sssd-devel September 2014

sssd-devel@lists.fedorahosted.org

23 participants
95 discussions

[PATCHES] PAM, NSS: allow UPN login names
by Sumit Bose 01 Sep '14

01 Sep '14

Hi, this series of patches should solve https://fedorahosted.org/sssd/ticket/1749 . The solution is a bit different than the one outline in https://fedorahosted.org/sssd/wiki/DesignDocs/NSSWithKerberosPrincipal but after a couple of iterations I prefer this solution because it adds only a minimal amount of new code and automatically covers features like mid-point refresh, because the same code path is used. If we agree on this approach I'll update the design page accordingly. The outline is in the commit message of the 5th patch, I'll copy it here for easier reference: With this patch the NSS and PAM responders can handle user principal names besides the fully qualified user names. User principal names are build from a user name and a domain suffix separated by an '@' sign. But the domain suffix does not necessarily has to be the same as the configured domain name in sssd.conf of the dynamically discovered DNS domain name of a domain. The typical use case is an Active Directory forest with lots of different domains. To not force the users to remember the name of the individual domain they belong to the AD administrator can set a common domain suffix for all users from all domains in the forest. This is typically the domain name used for emails to make it even more easy to the users to remember it. Since SSSD splits name and domain part at the '@' sign and the common domain suffix might not be resolvable by DNS or the given user is not a member of that domain (e.g. in the case where the forest root is used as common domain suffix) SSSD might fail to look up the user. With this patch the NSS and PAM responder will do an extra lookup for a UPN if the domain part of the given name is not known or the user was not found and the login name contained the '@' sign. The first patch contains the needs changes for the LDAP provider, patches 2, 3 and 4 some related cleanup and improvements. The main functionality is in the 5th patch. bye, Sumit

3 6

[PATCHES] Changes to AD functional level handling
by Jakub Hrozek 01 Sep '14

01 Sep '14

Hi, attached are three patches related to https://fedorahosted.org/sssd/ticket/2418 The first one simply adds the Windows Server 2012 R2 functional level. The second falls back to the oldest supported Windows Server in case we can't convert the the functional level but there is one in the rootDSE. And finally the last patch relaxes the requirement for tokenGroups. According to MSFT documentation, tokenGroups is available since Windows 2000, but the oldest release we have around is 2003, so I only downgraded the requirement to 2003.

2 5

[PATCH] responder_socket_access-tests: Fix condition in loop
by Lukas Slebodnik 01 Sep '14

01 Sep '14

ehlo, Function check_allowed_uids was not called in test check_allowed_uids_test Simple patch is attached. LS

3 2

[PATCH] strtonum-tests: Add unit test for strtouint16.
by Lukas Slebodnik 01 Sep '14

01 Sep '14

ehlo, It is almost the same as for strtouint32 LS

3 2

[PATCH] SDAP: Set default value of ldap_user_ssh_public_key to "sshPublicKey"
by Jan Cholasta 01 Sep '14

01 Sep '14

Hi, the attached patch fixes <https://fedorahosted.org/sssd/ticket/1560>. Honza -- Jan Cholasta

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2014