sssd-devel March 2012

sssd-devel@lists.fedorahosted.org

21 participants
80 discussions

SSSD Crypto Support
by Stephen Gallagher 21 Mar '12

21 Mar '12

SSSD is designed to have support for multiple cryptography libraries. Originally we build in support for both Mozilla NSS and libcrypto. However, over the last several releases, libcrypto support has fallen by the wayside and there is now a notable feature disparity between versions of SSSD built against Mozilla NSS and versions built against libcrypto. The basic functionality still works (we have support for caching credentials using a SHA512 algorithm provided by either library), but some of the more advanced features do not. For example: 1. Support for obfuscated passwords in the sssd.conf requires Mozilla NSS(*) 2. Support for centrally-managed SSH public keys requires a BASE64 encode/decode routine and in 1.8.2 wil add a SHA1 hash routine. There is no equivalent available in libcrypto at this time. Going forward, the core upstream for SSSD (all of whom run on Fedora and RHEL systems which have been consolidated on Mozilla NSS for some time) is planning to formally drop support for libcrypto. However, we're certainly willing to continue supporting it if someone else is willing to own the maintenance on it. Thus, I am CCing the maintainers of SSSD in non-Fedora/RHEL distributions that I know of. If anyone here is relying on libcrypto support and is willing to take over its maintenance, please speak up. (*) I consider this a misfeature imposed upon us by incompetent auditors, but it's still a checkbox on someone's list.

2 1

[PATCH] SSH: Fix infinite loop in sss_ssh_knownhostsproxy
by Jan Cholasta 20 Mar '12

20 Mar '12

Hi, this patch fixes infinite loop in sss_ssh_knownhostsproxy. https://fedorahosted.org/sssd/ticket/1268 Honza -- Jan Cholasta

2 1

[PATCH] NSS: Fix debug message
by Stephen Gallagher 20 Mar '12

20 Mar '12

Coverity Bug 12608 Pushed to master under the one-liner rule.

1 0

sssd.conf include feature
by Greg Lehmann 20 Mar '12

20 Mar '12

Wondering about whether this feature exists or is planned to exist? It is for use in a shared administration environment. We have central administration and local administrators. It would allow a central configuration for sssd with local changes. Puppet could manage the central main file and include a user managed portion. We handle sudoers in a similar way. I guess the main use of this might be to allow local admins to control who can login to a server. sssd.conf could include something like this: access_provider = simple simple_allow_groups = central_admins and the included locally managed file could have simple_allow_users = user01, user03, user42 I know we can do this in other ways with puppet, but this would be simpler and it seems to me an include feature might have other uses.

4 4

[PATCH 0/4]: Actual memory cache implementation
by Simo Sorce 19 Mar '12

19 Mar '12

>From [PATCH 0/0] A shared memory cache to perform better: 0/4: Actual memory cache implementation These is the bulk of the work, these patches are still a bit rough at the edges, grep for FIXMEs and TODOs and you'll see some plumbing (for example configure options in sssd to set expiration time and cache sizes are missing and are still harcoded). Simo. -- Simo Sorce * Red Hat, Inc * New York

4 21

Fwd: [Bug 743133] Performance regression with Kerberos authentication against AD
by Dmitri Pal 19 Mar '12

19 Mar '12

Should we make it a default option? It seems like in most cases it helps a lot. ---------------------------------------------------------------------------------------------- --- Comment #41 from Bojan Smojver <bojan(a)rexursive.com> 2012-03-18 00:50:01 EDT --- (In reply to comment #38) > One thing you might try is setting 'ldap_referrals = false'. Bingo! 1.6 secs with cache blown away, 0.16 secs with cache. Only about two orders of magnitude faster. :-) Thank you. Much appreciated!

3 3

[PATCH] SYSDB: Save only lowercased aliases in case-insensitive domains
by Stephen Gallagher 17 Mar '12

17 Mar '12

Fixes https://fedorahosted.org/sssd/ticket/1253 Previously, we were saving both the lower-cased alias names as well as the original capitalization. This was done in order to allow switching case-sensitive/insensitive modes safely, but it had the negative effect of producing duplicate alias entries (differing only by case) on maps like 'services' which have an 'aliases' field. Jakub and I discussed it and we agreed that switching case-sensitivity should always warrant a cache-purge, as it's a fundamental change to the cache contents.

3 4

[PATCH] Free entry from negative cache
by Jakub Hrozek 17 Mar '12

17 Mar '12

I found this (well, valgrind did..) when debugging #1251. I haven't found any TDB specific free function, so I just used free..

3 5

[PATCH] Fix uninitialized variable
by Jakub Hrozek 17 Mar '12

17 Mar '12

This resulted in using uninitialized variables with missing attributes unless the caller explicitly assigned NULL prior to calling list_missing_attrs.

3 2

[PATCH] IPA: Allow service lookups
by Stephen Gallagher 17 Mar '12

17 Mar '12

IPA doesn't natively support services, but if a user is extending their schema manually, we should still allow performing the lookup.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2012