Collapsing LDAP attribute name options into one
by Nikolai Kondrashov
Hi everyone,
Reading the sssd-ldap manpage I was struck by how many of the options deal
with setting various LDAP attribute names. This really makes the manpage
crowded and hard to navigate.
What if we replace all these options with a single option, accepting a list of
mappings (e.g. "ldap_attr_map")? We can then put the descriptions and default
mappings in a nice table under that single option in the manpage and deprecate
the separate options.
Has this been suggested before? If not, what do you think?
Thanks.
Nick
8 years, 12 months
[PATCH] Patches related to restricting domain access from PAM services
by Jakub Hrozek
Hi,
after further testing we realized there are some more bugs in the PAM
responder related to restricting users.
[PATCH 1/4] PAM: Domain names are case-insensitive
This bug was mostly hitting subdomain users in my tests.
[PATCH 2/4] PAM: Missing argument to domains= should fail auth
Prevents admin from misconfiguring his PAM stack in an insecure way.
[PATCH 3/4] MAN: Misspelled username in pam_trusted_users is not fatal
The man page described behaviour that wasn't implemented (and shouldn't
be)
[PATCH 4/4] RESPONDER: Log failures to resolve user names in csv_string_to_uid_array
Makes it easier to discover misspelled user names in the user lists.
I'm sorry there are no unit test (yet), I'm working on implementing
them:
https://fedorapeople.org/cgit/jhrozek/public_git/sssd.git/log/?h=pam
But the progress is slow and we need to apply the patches to downstream.
8 years, 12 months
[PATCH] Skip CHAUTHTOK_PRELIM when using OTPs
by Jakub Hrozek
Hi,
the attached patch fixes chpass for OTP users for me. I hope looking at
the ipaUserAuthType attribute is acceptable.
The attribute is undocumented on purpose -- I don't see a reason for the
user to set this attribute to a different value and the desription would
just clutter the (already too complex) sssd-ldap man page.
I'm open to adding the attribute to the configAPI, though.
8 years, 12 months
[PATCH] MONITOR: Disable inlining of function load_configuration
by Lukas Slebodnik
ehlo,
Michal tried to fix gcc warning im commit
cff89439b21f8573c6896b09cb1a8d5f9de3144c
The previous fix was not sufficient and similar warning appears after different
change in function load_configuration.
src/monitor/monitor.c: In function ‘main’:
src/monitor/monitor.c:2962:24: error: ‘monitor’ may be used uninitialized
in this function [-Werror=maybe-uninitialized]
monitor->is_daemon = !opt_interactive;
^
cc1: all warnings being treated as errors
It's better to disable optimisation of function load_configuration after fail
in chown(unlink) instead of checking errno for 0 and overriding it with EINVAL.
LS
9 years
[PATCH] KRB5: Check FAST kinit errors using get_tgt_times()
by Jakub Hrozek
Hi,
Coverity found an unused variable in the krb5_child code. After reading
the code again after a week it was written, I think we should do some
changes for better readability.
Mostly, fail on error from get_tgt_times() and change the flow so the
main branch (ie topmost indent) will be the success branch. It makes
sense to shortcut on success the first time get_tgt_times() is called to
check existing FAST ccache, but I think the second time, we expect
success, otherwise the forked child failed.
9 years
