sssd-devel August 2011

sssd-devel@lists.fedorahosted.org

16 participants
68 discussions

Re: [SSSD] [PATCHES] New DEBUG facility
by Pavel Březina 09 Aug '11

09 Aug '11

> On Mon, 2011-08-08 at 07:51 -0400, Pavel Brezina wrote: >> https://fedorahosted.org/sssd/ticket/925 >> >> [PATCH 1/2] There are several new macros in util/util.h: >> >> - SSSDBG_* to reflect a debug level (same names as in the ticket) - >> please, don't use magic numbers anymore >> >> - DEBUG_MSG(level, function, message) which will format the debug >> message like "(time) [prg_name] [function] (level): message\n" >> >> - DEBUG_IS_SET(level) that you should use to check if the level is >> allowed to be logged You can use it like: if >> (DEBUG_IS_SET(SSSDBG_TRACE_LIBS)) {...} >> > > For the most part, this patch is good (one minor nitpick: the comment > around DEBUG_MSG identifies the DEBUG macro, not the DEBUG_MSG macro) > > However, it is very difficult to review. Please break this patch up into > several: > > 1) Creation of the new levels and the macros for converting the old > versions to them. > 2) Modification of the DEBUG() macro and creation of the DEBUG_MSG() > macro > 3) Conversion of the old DEBUG macros to the new levels > 4) The unit tests. > > This will make it much more digestible for the reviewer. Done. > >> [PATCH 2/2] Changes unresolved debug level value (SSSDBG_UNRESOLVED) >> from -1 to 0 so DEBUG macro could be reduced by one condition. Anyway, >> it has a minor effect, every time you want to load debug_level from >> command line parameters, you have to use following pattern: >> >> /* Set debug level to invalid value so we can deside if -d 0 was >> used. */ debug_level = SSSDBG_INVALID; >> >> pc = poptGetContext(argv[0], argc, argv, long_options, 0); >> while((opt = poptGetNextOpt(pc)) != -1) { ... } >> >> debug_level = debug_level != SSSDBG_INVALID ? >> debug_convert_old_level(debug_level) : >> SSSDBG_UNRESOLVED; /* Debug level should be loaded from config file. */ > > I don't actually see any value to this patch. Well, the value isn't really big. -1 is 0xFFF... so you have to check against bit map like this: (debug_level >= 0) && (level & debug_level) ...and I've been told to keep that macro as small as possible. But I'm aware that it adds more complexity to the code so feel free to refuse this change. > Also, wouldn't this > conflict with compatibility with old settings if 'debug_level = 0' had > been explicitly set? Actually, it wouldn't conflict. If you try to put unresolved value in debug_level, it will be converted to 0x0010 (equiv. to 0 in old format). It makes problem only if you need to know if the program is run with -d 0 (so we can call every child with this parameter too) or not - and that's where the above pattern come in.

1 0

Re: [SSSD] [PATCHES] New DEBUG facility
by Pavel Březina 09 Aug '11

09 Aug '11

1 0

using ldb-tools to modify the cache
by Michael Gliwinski 09 Aug '11

09 Aug '11

Hello all, Is it safe to use ldbmodify / ldbdel to modify the LDB cache in /var/lib/sssd/db/ ? Does the daemon need to be stopped? Obviously this is only for debugging, etc. I'm currently trying to track down a weird issue where SSSD is losing track of members of an LDAP group (i.e. all member attribute values are OK in cache but only a subset or none of memberuid values). I wanted to expire an entry by either deleting it or resetting dataExpireTimestamp. Many thanks, -- Michael Gliwinski Henderson Group Information Services 9-11 Hightown Avenue, Newtownabby, BT36 4RT Phone: 028 9034 3319 ********************************************************************************************** The information in this email is confidential and may be legally privileged. It is intended solely for the addressee and access to the email by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. When addressed to our clients, any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing client engagement leter or contract. If you have received this email in error please notify support(a)henderson-group.com John Henderson (Holdings) Ltd Registered office: 9 Hightown Avenue, Mallusk, County Antrim, Northern Ireland, BT36 4RT. Registered in Northern Ireland Registration Number NI010588 Vat No.: 814 6399 12 *********************************************************************************

3 3

[PATCH] Prevent segfault if vetoed_shells are specified without allowed_shells
by Jakub Hrozek 08 Aug '11

08 Aug '11

https://fedorahosted.org/sssd/ticket/954

3 7

[PATCH] debug_timestamps fixes
by Pavel Březina 08 Aug '11

08 Aug '11

If you set value for debug_timestamps in sssd.conf, you are not able to overwrite it via --debug-timestamps parameter. Also sssd man page has an invalid description of this parameter. Both fixed in this patch.

2 2

[PATCH] Remove unused temporary context
by Jakub Hrozek 08 Aug '11

08 Aug '11

While removing an unrelated patch, Alexander noticed we had an unused temporary talloc context. This patch removes it. I didn't remove the done: label (in favor of just returning ret), it cases no harm and future additions to the function might need it again.

2 3

[PATCH] Rename sssd.conf to sssd-example.conf
by Stephen Gallagher 08 Aug '11

08 Aug '11

This file should not be installed by default. It leads to user confusion. We will instead install it as documentation. Authconfig or the SSSDConfig API can generate a file trivially. Also fixes the incorrect example of entry_cache_nowait_percentage https://bugzilla.redhat.com/show_bug.cgi?id=697893

2 2

couple of questions about local domain
by Michael Gliwinski 08 Aug '11

08 Aug '11

Hello all, I have a couple of questions about the SSSD local domain, hope you'll be able to shed some light. I realise the local domain is currently mostly intended for testing, I also get the impression (from searching the archives) that at some point it was meant to be more than that, however I can't find details. I have a couple of use-cases where the local domain would be rather useful, but I'm encountering some problems. 1) When a user is created a private group is automatically created too, however you can't seem to add another user into that group. Is this by design or a bug? (I've one case where I need to be able to do this) # sss_useradd test0 # sss_useradd test1 # sss_usermod -a test1 test0 Could not modify user - check if group names are correct 2) Cross domain memberships - that would be very useful to me. Specifically being able to add both local users and groups (i.e. /etc/passwd, /etc/group) and LDAP users and groups to a group in SSSD local domain. At the moment this doesn't work as sss_usermod/sss_groupmod complains it cannot find user/group in local domain. Are there any plans to have such functionality in SSSD local domain (esp. the 2nd point)? PS. many thanks for the great software, I started rolling out on our servers and all the problems we had before with nss_ldap+pam_krb5+nscd are now gone! -- Michael Gliwinski Henderson Group Information Services 9-11 Hightown Avenue, Newtownabby, BT36 4RT Phone: 028 9034 3319 ********************************************************************************************** The information in this email is confidential and may be legally privileged. It is intended solely for the addressee and access to the email by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. When addressed to our clients, any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing client engagement leter or contract. If you have received this email in error please notify support(a)henderson-group.com John Henderson (Holdings) Ltd Registered office: 9 Hightown Avenue, Mallusk, County Antrim, Northern Ireland, BT36 4RT. Registered in Northern Ireland Registration Number NI010588 Vat No.: 814 6399 12 *********************************************************************************

2 2

Announcing SSSD 1.5.12
by Stephen Gallagher 05 Aug '11

05 Aug '11

The SSSD team is proud to announce the version 1.5.12 enhancement and bugfix release of the System Security Services Daemon. As always, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Fixes a regression introduced in 1.5.11 with hostname resolution * Fixes an issue where sssd_pam would leak file descriptors until resource exhaustion * Complete rewrite of the FreeIPA Host-Based Access Control (HBAC) resolver * New shared library for HBAC access-control * Fixes for password expiration handling with LDAP auth * New option to veto certain centrally-managed shells (Patch by John Hodrien) == Detailed Changelog == Jakub Hrozek (18): * Use ares_search instead of ares_query for hostname resolution * Do not add a NULL host parsed from LDAP URI * Only print server address if one is available * Fix indexing of skipped groups * Set gidNumber of non-posix groups to 0 even on updates * Explicitly ignore groups with gidNumber=0 * Wrong paramater to sysdb_attrs_add_uint32 * Change the default value of ldap_tls_cacert in IPA provider * Provide python bindings for the HBAC evaluator library * Fixes for python HBAC bindings * Fix python HBAC bindings for python <= 2.4 * Remove dead code from python HBAC bindings * Handle allocation error in python HBAC bindings * UTF8 HBAC test * HBAC rule validation Python bindings * Request password control unconditionally during bind * pyhbac: Do not convert int to bool * Fix returning groups when gidNumber attribute is not ordered John Hodrien (1): * Add vetoed_shells option Simo Sorce (1): * sss_client: avoid leaking file descriptors Stephen Gallagher (19): * Bumping version to 1.5.12 * Remove incorrect private variable * Add helper function msgs2attrs_array * Add HBAC evaluator and tests * Add helper functions for looking up HBAC rule components * Remove old HBAC implementation * Add new HBAC lookup and evaluation routines * Add ipa_hbac_refresh option * Add ipa_hbac_treat_deny_as option * Treat NULL or empty rhost as unknown * libipa_hbac: Support case-insensitive comparisons with UTF8 * Fix memory leak in ipa_hbac_evaluate_rules * Fix incorrect NULL check in ipa_hbac_common.c * Require matched version and release for libipa_hbac * Add rule validator to libipa_hbac * Allow LDAP to decide when an expiration warning is warranted * Update translation files for SSSD 1.5.12 release * Revert "Allow LDAP to decide when an expiration warning is warranted" * Updating translations for SSSD 1.5.12 release

1 0

[PATCH] Allow LDAP to decide when an expiration warning is warranted
by Stephen Gallagher 04 Aug '11

04 Aug '11

Previously, we were only displaying expiration warnings if the password was going to expire within a day. We'll allow LDAP to make this decision (by whether it passes us the expiration time). In the future, we can add an option to clamp this down to a shorter period if the local admin prefers it. https://fedorahosted.org/sssd/ticket/940

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2011