sssd-devel July 2016

sssd-devel@lists.fedorahosted.org

18 participants
103 discussions

Re: [PATCH] PAM/KRB5: optional otp and password prompting
by Sumit Bose 07 Jul '16

07 Jul '16

On Wed, Jul 06, 2016 at 10:03:12AM -0400, Nathaniel McCallum wrote: > On Wed, 2016-07-06 at 15:55 +0200, Sumit Bose wrote: > > On Wed, Jul 06, 2016 at 09:03:45AM -0400, Nathaniel McCallum wrote: > > > > > > Patch WFM and looks clean. My only question is on the overall > > > > Thank you very much for testing. > > > > > > > > prompting. > > > > > > Currently we have: > > > * 1FA: > > > - "Password" > > > * 2FA (required): > > > - "First Factor" > > > - "Second Factor" > > > * 2FA (optional): > > > - "First Factor or Password" > > > - "Second Factor, press return for Password authentication" > > > > > > This all seems a little verbose to me. It also seems like it > > > reveals > > > technical details that don't matter and/or might confuse the user. > > > > > > Is there a reason not to do the following? > > > > > > * 1FA: > > > - "Password" > > > * 2FA (required): > > > - "Password" > > > - "Token > > > Code" > > > * 2FA (optional): > > > - "Password" > > > - "Token Code (optional)" > > > > > > This seems to me simpler, shorter and more descriptive. > > > Alternatively: > > > > > > * 1FA: > > > - "Password" > > > * 2FA (required): > > > - "Password" > > > - > > > "Second Factor" > > > * 2FA (optional): > > > - "Password" > > > - "Second Factor > > > (optional)" > > > > > > Whatever we decide to do, this patch has my ACK. So feel free to > > > just > > > change the string and merge it. > > > > When the 2FA prompting was added in the previous release I think I > > asked > > for alternative suggestions as well. My main reasons, especially with > > the 'First Factor' prompt were first to make the user aware that > > something new is happen. New in the sense that the user should be > > prepared to enter the second factor in a new prompt and not put the > > combined password in the 'Password' prompt as he was used to before. > > > > And second I wasn't sure if users are aware that the first factor is > > typically their long term password. Iirc the first factor with RSA > > tokens are typically referred to as PIN and asking for a password > > might > > confuse the users. > > > > Maybe we should reach out to UX designers to see what they recommend? > > Let's just go with this: > > * 1FA: > - "Password" > * 2FA: > - "First Factor" > - "Second Factor" > * 2FA, optional: > - "First Factor" > - "Second Factor (optional)" > > We already implement the first two cases, so adding one word is just a > small change. New version attached with the prompts changed accordingly. bye, Sumit

2 2

[PATCH] Fix packet size calculation in sss_packet_new
by Nikolai Kondrashov 07 Jul '16

07 Jul '16

Hi everyone, The attached patch fixes potential packet buffer overflow with certain body sizes. Found while reading through SSSD code. Nick

3 2

fully qualified sysdb names for users and groups
by Jakub Hrozek 07 Jul '16

07 Jul '16

Hi, here is my branch that implements using the fully qualified names in sysdb for users and groups: https://github.com/jhrozek/sssd/commits/sysdb-fqdn The SSSD code changes are done. There are some downstream tests that are failing (some sudo and some HBAC tests), but I think I can chase those down quickly. But -- I still don't have the upgrade code written and I only tested the IPA overrides and IPA-AD trust code manually, so there might be a lot of bugs there. It is also a lot of stuff to review. With that in mind, I would like to ask other developers for opinions -- should we still pursue pushing this refactoring into 1.14? Or should we release 1.14.0 first and push this patchset as the first thing into 1.15? I'm really on the fence myself.

5 15

RFC: Release notes for the 1.14.0 release
by Jakub Hrozek 06 Jul '16

06 Jul '16

Hi, I prepared the release notes for the 1.14.0 release here: https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0 please comment or edit them. The notes are written with the assumption that several pending patches (including prompting patches, enterprise principals or the sysdb refactoring) will be pushed before we tag the release.

1 0

[PATCHES] krb5 config snippets
by Sumit Bose 06 Jul '16

06 Jul '16

Hi, the following 4 patches include fixes for ttps://fedorahosted.org/sssd/ticket/2788 and https://fedorahosted.org/sssd/ticket/3041. They are not related but depend on each other patch-wise, so I put them in a single mail. Please let me know if you prefer to review them separately then I can them in to different threads. The first patch just removes the 'enable_only = sssd' like which effectively disables the default localauth mechanisms like checking .k5login. I thought we already did this some time ago but apparently not. While I was at it I made SSSD's localauth plugin non-authoritative for SSSD users as well (it already is non-authoritative for non-SSSD users, i.e. it returns KRB5_PLUGIN_NO_HANDLE which leaves the final decision to a different module). This would allow the usage of .k5login files for SSSD users as well. The third and fourth patch create a new krb5 config snippet krb5_libdefaults which will set 'canonicalize = true' if the related SSSD option is true as well, which is currently by default the case for the IPA provider. bye, Sumit

2 2

[PATCH] test_sysdb_ts_cache: Do not use wrong pointer for output argument
by Lukas Slebodnik 06 Jul '16

06 Jul '16

ehlo, Attached patches fix failures in test on big endian http://s390.koji.fedoraproject.org/kojifiles/work/tasks/4511/2274511/build.… It is not just bug in test becuase the same bug is in sysdb_enumpwent_filter and sysdb_enumgrent_filter LS

3 4

[PATCH] LDAP: Change the default rfc2307 autofs attribute mappings
by Jakub Hrozek 06 Jul '16

06 Jul '16

Hi, our rfc2307 attribute mappings are wrongs. Because we are close to releasing a major release, I think this is the time to change them. Attached is a patch that changes the attributes and warns users who use any of the changed attributes in default mappings. If we decide to accept this patch, we should also file a ticket to remove the warnings in the next release to avoid warning forever.

4 11

[PATCH] PAM/KRB5: optional otp and password prompting
by Sumit Bose 06 Jul '16

06 Jul '16

Hi, this patch is the SSSD part of the Authentication Indicator related changes in FreeIPA. The basic part is that now it is possible to authenticate at will with either password or 2FA as described on https://fedorahosted.org/sssd/wiki/DesignDocs/PromptingForMultipleAuthentic…. To test you need a FreeIPA server build from the FreeIPA master branch and optionally Nathaniel's '[PATCH 0093] Enable service authentication indicator management' which is currently under review for the kvno related test. Additionally you need MIT Kerberos packages which contain the fix for https://bugzilla.redhat.com//show_bug.cgi?id=1340304. Since this patch changes how libkrb5 gets the password for password authentication with newer version of MIT Kerberos it would be nice if someone can run some regression tests with the AD or plain KRB5 auth_provider. bye, Sumit

3 6

[PATCH] MAN: Remove leading spaces from elements programlisting
by Lukas Slebodnik 05 Jul '16

05 Jul '16

ehlo, I noticed weird indentation of example for allow_missing_name. It's longer that 80 columns which is not usual for man pages and default terminal size (25x80). LS

2 2

[PATCH] DOC: Fix few typos in doxygen comments
by Lukas Slebodnik 05 Jul '16

05 Jul '16

ehlo, I noticed doxygen warnings when I was packaging 1.14beta into fedora. LS

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel July 2016