sssd-devel September 2013

sssd-devel@lists.fedorahosted.org

15 participants
94 discussions

[PATCHES] Fix old ccache testing behavior
by Simo Sorce 25 Sep '13

25 Sep '13

Addresses #2053 and #2094 Check old ccaches only if needed, always precreate containing directory if we are goign to proceed with authentication and always fallback to old algorithm to check user presence on the system if systemd-login fails or returns negative result. (Patches as agreed on IRC after several discussions) All tested and apparently working. Simo. -- Simo Sorce * Red Hat, Inc * New York

2 5

[PATCH] NSS: Set UID and GID to negative cache after searching all domains
by Jakub Hrozek 25 Sep '13

25 Sep '13

Hi, the first patch fixes the bug that Jean-Baptiste Denis found earlier today. In case the lookup was not done using a FQDN, the code would skip setting the entries to the ncache. The second patch is an incremental improvement. I don't think we should abort the whole lookup if setting an entry in negcache would fail. The negative cache is a performance optimization after all.

4 11

[PATCHES] Include header file in implementation module.
by Lukas Slebodnik 24 Sep '13

24 Sep '13

ehlo, I wondered how could it happen that prototype function was different than definition of function "RESPONDER: Use right function prototype". Reason: we don't have enable warnings Wmissing-declarations. gcc manual pages says: Warn if a global function is defined without a previous declaration. Do so even if the definition itself provides a prototype. Use this option to detect global functions that are not declared in header files. In C, no warnings are issued for functions with previous non-prototype declarations; use -Wmissing-prototype to detect missing prototypes. In C++, no warnings are issued for function templates, or for inline functions, or for functions in anonymous namespaces. Attached patches include existing header files into implementation files, but I think we should file a ticket to fix remaining warnings. (Function should be declared as static or declaration should be in header file. 2nd patch fix warning for following functions Function | Implementation file without included header file --------------------------------------------------------- murmurhash3 src/util/murmurhash3.c ck_leak_check_setup src/tests/common_check.c sss_base64_encode src/util/crypto/nss/nss_base64.c sss_base64_decode src/util/crypto/nss/nss_base64.c nspr_nss_init src/util/crypto/nss/nss_util.c nspr_nss_cleanup src/util/crypto/nss/nss_util.c sss_parse_name_for_domains src/util/usertools.c sdap_dom_enum_send src/providers/ldap/sdap_async_enum.c sdap_nested_group_send src/providers/ldap/sdap_async_nested_groups.c sdap_nested_group_recv src/providers/ldap/sdap_async_nested_groups.c sdap_dyndns_update_send src/providers/ldap/sdap_dyndns.c sdap_dyndns_update_recv src/providers/ldap/sdap_dyndns.c become_user src/providers/krb5/krb5_become_user.c switch_creds src/providers/krb5/krb5_become_user.c krb5_child_init src/providers/krb5/krb5_init_shared.c get_uid_table src/util/find_uid.c check_if_uid_is_active src/util/find_uid.c sdap_pam_access_handler src/providers/ldap/ldap_access.c pack_user_info_chpass_error src/util/user_info_msg.c ipa_s2n_get_acct_info_send src/providers/ipa/ipa_s2n_exop.c ipa_srv_plugin_ctx_init src/providers/ipa/ipa_srv.c ipa_srv_plugin_send src/providers/ipa/ipa_srv.c ad_srv_plugin_send src/providers/ad/ad_srv.c ad_master_domain_send src/providers/ad/ad_domain_info.c sss_dp_get_ssh_host_send src/responder/ssh/sshsrv_dp.c sss_dp_get_ssh_host_recv src/responder/ssh/sshsrv_dp.c LS

2 3

[INI] Trim trailing spaces in values
by Dmitri Pal 24 Sep '13

24 Sep '13

Hello, Patch addresses: https://fedorahosted.org/sssd/ticket/2095 As usual actual fix is 10 times shorter than unit test... -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 2

[PATCH] Convert IN_MULTICAST parameter to host order
by Jakub Hrozek 24 Sep '13

24 Sep '13

The attached patch fixes https://bugzilla.redhat.com/show_bug.cgi?id=1007475#c2

2 8

[PATCH] man: server side password policies always takes precedence
by Pavel Březina 24 Sep '13

24 Sep '13

https://fedorahosted.org/sssd/ticket/2091

2 4

Domain fallback, filter_users and uid
by Jean-Baptiste Denis 23 Sep '13

23 Sep '13

Hi, I'm using a trick, suggested with CAUTION by Jakub, that allows me to have all user using local home directory and some honoring their ldap ones. This is the spirit of my sssd.conf : ==================== [sssd] config_file_version = 2 services = nss, pam domains = local_home, ldap_home [nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd override_shell = /bin/bash [domain/local_home] override_homedir = /home/%u filter_users = john id_provider = ldap ldap_uri = ldap://ldap.example.com/ # same as above, without override_homedir and filter_users [domain/ldap_home] id_provider = ldap ldap_uri = ldap://ldap.example.com/ ==================== I think I've got a side effect from this setup when I'm dealing directly with uid. For example, if the filtered user has uid 4242, after a fresh restart of sssd, I cannot perform an uid -> username resolution : $ getent passwd 4242 $ # NOANSWER But if try to get the john entry, everything is good after that $ getent passwd john john:*:4242:1010:John John:/ldap_home/john:/bin/bash $ getent passwd 4242 john:*:4242:1010:John John:/ldap_home/john:/bin/bash But, if I restart sssd, it doesn't work anymore : # service sssd restart # getent passwd 4242 # # NOANSWER Here is the corresponding sssd_nss.log when I've got no answer after sssd restart : (Mon Sep 23 12:32:02 2013) [sssd[nss]] [accept_fd_handler] (0x0400): Client connected! (Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client version [1]. (Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version [1]. (Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x4339e0:domains@local_home] (Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_get_domains_msg] (0x0400): Sending get domains request for [local_home][not forced][] (Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x4339e0:domains@local_home] (Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x4339e0:domains@ldap_home] (Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_get_domains_msg] (0x0400): Sending get domains request for [ldap_home][not forced][] (Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x4339e0:domains@ldap_home] (Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x4339e0:domains@local_home] (Mon Sep 23 12:32:02 2013) [sssd[nss]] [nss_cmd_getpwuid_search] (0x0100): Requesting info for [4242@local_home] (Mon Sep 23 12:32:02 2013) [sssd[nss]] [check_cache] (0x0400): Cached entry is valid, returning.. (Mon Sep 23 12:32:02 2013) [sssd[nss]] [nss_cmd_getpwuid_search] (0x0400): Returning info for uid [4242@local_home] (Mon Sep 23 12:32:02 2013) [sssd[nss]] [fill_pwent] (0x0100): User [john@local_home] filtered out! (negative cache) (Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x4339e0:domains@ldap_home] (Mon Sep 23 12:32:02 2013) [sssd[nss]] [client_recv] (0x0200): Client disconnected! The line that worries me is this one '[fill_pwent] (0x0100): User [john@local_home] filtered out! (negative cache)'. My request does not seem to go through my fallback domain "ldap_home". What do you think ?

5 9

[PATCH] Check slot validity before MC_SLOT_TO_PTR.
by Michal Židek 23 Sep '13

23 Sep '13

Hello, This patch should add another line of defence against memory cache problems caused by accessing slot outside of bounds. Thanks Michal

4 16

[PATCH] mmap_cache: Use two chains for hash collision.
by Lukas Slebodnik 23 Sep '13

23 Sep '13

ehlo, Two patches are attached. The 1st patch reverts commit 4662725ffef62b3b2502481438effa7c8fef9f80. "mmap_cache: Skip records which doesn't have same hash" --next patch lokks nicer with recerted commit 4662725ffe The 2nd patch changes behaviour of record chaining. LS

5 20

[PATCHES] Fix offline authentication for the AD provider
by Sumit Bose 23 Sep '13

23 Sep '13

Hi, with the following two patches offline authentication in the AD provider is working again and https://fedorahosted.org/sssd/ticket/2060 should be fixed. I started working on a unit test for find_or_guess_upn() but it is not finished yet because of the number of internal structs needed which must be created manually. Since the patches were working well in my tests I decided to send the functional part first and send the tests later. bye, Sumit

2 4

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2013