sssd-devel September 2013

sssd-devel@lists.fedorahosted.org

15 participants
94 discussions

planning the 1.9.6 release
by Jakub Hrozek 18 Sep '13

18 Sep '13

Hi, I've pushed quite a couple of patches to the sssd-1-9 branch lately as part of work on RHEL-6.5. I think it would be nice to use that as basis of 1.9.6 upstream release. Is there anything that the users or developers would like to include in the 1.9.6 ? There are some mmap patches on the list that need pushing to 1.9 but apart from them, I think this is pretty much it. Here is a list of tickets 1.9.6 would fix in the 1.9 branch: * Enabling enumeration causes sssd_be process to utilize 100% of the CPU https://fedorahosted.org/sssd/ticket/1893 * SSSD doesn't display warning for last grace login. https://fedorahosted.org/sssd/ticket/1890 * [RFE] support autoconfiguring SUDO with ipa provider and compat tree https://fedorahosted.org/sssd/ticket/1733 * SUDO is not working for users from trusted AD domain https://fedorahosted.org/sssd/ticket/1912 * getgrnam / getgrgid for large user groups is too slow due to range retrieval functionality https://fedorahosted.org/sssd/ticket/1823 * [RFE] Add support for suppressing group members https://fedorahosted.org/sssd/ticket/1376 * If previous SRV query failed, the next try might not be retried in some cases https://fedorahosted.org/sssd/ticket/1886 * [abrt] sssd-1.10.0-4.fc19.beta1: get_server_status: Process /usr/libexec/sssd/sssd_be was killed by signal 11 (SIGSEGV) https://fedorahosted.org/sssd/ticket/1947 * sssd_be goes to 99% CPU and causes significant login delays when client is under load https://fedorahosted.org/sssd/ticket/1806 * sudoHost mismatch response is incorrect sometimes https://fedorahosted.org/sssd/ticket/1693 * sssd fails to resolve hosts/services once the network is up https://fedorahosted.org/sssd/ticket/1933 * cyclic group memberships may not work depending on order of operations https://fedorahosted.org/sssd/ticket/1846 * sssd fails instead of skipping when a sudo ldap filter returns entries with multiple CNs https://fedorahosted.org/sssd/ticket/2031 * sssd_be crashing with nested ldap groups contain a dangling member https://fedorahosted.org/sssd/ticket/1932 * sss_cache -N/-n should invalidate the hash table in sssd_nss https://fedorahosted.org/sssd/ticket/1759 * SSSD filter out ldap user/group if uid/gid is zero https://fedorahosted.org/sssd/ticket/2005 * SSSD service randomly dies https://fedorahosted.org/sssd/ticket/1980 * SYSV init script should use @sbindir@ https://fedorahosted.org/sssd/ticket/1986 * Enhance sssd init script so that it would source a configuration https://fedorahosted.org/sssd/ticket/1959 * SSSD failover doesn't work if the first DNS server in resolv.conf is unavailable https://fedorahosted.org/sssd/ticket/1966 * resolv-tests failing with memory leak https://fedorahosted.org/sssd/ticket/1899 * sssd_nss terminated with segmentation fault https://fedorahosted.org/sssd/ticket/2018 * unite periodic refresh API https://fedorahosted.org/sssd/ticket/1891 * [RFE] Add a task to the SSSD to periodically refresh cached entries https://fedorahosted.org/sssd/ticket/1713 * passwd returns "Authentication token manipulation error" when entering wrong current password https://fedorahosted.org/sssd/ticket/2029 * Cannot change expired password of an AD user https://fedorahosted.org/sssd/ticket/1827 And here is a complete log of what's currently planned for 1.9.6 (git log --oneline sssd-1_9_5..sssd-1-9): 658e275 print hint about password complexity when new password is rejected f4f0a4c ldap, krb5: More descriptive msg on chpass failure. 261bc18 providers: refresh expired netgroups edbafc2 back end: add refresh expired records periodic task f47934c back end: periodical refresh of expired records API 651ab87 back end: periodic task API 4fda997 mmap_cache: Check if slot and name_ptr are not invalid. 560e2b4 resolv-tests failing with memory leak 8d4485d Set default DNS resolution timeout to 6 seconds. 1e50573 Lower timeout to contact DNS server 7a45875 Add a commit template 230e4e4 init script: source /etc/sysconfig/sssd 60d3b25 Configure SYSV init scripts properly 4a3ad2f Handle too many results from getnetgr. 67771f6 Do not call sss_cmd_done in function check_cache. 5d762a9 MAN: Clarify the min_id/max_id limits further 3678074 NSS: Clear cached netgroups if a request comes in from the sss_cache 845deed NSS: allow removing entries from netgroup hash table f081ea9 LDAP: Fix crash when processing nested groups c487f42 sudo: print better debug message when a rule has multiple cn values a810814 sudo: skip rule on error instead of failing completely e4c8fd0 Every time use permissive control in function memberof_mod. 26df163 Always set port status to neutral when resetting service. ec7fbcd sudo responder: use different callback for oob refresh e7769aa IPA: Do not download or store the member attribute of host groups ab4c050 failover: if expanded server is marked as neutral, invoke srv collapse 5ecdadb collapse_srv_lookup may free the server, make it clear from the API 5e0f0c4 failover: set state->out when meta server remains in SRV_RESOLVE_ERROR 868bf88 Add ignore_group_members option. c13eb93 Adding option to disable retrieving large AD groups. 200d054 Removing unused functions. 2aaa41c sudo responder: use fully qualified name for subdomain users 96db69c SUDO: IPA provider ac77faa Display the last grace warning, too 3896c82 Only try to relink ghost users if we're not enumerating

2 2

[PATCH] Do not set HAVE_SYSTEMD_LOGIN if libsystemd-login is not available
by Sumit Bose 17 Sep '13

17 Sep '13

Hi, I found this on a system where systemd-devel was not installed. Since we already know that systemd is available at this stage of the configure run I wonder if AC_MSG_NOTICE is ok or if AC_MSG_ERROR asking to install systemd-devel would be better? bye, Sumit

3 4

[PATCH] KRB5: Call umask before mkstemp in the krb5 child code
by Jakub Hrozek 17 Sep '13

17 Sep '13

Found by Coverity. Not really a huge issue, but as already agreed in a private conversation, a nice-to-have.

2 2

[PATCH] nss: Wrong debug message.
by Michal Židek 17 Sep '13

17 Sep '13

Simple patch attached. Thanks Michal

3 2

[PATCHES] simple access provider: support subdomain users and groups
by Pavel Březina 17 Sep '13

17 Sep '13

Patch 0001: I haven't used this one after all, but I still think it is nice to have. It reduces amount of code duplication. Patch 0005: > + /* Try to get group SID and assign it a domain */ > + group_sid = ldb_msg_find_attr_as_string(group, SYSDB_SID_STR, NULL); > + if (group_sid == NULL) { I'm not sure if this branch isn't a dead code, but I kept it there because it mimics current behaviour. > + /* We will look it up in main domain. */ > + domain = state->ctx->domain; > + } else { > + domain = find_subdomain_by_sid(state->ctx->domain, group_sid); > + if (domain == NULL) { > + DEBUG(SSSDBG_CRIT_FAILURE, ("There is no domain information for " > + "SID %s\n", group_sid)); > + return ENOENT; > + } > + }

2 7

[PATCHES] Fix warnings
by Lukas Slebodnik 16 Sep '13

16 Sep '13

ehlo, I tested some patches with old distro and I spotted warnings. -- uninitialized variable (gcc 4.4.7) -- macro AM_PROG_AR not found in library (automake 1.11.1) I checked them and all warnings should be harmless, but anyway we don't like warnings. Two patches are attached. LS

2 7

[PATCH] Add missing new line in DEBUG message
by Lukas Slebodnik 16 Sep '13

16 Sep '13

ehlo, I found this simple problem, when I was testing Michal's patch for mmap_cache "Check slot validity before MC_SLOT_TO_PTR." Patch is attached. LS

2 2

[PATCH] Use systemd-login session information to check if user is logged in
by Simo Sorce 16 Sep '13

16 Sep '13

This patch was meant to remove the trolling of /proc for uids but I haven't got there yet. I meant to use utmp as a fallback but I realized utmp does not deal with uid numbers rather usernames, and I need to think if it makes sense to go that way as it may be hairy when we use subdomains as now I need to know what kind of user name was used (fully qualified or not etcc.). So for now I left the old code as a fallback in case systemd is not available or fails unexpectedly. Ticket: #2084 Simo. -- Simo Sorce * Red Hat, Inc * New York

2 6

About managing branches: WAS: [Fwd: Re: [PATCH] nss: Add option to disable memcache]
by Simo Sorce 16 Sep '13

16 Sep '13

I wonder if it wouldn't make sense to delay commits to stable branches until the time to release comes ? Would it make it easier or harder to review and apply changes only at release time ? Simo. -- Simo Sorce * Red Hat, Inc * New York

3 3

setautomntenta autofs file not found
by steve 16 Sep '13

16 Sep '13

Hi Problems with autofs on a 1.11.1 git: The only error I can see is this: 2013-09-13T01:47:34.264459+02:00 catral automount[2569]: setautomntent: lookup(sss): setautomntent: No such file or directory and nothing gets mounted. sssd starts fine. Here is the conf: [sssd] #debug_level = 6 services = nss, pam, autofs config_file_version = 2 domains = default [nss] [pam] [autofs] [domain/default] #debug_level=6 dyndns_update=true #dyndns_refresh_interval=16 ad_hostname = catral.hh3.site ad_server = hh16.hh3.site ad_domain = hh3.site ldap_schema = ad id_provider = ad access_provider = simple enumerate = false cache_credentials = true #entry_cache_timeout = 60 auth_provider = krb5 chpass_provider = krb5 krb5_realm = HH3.SITE krb5_server = hh16.hh3.site krb5_kpasswd = hh16.hh3.site ldap_id_mapping=false ldap_referrals = false ldap_uri = ldap://hh16.hh3.site ldap_search_base = dc=hh3,dc=site #ldap_tls_cacertdir = /usr/local/samba/private/tls #ldap_id_use_start_tls = true #entry_negative_timeout = 1 ldap_user_object_class = user ldap_user_name = samAccountName ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_home_directory = unixHomeDirectory ldap_user_shell = loginShell ldap_group_object_class = group ldap_group_search_base = dc=hh3,dc=site ldap_group_name = cn ldap_group_member = member #ldap_default_bind_dn = cn=steve2,cn=Users,dc=dolores,dc=site #ldap_default_authtok_type = password #ldap_default_authtok = s2 ldap_sasl_mech = gssapi ldap_sasl_authid = CATRAL$(a)HH3.SITE #krb5_keytab = /etc/krb5.keytab ldap_krb5_init_creds = true autofs_provider=ldap ldap_autofs_search_base = DC=hh3,DC=site ldap_autofs_map_object_class = nisMap ldap_autofs_entry_object_class = nisObject ldap_autofs_map_name = nisMapName ldap_autofs_entry_key = cn ldap_autofs_entry_value = nisMapEntry

3 17

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2013