sssd-devel December 2015

sssd-devel@lists.fedorahosted.org

9 participants
48 discussions

[PATCHES] Support IPA sudo schema
by Pavel Březina 19 Jan '16

19 Jan '16

Hello list, the support of IPA sudo schema is almost complete. The only thing that remains is to finish smart refresh implementation and one patch to reduce code duplication between LDAP and IPA implementation. Then I need to run some tests but I don't expect much troubles here since I tested it a lot during development. I'll finish all of this after my Christmas vacation. The patches are probably too big to be sent as an attachment, so until I complete the last two patches, you can check it on my git repo, branch sudo [1]. I don't really expect anyone to review them during Christmas break, but I thought it's a good thing to present if in case someone will get really bored from all the candies and family visits :-) Happy reviewing. [1] https://fedorapeople.org/cgit/pbrezina/public_git/sssd.git/log/?h=sudo

4 28

[PATCH] Improve negcache with subdomains
by Jakub Hrozek 14 Jan '16

14 Jan '16

Hi, I noticed this bug while working on the SSH fix with default_domain_suffix. It turns out our filter_users/filter_groups don't work well in this scenario, which might have effect on the server load even. Attached are patches that re-initialize negcache with filter_lists contents after the subdomains are (re)discovered. All patches have tests.

2 5

[PATCH] util-tests: Initialize boolean variable to default value
by Lukas Slebodnik 14 Jan '16

14 Jan '16

ehlo, The boolean variable found_nss could be used uninitialized in test test_known_service if service "nss" would not be found. We would catch it with valgind. Simple patch is attached. LS

3 7

[PATCH] tests: use unittest.TestCase.assertCountEqual if possible
by Jakub Hrozek 13 Jan '16

13 Jan '16

When Python3 was used, the tests used our own compat function for checking sequences. It's better to stick to the standard-library provided methods. More details are in the commit message..

3 10

[PATCH] Reduce the code duplication in Data Provider
by Jakub Hrozek 11 Jan '16

11 Jan '16

Hi, I think one of the prime reasons for #2861 was copy-pasting code. The two attached patches reduce the code duplication and hopefully will make future additions to Data Provider safer. Ideas on different solutions are welcome!

4 22

Announcing SSSD 1.13.3
by Jakub Hrozek 15 Dec '15

15 Dec '15

== SSSD 1.13.3 === The SSSD team is proud to announce the release of version 1.13.3 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * A bug that prevented user lookups and logins after migration from winsync to IPA-AD trusts was fixed * The OCSP certificate validation checks are enabled for smartcard logins if SSSD was compiled with the NSS crypto library. * A bug that prevented the ignore_group_members option from working correctly in AD provider setups that use a dedicated primary group (as opposed to a user-private group) was fixed * Offline detection and offline login timeouts were improved for AD users logging in from a domain trusted by an IPA server * The AD provider supports setting up autofs_provider=ad * Several usability improvements to our debug messages == Packaging Changes == * The p11_child helper binary is able to run completely unprivileged and no longer requires the setgid bit to be set == Documentation Changes == * A new option certificate_verification was added. This option allows the administrator to disable OCSP checks in case the OCSP server is not reachable == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1632 [RFE] Unable to use AD provider for automount lookups https://fedorahosted.org/sssd/ticket/1943 convert sudo timer to be_ptask https://fedorahosted.org/sssd/ticket/2672 sudo: reload hostinfo when going online https://fedorahosted.org/sssd/ticket/2732 Add Integration tests for local views feature https://fedorahosted.org/sssd/ticket/2747 get_object_from_cache() does not handle services https://fedorahosted.org/sssd/ticket/2755 Review p11_child hardening https://fedorahosted.org/sssd/ticket/2787 We should mention SSS_NSS_USE_MEMCACHE in man sssd.conf(5) as well https://fedorahosted.org/sssd/ticket/#2796 fix man page for sssd-ldap https://fedorahosted.org/sssd/ticket/2801 Check next certificate on smart card if first is not valid https://fedorahosted.org/sssd/ticket/2812 Smartcard login when certificate on the card is revoked and ocsp check enabled is not supported https://fedorahosted.org/sssd/ticket/2830 Try to suppress "Could not parse domain SID from [(null)]" for IPA users https://fedorahosted.org/sssd/ticket/2846 Inform about SSSD PAC timeout better https://fedorahosted.org/sssd/ticket/2868 AD provider and ignore_group_members=True might cause flaky group memberships https://fedorahosted.org/sssd/ticket/2874 sssd: [sysdb_add_user] (0x0400): Error: 17 (File exists) == Detailed Changelog == Dan Lavu (1): * Clarify that subdomains always use service discovery Jakub Hrozek (7): * Upgrading the version for the 1.13.3 release * DP: Do not confuse static analysers with dead code * BUILD: Only install polkit rules if the directory is available * IPA: Use search timeout, not enum timeout for searching overrides * AD: Add autofs provider * MAN: Clarify when should TGs be disabled for group nesting restriction * Update translations for the 1.13.3 release Lukas Slebodnik (2): * sbus_codegen_tests: Use portable definition of large constants * DEBUG: Add missing new lines Michal Židek (1): * MAN: sssd.conf should mention SSS_NSS_USE_MEMCACHE Pavel Březina (22): * SYSDB: Add missing include to sysdb_services.h * LDAP: Mark globals in ldap_opts.h as extern * AD: Mark globals in ad_opts.h as extern * IPA: Mark globals in ipa_opts.h as extern * KRB5: Mark globals in krb5_opts.h as extern * SUDO: convert periodical refreshes to be_ptask * SUDO: move refreshes from sdap_sudo.c to sdap_sudo_refresh.c * SUDO: move offline check to handler * SUDO: simplify error handling * SUDO: fix sdap_id_op logic * SUDO: fix tevent style * SUDO: fix sdap_sudo_smart_refresh_recv() * SUDO: sdap_sudo_load_sudoers improve iterator * SUDO: set USN inside sdap_sudo_refresh request * SUDO: built host filter inside sdap_sudo_refresh request * SUDO: do not imitate full refresh if usn is unknown in smart refresh * SUDO: fix potential memory leak in sdap_sudo_init * SUDO: obtain host information when going online * SUDO: remove finalizer * SUDO: make sdap_sudo_handler static * SUDO: use size_t instead of int in for cycles * SUDO: get srv_opts after we are connected Pavel Reichl (1): * sysdb-tests: Fix warning - incompatible pointer type Petr Cech (2): * IPA_PROVIDER: Explicit no handle of services * KRB5_CHILD: Debug logs for PAC timeout Sumit Bose (7): * IPA: fix override with the same name * p11: allow p11_child to run completely unprivileged * p11: check if cert is valid before selecting it * p11: enable ocsp checks * ldap: skip sdap_save_grpmem() if ignore_group_members is set * initgr: only search for primary group if it is not already cached * LDAP: check early for missing SID in mapping check

1 0

[PATCHES] sudo provider improvements
by Pavel Březina 15 Dec '15

15 Dec '15

Hi, I'm sending some sudo provider patches. I wanted to fix/improve things in the ldap sudo provider prior my work on ipa provider so I get familiar with it again and avoid making the same mistakes. It fixes tevent style, shuffles the code around a little bit, convert periodic task to use be_ptask module, renew hostinfo when needed, fix sdap_id_op logic, recude code duplication, remove dead code, simplify error handling, etc. Ticket fixed: https://fedorahosted.org/sssd/ticket/1943 https://fedorahosted.org/sssd/ticket/2672 I let Dan run downstream tests on those patches. We had to fix one test that was prone to a race condition which my patches revealed, but everything is green now.

3 19

[PATCH] KRB5_CHILD: Debug logs for PAC timeout
by Petr Cech 14 Dec '15

14 Dec '15

Hi, simple patch is attached. Regards Petr

3 11

[PATCH] make globals in *_opts.h extern
by Pavel Březina 14 Dec '15

14 Dec '15

This solves situation where you want to use those globals on other place than in *_common.c. I also created https://fedorahosted.org/sssd/ticket/2890 so we can avoid order-dependency on header files such as sysdb_services.h which I had to fix for AD patch.

2 10

[PATCHES] cleanup task: Expire all memberof targets when removing user
by Michal Židek 14 Dec '15

14 Dec '15

Hi, see the attached patches for ticket https://fedorahosted.org/sssd/ticket/2676 Removing the user during cleanup task completely removes that user from local database, so that user is no longer part of any group in sysdb. Such user may, or may not have been removed from LDAP so the only way to figure out is check on the next refresh otherwise we may get inconsistent results. The third patch adds integration test for this Apply and run the intgcheck without the first 2 patches to see the failed test (you will also see that all the tests after this failed one will end with errors as well, that is probably due to incomplete clean up after the ldap tests and I do not intend to solve this as part of this patchset but will investigate it later). Thanks, Michal -- Senior Principal Intern

4 14

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel December 2015