sssd-devel September 2014

sssd-devel@lists.fedorahosted.org

23 participants
95 discussions

Start a nNew thread

[PATCH] CI: Add libnfsidmap-dev Debian dependency
by Nikolai Kondrashov 02 Sep '14

02 Sep '14

Hi everyone, The attached patch fixes CI builds on Debian. Nick

2 4

[PATCH] libwbclient: SSSD implementation
by Sumit Bose 02 Sep '14

02 Sep '14

Hi, this patch contains the libwbclient implementation for SSSD to allow Samba file-servers and utilities to use SSSD instead of winbind to map SIDs, names and POSIX IDs. The related ticket is https://fedorahosted.org/sssd/ticket/1588. The SSSD specific calls can be found in files with '_sssd' as part of the name, the other files are mainly taken from the original Samba sources because they contain API calls which are independent of the backend. I have made some minor modification to meet the SSSD coding style but tried to avoid major changes to make a diff to the original version more easy. If major issue are found during review I think it would be a good idea to try to bring the changes back to samba as well. In wbc_pwd_sssd.c instead of linking in the related sources of the NSS client I dlopen-ed libnss_sss.so.2 to have more flexibility about where and how to build the library. I you think this is too much overhead I'd be happy to change the code to use the NSS client call directly. The patch does not contain unit test because the Samba source code already contains some basic tests. I'll try to work with the samba package maintainer to make this code in a samba-devel or samba-test package available so that it can be used by SSSD as well. Basic functional test can be run manually with wbinfo, e.g.: $ /usr/bin/wbinfo -n 'AD18\Administrator' S-1-5-21-3090815309-2627318493-3395719201-500 SID_USER (1) $ /usr/bin/wbinfo -S S-1-5-21-3090815309-2627318493-3395719201-500 1670800500 bye, Sumit

3 24

[PATCH] Doxygen: replace <pre> by \verbatim
by Sumit Bose 02 Sep '14

02 Sep '14

Hi, this patch should fix a warning while creating the docs and the layout of the docs. bye, Sumit

3 9

[PATCH v3 0/4] NFSv4 rpc.idmapd plugin
by Noam Meltzer 02 Sep '14

02 Sep '14

Follow patches are the code implementing design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin Changes compared to v2 of this patch: * rebase over rev. 8ca18752 (current master) * remove man pages from the patch (will be sent separately) * add new contact details for plugin author * code style * remove sss_nfs_make_request() wrapper * fix typo in reply_to_name(): REPLY_ID_OFFSET -> REPLY_NAME_OFFSET Noam Meltzer (4): NEW CLIENT: plugin for NFSv4 rpc.idmapd NFSv4 client: (private) headers from libnfsidmap NFSv4 client: add to build system NFSv4 client: add to RPM spec Makefile.am | 24 ++ configure.ac | 10 + contrib/sssd.spec.in | 7 + src/conf_macros.m4 | 30 ++ src/external/libnfsidmap.m4 | 17 + src/sss_client/nfs/nfsidmap_internal.h | 78 +++++ src/sss_client/nfs/sss_nfs_client.c | 571 +++++++++++++++++++++++++++++++++ 7 files changed, 737 insertions(+) create mode 100644 src/external/libnfsidmap.m4 create mode 100644 src/sss_client/nfs/nfsidmap_internal.h create mode 100644 src/sss_client/nfs/sss_nfs_client.c -- 1.9.1

5 37

[PATCH] LDAP: Set umask before calling mkstemp
by Jakub Hrozek 02 Sep '14

02 Sep '14

Hi, attached is a simple patch that fixes a Coverity warning.

2 2

[PATCH v5] Add basic support for CI test execution
by Nikolai Kondrashov 02 Sep '14

02 Sep '14

Hi everyone, Here is the fifth version of the patch adding CI scripts. The differences from the last version are: * All supported Fedora and RHEL distros are building with Samba again. * The extra dependencies yum repository [1] is expected to be in the host yum configuration and is used in mock builds. * Yum ignoring missing packages during dependency installation is now detected and considered an error. * A -n/--no-deps option is added, which disables dependency installation for use with manual dependency management (e.g. building from source). * contrib/ci/README.md added. * The "full" test set is rebranded as "rigorous", selected with -r/--rigorous to fit better with "essential" and "moderate", but -f/--full option is still accepted. Nick [1] http://copr-fe.cloud.fedoraproject.org/coprs/lslebodn/sssd-deps/

4 11

[PATCHES] Implement MIT Kerberos localauth plugin
by Sumit Bose 02 Sep '14

02 Sep '14

Hi, these two patches implement the MIT Kerberos localauth plugin for SSSD. Since it uses the new plugin style (http://k5wiki.kerberos.org/wiki/Projects/Plugin_support_improvements) it has to be activated explicitly. A section like [plugins] localauth = { module = sssd:/path/to/plugin/sssd_krb5_localauth_plugin.so enable_only = sssd } Should work. Please note that this example deactivates any other mechanism, e.g. .k5login files. See krb5.conf man page of MIT Kerberos 1.12 how to active the mechanism as well. One of the main use cases for this plugin is an IPA environment with trust to AD. Currently AD user who want to use SSO with IPA client needed a .k5login file in their home directory containing their Kerberos principal. Alternatively krb5.conf has to be edited but here the names user at the login prompt has to follow a fixed format and are case sensitive. If the localauth plugin is activated the mapping of Kerberos principal and user name is done by SSSD. While I was testing the plugin with ssh I found that st least the Fedora and RHEL versions of the sshd do not rely completely in the Kerberos libraries here but do some checks on their own, especially they check for the existence of the .k5login file in the default configuration. This check can be disabled by setting KerberosUseKuserok to 'no' but then sshd does not call krb5_userok() but the more restrictive krb5_aname_to_localname() and does case sensitive checks on the related names which won't help much in out case. As a result a .k5login file is still needed when testing with ssh but it can be empty or contain random content. I will investigate why OpenSSH is patched in this way on Fedora and RHEL. bye, Sumit

4 9

[PATCH] TESTS: Add unit tests for the GPO interface
by Jakub Hrozek 01 Sep '14

01 Sep '14

Hi, I used the attached patch to exercise Yassir's new additions to the sysdb API.

3 10

[PATCH] Replace space: add some checks
by Sumit Bose 01 Sep '14

01 Sep '14

Hi, this patch adds some additional checks to the logic or replacing space with a different character. The idea is to not replace the space if we might run into trouble with the modified name and log an error. As mentioned in the commit message if the original name already contains the replacement character the original name is used and if the input for the revers operation contains both space and the replacement character the input is returned unmodified as well. As an alternative it would be possible to return NULL and cause an error during the lookup. I think returning the unmodified name is more user friendly. The admin might wonder why the space is not replaced but at least the name is resolved. With this patch a name like 'abc def_ghi' is return unmodified if the replacement character is '_' . But without the check 'abc_def_ghi' is returned which cannot be resolved back which might cause more trouble than the space in the name. bye, Sumit

2 4

[PATCH] MAN: Fix a conversion of seconds to hours
by Lukas Slebodnik 01 Sep '14

01 Sep '14

ehlo. simple patch is attached. BTW: Do we want to document that this interval in ipa is 3x shorter? We could also change default value in ipa provider. sh$ git grep ldap_purge_cache_timeout -- src/providers/ src/providers/ad/ad_opts.h: { "ldap_purge_cache_timeout", DP_OPT_NUMBER, { .number = 10800 }, NULL_NUMBER }, src/providers/ipa/ipa_opts.h: { "ldap_purge_cache_timeout", DP_OPT_NUMBER, { .number = 3600 }, NULL_NUMBER }, src/providers/ldap/ldap_opts.h: { "ldap_purge_cache_timeout", DP_OPT_NUMBER, { .number = 10800 }, NULL_NUMBER }, LS

3 3

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2014