sssd-devel September 2013

sssd-devel@lists.fedorahosted.org

15 participants
94 discussions

[PATCH] Check return values of setenv and unsetenv
by Jakub Hrozek 22 Sep '13

22 Sep '13

We didn't run a patch through Coverity because it looked straighforward enough..well.. Attached is a patch that checks the retval of two calls to silence Coverity warning.

2 2

[PATCH] LDAP: Use primary cn to search netgroup
by Lukas Slebodnik 22 Sep '13

22 Sep '13

ehlo, Attached patch resolves ticket #2075 LS

3 12

[PATCH] AD: Failure to get flat name is not fatal
by Jakub Hrozek 22 Sep '13

22 Sep '13

This patch depends on my other AD enumeration patches. https://fedorahosted.org/sssd/ticket/2067 Some AD or AD-like servers do not contain the netlogon attribute in the master domain name. Instead of failing completely, we should just abort the master domain request and carry on. The only functionality we miss would get getting users by domain flat name.

2 8

[PATCH] RESPONDER: Use right function prototype
by Lukas Slebodnik 22 Sep '13

22 Sep '13

ehlo, Protype of function sss_ncache_check_netgr was different than definition of function sss_ncache_check_netgr. We did not catch it, because header file "responder/common/negcache.h" was not included in implementation file "responder/common/negcache.c" Simple patch is attached. LS

2 2

[PATCH] Two minor man page patches
by Jakub Hrozek 20 Sep '13

20 Sep '13

I found these minor issues in our man pages, when triaging support issues with Red Hat GSS earlier today. The first patch changes the subtitle of the man pages. I wasn't completely sure if the title is set to "SSSD config file" on purpose (after all they do describe the config file, just per-provider), but I think that at least the Kerberos locator man page should be fixed. The second patch fixes indentation of programlisting. The programlisting element makes the text in the element formatted verbatim, so it would have appeared too much to the right.

2 4

[PATCH] sdap_domain_add: remove too strict consistency check
by Sumit Bose 20 Sep '13

20 Sep '13

Hi, without the following patch member domains in a trusted forest cannot be properly initialized in the IPA provider. bye, Sumit

2 2

[PATCH] man: improve sssd-sudo manual page
by Pavel Březina 20 Sep '13

20 Sep '13

https://fedorahosted.org/sssd/ticket/2085

2 6

Understanding entry_negative_timeout
by Jean-Baptiste Denis 20 Sep '13

20 Sep '13

Hello everybody, I've got an sssd configuration with two ldap domains. The nss part of the configuration is this one : [nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd override_shell = /bin/bash entry_negative_timeout = 15 debug_level = 0x02F0 I've got a program that crawl a filesystem. For some reason, a bunch of files have an uid which do not "resolve" to anything. My ldap backend are hammered with requests like this one : slapd[31421]: conn=361745 op=1712 SRCH base="ou=users,dc=example,dc=com" scope=2 deref=0 filter="(&(uidNumber=1047)(objectClass=posixAccount)) In /var/log/sssd/sssd_nss.log, it correspond to a lot of : .... [sssd[nss]] [nss_cmd_getpwuid_search] (0x0040): No matching domain found for [1047], fail! ... I thought that the "entry_negative_timeout" in the nss part of the configuration would prevent this kind of behaviour, but I obviously didn't guess right. Any advice ? Jean-Baptiste

2 11

[PATCH] AD enumeration improvements
by Jakub Hrozek 18 Sep '13

18 Sep '13

Hi, attached are patches that improve how we enumerate AD domains. The problem is that currently the domain info (subdomain and master domain) is downloaded when a responder queries the DP for domain info. But when enumeration is enabled, the responder might not contact the DP at all as the enumeration task runs on its own. I think the best solution is to extend the enumeration task so that it also downloads the domain data itself. About the implementation, I was considering two options. One is the way I took where the enumeration request is simply extended with downloading master domain data. The other approach I was considering was extending the generic enumeration request with downloading domain data which the generic request would just shortcut. While this might seem like a better approach, it also seemed like a complete overkill..but I'd like to hear other opinons. [PATCH 1/3] AD: async request to retrieve master domain info Adds a reusable async request to download the master domain info. This patch just splits the master domain request from the subdomain request. [PATCH 2/3] LDAP: sdap_id_setup_tasks accepts a custom enum request AD provider will override the default with its own. [PATCH 3/3] AD: Download master domain info when enumerating https://fedorahosted.org/sssd/ticket/2068 Adds the master domain download task before the enumeration.

2 4

[PATCH] Add journald support
by Jakub Hrozek 18 Sep '13

18 Sep '13

Hi, attached are two small patches I wrote when I was checking whether Fedora's move to journald affects us or not. Patch #1 adds a new configure option, that, if enabled, routes logging via journald's API. No change in logging format is present in this patch. You need to have systemd-devel installed -- if the patches are accepted I'll amend the specfile as well, but I didn't want to waste time now. Patch #2 adds acts as kind of a demonstration of journald's extended capabilities. The patch adds a new field that contains SSSD domain name and makes it easy to distinguish log messages coming from different domains with: # journalctl SSSD_DOMAIN=foo.example.com

2 5

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2013