[sssd PR#678][opened] files: add session recording flag
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/678
Author: sumit-bose
Title: #678: files: add session recording flag
Action: opened
PR body:
"""
If session recording is configured for a group the NSS ans PAM
responder rely on a attribute in the cache set by the backend to
determine is session recording is configured for the user or not. This
flag is typically set during the initgroups request.
Since the files provider does not have a dedicated initgroups request
the attribute must be set otherwise. This patch sets is for all users
after the files are reloaded.
Related to https://pagure.io/SSSD/sssd/issue/3855
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/678/head:pr678
git checkout pr678
5 years, 6 months
[sssd PR#679][opened] UTIL: Suppress Coverity warning
by jhrozek
URL: https://github.com/SSSD/sssd/pull/679
Author: jhrozek
Title: #679: UTIL: Suppress Coverity warning
Action: opened
PR body:
"""
We recently added this code:
if (domain_name != NULL
&& is_files_provider(find_domain_by_name(dom,
domain_name,
false)))
find_domain_by_name returns NULL if the domain_name can't be found. This of
course makes mostly sense for trusted domains that can appear and
disappear. And is_files_provider() didn't handle the situation where the
domain pointer was NULL and would directly dereference it.
This commit just adds a NULL check for the domain pointer so that
is_files_provider() returns 'false' if the domain pointer was NULL.
Another alternative might be to check the return value of
find_domain_by_name(), but I don't think it's worth the trouble.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/679/head:pr679
git checkout pr679
5 years, 6 months
[sssd PR#670][opened] FILES: The files provider should not enumerate
by jhrozek
URL: https://github.com/SSSD/sssd/pull/670
Author: jhrozek
Title: #670: FILES: The files provider should not enumerate
Action: opened
PR body:
"""
Resolves: https://pagure.io/SSSD/sssd/issue/3849
For reason I cannot explain now, the files provider always enumerates.
There is commit a60e6ec which implements this, but it's clearly wrong,
because then the plain getent passwd output contains duplicates from
nss_files and nss_sss:
$ getent passwd | sort adm:x:3:4:adm:/var/adm:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin bin:x:1:1:bin:/bin:/sbin/nologin
bin:x:1:1:bin:/bin:/sbin/nologin
certuser:x:10329:10330::/home/certuser:/bin/bash
certuser:x:10329:10330::/home/certuser:/bin/bash
chrony:x:997:994::/var/lib/chrony:/sbin/nologin
chrony:x:997:994::/var/lib/chrony:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/670/head:pr670
git checkout pr670
5 years, 6 months
[sssd PR#673][opened] PAM: return short name for files provider users
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/673
Author: sumit-bose
Title: #673: PAM: return short name for files provider users
Action: opened
PR body:
"""
If the 'allow_missing_name' option is used with pam_sss and the user
name will be determined based on the certificate content and the mapping
rules the PAM responder will by default return the fully-qualified name
of the user which is then later used by other PAM modules as well.
For local users which are configured to use SSSD for Smartcard
authentication this might cause issues in other PAM modules because they
are not aware of the fully-qualified name and will treat the user as
unknown.
With this patch the PAM responder will return the short name for all
users handled by the files provider.
Related to https://pagure.io/SSSD/sssd/issue/3848
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/673/head:pr673
git checkout pr673
5 years, 6 months