15 Aug '11

15 Aug '11

I'm sending several patches with the sysdb refactoring. Originally, I was planning one more step - to change return type from int to errno_t where it was convenient. If someone wants to do it, feel free. Otherwise I'm going to make the patch myself in couple days. When reviewing, please note that patches 40-43 have to be tested together. The same applies for patches 44-46. Jan

3 9

[PATCH] Use sysdb attribute name for GID, not LDAP attribute
by Stephen Gallagher 11 Aug '11

11 Aug '11

This was working in the common case, because for most (non-AD) directory servers, the LDAP attribute and the sysdb attribute had the same name. However, this was incorrect behavior. In the future, I've asked our QE group to set up LDAP servers with ALL non-standard attribute names, so that we'll discover mistakes of this nature sooner.

2 2

[PATCH]Fix broken RHEL5 build
by Stephen Gallagher 11 Aug '11

11 Aug '11

RPM in RHEL 5 requires %ghost entries to be present in the build root. Pushed to master under the one-liner and unbreak-the-build rules.

1 0

Re: [SSSD] [Freeipa-users] Kerberos kew renewal not working
by Sumit Bose 11 Aug '11

11 Aug '11

adding sssd-devel On Thu, Aug 11, 2011 at 10:14:09AM +0200, Tim Niemueller wrote: > Hi all. > > We have setup FreeIPA on a F-15 virtual machine. I'm currently > testing with a F-14 client. We would like to keep F-14, as F-15 > seems not generally stable enough for wide deployment (graphics > issues etc.). I have described the setup a bit at > http://www.niemueller.de/blog/id/245, which was possible only > through numerous IRC sessions on #freeipa. This issue here seems a > little more long-standing, hence the mail this time. > > I'm having a hard time getting the setup running reliably. Initial > login and desktop use works fine. But a typical use case is leaving > the desktop running overnight with just the screen locked (there > might be stuff running in the background). Now, if I return the next > day and try to use the machine the machine is frozen and cannot be > used. Tickets have not been renewed, in particular the one for the > NFSv4 server protected by Kerbero (sec=krb5). It just expired after > 24h. > > The problem can be recreated quickly with a shorter 5 minute > lifetime with the following modifications (on the client). > > This assumes that you have /home mounted via Kerberos-protected NFSv4 share! > > In /etc/sssd/sssd.conf: > [domain/somedomain] > krb5_renewable_lifetime = 14d > krb5_renew_interval = 60 > krb5_lifetime = 5m > > [domain/default] > krb5_renewable_lifetime = 14d > krb5_renew_interval = 60 > krb5_lifetime = 5m > > Then reboot (just restarting sssd does not always show the problem, > especially if you had been logged in before). > Then login and wait five minutes, the machine freezes, as the NFS > key has expired. If you do a klist just before the timeout expires, > you see that the keys have not been renewed as expected (but the > renewable end time is still way in the future, even if the FreeIPA > server default of 7d was not increased). Maybe I need to set some > magic flag for rpc.gssd, but I couldn't find it. Which version of sssd are you using? Does it work is you manually call 'kinit -R' before the ticket expires? Can you send a sanitized version of the sssd log files with debug_level=9? bye, Sumit > > Is there something I can do on my side to get this working? Or is it > a FreeIPA or sssd shortcoming, or even "intended not to work by > design"? > > Ideally, I want to make it possible for users to just keep logged in > all the time, so even acquiring new tickets automatically by > requesting an intermediate user authentication or just doing it from > the screensaver would be great, but I guess with /home mounted I'm > pretty much out of luck? Is there alternatively a way to only > authenticate the host via krb5, but not the user? In the old days we > would simply use IP addresses to allow access. Well, that's bad, but > having just the host authenticate to prevent laptop road warriors > from snooping around could be just enough for us and avoid user > ticket renewal, any idea? > > Thanks for your input. > Tim > > -- > KBSG - Knowledge-Based Systems Group AllemaniACs RoboCup Team > ======================================================================== > http://robocup.rwth-aachen.de RWTH Aachen University > http://kbsg.rwth-aachen.de Ahornstrasse 55 > http://www.fawkesrobotics.org D-52056 Aachen > > _______________________________________________ > Freeipa-users mailing list > Freeipa-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/freeipa-users

1 0

[PATCHES] Fixes for sysdb upgrades
by Stephen Gallagher 10 Aug '11

10 Aug '11

I noticed two issues with sysdb upgrades: Patch 0001: If the transaction failed to commit for any reason, we were not cancelling it. This could leave the LDB in an unusable state. Patch 0002: There was a double-free in sysdb_domain_init_internal(), since tmp_ctx was allocated as a child of ctx.

2 2

[PATCH] Include the configuration file as a %ghost entry
by Stephen Gallagher 10 Aug '11

10 Aug '11

This is an issue only in the master branch. The recent patch to stop installing the example config into /etc/sssd/sssd.conf was incomplete and resulted in RPM removing existing configurations. This config file needs to be listed as a %ghost entry so it's maintained properly.

3 4

[PATCH] Remove private shared object Provides: for pysss.so and pyhbac.so
by Stephen Gallagher 10 Aug '11

10 Aug '11

Eliminates rpmlint warning: libipa_hbac-python.x86_64: W: private-shared-object-provides /usr/lib64/python2.7/site-packages/pyhbac.so pyhbac.so()(64bit) (and also for pysss.so in the sssd package)

2 2

[PATCH] Remove private shared object Provides: for pysss.so and pyhbac.so
by Stephen Gallagher 09 Aug '11

09 Aug '11

Eliminates an rpmlint warning about private shared object provides. There's no reason to be advertising this.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2011