October 2013 - sssd-devel - Fedora mailing-lists

[PATCH] PROXY: Fix memory hierarchy when enumerating services
by Jakub Hrozek 22 Oct '13

22 Oct '13

Enumerating services with the proxy backend didn't work, a local variable was used as a talloc context..

2 2

[PATCH] krb5: Use right function to free data
by Lukas Slebodnik 22 Oct '13

22 Oct '13

ehlo, This patch fixes warning reported by clang static analyzer. Simple patch is attached. LS

3 4

[INI][PATCHES] Allow c-style comments in config files
by Dmitri Pal 21 Oct '13

21 Oct '13

Hello The following patch set addresses ticket https://fedorahosted.org/sssd/ticket/2108 Please see commit messages for more details about what each patch does. Please follow the order of the patches in the set. -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 4

SSSD Internals Document published
by Yassir Elley 21 Oct '13

21 Oct '13

The SSSD team has published an SSSD Internals Document, which can be found at https://fedorahosted.org/sssd/wiki/InternalsDocs. If there are any mistakes in the document, feel free to modify the document. >From the Introduction to the document: " The purpose of this document is to give a basic description of the internals of the SSSD implementation. The material in this document is accurate as of SSSD 1.10. It is assumed that the reader is already familiar with the external usage of SSSD. The intended audience of this document are new contributors to the SSSD project. This document is not intended to be comprehensive. For additional details on specific features, please refer to the various Design Documents. This document does not discuss the details of building, installing, and debugging SSSD. More information on these topics can be found in the Developer Pages, and the Documentation. To be most useful, this document should be updated as appropriate, and reviewed at regular intervals. In order to better understand the material and make things more concrete, this document starts by describing a specific use case (and configuration) that will be discussed throughout the document. The document starts with a high level end-to-end overview, and then deep-dives into detailed descriptions. The document is organized into the following sections: Active Directory Use Case: specifies use case used throughout the document System Overview: end-to-end SSSD overview, including short descriptions of components Advanced Topics: offline operation, multiple domains, trust relationships SSSD Wrappers: SBus, SDAP Common Data Structures: data structures used by each SSSD process Component Details: gory details of each component Appendix: tevent, function descriptions, filesystem locations, helpful links " Regards, Yassir.

3 3

Design Discussion: Improving AD provider access control
by Jakub Hrozek 20 Oct '13

20 Oct '13

Hi, I created a design page that describes a proposed way of improving the current AD provider access control. The main ticket that tracks the work is https://fedorahosted.org/sssd/ticket/2082 and the full design page can be found here: https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryAccessControl Comments and review are mostly welcome. For your convenience, the text of the design page is also copied below, in wiki syntax: == Active Directory client access control == Related ticket(s): * [https://fedorahosted.org/sssd/ticket/2082 RFE:Add a new option ad_access_filter] * [https://fedorahosted.org/sssd/ticket/1975 RFE:Change the default of ldap_access_order] * [https://fedorahosted.org/sssd/ticket/1977 issues when combining the AD provider and ldap_access_filter] Somewhat related: * [https://fedorahosted.org/sssd/ticket/2083 Document the best practices for AD access control] === Problem Statement === The recommended way of connecting a Linux client to an Active Directory domain is using the [http://jhrozek.fedorapeople.org/sssd/1.11.0/man/sssd-ad.5.html AD provider]. However, in the default configuration of the Active Directory provider, only account expiration is checked. Very often, the administrator needs to restrict the access to the client machine further, limiting the access to a certain user, group of users, or using some other custom filtering mechanism. In order to do so, the administrator is required to use an alternative access control provider. However, none of the alternatives provide the full required functionality for all users resolvable by the AD provider, moreover they are hard to configure. This design page proposes extension of the AD access provider to address these concerns. === Current access control options === With the existing SSSD, the administrator has two basic means to restrict access control to the Linux client - using the [http://jhrozek.fedorapeople.org/sssd/1.11.0/man/sssd-simple.5.html simple access control provider] or configuring the LDAP access control provider. Each approach has its pros and cons. ==== Using the simple access provider ==== The simple access provider grants or denies access based on the contents of allow and deny lists. There are separate lists for user and group names as well as allowed and denied objects. The following example shows configuration that grants access to user named `tux` and group called `linuxadmins`. {{{ access_provider = simple simple_allow_users = tux simple_allow_groups = linuxadmins }}} * Pros: * Easy to configure * Realmd provides an interface to configure the simple access provider using its CLI * Cons: * Account expiration is not checked * Limited expresiveness. No way to combine several clauses * Does not align with the LDAP structure the Active Directory uses ==== Using the LDAP access provider ==== The LDAP access provider offers a way to configure the access control decision based on whether the user matches a preconfigured filter. Moreover, the LDAP access provider also offers chaining other LDAP based checks. For the vanilla AD environment, only account expiration check applies. The following example illustrates configuration that allows access to those users, who are members of group named `linuxadmins` AND have a valid home directory set using the `ldap_access_filter` directive. The users who match the configured filter are also checked whether they are expired (`ldap_access_order` contains `expire`). {{{ access_provider = ldap ldap_access_order = filter, expire ldap_account_expire_policy = ad ldap_access_filter = (&(memberOf=cn=admins,ou=groups,dc=example,dc=com)(unixHomeDirectory=*)) ldap_sasl_mech = GSSAPI ldap_sasl_authid = CLIENT_SHORTNAME$(a)EXAMPLE.COM ldap_schema = ad }}} * Pros: * Allows the administrator to base access control on a custom LDAP filter, making it possible to combine several conditions * Conditions are not limited to user names or group membership * Cons: * Nontrivial and clumsy configuration that must include several low level LDAP settings, otherwise set automatically by the AD provider. Defeats the whole purpose of the AD provider * The admin needs to combine AD and LDAP providers. Judging by experience from triaging support cases with Red Hat support, this is a problem for many admins. * Account expiration check must be configured separately, which is not obvious * No support for users from trusted AD domains * No realmd integration === Proposed solution === The proposal is to add a new access filter configuration option to the existing AD access provider. Adding the option to the AD provider would greatly simplify the configuration when compared to the LDAP access control, while maintaining the full expresiveness of `ldap_access_filter`. The new option would be called `ad_access_filter`. If the new option was set, then the AD access provider would first match the entry against the filter in that option. If the entry matched, then the account would be checked for expiration. The following exapmple illustrates an example similar to the one above, using the proposed AD options: {{{ access_provider = ad ad_access_filter = (&(memberOf=cn=admins,ou=groups,dc=example,dc=com)(unixHomeDirectory=*)) }}} The main advantage is simplified configuration. The admin doesn't have to know or understand what "SASL ID" is. In comparison with the two legacy solutions explained above: * Pros * Easy and intuitive configuration. Only one provider type is configured * Sane defaults - always checks for expiration, also checks access filter if configured that way * Would support users and groups from trusted domains by leveraging the existing AD provider infrastructure * Cons * No realmd integration === Realmd integration === After a short discussion with the realmd upstream maintainer, it was decided that these options do not fit the realmd use-cases well. If the user needs to use such advanced techniques as LDAP filters, chances are that he doesn't need a tool like realmd to set them up in the config file. === Implementation details === 1. The default value of what AD access_provider is set to should be changed * Currently, if `access_provider` is not set explicitly, the default is `permit`, thus allowing even expired accounts * The new default would be `ad`, checking account expiration even with a minimal configuration 1. A new option would be added. The new option would be called `ad_access_filter` 1. The LDAP access provider must be extended to allow connecting to a GC and support subdomains in general * Pass in `struct sdap_domain` and `id_conn` instead of using the connection from `sdap_id_ctx` directly * The code must not read the `sss_domain_info` from `be_ctx` but only from `sdap_domain` in order to support subdomain users 1. The AD access provider must call the improved LDAP access provider internally with the right connection * The default should be GC * If POSIX attributes are in use and GC lookup wouldn't match, optionally fall back to LDAP. This fallback could be tried just once to speed up subsequent access control 1. The default chain of LDAP access filter the AD provider sets internally must be changed. * Currently AD provider sets `ldap_access_order=expire`. If (and only if) `ad_access_filter` was set, the LDAP chain would become `ldap_access_order=filter,expire` ==== Parsing the `ad_access_filter` option ==== 1. The `ad_access_filter` option is a comma-separated list of filters that apply globally, per-domain or per-forest. The most specific match is used 1. If the `ad_access_filter` value starts with an opening bracket `(`, it is used as a filter for all entries from all domains and forests * example: `(&(memberOf=cn=admins,ou=groups,dc=example,dc=com)(unixHomeDirectory=*))` 1. More advanced format can be used to restrict the filter to a specific domain or a specific forest. This format is `KEYWORD:NAME:FILTER` * KEYWORD can be one of `DOM` or `FOREST` * KEYWORD can be missing * NAME is a label. * if KEYWORD equals `DOM` or missing completely, the filter is applied for users from domain named NAME only * if KEYWORD equals `FOREST`, the filter is applied on users from forest named NAME only * examples of valid filters are: * apply filter on domain called dom1 only: * `dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)` * apply filter on domain called dom2 only: * `DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)` * apply filter on forest called EXAMPLE.COM only: * `FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)` 1. If no filter matches the user's domain, access is denied * example `ad_access_filter = dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com), dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)`, user logs in from dom3 === Contingency plan === None needed. The existing options would still exist and function as they do now. === How to test === 1. Check that `access_provider=ad` without any other options allows non-expired users 1. Check that `access_provider=ad` without any other options denies expired users 1. Test that setting `ad_access_filter` restricts access to users who match the filter * test that an expired user, even though he matches the filter, is denied access * this test must include users from the primary domain as well as a sub domain * Different filters should be tested to make sure the most speficic filter applies * example: add a restrictive filter for dom1 and permissive filter without specifying the domain. A user from dom1 must be denied access, while a user from other domain must be allowed access 1. When access is denied, the SSSD PAM responder must return a reasonable return code (6) === Future and optional enhancements === In the future, we should extend the `access_provider` option itself and allow chaining access providers. This enhancement would allow even more flexibility and would allow the administrator to combine different access providers, but is outside the scope of the change described by this design page. === Author(s) === * Jakub Hrozek <jhrozek(a)redhat.com> * Sumit Bose <sbose(a)redhat.com>

4 7

[INI] [PATCHES] Add UTF 8/16/32 conversion
by Dmitri Pal 19 Oct '13

19 Oct '13

Hello, The attached patches address ticket https://fedorahosted.org/sssd/ticket/2106 The patches do not define new flags as suggested in the ticket. As we discussed with Nalin we try to detect the encoding based on the BOM and do the right thing without flags. If we see that this is not enough we will add flags but that would add a new function so such change would be destined for a bigger release. For now I think the use case is addressed. If we see the need to other use cases we will open other tickets. The patch depends on the previous set of patches that deal with C-Style comments. I also found some other unrelated issue that I logged as a separate ticket. https://fedorahosted.org/sssd/ticket/2119 -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 3

automatic renewal of TGT for IPA users
by Qing Chang 18 Oct '13

18 Oct '13

In sssd InternalsDocs, there is a statement: "SSSD can automatically renew the TGT at a configurable interval". Can someone give me a pointer as how I can configure sssd to do it? I am using krenew for the same effect, thought a native way would be much better... Many thanks, Qing

2 1

[PATCHES] struct sockaddr casting
by Michal Židek 17 Oct '13

17 Oct '13

Hello, these are the patches, that solve the casting of sockaddr structure. Patch 0001 - Adds function to filter out special ip addresses (loopback, multicast, linklocal, broadcast) and also a unit test for it. Used in later patches. Patch 0002 and 0003 - Use the function from patch 0001 and properly copy the sockaddr_in structure to avoid alignment warnings. Patch 0004 - Avoid casting of sockaddr to sockaddr_in in tests. Also here is the discussion from diffrent thread, related to sockaddr casting: // PASTE BEGIN >>>>> I tested some compilers and patches work fine with clang and gcc. >>>>> But there are also another compilers in the world >>>>> ant they needn't understand "pragma GCC". This pragma is not standardized. >>>>> >>>>> >>>>> src/providers/dp_dyndns.c(145): warning #161: unrecognized #pragma >>>>> #pragma GCC diagnostic push >>>>> ^ >>>>> >>>>> src/providers/dp_dyndns.c(146): warning #161: unrecognized #pragma >>>>> #pragma GCC diagnostic ignored "-Wcast-align" >>>>> ^ >>>>> >>>>> src/providers/dp_dyndns.c(206): warning #161: unrecognized #pragma >>>>> #pragma GCC diagnostic pop >>>>> ^ >>>>> >>>>> If you are 100% sure about alignment, you can define own macro. >>>>> >>>>> Something like this: >>>>> #define ignore_align(var, dest_type) \ >>>>> (dest_type *)((void*)(var)) >>>>> >>>>> And usage: >>>>> wrapper->refcount = ignore_align(wrapper->ptr + refcount_offset, int); >>>>> >>>>> >>>>> Does anybody have any better ideas? >>>> Compiler specific #pragma should not be used. And I think in general >>>> #pragma should be used with great care. Currently there is only one use >>>> case in sssd in the memcache code to align some structs which make >>>> sense. >>> Indeed, agree 100% >>> >>>> Especially I think ingnoring a warning is not a good idea. If currently >>>> no one has a good idea how to handle the sockaddr and in_addr structs in >>>> a way which does not produce a warning I would prefer to keep the >>>> warning around until someone has a good idea. Imo a comment in the code >>>> that the warning can be ignored would be sufficient for the time being. >>> casting sockaddr is a bug, unless you know for sure it was created as >>> sockaddr_un and then simply casted to sockaddr, but in that case I would >>> consider the casting to pass it around just a different bug. >>> >>> Please use sockaddr_un anywhere you need to perform casts. Pass around >>> sockaddr_un and cast it only at the time of use when needed. >> It is not possible to use sockaddr_un(or sockaddr_storage). >> >> We use function getifaddrs to retrieve addresses of network interfaces. >> >> Manual page says (man 3 getifaddrs) >> -------------------------------------------------------------------------- >> int getifaddrs(struct ifaddrs **ifap); >> >> The getifaddrs() function creates a linked list of structures >> describing the network interfaces of the local system, and stores >> the address of the first item of the list in *ifap. >> The list consists of ifaddrs structures, defined as follows: >> >> struct ifaddrs { >> struct ifaddrs *ifa_next; /* Next item in list */ >> char *ifa_name; /* Name of interface */ >> unsigned int ifa_flags; /* Flags from SIOCGIFFLAGS */ >> struct sockaddr *ifa_addr; /* Address of interface */ >> ^^^^^^^^^^^^^^^ >> We cannot change this type >> struct sockaddr *ifa_netmask; /* Netmask of interface */ >> union { >> struct sockaddr *ifu_broadaddr; >> /* Broadcast address of interface */ >> struct sockaddr *ifu_dstaddr; >> /* Point-to-point destination address */ >> } ifa_ifu; >> #define ifa_broadaddr ifa_ifu.ifu_broadaddr >> #define ifa_dstaddr ifa_ifu.ifu_dstaddr >> void *ifa_data; /* Address-specific data */ >> }; >> >> -------------------------------------------------------------------------- > In this case you should copy the contents of sockaddr to a new variable > of the right type, and not cast. > > Simo. > Yes, this is the only way you can deal with these issues. I remembered this from my experiments with ELAPI 3 years ago. I ran into similar problems with this function and had to copy data. -- Thank you, Dmitri Pal // PASTE END Thank you, Michal

3 10

[PATCH] krb5: Remove warning dereference of a null pointer
by Lukas Slebodnik 17 Oct '13

17 Oct '13

ehlo, coverity and clang report warning "dereference of a null pointer". I think it was false possitive, because we cannot get to the sithuation where "kr->creds == NULL" Patch is attached. Gzipped clang report is attached. (report-pv9WXu.html#Path19) LS

3 2

[PATCH] sdap_idmap: properly handle ranges for external mappings
by Sumit Bose 17 Oct '13

17 Oct '13

Hi, this patch set aims to fix https://fedorahosted.org/sssd/ticket/2105 . But since I had to touch the libsss_idmap code for this I found an issue here as well, which is fixed by the first two patches. bye, Sumit

2 2

[PATCH] KRB5: Return PAM_ACCT_EXPIRED when logging in as expired AD user
by Jakub Hrozek 17 Oct '13

17 Oct '13

Hi, When testing the AD access control patches, I found out that logging in as expired AD user triggered a System Error. The attached patch fixes that.

2 2

[PATCH] dlopen-tests: Check the result of asprintf
by Benjamin Franzke 17 Oct '13

17 Oct '13

According to asprintf(3) the content off errmsg is undefined on error, lets set it to NULL.

3 2

ssh does not remove credential cache at logout
by Qing Chang 16 Oct '13

16 Oct '13

IPA clients (RHEL, CentOS and Unbuntu 12.04) does not clear credential cache files when a user logout from a ssh session. pam_sss man page does not have much information on how it manage to clean out a session when the session is ended. This is my sshd and session_common file: ===== sshd ===== @include common-auth account required pam_nologin.so @include common-account @include common-session session optional pam_motd.so # [1] session optional pam_mail.so standard noenv # [1] session required pam_limits.so session required pam_env.so # [1] session required pam_env.so user_readenv=1 envfile=/etc/default/locale @include common-password ===== ===== common-session ===== auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_sss.so use_first_pass auth requisite pam_deny.so auth required pam_permit.so auth optional pam_cap.so ===== Is this a pam configuration issue or a pam_sss issue? Thanks, Qing -- ------------------ Qing Chang Senior Systems Administrator M6-624 Research Computing Sunnybrook Health Sciences Centre 2075 Bayview Ave. Toronto, Ontario, M4N 3M5 (416) 480-6100 x3263 qchang(a)sri.utoronto.ca ------------------

2 2

[PATCH] IPA server mode: properly initialize ext_groups
by Sumit Bose 16 Oct '13

16 Oct '13

Hi, when writing the code to read IPA memberships for trusted AD users I didn't carefully check how struct ipa_server_mode_ctx is initialized. Hence the new member I have added was not properly initialized. This patch should fix it. bye, Sumit

3 4

[PATCH v2] Debug macro refactoring
by Nikolai Kondrashov 16 Oct '13

16 Oct '13

Hi everyone, Please find attached my updated patches refactoring the DEBUG macro (mostly). I've moved the level limiting condition to the macro as requested by Simo. I've separated the macro definition update from the invocation update. I've tried using coccinelle ("spatch") to do the invocation update, but unfortunately, it either puts all DEBUG macro arguments on a single line with a simple semantic patch (debug.spatch), or puts parts of the concatenated string literals on a single line with an unrolled version (debug_unrolled.spatch). I haven't managed to find another way. So, for this simple case, Perl seems to be better (if not so reliable). I've used the following command to update the invocations: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv $f{,.orig} perl -e 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*$[^(]+)\((.*?)$\s*\)\s*;#$1$2);#gs; print $text; ' < $f.orig > $f done And then manually fixed two or three cases where it got confused and has broken the compilation. After that, coccinelle couldn't find any more places to update. You can either use the included patch, try applying one of the semantic patches, or not convert the macro to variadic and not update the invocations at all. You can still get the size reduction benefit and fix the flushing. I will leave this up to you. If you decide to try the semantic patches, they can be applied as such: spatch --sp-file debug_unrolled.spatch -dir . | git apply You will need the "coccinelle" package to get the "spatch" tool. Sincerely, Nick

1 0

[PATCH v2] Debug macro refactoring
by Nikolai Kondrashov 16 Oct '13

16 Oct '13

Hi everyone, Please find attached my updated patches refactoring the DEBUG macro (mostly). I've moved the level limiting condition to the macro as requested by Simo. I've separated the macro definition update from the invocation update. I've tried using coccinelle ("spatch") to do the invocation update, but unfortunately, it either puts all DEBUG macro arguments on a single line with a simple semantic patch (debug.spatch), or puts parts of the concatenated string literals on a single line with an unrolled version (debug_unrolled.spatch). I haven't managed to find another way. So, for this simple case, Perl seems to be better (if not so reliable). I've used the following command to update the invocations: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv $f{,.orig} perl -e 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*$[^(]+)\((.*?)$\s*\)\s*;#$1$2);#gs; print $text; ' < $f.orig > $f done And then manually fixed two or three cases where it got confused and has broken the compilation. After that, coccinelle couldn't find any more places to update. You can either use the included patch, try applying one of the semantic patches, or not convert the macro to variadic and not update the invocations at all. You can still get the size reduction benefit and fix the flushing. I will leave this up to you. If you decide to try the semantic patches, they can be applied as such: spatch --sp-file debug_unrolled.spatch -dir . | git apply You will need the "coccinelle" package to get the "spatch" tool. Sincerely, Nick

1 0

[PATCH] LDAP: Set default value for dyndns update to false
by Lukas Slebodnik 15 Oct '13

15 Oct '13

ehlo, In some cases, local boolean variable "do_update" could be used without proper initialisation. Clang static analyser warning: "Assigned value is garbage or undefined" It was not a big problem, because non-zero value for boolean variable mean true. Simple patch is attached. LS

3 3

Fwd: [sudo-users] objectClass=sudoRule vs objectClass=sudoRole in AD
by JR Aquino 15 Oct '13

15 Oct '13

This was asked in the SUDO-users mailing list today. It seemed like something important to cover in here as well. From: <Curtis.CTR.Roze(a)faa.gov<mailto:Curtis.CTR.Roze@faa.gov>> Subject: [sudo-users] objectClass=sudoRule vs objectClass=sudoRole in AD Date: October 11, 2013 5:53:44 AM PDT To: <sudo-users(a)sudo.ws<mailto:sudo-users@sudo.ws>> How does the query for sudo rules in AD even work when the debug shows a query such as: (&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=test.user)(sudoUser=#1215014110)(sudoUser=%test_rmm_linux_users)(sudoUser=%Domain Users)(sudoUser=%Domain Users)(sudoUser=+*))) If I execute this on the command line using ldapsearch I get no results. If I change objectClass to objectClass=sudoRole in the same seach, ldapsearch works perfectly. I created the sudoers ou and objects using the guidance in the sudoers documentation on sudo.ws. Thanks for the insight. Curtis Roze ____________________________________________________________ sudo-users mailing list <sudo-users(a)sudo.ws<mailto:sudo-users@sudo.ws>> For list information, options, or to unsubscribe, visit: http://www.sudo.ws/mailman/listinfo/sudo-users

4 5

[PATCH] Spec file changes for cifs-utils plugin
by Sumit Bose 15 Oct '13

15 Oct '13

Hi, as promised I created the spec file changes to include the cifs-utils plugin into the sssd-client package on Fedora and RHEL platforms where recent cifs-utils are available. bye, Sumit

3 9

Re: [SSSD] [PATCH] CIFS idmap Plugin using SSSD
by Benjamin Franzke 15 Oct '13

15 Oct '13

Hi Sumit, Sorry for the delay, got sidetracked by trying to find an appropriate way to handle the well known sids etc.. But thanks to your reminder I got over to do the integration into sssd's autoconf/make now :) So here is the patch as an attachment. (as recommended by the contrib page - but if you like it better for review l'll git send-email it as well..) This patch does not include an update for the rpm specs. Could you do that integration? For me as a gentoo user that is currently an unknown-area :) Regards, Ben 2013/10/9 Sumit Bose <sbose(a)redhat.com> > On Mon, Oct 07, 2013 at 12:22:13PM +0200, Benjamin Franzke wrote: > > 2013/10/7 Sumit Bose <sbose(a)redhat.com> > > > > > On Thu, Oct 03, 2013 at 11:57:07PM +0200, Benjamin Franzke wrote: > > > > > > > > > > Hi Ben, > > > > > > > > > > this is really great, thank you very much for the contribution! As > a > > > > > matter of fact, we've been planning on delivering the CIFS plugin > as > > > > > part of the next release: > > > > > https://fedorahosted.org/sssd/ticket/1534 > > > > > > > > > > Have you found the design page we created? > > > > > > > > > https://fedorahosted.org/sssd/wiki/DesignDocs/IntegrateSSSDWithCIFSClient > > > > > > > > > > > > Yeah, I've read those pages before writing the plugin.. > > > > > > > > > > > > > > > > > > Mostly the work on our side was done by Sumit Bose (I've CC-ed > him). I > > > > > would propose to get in touch with him to avoid duplicating some > > > effort. > > > > > > > > > Unfortunately Sumit is in Germany and there is a holiday so he won't > be > > > > > available until Monday. > > > > > > > > > > > > > > In general, I would suggest to merge this code into the SSSD tree > if > > > you > > > > > wouldn't mind. I think it would makes sense to have the code in the > > > same > > > > > repo as the ID mapping library. > > > > > > > > > > > > > I'd really appreciate having it integrated in sssd tree, > > > > to have centralized maintainance and adoption by distributions.. > > > > > > Thanks a lot for the patch. I would suggest to put your code into > > > src/lib/cifs_idmap_sss/ and modify SSSD's Makefile.am to build the > > > plugin. Would you like to do the integration and send the result for > > > review to this list again? > > > > > > > I'd like to do that integration, will send a patch.. > > I'd like to add the plugin to the next Fedora release which > unfortunately has its deadline next week. I don't want to rush you, but > do you have a chance to send the patch today or tomorrow? Otherwise > would you mind if I prepare the patch to integrate your code into the > SSSD tree? > > Thanks for your help. > > bye, > Sumit > > > > > > > About the well-know SIDs. They should not be handled inside the plugin > > > but by SSSD itself. If you are interested in adding them I'd be happy > to > > > help you how to start (if my help is needed at all :-). > > > > > > > Yup, sounds better to handle the SIDs by SSSD core. I'd like to try.. > > I'll see whether time permits me to do that soon.. (doing this as a part > of > > my thesis) > > > > > > > > > > > > bye, > > > Sumit > > > > > > > > > > > > > > > > Thanks again for the contribution, much appreciated! > > > > > _______________________________________________ > > > > > sssd-devel mailing list > > > > > sssd-devel(a)lists.fedorahosted.org > > > > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel > > > > > > > > > > > > _______________________________________________ > > > > sssd-devel mailing list > > > > sssd-devel(a)lists.fedorahosted.org > > > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel > > > > > > _______________________________________________ > > > sssd-devel mailing list > > > sssd-devel(a)lists.fedorahosted.org > > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel > > > > > > _______________________________________________ > > sssd-devel mailing list > > sssd-devel(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel > >

4 16

[PATCH] INI: Disable line-wrapping functionality
by Jakub Hrozek 11 Oct '13

11 Oct '13

As Dmitri noted in a thread on sssd-users, we did an incompatible change in how we handle lines beginning with whitespace. Since the change is breaking existing configurations, we should revert the change. There is a separate ticket to consider the line wrapping functionality: https://fedorahosted.org/sssd/ticket/2118

2 2

[PATCH] MAN: Fix refsect-id
by Jakub Hrozek 11 Oct '13

11 Oct '13

A trivial man page patch.

2 2

[PATCH] krb5: fix warning variable may be used uninitialized
by Lukas Slebodnik 10 Oct '13

10 Oct '13

ehlo, scan-build found a warning. src/providers/krb5/krb5_child.c:1988:9: error: ‘offline’ may be used uninitialized in this function [-Werror=maybe-uninitialized] ret = k5c_setup(kr, offline); gcc also reports this warning with enabled optimization >= "-O2". It seems to me really weird, because compilator assumes that function sss_atomic_read_s return value -1 and errno==0. I tried to modify function sss_atomic_read_s, but I could not fix this warning. Another possible solution is to initialize variable "offline" to some default value. I appreciate any comment. Patch is attached. LS

2 2

[PATCH] LDAP: handle SID requests if noexist_delete is set
by Sumit Bose 10 Oct '13

10 Oct '13

Hi, I found this while testing the cifs-utils plugin I opened https://fedorahosted.org/sssd/ticket/2116 to make sure all affected versions will be fixed. bye, Sumit

2 2

Something to share about fmemopen()
by Dmitri Pal 10 Oct '13

10 Oct '13

Hello, I came across an interesting behavior that is IMO worth sharing with other developers. It turns out that fmemopen() fails with error 22 EINVAL if the buffer passed in is of length 0. Imagine situation: I have a file in the directory of 0 length. I open it with fopen() or with open() and then fdopen() in "r" mode and I can read it with getline(). Of cause the first read will return EOF and I will be done. But if I open file with open() in binary mode, and mirror it into a buffer and the file is of length 0 then the buffer will be of length 0 too but attemt to use fmemopen() would fail. So mirroring in becomes non transparent operation you have to special case the situation when original file in NULL. So question is what should I do with it? File a bug or just ask to document it? Man page does not say anything about it. Advises welcome. -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel October 2013