sssd-devel April 2013

sssd-devel@lists.fedorahosted.org

27 participants
94 discussions

[PATCH] Convert the simple access check to new error codes
by Jakub Hrozek 19 Apr '13

19 Apr '13

Hi, I took a look into converting the simple access provider to use the new error codes and I think a patch might not even be needed. The current request returns errno on error and boolean for access granted/denied. I think the boolean is actually nice in the case and converting to ERR_ACCESS_DENIED instead of false doesn't make much sense. The attached patch just makes the top-level request called by the DP handler return ERR_ACCOUNT_UNKNOWN in case the user passed via struct pam_data does not exist in sysdb and ERR_INTERNAL instead of EIO for internal errors. It would make the error reporting somewhat nicer, I think, but even if we drop the patch I would like to close https://fedorahosted.org/sssd/ticket/453

3 7

[PATCH] Do not change attr pointer with realloc
by Jakub Hrozek 19 Apr '13

19 Apr '13

https://fedorahosted.org/sssd/ticket/1799 One peculiarity of the sysdb_attrs_get_el interface is that if the attribute does not exist, then the attrs array is reallocated and the element is created. But in case other pointers are already pointing into the array, the realloc might invalidate them. One such case was in the sdap_process_ghost_members function where if the group had no members, the "gh" pointer requested earlier might have been invalidated by the realloc in order to create the member element I'm actually pondering the idea of renaming the interface to make it clear that if you request a nonexistent attr, the pointer already pointing there might become invalid.

2 5

[PATCH] tests: Fix the order of key/values
by Jakub Hrozek 18 Apr '13

18 Apr '13

I found out that the code to add custom options to confdb during tests had the key/value order reversed on one place. The attached patch fixes that.

2 2

Re: [SSSD] getent returns only single users
by John Hodrien 17 Apr '13

17 Apr '13

Enumerate = false Jh

5 20

[PATCH] Make leak checks usable in tests that do not utilize check
by Jakub Hrozek 17 Apr '13

17 Apr '13

I am using the leak check to make sure the dyndns requests do not leak, but the leak checks were only usable in conjunction with check. This patch does the following: * Remove check-specific failure reporting from common_check.c * Add check-specific abstraction over memleak checks * Rename common_check.c to leak_check.c

2 5

[PATCH] Inform about function duplication.
by Michal Židek 17 Apr '13

17 Apr '13

See patch description or ticket comments. https://fedorahosted.org/sssd/ticket/1767 Thanks Michal

2 2

Radius provider
by Ondra Hujňák 16 Apr '13

16 Apr '13

Hi, I'm about to develop new provider for RADIUS protocol. I just made some stub and wanted to ask you guys to check the coding style. My work is available at github repo https://github.com/hujon/sssd.git in branch rad. So far it's just a really preliminary review which lacks support for RADIUS. I just wanted to know if I'm heading the right way. Ondrej Hujnak

4 7

getent returns only single users
by steve 15 Apr '13

15 Apr '13

1.9.4 on openSUSE 12.3 with Samba4 AD Hi Everything is fine apart from that we'd like for getent passwd to throw out all users. At the moment it only returns single user information and even then only if we specify the user: getent passwd <loadsa local users> <nothing from AD> but: getent passwd steve2 steve2:*:3000034:20513:steve2:/home/users/steve2:/bin/bash We've tried enumerate = TRUE an waited for 30 minute on a test domain with only 2 users and 2 groups but still getent passwd returns a blank for domain users. Everything else is fine. Authentication, group membership. . . Any ideas on the getent? Cheers, Steve (This is my first post here and I've only had time for a quick look through the archive so please accept my apologies if this is OT.) /etc/nsswitch.conf passwd: compat sss group: compat sss /etc/sssd/sssd.conf [sssd] services = nss, pam config_file_version = 2 domains = default [nss] [pam] [domain/default] ldap_schema = rfc2307bis access_provider = simple enumerate = FALSE cache_credentials = true id_provider = ldap auth_provider = krb5 chpass_provider = krb5 krb5_realm = HH3.SITE krb5_server = hh16.hh3.site krb5_kpasswd = hh16.hh3.site ldap_uri = ldap://hh16.hh3.site/ ldap_search_base = dc=hh3,dc=site #ldap_tls_cacertdir = /usr/local/samba/private/tls #ldap_id_use_start_tls = true ldap_user_object_class = user ldap_user_name = samAccountName ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_home_directory = unixHomeDirectory ldap_user_shell = loginShell ldap_group_object_class = group ldap_group_search_base = dc=hh3,dc=site ldap_group_name = cn ldap_group_member = member ldap_user_search_filter =(&(objectCategory=User)(uidNumber=*)) ldap_sasl_mech = gssapi ldap_sasl_authid = HH16$ ldap_krb5_keytab = /etc/krb5.keytab ldap_krb5_init_creds = true

2 2

[PATCH] Fix simple access group control in case-insensitive domains
by Jakub Hrozek 15 Apr '13

15 Apr '13

https://fedorahosted.org/sssd/ticket/1713 In the simple access provider, we need to only canonicalize user names when comparing with values in the ACL, not when searching the cache. The sysdb searches might do a base search with a DN constructed with the username which fails if the username is lower case.

2 3

[PATCH] sss_cache: Remove annoying messages
by Michal Židek 15 Apr '13

15 Apr '13

See patch description. This patch applies on top of the "sss_cache: support for subdomains" patch. Thanks Michal

2 2

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel April 2013