sssd-devel April 2013

sssd-devel@lists.fedorahosted.org

27 participants
94 discussions

Group name lost randomly
by Qing Chang 24 Apr '13

24 Apr '13

at the same time on different IPA clients, group name could become unavailable on one but not the other: ===== available on fisher ===== fisher:$ groups chuck chuck : mri hcgrp ccgrp prgrp chuksh crdsh2 ipausers slcc ===== ===== unavailable on robin ===== [root@robin ~]# groups chuck chuck : groups: cannot find name for group ID 422 422 ipausers prgrp crdsh2 slcc chuksh hcgrp ccgrp ===== Note in this case 422 is mri, but it could happen to another GID. Just did a "\rm /var/lib/sss/db/cache_sri.utoronto.ca.ldb" and "service sssd restart", the group name still did not come back. A reboot would fix the problem, but it could creep back some time later. Any idea why this is happening? Best Regards, Qing -- ------------------ Qing Chang Senior Systems Administrator M6-624 Research Computing Sunnybrook Health Sciences Centre 2075 Bayview Ave. Toronto, Ontario, M4N 3M5 (416) 480-6100 x3263 qchang(a)sri.utoronto.ca ------------------

3 8

[PATCH] Add exit status section to sss_ssh_* man pages
by Jan Cholasta 23 Apr '13

23 Apr '13

Hi, the attached patch fixes <https://fedorahosted.org/sssd/ticket/1843>. Honza -- Jan Cholasta

2 2

Announcing SSSD 1.9.5
by Jakub Hrozek 23 Apr '13

23 Apr '13

=== SSSD 1.9.5 === The SSSD team is proud to announce the release of version 1.9.5 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd This is mostly a bugfix release with minor feature enhancements -- see the changelog below for details. In addition to fixing functionality, this release also includes one security patch. Our focus is now on developing new features for the upcoming 1.10 release. That said, fixes for important bugs will be added to the 1.9.6 bucket and released when appropriate. The 1.9.6 release has no due date yet, although we would release it to be aligned with RHEL-6.5 at the latest. RPM packages will be made available for Fedora shortly, initially for F-18 and later also backported to F-17, which has moved to the 1.9 series recently. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * This release focused mainly on fixing regressions compared to the 1.8 series and bugfixes for features introduced in the 1.9 release cycle. The release also includes one security fix * Includes a fix for CVE-2013-0287: A simple access provider flaw prevents intended ACL use when SSSD is configured as an Active Directory client * Fixed spurious password expiration warning that was printed on login with the Kerberos back end * A new option ldap_rfc2307_fallback_to_local_users was added. If this option is set to true, SSSD is be able to resolve local group members of LDAP groups. * Fixed an indexing bug that prevented the contents of autofs maps from being returned to the automounter deamon in case the map contained a large number of entries * Several fixes for safer handling of Kerberos credential caches for cases where the ccache is set to be stored in a DIR: type == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1020 SSSD does not list local user's group membership defined in LDAP https://fedorahosted.org/sssd/ticket/1512 [sssd[krb5_child[PID]]]: Credential cache directory /run/user/UID/ccdir does not exist https://fedorahosted.org/sssd/ticket/1737 Misleading example in the man page https://fedorahosted.org/sssd/ticket/1739 sssd is not serving large automount maps reliably https://fedorahosted.org/sssd/ticket/1755 Saving dereferenced groups fails if a nested group member is outside nesting limit https://fedorahosted.org/sssd/ticket/1791 Unchecked return value in files.c https://fedorahosted.org/sssd/ticket/1795 names of domain_realm mapping files in SSSD contain dots https://fedorahosted.org/sssd/ticket/1799 sssd_be crashes sometimes https://fedorahosted.org/sssd/ticket/1808 pwd_expiration_warning has wrong default for Kerberos https://fedorahosted.org/sssd/ticket/1817 sssd pam write_selinux_login_file creating the temp file for SELinux data failed https://fedorahosted.org/sssd/ticket/1818 LDAP provider doesn't save binary attributes correctly https://fedorahosted.org/sssd/ticket/1822 krbcc dir creation issue with MIT krb5 1.11 https://fedorahosted.org/sssd/ticket/1826 sssd etas 99% CPU and runs out of file descriptors when clearing cache https://fedorahosted.org/sssd/ticket/1841 document what does access_provider=ad do https://fedorahosted.org/sssd/ticket/1868 sssd fails with readonly /etc/selinux/targeted/logins https://fedorahosted.org/sssd/ticket/1869 pam responder segfaults if the client disconnects before the operation finishes https://fedorahosted.org/sssd/ticket/1880 Simple access control always denies uppercased users in case insensitive domain == Detailed Changelog == Jakub Hrozek (16): * Bump the version to 1.9.5, reset release in RPMs to 0 * Don't use srcdir with tests * Fix the krb5 password expiration warning * Remove enumerate=true from man sssd-ldap * Don't treat 0 as default for pam_pwd_expiration warning * Provide a be_get_account_info_send function * Add unit tests for simple access test by groups * Do not compile main() in DP if UNIT_TESTING is defined * Resolve GIDs in the simple access provider * Document what does access_provider=ad do * Allocate PAM DP request data on responder context * krb5: include backwards compatible declaration of krb5_trace_info * Fix simple access group control in case-insensitive domains * LDAP: do not invalidate pointer with realloc while processing ghost users * tests: Link the simple access tests with -ldl * Updating the translations for the 1.9.5 release Jan Engelhardt (1): * sysdb: try dealing with binary-content attributes Kamil Dudka (1): * sssd-1.8.0: work around a bug in cov-build from Coverity Lukas Slebodnik (1): * Fix krbcc dir creation issue with MIT krb5 1.11 Michal Zidek (4): * Unchecked return value in files.c * File descriptor leak in nss responder. * Debug message in sss_mc_create_file. * sssd fails with readonly SELinux login files Pavel Březina (6): * krb: recreate ccache if it was deleted * subdomains: replace invalid characters with underscore in krb5 mapping file name * sdap_fill_memberships: continue if a member is not foud in sysdb * autofs: fix invalid header 'number of entries' in packet * if selinux is disabled, ignore that selogin dir is missing * krb5-utils-tests: remove invalid condition Simo Sorce (1): * ldap: Fallback option for rfc2307 schema Stephen Gallagher (2): * Fix minor grammar error in log * NSS: Add original homedir to home directory template options

1 0

memberof.la error after make install
by steve 23 Apr '13

23 Apr '13

1.9.4 and 1.10 alpha on openSUSE 12.3 After a successful build, the following appears upon starting sssd: db: unable to dlopen /usr/lib/ldb/memberof.la : /usr/lib/ldb/memberof.la: invalid ELF header I removed the file and all was well. Do we need it? Cheers, Steve

3 3

[PATCH] tests: Link the simple access tests with -ldl
by Jakub Hrozek 22 Apr '13

22 Apr '13

Timo Aaltonen discovered that on Ubuntu the simple access tests fail with a linker error saying that dlopen and dlsym are not available. It seems that because we are linking to some files from src/providers/data_provider_*.c we need to also link with -ldl. Timo confirmed on IRC that this one-liner fixes the problem for him.

2 6

[PATCH] Use UPN from Kerberos ticket
by Sumit Bose 22 Apr '13

22 Apr '13

Hi, this patch should fix https://fedorahosted.org/sssd/ticket/1634 and eliminates the need to guess the UPN in the PAC responder. bye, Sumit

3 2

[PATCH] Allow usage of enterprise principals
by Sumit Bose 22 Apr '13

22 Apr '13

Hi, this patch fixes https://fedorahosted.org/sssd/ticket/1842 . The actual functionality is added by the replacement of krb5_parse_name() by (sss_)krb5_parse_name_flags() in krb5_child.c. bye, Sumit

3 4

[PATCH] Refactoring: remove duplicated code in nss responder
by Sumit Bose 21 Apr '13

21 Apr '13

Hi, while working on adding new nss responder calls for SID related lookups I realized that I can copy-and-paste some existing code again and add even more duplication or start to refactor some of the existing code in the nss responder. It preferred to second and the attached pathc is the result. There is still lots of duplicated code in the nss responder, but this patch would at least help to add the SID lookups without adding redundancy. bye, Sumit

3 4

[PATCH] Fix and rename get_my_domain_data()
by Sumit Bose 21 Apr '13

21 Apr '13

Hi, this patch fixes https://fedorahosted.org/sssd/ticket/1888 . The issue was introduced during the redesign of the sysdb API and hence no backport to older versions is needed. bye, Sumit

2 2

debbuging, how to turn off cache
by steve 19 Apr '13

19 Apr '13

Hi When I'm debugging or adding new objects and attributes to the directory, I need to be able to turn off the sssd cache. Otherwise, I do not see any of the changes I have made. How can I force sssd to read from the directory and not from the cache? Cheers, Steve

6 40

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel April 2013