sssd-devel February 2017

sssd-devel@lists.fedorahosted.org

10 participants
61 discussions

[sssd PR#165][opened] selinux: Do not fail if SELinux is not managed
by mzidek-rh 06 Apr '17

06 Apr '17

URL: https://github.com/SSSD/sssd/pull/165 Author: mzidek-rh Title: #165: selinux: Do not fail if SELinux is not managed Action: opened PR body: """ Previously we failed if selinux_is_managed returned 0 or -1 (not managed or error). With this patch we only fail in case of error and continue normally if selinux is not managed by libsemanage at all. Resolves: https://fedorahosted.org/sssd/ticket/3297 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/165/head:pr165 git checkout pr165

4 22

[sssd PR#170][opened] PROXY: Remove duplicit users from group
by celestian 15 Mar '17

15 Mar '17

URL: https://github.com/SSSD/sssd/pull/170 Author: celestian Title: #170: PROXY: Remove duplicit users from group Action: opened PR body: """ It is possible to have duplicit members in local files (/etc/group). This patch removes duplicity in groups in proxy provider. Resolves: https://fedorahosted.org/sssd/ticket/3314 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/170/head:pr170 git checkout pr170

3 8

[sssd PR#152][opened] Add a tevent wrapper around libcurl's asynchronous interface
by jhrozek 14 Mar '17

14 Mar '17

URL: https://github.com/SSSD/sssd/pull/152 Author: jhrozek Title: #152: Add a tevent wrapper around libcurl's asynchronous interface Action: opened PR body: """ This patch set adds a generic utility module that uses libcurl's multi interface to allow the caller to talk HTTP using libcurl. The patch set was part of the KCM responder branch, but as it might be useful to unblock pbrezina's development, I'm submitting it separately. The iobuf module might seem like an overkill for the libcurl tevent wrapper, but please also check the KCM branch during review -- there it proved quite valuable, so I think it makes sense to just reuse the same code in the curl wrapper as well. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/152/head:pr152 git checkout pr152

4 59

[sssd PR#154][opened] Confront caches first
by fidencio 14 Mar '17

14 Mar '17

URL: https://github.com/SSSD/sssd/pull/154 Author: fidencio Title: #154: Confront caches first Action: opened PR body: """ This patch set has been written on top of PR#141, thus PR#141 should be merged before this one and also the following patches* are don't have to be reviewed as part of this PR. *: - CACHE_REQ: Add cache_req_data_set_bypass_cache() - PAM: Use cache_req to perform initgroups lookups - TESTS: Adapt pam-srv-tests to deal with cache_req related changes The other 2 patches, the important ones. are basically introducing a new configurable option to define whether the responder should query all the caches before querying the data providers and reasonable debug info for the work. I'm not 100% sure those changes are the only changes needed (but seems so), so I'd like to ask @jhrozek and @pbrezina for a first review just in order to be sure this series is according to their ideas. Those 2 important patches could be squashed, in case it's the preference of the reviewers. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/154/head:pr154 git checkout pr154

4 37

[sssd PR#166][opened] Please see the commit message for commit description.
by jhrozek 13 Mar '17

13 Mar '17

URL: https://github.com/SSSD/sssd/pull/166 Author: jhrozek Title: #166: Please see the commit message for commit description. Action: opened PR body: """ To reproduce, log in as a user from a trusted domain. Before the patch, you should see an error message about the domain not being found such as: (Wed Feb 22 20:35:33 2017) [sssd[nss]] [nss_update_initgr_memcache] (0x0040): Unknown domain (win.trust.test) requested by provider and the memory cache wouldn't be in fact be invalidated. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/166/head:pr166 git checkout pr166

3 7

Tlog integration and packages
by Nikolai Kondrashov 10 Mar '17

10 Mar '17

Hi everyone, I'd like to continue the discussion of tlog integration, and also present you the first release of tlog - a development preview, which has the configuration interface necessary to implement the integration: https://github.com/spbnick/tlog/releases/tag/v1 You're more than welcome to download RPMs, install, read tlog-rec(8) and tlog-rec.conf(5), and experiment! Building from the Git tree and the tarball works as well, if you're so inclined. I'm also attaching those manpages for convenience. Here are the integration plans so far, as discussed with Jakub on our devconf.cz trip meetings and before on the list. Jakub, please correct me or add details. * We follow the route similar to that taken by SELinux rule control implementation [1][2]. I.e. store the configuration in LDAP HBAC rules, write to files on the client side and then specify them to tlog upon user login. However, I'm also rather fond of the idea of specifying the whole configuration through an environment variable instead of through a file referenced by an environment variable - it's not big at all, and we'll avoid the hassle of managing the files. I implemented support for both in tlog (was easy). * We'll have to make nss_sss report user's shell as tlog-rec (how?) and specify the actual shell to tlog-rec via an environment variable, through pam_sss (with SSS_PAM_ENV_ITEM messages). I.e.: * Nss_sss would always report tlog-rec as the user's shell. * During login (e.g. through "login" or "sshd") pam_sss would add a variable to the user environment, containing, or pointing at, a tlog-rec configuration (TLOG_REC_CONF_TEXT or TLOG_REC_CONF_FILE). That configuration would contain the user's actual shell. I can also implement support for a separate variable just for the shell (TLOG_REC_SHELL?) to simplify the implementation for the start. * Tlog-rec would read the system-wide configuration and overlay it with the one specified in the environment, adding the specific user shell, and then would spawn it. Please also see the draft integration design page [3] for reference. I hope to refine and extend it in the coming weeks to match FreeIPA standards. Please chime in and suggest, object, discuss! Also, please report tlog bugs at https://github.com/spbnick/tlog/issues Thank you! Nick [1]: http://www.freeipa.org/page/SELinux_user_mapping [2]: http://www.freeipa.org/images/b/b9/Freeipa30_SELinuxUserMap.pdf [3]: http://www.freeipa.org/page/Session_Recording

5 22

[sssd PR#127][opened] ssh: use cache_req
by fidencio 10 Mar '17

10 Mar '17

URL: https://github.com/SSSD/sssd/pull/127 Author: pbrezina Title: #127: ssh: use cache_req Action: opened PR body: """ This patches makes SSH responder use the cache_req interface. Since this responder uses that same `cache-domain-cache` lookup logic for host certificates I implemented `host by name` request in `cache_req`. In order to achieve this I moved data provider lookup function from `cache_req` code into plugins. The first two patches fixes minor issues in the SSH responder and should be pushed to earlier versions as well. The first patch fix a little issue introduced probably by overrides and the second patch removes name qualification since it is already qualified in the sysdb since fqname patches. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/127/head:pr127 git checkout pr127

4 22

[sssd PR#153][opened] SYSDB: Changing dataExpireTimestamp in domain cache
by celestian 10 Mar '17

10 Mar '17

URL: https://github.com/SSSD/sssd/pull/153 Author: celestian Title: #153: SYSDB: Changing dataExpireTimestamp in domain cache Action: opened PR body: """ When a group/users are invalidated from sss cache, the group/user information in Domain (cache_LDAP.ldb) and timestamps cache are inconsistent with regard to dataExpireTimestamp attribute. This patch fixes it. Resolves: https://fedorahosted.org/sssd/ticket/3164 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/153/head:pr153 git checkout pr153

4 43

[sssd PR#167][opened] Add missing dyndns_auth option to AD and IPA provider man pages
by justin-stephenson 07 Mar '17

07 Mar '17

URL: https://github.com/SSSD/sssd/pull/167 Author: justin-stephenson Title: #167: Add missing dyndns_auth option to AD and IPA provider man pages Action: opened PR body: """ Add the **dyndns_auth** option into the `sssd-ad` and `sssd-ipa` provider man pages for more configuration information regarding nsupdate behavior. There was no ticket for this, I wasn't sure if it was required to create one for this already-implemented option. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/167/head:pr167 git checkout pr167

4 12

[sssd PR#141][opened] PAM: Use cache_req_user_by_name_*()
by fidencio 03 Mar '17

03 Mar '17

URL: https://github.com/SSSD/sssd/pull/141 Author: fidencio Title: #141: PAM: Use cache_req_user_by_name_*() Action: opened PR body: """ PAM responder has been already using a lot from cache_req and one of the missing parts (most likely the only one?) was that pam_check_user_search() has been using sss_dp_get_account_send(), which could be dropped (and a lot of code around it) in favour of using cache_req_user_by_name_*() instead. Resolves: https://fedorahosted.org/sssd/ticket/1126 Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/141/head:pr141 git checkout pr141

5 50

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel February 2017