sssd-devel January 2015

sssd-devel@lists.fedorahosted.org

18 participants
89 discussions

Start a nNew thread

[PATCHES] sbus: support multiple interfaces on single object path
by Pavel Březina 23 Jan '15

23 Jan '15

2 16

[PATCH] nss: fix SID lookups
by Sumit Bose 23 Jan '15

23 Jan '15

Hi, one of the recent patches related to the changes of the sysdb calls to return ENOENT broke the flow in the lookups by SID. As a result the request always returned if no result was found in the cache instead of asking the backend. With the new flow the ldb_result has to be properly initialized (I remember there was a long discussion about it, but I can't remember the result, so I fixed it in the caller). The verify this you need just to look up a SID with is currently not in the cache, the easiest way is to use an empty cache: python -c "import pysss_nss_idmap; print pysss_nss_idmap.getnamebysid('S-1-5-21-3456664713-2053453454-4165325232-500')" Without the patch only an empty list is return, with the patch the SID is properly looked up by the backend. bye, Sumit

3 3

[PATCH] IPA: properly handle mixed-case trusted domains
by Sumit Bose 23 Jan '15

23 Jan '15

Hi, this patch fixes some issues in the IPA provider if the name of a trusted domain contains upper-case characters. bye, Sumit

2 2

Config file ownership and cwrap tests
by Nikolai Kondrashov 22 Jan '15

22 Jan '15

Hi everyone, I have a bit of a chicken/egg problem with implementing cwrap tests. Sssd currently requires the config file to belong to root. However, that is not possible to arrange when running under a regular user, in cwrap tests. Even though uid_wrapper fakes running under root, the created files still belong to the real user. I see two ways out of this: either run under fakeroot, or allow the config file to (also?) belong to the user sssd is configured to run under (target user). While fakeroot will likely work, to me it seems like sweeping the problem under the rug. The second option seems a bit more natural, especially considering that the CDB file is explicitly chown'ed to the target user, anyway. Now, since the target user can be configured both at the build time *and* in the configuration file itself, we'll need to verify file ownership *after* reading it. Or, can we maybe move user specification to command-line option? What do you think? Thank you. Nick

6 47

[PATCH] views: fix GID overrride for mpg domains
by Sumit Bose 21 Jan '15

21 Jan '15

Hi, this patch fixes and issue Steeve found while testing views. bye, Sumit

2 2

[PATCH] Open the PAC socket from krb5_child before dropping root
by Jakub Hrozek 21 Jan '15

21 Jan '15

Hi, the attached patch adds a public function that opens the PAC responder socket. The krb5_child uses this call to open a fd towards PAC before becoming user so that PAC responder is contacted for users from trusted domains.

2 4

[PATCHES] nss: Add original DN and memberOf to origbyname request
by Sumit Bose 20 Jan '15

20 Jan '15

Hi, The original values of memberOf and the original DN are used in the HBAC evaluation and should be send to the IPA client for AD users via the extdom plugin. The attached patches adds those attribute to the response of of the getorig request. No changes in the extdom plugin are needed. Since originalMemberOf is a multi-value attribute fill_orig() must be able to handle multi-value attributes. The first patch adds the needed changes while the second refactors fill_orig() a bit. To make reviewing easier I didn't squash them together. The last patch adds the new attributes to the getorig request. bye, Sumit

2 5

[PATCH] MAKE: Don't include autoconf generated file to tarball
by Lukas Slebodnik 20 Jan '15

20 Jan '15

ehlo, simple patch is attached. LS

3 5

[PATCH] SPEC: Use libnl3 for epel6
by Lukas Slebodnik 20 Jan '15

20 Jan '15

ehlo, RHEL/CentoOS 6.6 already contains libnl3. LS

2 2

Re: [SSSD] [Freeipa-users] IPA/Kerberos5 and Upper Case/Lower-case Hostnames
by Dmitri Pal 19 Jan '15

19 Jan '15

On 01/18/2015 03:24 AM, Traiano Welcome wrote: > Hi Dmitri > > > On Tue, Dec 30, 2014 at 12:17 AM, Dmitri Pal <dpal(a)redhat.com> wrote: >> On 12/24/2014 01:04 AM, Traiano Welcome wrote: >>> Hi List >>> >>> I have a large number of legacy hosts with upper-case host names, that >>> I'd like to configure as IPA clients. However ipa client refuses to >>> accept upper case hostnames during configuration time. >>> >>> I think this derives from the fact that the kerberos5 database stores >>> host names in a case sensitive way and requires that the DNS hostname >>> matches the server hostname case. >>> >>> My question is: Is it mandatory that the hostname be lower-cased, or >>> is there a safe workaround that will allow IPA client to work with >>> hosts that have upper case host names ? >>> >>> Thanks in advance! >>> Traiano >>> >> See man sssd-ipa >> >> ipa_hostname (string) >> Optional. May be set on machines where the hostname(5) does not >> reflect the fully qualified name used in the IPA domain to identify this >> host. >> >> AFAIR you use this setting for the cases when you want the actual machine >> name be different than the one IPA has. > > > It looks like I would have to add this parameter in the sssd.conf > before running the ipa client configuration. In that case, would the > configurator not overwrite this parameter ? > Or is there some way to provide this option to ipa-client-install initially? AFAIR then you have to configure it manually. But this question belongs more to SSSD list so I am moving it there. Also I think the option is to change the name of the host, enroll automatically, then change it back and update the configuration. But I would prefer SSSD gurus to confirm that. > > >> -- >> Thank you, >> Dmitri Pal >> >> Sr. Engineering Manager IdM portfolio >> Red Hat, Inc. >> >> -- >> Manage your subscription for the Freeipa-users mailing list: >> https://www.redhat.com/mailman/listinfo/freeipa-users >> Go To http://freeipa.org for more info on the project > Thanks in advance, > Traiano -- Thank you, Dmitri Pal Sr. Engineering Manager IdM portfolio Red Hat, Inc.

2 4

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel January 2015