sssd-devel March 2014

sssd-devel@lists.fedorahosted.org

24 participants
69 discussions

Start a nNew thread

[PATCH 1/1] Remove --with-distro-version
by Nikolai Kondrashov 03 Apr '14

03 Apr '14

Hi everyone, Please find attached removing the unused "--with-distro-version" configure option. Sincerely, Nick

3 4

review request for F21 gpo wiki page
by Yassir Elley 01 Apr '14

01 Apr '14

Hi everyone, I have put together a Fedora 21 Self-Contained Change wiki page for the GPO Access Control feature: https://fedoraproject.org/wiki/Changes/SssdGpoBasedAccessControl. I would like to get the team's review and feedback before officially submitting it to Jaroslav. Thanks, Yassir.

3 6

[PATCH] LDAP: Setup periodic task only once.
by Lukas Slebodnik 31 Mar '14

31 Mar '14

ehlo, If id provider is {ipa, ad} periodic task will be stared in sssm_{ipa,ad}_init If you enable enumeration and use different providers for id and sudo(autofs) then another periodic task will be scheduled. This can cause weird behaviour (e.g. missing members of group) I provided test package to reporter of bug #2153 with attached patch (actually it was patch for 1.9 branch). I was not able to reproduce problem with missing groups. Thus I was wainting for response from customer. But it will be better to do a (pre-)review of patch. I am also attaching part of log file. You can notice Two enumerations are started. There is difference only few milliseconds. LS

2 11

[PATCH] IPA: Use function sysdb_attrs_get_el in safe way
by Lukas Slebodnik 31 Mar '14

31 Mar '14

ehlo, Intention of ticket @2284 was to refactor function sysdb_attrs_get_el This would be a big change and it would not ne easy to backport patch to the branch sssd-1-11. The attached patch fixes prolem in simple way and patch can be easily applied on top of branch sssd-1-11 Function sysdb_attrs_get_el can enlarge array of ldb_message_element in "struct sysdb_attrs" if attribute is not among available attributes. Array will be enlarged with function talloc_realloc but realloc can move array to another place in memory therefore ldb_message_element should not be used after next call of function sysdb_attrs_get_el sysdb_attrs_get_el(netgroup, SYSDB_ORIG_MEMBER_USER, &user_found); sysdb_attrs_get_el(netgroup, SYSDB_ORIG_MEMBER_HOST, &host_found); With netgroups, it is common to omit user or host from netgroup triple. There is very high probability that realloc will be called. it is possible pointer user_found can refer to the old area after the second call of function sysdb_attrs_get_el. Resolves: https://fedorahosted.org/sssd/ticket/2284 How to test? sh-4.2$ getent netgroup netgroup_user1 netgroup_user2 (-,usersssd01,example.com) and run backend with valgrind Result: --without patch: there are errors like in description of ticket https://fedorahosted.org/sssd/ticket/2284 --with patch: errors are gone LS

3 2

[PRELIMINARY] libsss_dbus
by Pavel Březina 28 Mar '14

28 Mar '14

Hi, I'm basically finished with https://fedorahosted.org/sssd/ticket/2254. If you're interested, you can find it in my git repo: git://fedorapeople.org/home/fedora/pbrezina/public_git/sssd.git # libsss_dbus I haven't test it yet, since there isn't any ifp responder right now (I'm waiting for Jakub's rebase), but the code should be more or less stable.

2 1

[PATCH] KRB5: Do not attemtp to get a TGT after a password change using OTP
by Jakub Hrozek 26 Mar '14

26 Mar '14

Hi, the attached patch fixes #2271. Kindly see the patch and the commit message for more details. I tested password change w/o OTPs to make sure we don't regress and also with TOTP. I tested both expired passwords and password change via PAM. HOTP currently doesn't work because of another bug.

5 8

Ldap question: How to quickly see changes to a user's group list.
by Mark London 25 Mar '14

25 Mar '14

Hi - We are running an LDAP server on a Windows box. We have a need for our Linux clients to be able to quickly see modifications we make to a user's account, i.e. adding a group to an account. The only way that I've found to be able to do this, is to set ldap_enumeration_refresh_timeout to a small amount of time. Is there a better way to do this (that uses less cpu)? Thanks. - Mark

4 3

[PATCH] krb5-child: add revert_changepw_options()
by Sumit Bose 21 Mar '14

21 Mar '14

Hi, a recent patch unified the usage of the krb5_get_init_creds_opt options to make sure the same set of FAST related options are uses for authentication and password changes. Before changing the password some options were set to special values but were not reverted before requesting a new TGT with the new password. As a result the new TGT will have some unexpected options set or the request might even fail. This patch set resets the password change related option to their original values before requesting the new TGT. The first two patches are just refactorings which are required to keep the third patch simple. bye, Sumit

3 3

[PATCH] SYSV: Do not call functions success and fail itself
by Lukas Slebodnik 20 Mar '14

20 Mar '14

ehlo, Bash function daemon will call success or fail. It is useless to call them one more time. It may cause strange behaviour with some configurations of terminal. # service sssd restart Stopping sssd: [ OK ] [ OK ] sssd: [ OK ] Resolves: https://fedorahosted.org/sssd/ticket/2280 sh-4.1# grep -Rn daemon /etc/init.d/ | grep failure /etc/init.d/sssd:46: daemon $SSSD -f -D && success || failure sh-4.1# grep -Rn daemon /etc/init.d/ | grep success /etc/init.d/sssd:46: daemon $SSSD -f -D && success || failure sh-4.1# ls -1 /etc/init.d/ | wc -l 57 simple patch is attached. LS

2 4

minimal value expected for ldap_idmap_range_size
by Pavel Reichl 20 Mar '14

20 Mar '14

Hello, please see attached patch. Pavel Reichl

3 5

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2014