August 2011 - sssd-devel - Fedora Mailing-Lists

[PATCH] Add option to specify the kerberos replay cache dir

by Stephen Gallagher

Adds a configure option to set the distribution default as well as an sssd.conf option to override it. Resolves: https://fedorahosted.org/sssd/ticket/980

12 years, 7 months

3
12
0 / 0

Tarball for GSOC code uploading

by arun scaria (Google Docs)

This tar ball contain the work I've done over the last months. This is ready for uploading to the google project hosting. Please feel free to comment in case of any flaw in any part of the tar ball contents. :) By, r00tkit -- *Arun Scaria** | *arunscaria91(a)gmail.com | arunscaria(a)acm.org<arunscaria91(a)gmail.com> | +91-808952852 Chairman | MEC Association of Computer Students (MACS), Junior Under Graduate | Computer Science and Engineering (2008-2012), Govt. Model Engineering College, Cochin-21, India.

12 years, 8 months

1
0
0 / 0

Announcing SSSD 1.6.1

by Stephen Gallagher

The SSSD team is proud to announce the version 1.6.1 bugfix release of the System Security Services Daemon. This release fixes several regressions introduced in 1.6.0 during the HBAC rule rewrite and is a highly recommended update for any FreeIPA deployment. Several other bugs have also been fixed and are described below. As always, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Fixes a serious issue with LDAP connections when the communication is dropped (e.g. VPN disconnection, waking from sleep) * SSSD is now less strict when dealing with users/groups with multiple names when a definitive primary name cannot be determined * The LDAP provider will no longer attempt to canonicalize by default when using SASL. An option to re-enable this has been provided. * Fixes for non-standard LDAP attribute names (e.g. those used by Active Directory) * Three HBAC regressions have been fixed. * Fix for an infinite loop in the deref code == Detailed Changelog == Jakub Hrozek (9): * pyhbac: Do not convert int to bool * Fix returning groups when gidNumber attribute is not ordered * Prevent segfault if vetoed_shells are specified without allowed_shells * Handle timeout during sss_ldap_init_send * IPA dyndns: do not segfault if the server cannot be resolved * Return the first value of name if the multivalued name attribute does not match RDN * Add LDAP provider option to set LDAP_OPT_X_SASL_NOCANON * Use the default Kerberos realm for LDAP with GSSAPI auth * Fix moving to next entry in deref code Ralf Haferkamp (1): * Allow the O_NONBLOCK flag to be reset correctly Stephen Gallagher (7): * Bumping version to 1.6.1 * Revert "Allow LDAP to decide when an expiration warning is warranted" * Use sysdb attribute name for GID, not LDAP attribute * HBAC: Handle saving groups that have no members * HBAC: Use of hostgroups for targethost or sourcehost was broken * HBAC: Properly skip all non-group memberOf entries * Updating translation files for 1.6.1 release Sumit Bose (1): * Improve password policy error code and message Yuri Chornoivan (1): * Fix two man page typos

12 years, 8 months

1
0
0 / 0

Announcing SSSD 1.5.13

by Stephen Gallagher

The SSSD team is proud to announce the LTM version 1.5.13 bugfix release of the System Security Services Daemon. This release fixes several regressions introduced in 1.5.12 during the HBAC rule rewrite and is a highly recommended update for any FreeIPA deployment. Several other bugs have also been fixed and are described below. As always, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Fixes a serious issue with LDAP connections when the communication is dropped (e.g. VPN disconnection, waking from sleep) * SSSD is now less strict when dealing with users/groups with multiple names when a definitive primary name cannot be determined * The LDAP provider will no longer attempt to canonicalize by default when using SASL. An option to re-enable this has been provided. * Fixes for non-standard LDAP attribute names (e.g. those used by Active Directory) * Three HBAC regressions have been fixed. == Detailed Changelog == Jakub Hrozek (5): * Prevent segfault if vetoed_shells are specified without allowed_shells * Handle timeout during sss_ldap_init_send * Return the first value of name if the multivalued name attribute does not match RDN * Add LDAP provider option to set LDAP_OPT_X_SASL_NOCANON * Use the default Kerberos realm for LDAP with GSSAPI auth Ralf Haferkamp (1): * Allow the O_NONBLOCK flag to be reset correctly Stephen Gallagher (6): * Bumping version to 1.5.13 * Use sysdb attribute name for GID, not LDAP attribute * HBAC: Handle saving groups that have no members * HBAC: Use of hostgroups for targethost or sourcehost was broken * HBAC: Properly skip all non-group memberOf entries * Updating translation files for SSSD 1.5.13 Sumit Bose (1): * Improve password policy error code and message

12 years, 8 months

1
0
0 / 0

[PATCH] Fix moving to next entry in deref code

by Jakub Hrozek

https://fedorahosted.org/sssd/ticket/973 I'm pretty sure this patch will fix the problem John Hodrien had with dereference code, although I have not reproduced the problem using referrals as he did, but simpler: i) use the dereference code, but process a group that is below the full deref threshold (<10 members by default) ii) one of its members is neither user nor group and is not cached iii) the dereference code always tries to move the "expired group index" not the "missing DN index" so the missing DN array never reaches the NULL sentinel

12 years, 8 months

2
3
0 / 0

[PATCH] HBAC: Properly skip all non-group memberOf entries

by Stephen Gallagher

There was a typo here and we weren't properly skipping memberOf attributes in a user entry that contained fewer than four domain components. This can be reproduced by creating an HBAC rule that includes a specific user. The FreeIPA server must also be using a single-component domain (e.g. dc=freeipa as opposed to dc=example,dc=com) Resolves https://bugzilla.redhat.com/show_bug.cgi?id=733237

12 years, 8 months

3
3
0 / 0

[PATCH] Use the default Kerberos realm for LDAP with GSSAPI auth

by Jakub Hrozek

https://fedorahosted.org/sssd/ticket/970

12 years, 8 months

2
3
0 / 0

[PATCHES] Fixes for HBAC regressions

by Stephen Gallagher

Patch 0001: Handle saving groups that have no members https://fedorahosted.org/sssd/ticket/981 Patch 0002: Fix using hostgroups for targethost or sourcehost We were trying to look up the wrong attribute for the name of the hostgroup. https://fedorahosted.org/sssd/ticket/979

12 years, 8 months

2
2
0 / 0

Add LDAP provider option to set LDAP_OPT_X_SASL_NOCANON

by Jakub Hrozek

https://fedorahosted.org/sssd/ticket/978 This is currently not testable on Fedora 15 due to a number of bugs (#733675, #733056). I used RHEL 6.2 to test the patch. To test: * change the PTR record of the IPA server to point to something else than its hostname * on the client, run getent passwd admin With the unpatched version, ldap_sasl_bind() would fail with a "Local error". With the patch, which turns off canonicalization by default, the user lookup should succeed. The patch does not apply cleanly on 1.5. I'll send a 1.5 version once this one is acked.

12 years, 8 months

2
4
0 / 0

[PATCH] --debug-timestamps=1 is not passed to providers

by Pavel Březina

https://fedorahosted.org/sssd/ticket/972 Requires "New DEBUG facility" patches.

12 years, 8 months

3
4
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2011