[PATCHES] PAM: refactor pam_reply
by Pavel Reichl
Hello,
please see attached patch set which contains some refactoring which is
in my opinion quite safe. It doesn't touch the recursive call of
pam_reply() as I think that changing that would be more risky change.
Thanks!
7 years, 12 months
[PATCH] ldap_test.py: Modify enum cache timeouts
by Michal Židek
Hi!
I saw some integration tests failures recently,
and I think there is a race condition between the
enumeration refresh timeout and the sleeps
after some operations that wait for this timeout.
SSSD fails to populate changes from LDAP in time
and some asserts can fail because of this.
So far I saw 4 tests to fail like this, which
is already quite a lot.
The attached patch modifies the timeout values
and hopefully removes the issue.
Michal
7 years, 12 months
URI in HBAC - update
by Lukáš Hellebrandt
http://www.freeipa.org/page/V4/URI-based_HBAC
I have made some important changes to the design document of this
proposed feature. The difference is mainly changing regular expression
interpretation of URI to longest-prefix matching.
This change was done mainly because of upstream's reactions. I value any
further comments and particularly discussion about the two topics
mentioned at the end of the design page:
* For backwards compatibility, lack of URI in request means any URI is
matched (as described in the design document). Is it a good idea? Any
other solution?
* How about multiple URI's in one HBAC rule? Is it a good idea? How to
interpret combinations of host+scheme+port (one field) and URI paths
(another field) in that case?
--
Lukas Hellebrandt
Associate Quality Engineer
lhellebr(a)redhat.com
7 years, 12 months
[PATCH] intg: Use different uid range for add_remove tests
by Lukas Slebodnik
ehlo,
I use special local user for building srpms in mock
and it caused failures for me with running integration tests.
Attached patch is a workaround. The proper solution would be to wrap
detection of active users in CWRAP enviroment.
LS
8 years
[PRELIMINARY] Data Provider changes
by Pavel Březina
Hi,
the data provider code is basically ready for someone to start looking
into it. I'm in the process of converting old handlers to the new
interface (sudo and hostid is finished) and at this moment I don't plan
to do further changes to the dp interface itself unless something shows
up during the conversion.
I tried to keep the code separated for the moment so it can be split
into more commits to simplify review and current functionality and even
some future bisecting is not broken. For this the DP code itself is
quite self-contained and changes in the modules are done in separate
files (marked as $orig_new.c). The last commit switches the old files
for the new ones in the makefile so new code can be compiled, though at
this moment is is only for development purpose.
There are too many patches to be sent to the list at this incomplete
stage, you can check it out either from my fedorapeople repo [1] or
github repo [2], which Pavel forced me to create (meh :-)).
Pavel Reichl is currently working on unit tests -- thank you!
[1]
https://fedorapeople.org/cgit/pbrezina/public_git/sssd.git/log/?h=backend
[2] https://github.com/pbrezina/sssd/tree/backend
8 years
[DESIGN] sss_confcheck tool
by Michal Židek
Hi,
I just updated the design for the planned sss_confcheck tool.
It can be found here:
https://fedorahosted.org/sssd/wiki/DesignDocs/ConfigCheckTool
For convenience I paste it here as well:
sss_confcheck tool
Related ticket(s):
https://fedorahosted.org/sssd/ticket/2269
Problem statement
There is no easy way to debug the SSSD configuration without having to
look into the debug logs. Moreover the debug logs can be difficult to
understand for people outside SSSD development team. Some common issues
can be identified during static offline analysis of the config files. To
find these issues soon we need a tool that performs this analysis and
provides human readable report.
Use cases
- performing ad-hoc static analysis of the installed SSSD configuration
- performing ad-hoc static analysis of SSSD configuration files
retrieved from user with some SSSD problems
Overview of the solution - sss_confcheck tool
A new tool will be added to sss_* tools that will perform static
analysis of SSSD configuration files. This tool can be run without any
parameters in which case it will print a report to the standard output
in the following or similar format:
-----------------
$ sss_confcheck
Number of identified issues: 1
[rule/allowed_nss_options]: Attribute 'foo' is not allowed in section
'nss'. Check for typos.
Used configuration file:
<Here will be the contents of sssd.conf file>
Number of used configuration override snippets: 2
List of configuration override snippets in order of priority (lowest
priority first):
snippet_name_1.conf
snippet_name_2.conf
Content of configuration override snippets:
snippet_name_1.conf:
<content of snippet_name_1.conf>
snippet_name_2.conf:
<content of snippet_name_2.conf>
-------------------
Available options:
?, --help
--config-file PATH_CONFIG_FILE Path to config file
that will be checked.
--snippets-dir PATH_TO_SNIPPETS_DIRECTORY Path to snippets directory.
--no-validators Do not use validators
(no analysis will be made).
--no-file-content Do not print config
file or snippet contents.
--no-snippets Ignore the snippets.
--silent If no errors are
detected, do not print anything.
Implementation details
The tool will use ding-libs validators feature described in this design
document
https://fedorahosted.org/sssd/wiki/DesignDocs/libini-config-file-checks.
Configuration changes
No configuration changes.
How To Test
Depending on the capabilities of validators used by SSSD, make an error
in configuration and run sss_confcheck to see if it was detected.
8 years
[PATCHES] PAC: only save PAC blob into the cache
by Sumit Bose
Hi,
this patch-set should solve https://fedorahosted.org/sssd/ticket/2158 by
moving the main processing of the PAC data to the backends. The PAC
responder now only has to send one request to the backend to look up the
user based on its SID if the user's SID was not found in the cache. I
used the new cache_req here so the patches depend on Pavel's latest
cache_req patches which are currently under review.
Since new IPA server can provided group-membership data to IPA clients
via the extdom plugin the most important test-cases are currently
against older IPA servers e.g. version 3.3.3 provided by RHEL/CentOS 7.0
(7.1 already has a newer version with enhanced extdom plugin).
bye,
Sumit
8 years
[PATCH] NEGCACHE: Removing of condition for ttl = -1
by Petr Cech
Hi,
I found a strange condition in the function sss_ncache_check_str().
This condition causes the cache is NOT checked and the result of
checking is automatically EEXIST.
I dind't find call of sss_ncache_check_str() with ttl = -1, except in tests.
Note: We use value 0 for permanent cache, no -1.
Regards
--
Petr^4 Čech
8 years
