August 2013 - sssd-devel - Fedora mailing-lists

[PATCH] Two krb5 small child fixes
by Jakub Hrozek 19 Aug '13

19 Aug '13

[PATCH 1/2] KRB5: Formatting changes Trivial formatting patch [PATCH 2/2] KRB5: Do not log to syslog on each login Only log on failures, not each login. I don't think admins of busy servers would appreciate a syslog message per login.

2 2

[PATCHES] fill_initgr: add original primary GID if available
by Sumit Bose 19 Aug '13

19 Aug '13

Hi, the attached patches should fix https://fedorahosted.org/sssd/ticket/2027, i.e. always show that and AD user is a member of it's primary AD group, even for subdomains. The first patch in this series just fixes a typo I came across while working at #2027. bye, Sumit

2 2

[PATCH] ipa_s2n_get_user_done: make sure ALIAS name is lower case
by Sumit Bose 19 Aug '13

19 Aug '13

Hi, the second patch fixes https://fedorahosted.org/sssd/ticket/1630 while the first adds a missing talloc_free(). One might argue that both talloc_free() can be removed because the parent context is freed later during the request. bye, Sumit

2 2

[PATCH] UTIL: Remove obsolete compat macros
by Jakub Hrozek 19 Aug '13

19 Aug '13

There is no supported tevent release out there that would still be missing these macros. Also, they were confusing my ctags.

2 2

[PATCH] AD: Use the correct include guard
by Jakub Hrozek 19 Aug '13

19 Aug '13

I found this little issue while working on improving enumeration.

2 2

[PATCH] Remove include recursion
by Lukas Slebodnik 19 Aug '13

19 Aug '13

ehlo, Header file proxy.h included itself. It is harmless, because we have in header files conditional build. #ifndef __PROXY_H__ #define __PROXY_H__ .. snip .. #endif On the other side it does not make sense. Simple patch is attached. LS

3 3

[PATCH] Check whether servername is not empty string
by Lukas Slebodnik 19 Aug '13

19 Aug '13

ehlo, simple patch is attached. LS

3 2

[PATCH] proxy: Alocate auth tokens in struct authtok_conv
by Lukas Slebodnik 19 Aug '13

19 Aug '13

ehlo, Struct sss_auth_token became opaque in commit 9acfb09f7969a69f58bd45c856b01700541853ca. All ocasions of "struct sss_auth_token" was replaced with pointer to this structure, but proper initialization of auth_tokens was missing in struct authtok_conv. Patch is attached. LS

3 4

[PATCH] mmap_cache: Check data->name value in client code
by Michal Židek 14 Aug '13

14 Aug '13

This should have been part of the patch: [PATCH] mmap_cache: Check if slot and name_ptr are not invalid. I missed the fact that name_ptr is called just name in the client code and did not add check there. Using manually corrupted cache (setting name_ptr to some high value in hexeditor) this caused segfault in the client code. The attached patch fixes this. Please review and push this patch to master, 1-9 and 1-10. Thanks Michal

3 4

sss_cache --everything
by steve 12 Aug '13

12 Aug '13

Hi Any chance of having this for 1.10? Cheers, Steve

3 13

[PATCH] print password complexity hint when change password failed
by Pavel Březina 11 Aug '13

11 Aug '13

Now the output looks like: $ su test-user Password: Password expired. Change your password now. Current Password: New password: Retype new password: Password change failed. Please make sure the password meets the complexity constraints. su: incorrect password

3 8

[PATCH] ldap, krb5: More descriptive msg on chpass failure.
by Michal Židek 11 Aug '13

11 Aug '13

During password change operation if wrong current password was given we gave no hint to the user about what went wrong. The "Authentication token manipulation error" message alone was not very descriptive. resolves: https://fedorahosted.org/sssd/ticket/2029 Thanks Michal

2 4

[PATCH] backport be_refresh to sssd-1-9
by Pavel Březina 11 Aug '13

11 Aug '13

2 2

[PATCH] mmap_cache: Check if slot and name_ptr are not invalid.
by Michal Židek 11 Aug '13

11 Aug '13

This is very ugly hotfix for ticket: https://fedorahosted.org/sssd/ticket/2018 So far we were not able to find out why the slot or name_ptr values were corrupted, but this should at least prevent segfaults. Comments are highly appreciated. Thanks Michal

3 5

[PATCH 1/2] Set default DNS resolution timeout to 15 seconds.
by Michal Židek 09 Aug '13

09 Aug '13

https://fedorahosted.org/sssd/ticket/1966 (SSSD failover doesn't work if the first DNS server in resolv.conf is unavailable). The problem here is, that if first nameserver in resolv.conf is down, the resolution is too slow and SSSD will not wait for the result of ares_search and go offline. In my case the resolution was sometimes more than a minute, because all search domains in resolv.conf were searched inside ares_search() call using the first (not working) nameserver in the first place and then with the working nameserver (and before that, SSSD tried to figure out the domain name from my incorrectly set hostname, which added more unnecessary DNS lookups). To avoid this problem, the option dns_discovery_domain must be set properly, so that only the correct domain is searched, but even that is not enough, because the default timeout for dns resolver operation in sssd is too low. This patch rises the default value to 15 seconds (instead of 5 seconds). Another option might be to lower the amount of time ares waits for a nameserver to respond (currently it is 5 seconds, that is why 5 second for the entire dns resolution is not sufficient), but I do not want to do this. These patches also change man pages, so probably master only (string freeze)? Even if this is a really small change. I was also thinking, would it make sense to write a warning to the logs if the dns_discovery_domain option is not set? It seem to be important to set it properly for cases like this one. Thanks Michal

3 14

[PATCH] AD: Cast SASL callbacks to propper type
by Ondrej Kos 09 Aug '13

09 Aug '13

Hi, While working on another issue, I noticed a warning in recently added code (commit fb945a2c). On F18 the build works fine, but not on F19. This is caused by the change of cyrus-sasl API, they changed the *sasl_callback_t* callback member from int (*proc)(); to int (*proc)(void); Attached patch adds typedef for propper cast and fixes the issue. Ondra -- Ondrej Kos Associate Software Engineer Identity Management - SSSD Red Hat Czech

5 5

[PATCH] Two minor failover fixes
by Jakub Hrozek 09 Aug '13

09 Aug '13

Hi, I found these when backporting a failover fix for RHEL-6.5. Michal, can you take a look? I think you know the are best currently. btw I'm wondering if for SRV resolving we should use a larger timeout as the operation consists of resolving the SRV query and then the host name itself..

2 2

[PATCH] An idea for a default commit message
by Simo Sorce 09 Aug '13

09 Aug '13

This is just an idea, but if people like it and agree with the format it would be nice to have it in tree. Simo. -- Simo Sorce * Red Hat, Inc * New York

4 6

[PATCH] init script: source /etc/sysconfig/sssd
by Pavel Březina 08 Aug '13

08 Aug '13

https://fedorahosted.org/sssd/ticket/1959 Is there anyway how to achieve this in systemd? Do we want the path configurable?

4 10

[PATCHES] Do not call sss_cmd_done in function check_cache
by Lukas Slebodnik 08 Aug '13

08 Aug '13

ehlo, Attached patches should fix https://fedorahosted.org/sssd/ticket/1980 The first patch adds check after sysdb_getnetgr. If sysdb_getnetgr returns more result than 1, sssd will return error. sysdb_getpwnam has already had this check. The second patch removes function call sss_cmd_done inside of check_cache, because function is sss_cmd_done is called in parent functions. This was a reason of sssd crash. How to reproduce this crash. 1.Add Netgroup to sysdb cache with base cn=Netgroups,cn=<domain>,cn=sysdb This netgroup should have the same attribute (name or nameAlias or memberOf) as another netgroup. 2. call sudo with user, which is member of ^^^ netgroup. Those patches fix only sssd crash, but we should find out: Why were those netgroups stored in sysdb. LS

2 7

[PATCH] Minor man page patches
by Jakub Hrozek 08 Aug '13

08 Aug '13

Hi, attached are three man page patches. [PATCH 1/3] MAN: clarify the default access provider for AD https://fedorahosted.org/sssd/ticket/1965 After we added a section that clarified what access_provider=ad did, some users were confused and thought that "ad" was also the default access provider if "id_provider=ad" was specified. [PATCH 2/3] MAN: IP addresss does not work when used for ad_server https://fedorahosted.org/sssd/ticket/1998 Currently using IP address as value of ad_server is not supported, so the man pages should not mention that as an option. [PATCH 3/3] MAN: Clarify the min_id/max_id limits further https://fedorahosted.org/sssd/ticket/2005 Some users were confused by our description of min_id/max_id and thought the limits only applied to returning entries from the NSS responder. However, the limits are actually enforced on the back end side, so the entries are not even saved to cache.

2 3

[PATCHES] NSS: Clear cached netgroups if a request comes in from the sss_cache
by Lukas Slebodnik 08 Aug '13

08 Aug '13

ehlo, Attached patches fix ticket #1759 sss_cache -N/-n should invalidate the hash table in sssd_nss LS

3 7

[PATCH] LDAP: Fix crash when processing nested groups
by Jakub Hrozek 08 Aug '13

08 Aug '13

https://fedorahosted.org/sssd/ticket/1932 There is a rather strange workaround in the nested groups processing code that calls tevent_req_post outside _send(). However, it broke in certain situations where the tevent_req_call resulted in req being freed, which freed state by extension and then the subsequent _post call was a use-after-free. This patch saves the two variables used outside state so that it's safe to use them even after the callback.

3 8

[PATCH] Two minor enhancements on using the negative cache in the PAM responder
by Jakub Hrozek 07 Aug '13

07 Aug '13

Hi, Yassir who was going through the PAM code recently pointed out two strange issues with the PAM responder's usage of negative cache. Please see the attached patches for more details, but simplified version is: 1) The negative cache was only ever checked for domainless searches 2) The negative cache was only checked, never set I don't think this is a pressing issue because in most occasions, the negative cache would be hit by the application calling getpwnam() and so the PAM responder would not be called at all, but I think the code should at least be consistent. The alternative is of course to stop using negative cache in the PAM respnder completely, but I think it has some benefit if the application would only call the PAM conversation.

2 2

[PATCH] Fix memory context for hash entries
by Sumit Bose 07 Aug '13

07 Aug '13

Hi, here is another fix for a use-after-free of variables allocated on a temporary memory context. bye, Sumit

3 2

[PATCH] simple access provider: allow fully qualified names
by Pavel Březina 07 Aug '13

07 Aug '13

https://fedorahosted.org/sssd/ticket/2026 I created a separate ticket to support subdomain users and groups in allow/deny lists. https://fedorahosted.org/sssd/ticket/2034 There is a bug in PAC responder at the moment which makes simple access provider to always deny access to subdomain users. PAC responder currently fails to resolve group membership, thus we get error in access provider when looking up groups and access is denied. Jakub will look into this.

2 6

[PATCH] Add script make_srpm.sh to dist tarball.
by Lukas Slebodnik 07 Aug '13

07 Aug '13

ehlo, Simple script make_srpm.sh was added to git repo few weeks ago. With this script, source rpm file can be created without installed sssd build dependencies. I forgot to add this file to Makefile.am and therefore this script is not bundled to tarball. Simple patch attached. LS

3 2

[PATCH] Fix memory context for a state member
by Sumit Bose 07 Aug '13

07 Aug '13

Hi, I came across this while testing other stuff. I think the issue was introduced in 1.10, 1.9 looks fine. bye, Sumit

3 2

[PATCH] fix GSSAPI integrity detection for AD servers
by Simo Sorce 06 Aug '13

06 Aug '13

This patch (hopefully) fixes an interop issues with AD servers where they fail to realize the connection is indeed integrity protected. It's a bit of a hack as we need to work around openldap initialization of cyrus sasl libraries. But it should work unitl we get openldap libraries to expose SASL_CB_GETOPT to us. Ticket: https://fedorahosted.org/sssd/ticket/2040 Simo. -- Simo Sorce * Red Hat, Inc * New York

2 3

[PATCH] skip rule on error instead of failing completely
by Pavel Březina 05 Aug '13

05 Aug '13

https://fedorahosted.org/sssd/ticket/2031

2 4

[PATCH] SSH: Ensure that cmd_ctx->name will not be NULL.
by Lukas Slebodnik 05 Aug '13

05 Aug '13

ehlo, Ensure that cmd_ctx->name will not be NULL. If cmd_ctx->name was not initialized by sss_parse_name then copy of name will be used. https://fedorahosted.org/sssd/ticket/1970 Coverity ID: 11647 Patch is attached. LS

3 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2013