August 2016 - sssd-devel - Fedora Mailing-Lists

[PATCH] SECRETS: Search by the right type when checking containers

by Fabiano Fidêncio

We've been searching for the wrong type ("simple") in local_db_check_containers(), which always gives us a NULL result. Let's introduce the new LOCAL_CONTAINER_FILTER and do the search for the right type ("container") from now on. Resolves: https://fedorahosted.org/sssd/ticket/3137 Best Regards, -- Fabiano Fidêncio

7 years, 7 months

2
2
0 / 0

[PATCH] SDAP: Fix settig paging attribute in sdap_get_generic_ext_send

by Lukas Slebodnik

ehlo, We should set pagging flag in state and not in local variable which is not read anywhere in the function. Found by clang static analyzer. Do we need this patch also to stable branch? LS

7 years, 7 months

3
4
0 / 0

MONITOR: Add disable_netlink sssd.conf option

by Justin Stephenson

Hello, The attached patches resolve https://fedorahosted.org/sssd/ticket/3142 However, I am having difficult with the man page addition to 'src/man/sssd.conf.5.xml' for this new option. I have stared at the open and close xml tags(for far too long) and it looks correct but when I build sssd I never see the sssd.conf man page inclusion. Could anyone tell me what I am missing here? If you feel there is better wording for the description please let me know. Kind regards, Justin Stephenson

7 years, 7 months

4
17
0 / 0

Getting overridden shell in pam_sss

by Nikolai Kondrashov

Hi Sumit, Now I'm again approaching the implementation of tlog integration in pam_sss, and as planned, I need to get the actual user shell to put it into TLOG_REC_SHELL environment variable upon opening of the session. However, the get_shell_override, which does all the hops and tricks to get it, requires nss_ctx, which belongs to NSS responder, specifically various shell-related configuration settings (override_shell/allowed_shells/vetoed_shells/etc_shells). I.e. essentially the PAM responder needs to be an NSS responder to get it. To me it seems that there is no exit but to finally put that override machinery into a library, instead of having it directly in the NSS responder. Am I wrong? Is there perhaps another way? Do you have any suggestion how to best do it? Thanks a lot! Nick

7 years, 7 months

3
6
0 / 0

[PATCH SYSDB: Fix handling of version in sysdb_cache_connect_helper

by Lukas Slebodnik

ehlo, Clang static analyzer assume that ldb_search can found 0 entries in the tree "cn=sysdb". Thenvariable version could be used uninitialized. We cannot get to such state in sssd but we already handle a case for more then one entry. LS

7 years, 7 months

3
7
0 / 0

[RFC] Cleaning up the IFP responder (mainly) and socket-activatable responders

by Fabiano Fidêncio

Howdy! Taking a look on https://fedorahosted.org/sssd/ticket/2395 seems that there are a few ways to achieve what's proposed by Simo and I'd like to discuss one of those before start implementing it. As far as I understand the bug, SSSD cannot be run as a non-root user because of IFP responder, which needs to be run as root in order to write to sssd.conf file. Simo's suggestion was to create a new service, which should be socket-activated, to handle this writing to sssd.conf part and Jakub's suggested to completely get rid of this part. However, Dmitri pointed out that we must have some service playing with sssd.conf as it's the way that cockpit and ansible can remotely manage the SSSD configuration. Okay, in order to actually start solving the issue I'd like to propose the follow steps: 1) Create a new service, still explicitly enabled in sssd.conf, that would take care of the managing the SSSD configuration. 2) Get rid of the code dealing with the SSSD configuration from the IFP responder. 3) Get rid of the OpenLMI specific code from the IFP responder Till this point the problem wasn't solved at all, but those seem to be the logical steps in order to make our own lives easier for working in the next two steps. 4) Make the new service (created in 1) socket-activated/bus-activated. 5) Make the IFP responder also bus-activated/socket-activated. So, does it sound like a reasonable way to approach the problem? If yes, I'd like to ask a few questions, mainly about items 4 and 5, as it eems that in order to achieve what we want, https://fedorahosted.org/sssd/ticket/2243 and https://fedorahosted.org/sssd/ticket/3129 have to be solved together, which seems to be a not so small task. So, do we have to care about systems that don't have systemd support? IOW, do we have to keep the current code and also add socket-activation? If yes, would it be explicitly enabled/disabled on configure time? Maybe a lame question, but what are the advantages of the socket-activation over the bus-activation approach (I still didn't look at any of those :-\)? Thanks in advance, -- Fabiano Fidêncio

7 years, 7 months

4
3
0 / 0

[sssd PR#9] SYSDB: Removing of unused parametr (opened)

by fidencio

celestian's pull request #9: "SYSDB: Removing of unused parametr" was opened PR body: """ There were unused parameter struct ldb_message *cached_group in sysdb_store_group_attrs(). This parameter was introduced by 40de79d69860ec7f04bf7795bd88b641ec42fd23 SYSDB: Check if group attributes differ before saving a group """ See the full pull-request at https://github.com/SSSD/sssd/pull/9 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/9/head:pr9 git checkout pr9

7 years, 7 months

1
5
0 / 0

[sssd PR#8] MAN: Document the ldap_user_gid_number option (opened)

by fidencio

jhrozek's pull request #8: "MAN: Document the ldap_user_gid_number option" was opened PR body: """ Some users, mostly those who cannot join the Linux machines to their AD domain resort to using the LDAP provider with ID mapping. But in order for that to work correctly, the ldap_user_gid_number option must be set correctly, otherwise SSSD complains about not finding the primary GID: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Cannot get the GID for [someuser] in domain [extdev]. """ See the full pull-request at https://github.com/SSSD/sssd/pull/8 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/8/head:pr8 git checkout pr8

7 years, 7 months

1
5
0 / 0

[PATCH] GPO: Cat vals with same key from different GPOs

by Michal Židek

Hi, here is patch for ticket #3161. See more in the ticket description. I was thinking why we originally replaced the lists and I think it comes from confusion on how we handle the same keys in single GPO ini file, however that is handled by libini not by SSSD. Michal

7 years, 7 months

6
7
0 / 0

[sssd PR#7] Fix initgroups with nested groups (comment)

by fidencio

lslebodn commented on a pull request """ On (31/08/16 01:47), sumit-bose wrote: >On Wed, Aug 31, 2016 at 01:30:12AM -0700, Jakub Hrozek wrote: >> On Wed, Aug 31, 2016 at 12:36:37AM -0700, sumit-bose wrote: >> > On Tue, Aug 30, 2016 at 12:36:20PM -0700, Jakub Hrozek wrote: >> > > On Tue, Aug 30, 2016 at 11:47:09AM -0700, lslebodn wrote: >> > > >> > > About the discussion I saw on #sssd in backscroll, the rfc2307bis schema >> > > only uses the member attribute because IIRC the RFC doesn't talk about >> > > memberof at all. But in IPA, we know the specifics on the schema, so we >> > > are able to dereference the memberof attribute to get a complete list of >> > > all groups with one call. >> > >> > Unfortunately it is more complicated with IPA because memberOf only >> > contains the direct memberships, there is a second attribute >> > memberofindirect which hold the indirect memberships. >> >> This is only how IPA UI displays indirect memberships, if you check the >> memberships with ldapsearch, you'll see it's really only memberof. > >bummer, you are right, I thought the --raw option of ipa user-show really >means 'raw' but it looks some of the values are still processed. > >Sorry for the noise. > I haven't found any regression caused by this patch. So at least; issues in ipa-trust test are not caused by this bug. LS """ See the full comment at https://github.com/SSSD/sssd/pull/7#issuecomment-243777706

7 years, 7 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2016