November 2018 - sssd-devel - Fedora mailing-lists

[sssd PR#175][opened] Add module for starting services
by lslebodn 22 Nov '21

22 Nov '21

URL: https://github.com/SSSD/sssd/pull/175 Author: lslebodn Title: #175: Add module for starting services Action: opened PR body: """ This is a WIP version of reducing code duplication in our cwrap integration tests. I am still not sure whether we should also reuse function `create_sssd_fixture`. And if yes; then probably in different nodule then `services` And comments are welcome. BTW I wrote patches few weeks ago; therefore new tests are not converted. I am just sending patches to get some feedback. Site effect of this patches is that tests are cca 20% faster (IIRC) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/175/head:pr175 git checkout pr175

5 5

[sssd PR#616][opened] become_user: add supplementary groups so ad provider can access keytab
by asheplyakov 28 Jan '21

28 Jan '21

URL: https://github.com/SSSD/sssd/pull/616 Author: asheplyakov Title: #616: become_user: add supplementary groups so ad provider can access keytab Action: opened PR body: """ For security reasons one might want to run providers as a non-privileged user (say, _sssd). However some providers (in particular ad) might need an access to restricted (non world-readable) files (for instance, /etc/krb5.keytab). One of the possible ways to solve the problem is to - add a special group (for instance, _keytab) - set the owner:group of the file in question to root:_keytab - set the permissions of the file in question to 640 - make the _sssd user a member of the _keytab group For this to work become_user should assign supplementary groups, which is what this patch does. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/616/head:pr616 git checkout pr616

5 13

[sssd PR#269][opened] Add support for ActiveDirectory's logonHours restrictions
by NWilson 03 Sep '20

03 Sep '20

URL: https://github.com/SSSD/sssd/pull/269 Author: NWilson Title: #269: Add support for ActiveDirectory's logonHours restrictions Action: opened PR body: """ This is a straightforward patch for denying access to a user when the user is not permitted to access their account due to logonHours restrictions. This matches the default behaviour for domain-joined Windows machines. When outside the logonHours, all types of authentication are denied (password/Kerberos/certificate) - so it is appropriate to put this check inside the PAM "account" rules. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/269/head:pr269 git checkout pr269

9 30

[sssd PR#578][opened] proxy: proxy_child hardening
by amitkumar50 10 Aug '20

10 Aug '20

URL: https://github.com/SSSD/sssd/pull/578 Author: amitkumar50 Title: #578: proxy: proxy_child hardening Action: opened PR body: """ proxy_child will call chdir("/"), umask(022) and reset the environment with clearenv(). The --domain argument to be sanitized. Resolves: https://pagure.io/SSSD/sssd/issue/2689 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/578/head:pr578 git checkout pr578

5 14

[sssd PR#693][opened] SYSDB: Fall back to the MPG result of getgrgid search if the non-MPG search for override doesn't match anything
by jhrozek 24 Mar '20

24 Mar '20

URL: https://github.com/SSSD/sssd/pull/693 Author: jhrozek Title: #693: SYSDB: Fall back to the MPG result of getgrgid search if the non-MPG search for override doesn't match anything Action: opened PR body: """ Commit cf4f5e031ecbdfba0b55a4f69a06175a2e718e67 changed the logic of getgrgid (and getpwnam, so far this patch only touches getgrgid) in the sense that if looking up a GID in a MPG domain, the code checks if the GID was overriden and if yes, it mandates that the overriden GID resolves to a group by falling back to a non-MPG search. This breaks the following use-case: $ ipa idoverrideuser-add --uid=13133 --gidnumber=13133 'Default Trust View' user@domain Most importantly, I'm on the fence about whether the current behaviour is a bug or not. In general, I would have expected that if a primary GID is overriden, you more or less break the MPG model, and then it's fair from SSSD to make sure the GID number resolves to an entry. But apparently our users were relying on the old behaviour where you can set the primary GID with an override and then still resolve the primary group by ID to the user entry. So the patch in the PR is just a quick hack which sort of falls back to using the user entry as the group if the overriden GID doesn't resolve to anything. Should we support this use-case at all? Should we maybe limit it to cases where the UID and GID are the same? """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/693/head:pr693 git checkout pr693

3 8

[sssd PR#596][opened] [CONFDB]:[RFE] Add "enabled" option to domain section
by amitkumar50 24 Mar '20

24 Mar '20

URL: https://github.com/SSSD/sssd/pull/596 Author: amitkumar50 Title: #596: [CONFDB]:[RFE] Add "enabled" option to domain section Action: opened PR body: """ Upstream Request: Instead of enabling domains using the "domains" option in [sssd] section we could have [domain/*] option "enabled". This would allow admins to configure and enable domain in the same snippet file. This Fix would be submitted in 2 patches: Patch-1(This Patch): - Introduces 'enabled' option in domain section - Introduces 'CONFDB_DOMAIN_ENABLED' variable to retrieve enabled value from confdb - Code to call start_service() routine only for domains having enabled=1 Patch-2(Upcoming): - Would remove 'domains' option from sssd section. - Would remove corresponding code to parse 'domains' option - Providing a check that atlest One domain have enabled option set. Resolves: https://pagure.io/SSSD/sssd/issue/3735 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/596/head:pr596 git checkout pr596

7 12

[sssd PR#132][opened] Add "Wants=" to sssd unit and avoid PAC responder to be always running
by fidencio 02 Jan '20

02 Jan '20

URL: https://github.com/SSSD/sssd/pull/132 Author: fidencio Title: #132: Add "Wants=" to sssd unit and avoid PAC responder to be always running Action: opened PR body: """ The first patch changes the current logic of having the services' sockets disabled by default as it adds a "Wants=" to the sssd unit file, making all the services' sockets enabled by the moment sssd service is enabled. The second patch takes advantage of the first patch and avoids running PAC responder in case its socket is active, leaving the service to be socket-activated when needed. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/132/head:pr132 git checkout pr132

3 40

[sssd PR#646][opened] proxy: access provider directly not through be_ctx
by pbrezina 18 Dec '19

18 Dec '19

URL: https://github.com/SSSD/sssd/pull/646 Author: pbrezina Title: #646: proxy: access provider directly not through be_ctx Action: opened PR body: """ See commit message for details. Resolves: https://pagure.io/SSSD/sssd/issue/3812 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/646/head:pr646 git checkout pr646

3 12

[sssd PR#558][opened] WIP: Add a test for sss_nss_getgrouplist_timeout and fix invalidating the initgroups cache
by jhrozek 04 Nov '19

04 Nov '19

URL: https://github.com/SSSD/sssd/pull/558 Author: jhrozek Title: #558: WIP: Add a test for sss_nss_getgrouplist_timeout and fix invalidating the initgroups cache Action: opened PR body: """ This is a WIP on adding tests for the sss_nss_ex interface. I covered only the sss_nss_getgrouplist_timeout function so far. I'm submitting the PR already in this state to get some feedback if this coverage is enough and the other functions can be covered similarly or if there is some issue with this approach. Also, I found a bug in invalidating the initgroups memory cache, that's the first of the two patches. Here I'm really not sure if the fix is even how the issue should be fixed, so I just hacked something up, even without allocation checks etc. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/558/head:pr558 git checkout pr558

3 10

[sssd PR#457][opened] ipa: Removal of umask(0) in selinux_child
by amitkumar50 30 Oct '19

30 Oct '19

URL: https://github.com/SSSD/sssd/pull/457 Author: amitkumar50 Title: #457: ipa: Removal of umask(0) in selinux_child Action: opened PR body: """ Code for calling umask(0) was added to address bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=1186422. Now this bugzilla is fixed, removing the workaround. Resolves: https://pagure.io/SSSD/sssd/issue/3583 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/457/head:pr457 git checkout pr457

11 27

[sssd PR#390][opened] NSS: Add option to disable memcache
by mzidek-rh 21 Oct '19

21 Oct '19

URL: https://github.com/SSSD/sssd/pull/390 Author: mzidek-rh Title: #390: NSS: Add option to disable memcache Action: opened PR body: """ Added option use_memcache to centrally disable memcache for all clients without the need to specify SSS_NSS_USE_MEMCACHE=NO environment variable. Resolves: https://pagure.io/SSSD/sssd/issue/3496 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/390/head:pr390 git checkout pr390

8 106

[sssd PR#546][opened] TESTS: Re-add tests for `kdestroy -A`
by fidencio 23 Sep '19

23 Sep '19

URL: https://github.com/SSSD/sssd/pull/546 Author: fidencio Title: #546: TESTS: Re-add tests for `kdestroy -A` Action: opened PR body: """ This reverts commit 89726be5a05493b7af312f0be9ac5ecb6f1822e1 and also do a few modifications on it in order to ensure we don't have any regression on https://pagure.io/SSSD/sssd/issue/3413 As this patch depends on a krb5 patch applied to the distros we run our internal CI on, I've opened a bug report providing patches for Fedora[0] and Debian[1]. [0]: https://bugzilla.redhat.com/show_bug.cgi?id=1561917 [1]: https://salsa.debian.org/debian/krb5/merge_requests/1 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/546/head:pr546 git checkout pr546

4 27

[sssd PR#560][opened] NSS: close files after mmap
by ChrisKowalczyk 17 Sep '19

17 Sep '19

URL: https://github.com/SSSD/sssd/pull/560 Author: ChrisKowalczyk Title: #560: NSS: close files after mmap Action: opened PR body: """ The files in MC cache folder were initialized by SSSD on startup, and mapped by using mmap function. due to the fact that they weren't closed afterwards, their File descriptors were still marker alive but marked as 'Deleted'. This was noticed by a customer of SUSE, see more details here: https://bugzilla.suse.com/show_bug.cgi?id=1080156 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/560/head:pr560 git checkout pr560

6 12

[sssd PR#636][opened] failover: tune up default timeouts
by pbrezina 31 Jul '19

31 Jul '19

URL: https://github.com/SSSD/sssd/pull/636 Author: pbrezina Title: #636: failover: tune up default timeouts Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/3217 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/636/head:pr636 git checkout pr636

3 22

[sssd PR#677][opened] pcre: port to pcre2
by thalman 03 Jul '19

03 Jul '19

URL: https://github.com/SSSD/sssd/pull/677 Author: thalman Title: #677: pcre: port to pcre2 Action: opened PR body: """ Some distributions want to drop pcre support. Sssd should work with pcre2. With this patch sssd tries to use pcre2 if pcre is not present. Resolves: https://pagure.io/SSSD/sssd/issue/3833 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/677/head:pr677 git checkout pr677

3 33

[sssd PR#541][opened] memberof: keep memberOf attribute for nested member
by pbrezina 08 Apr '19

08 Apr '19

URL: https://github.com/SSSD/sssd/pull/541 Author: pbrezina Title: #541: memberof: keep memberOf attribute for nested member Action: opened PR body: """ If we have a member that is both direct and nested member, memberOf attribute was removed if the direct membership was deleted. 1) user ----------> groupB -> groupC -> groupA / 2) user -> groupA -> groupB -> groupC If we remove user->groupB from 1), we get 2) but groupB was still removed from user memberOf attribute. Resolves: https://pagure.io/SSSD/sssd/issue/3636 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/541/head:pr541 git checkout pr541

3 16

[sssd PR#650][opened] Implement a hybrid mode of generating private groups
by jhrozek 20 Mar '19

20 Mar '19

URL: https://github.com/SSSD/sssd/pull/650 Author: jhrozek Title: #650: Implement a hybrid mode of generating private groups Action: opened PR body: """ Related: https://pagure.io/SSSD/sssd/issue/3822 Design page PR: https://pagure.io/SSSD/docs/pull-request/72 Commit mesages follow, hopefully they are enough to explain what is going on. SYSDB: Special case getgrnam and getgrgid searches in hybrid MPG mode In hybrid MPG mode, we want to return the MPG group only in case the user entry has no original GID set. To achieve this, we first search with the non-MPG filter to find 'real' groups. If that fails, we try the MPG filter, but throw away entries that has any real GID set. Related: https://pagure.io/SSSD/sssd/issue/3822 SYSDB: Refactor the mpg and non-mpg searches out of sysdb_getgrnam() and sysdb_getgrgid() to make them more reusable The getgrnam and getgrgid searches already special-case lookups with overrides where in some cases the search falls back no a non-MPG search. The upcoming special case for the hybrid mode would do something similar, just in the opposite direction, so it makes sense to split out the functions for just the MPG step and just the non-MPG step into reusable functions. Related: https://pagure.io/SSSD/sssd/issue/3822 CONFDB/NSS: Add the hybrid MPG mode Permits a new option value 'hybrid' for the auto_private_groups option. The option was even previously marked as a string option in both the configAPI and the man pages, so we don't have to change the type now. If the hybrid mode is selected and the user's original GID number is available, then during initgroups and getpwnam, it is used as their primary GID instead of the MPG group. The original group is also not added as a secondary group during initgroups in this case. Related: https://pagure.io/SSSD/sssd/issue/3822 CONFDB: Read auto_private_groups as string, not bool In preparation to adding the third value of auto_private_groups, this patch reads the confdb value as string and checks for the option values on its own. Related: https://pagure.io/SSSD/sssd/issue/3822 UTIL: Convert bool mpg to an enum mpg_mode Instead of bool mpg inside struct sss_domain_info, let's introduce enum mpg_mode that currently maps pretty much 1:1 to the boolean. In future patches, a third value will be added. Also adds a getter for the mpg_mode value because we want to discourage getting or setting the value directly. Instead, the sss_domain_info structure should be opaque in the future. Related: https://pagure.io/SSSD/sssd/issue/3822 UTIL: Add a is_domain_mpg shorthand Instead of looking into the domain structure directly, add a sss_domain_is_mpg() function. This will make sense when we add a third state instead of the boolean that will also be mpg-like. Related: https://pagure.io/SSSD/sssd/issue/3822 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/650/head:pr650 git checkout pr650

2 59

[sssd PR#702][opened] NSS: Avoid changing the memory cache ownership away from the SSSD user
by jhrozek 13 Dec '18

13 Dec '18

URL: https://github.com/SSSD/sssd/pull/702 Author: jhrozek Title: #702: NSS: Avoid changing the memory cache ownership away from the SSSD user Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/3890 In case SSSD is compiled --with-sssd-user but run as root (which is the default on RHEL and derivatives), then the memory cache will be owned by the user that sssd_nss runs as, so root. This conflicts with the packaging which specifies sssd.sssd as the owner. And in turn, this means that users can't reliably assess the package integrity using rpm -V. This patch makes sure that the memory cache files are chowned to sssd.sssd even if the nss responder runs as root. Also, this patch changes the sssd_nss responder so that is becomes a member of the supplementary sssd group. Even though in traditional UNIX sense, a process running as root could write to a file owned by sssd:sssd, with SELinux enforcing mode this becomes problematic as SELinux emits an error such as: type=AVC msg=audit(1543524888.125:1495): avc: denied { fsetid } for pid=7706 comm="sssd_nss" capability=4 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=capability To make it possible for the sssd_nss process to write to the files, the files are also made group-writable. The 'others' permission is still set to read only. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/702/head:pr702 git checkout pr702

2 10

[sssd PR#696][opened] DYNDNS: SSSD does not batch DDNS update requests
by thalman 10 Dec '18

10 Dec '18

URL: https://github.com/SSSD/sssd/pull/696 Author: thalman Title: #696: DYNDNS: SSSD does not batch DDNS update requests Action: opened PR body: """ SSSD includes a 'send' command in between each record modification and does not batch DDNS update requests. This is problematic in complex AD environments because those requests may not be processed by the same server. Now zone update is done in two steps - one per protocol family. If dyndns_update_per_family is set to false, update is performed in single step. Resolves: https://pagure.io/SSSD/sssd/issue/3829 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/696/head:pr696 git checkout pr696

3 12

[sssd PR#701][opened] ci: add ability to run tests in jenkins
by pbrezina 05 Dec '18

05 Dec '18

URL: https://github.com/SSSD/sssd/pull/701 Author: pbrezina Title: #701: ci: add ability to run tests in jenkins Action: opened PR body: """ Jenkins master polls github for new branches and pull requests. When it discovers new pull request or branch or changes to existing pull request or branch it will allocate a jenkins agent and executes pipeline defined in `./Jenkinsfile` (in SSSD source) on this agent. The pipeline executes `./contrib/test-suite/run.sh` and archives logs when testing is finished. Script `./contrib/test-suite/run.sh` prepares sssd-test-suite, starts the vagrant machines and copy SSSD source code to the client machine. Then it calls `./contrib/test-suite/run-client.sh` on the client machine which runs continuous integration tests. ### Extending current tests To extend current testing capabilities, modify `./contrib/test-suite/run.sh` and `./contrib/test-suite/run-client.sh` to new requirements. These files can be modified by anyone but are considered untrusted from contributor that is not an administrator of SSSD repository. This means that if a public contributor submits a pull request that changes those files, Jenkins will refuse to run tests. ### Adding additional distribution to test on You need to modify `./Jenkinsfile`. Simply copy, paste and amend existing Fedora 28 stage. This file is also considered untrusted so only administrators can modify it within a pull request. You also need to extend `sssd-test-suite` and prepare vagrant boxes for this distro. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/701/head:pr701 git checkout pr701

2 11

[sssd PR#695][opened] sss_iface: prevent from using invalid names that start with digits
by pbrezina 05 Dec '18

05 Dec '18

URL: https://github.com/SSSD/sssd/pull/695 Author: pbrezina Title: #695: sss_iface: prevent from using invalid names that start with digits Action: opened PR body: """ From: https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-n… - Bus names that start with a colon (':') character are unique connection names. Other bus names are called well-known bus names. - Bus names are composed of 1 or more elements separated by a period ('.') character. All elements must contain at least one character. - Each element must only contain the ASCII characters "[A-Z][a-z][0-9]_-", with "-" discouraged in new bus names. Only elements that are part of a unique connection name may begin with a digit, elements in other bus names must not begin with a digit. - Bus names must contain at least one '.' (period) character (and thus at least two elements). - Bus names must not begin with a '.' (period) character. - Bus names must not exceed the maximum name length (255). Resolves: https://pagure.io/SSSD/sssd/issue/3872 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/695/head:pr695 git checkout pr695

2 5

[sssd PR#690][opened] DYNDNS: Convert dyndns timer to be_ptask
by thalman 05 Dec '18

05 Dec '18

URL: https://github.com/SSSD/sssd/pull/690 Author: thalman Title: #690: DYNDNS: Convert dyndns timer to be_ptask Action: opened PR body: """ We have API for periodic tasks and we want to use it instead of tevent timers. Resolves: https://pagure.io/SSSD/sssd/issue/1944 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/690/head:pr690 git checkout pr690

3 15

[sssd PR#700][opened] LDAP: Only authenticate the auth connection if we need to look up user information
by jhrozek 26 Nov '18

26 Nov '18

URL: https://github.com/SSSD/sssd/pull/700 Author: jhrozek Title: #700: LDAP: Only authenticate the auth connection if we need to look up user information Action: opened PR body: """ Related: https://pagure.io/SSSD/sssd/issue/3451 Commit add72860c7a7a2c418f4d8b6790b5caeaf7dfb7b initially addressed #3451 by using the full sdap_cli_connect() request during LDAP authentication. This was a good idea as it addressed the case where the authentication connection must also look up some user information (typically with id_provider=proxy where you don't know the DN to bind as during authentication), but this approach also broke the use-case of id_provider=ldap and auth_provider=ldap with ldap_sasl_auth=gssapi. This is because (for reason I don't know) AD doesn't like if you use both GSSAPI and startTLS on the same connection. But the code would force TLS during the authentication as a general measure to not transmit passwords in the clear, but then, the connection would also see that ldap_sasl_auth=gssapi is set and also bind with GSSAPI. This patch checks if the user DN is already known and if yes, then doesn't authenticate the connection as the connection will then only be used for the user simple bind. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/700/head:pr700 git checkout pr700

2 19

[sssd PR#699][opened] Fixes for MIT Kerberos 1.17 and valgind CI runs
by sumit-bose 26 Nov '18

26 Nov '18

URL: https://github.com/SSSD/sssd/pull/699 Author: sumit-bose Title: #699: Fixes for MIT Kerberos 1.17 and valgind CI runs Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/699/head:pr699 git checkout pr699

2 5

[sssd PR#644][opened] When multiple UIDs exist, use the username provided by the user as the first lookup
by joeFischetti 22 Nov '18

22 Nov '18

URL: https://github.com/SSSD/sssd/pull/644 Author: joeFischetti Title: #644: When multiple UIDs exist, use the username provided by the user as the first lookup Action: opened PR body: """ The current state of the code has no way of determining the "correct" UID to use when there are multiple values. If there are multiple values, and the RDN doesn't match, this update checks the UID's returned against the username that was provided by the user at the prompt. If that matches, it's used. If that doesn't match, it falls back to the existing code. Example: My ldap record includes multiple uid values, ["genericemployee1", "itstaff1"] I need access to machines as "itstaff1". "genericemployee1" is used as an identifier in other systems/services. If I log in with "itstaff1" at the prompt, and my ldap lookup with filter (uid=itstaff1) is successful, the array of UID's are checked against "itstaff1" and that's what *_primary is set to. With the current code, if I try to log in with "itstaff1" at the prompt, I'm actually logged into the system as "genericemployee1". Based on the order that the values are returned... some other staff are logged into their "genericemployee" or the "itstaff" accounts. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/644/head:pr644 git checkout pr644

4 17

[sssd PR#698][opened] Add support for EC keys
by sumit-bose 22 Nov '18

22 Nov '18

URL: https://github.com/SSSD/sssd/pull/698 Author: sumit-bose Title: #698: Add support for EC keys Action: opened PR body: """ This patch set adds support for elliptic curve (EC) keys to p11_child and the ssh key extraction code. Related to https://pagure.io/SSSD/sssd/issue/3887 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/698/head:pr698 git checkout pr698

2 5

[sssd PR#697][opened] RESPONDER: Log failures from bind() and listen()
by jhrozek 22 Nov '18

22 Nov '18

URL: https://github.com/SSSD/sssd/pull/697 Author: jhrozek Title: #697: RESPONDER: Log failures from bind() and listen() Action: opened PR body: """ We've seen reports from users where SSSD (for a reason which is not known at the moment) couldn't bind to the created socket. This patch just logs the errno which should help in debugging issues like that in the future. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/697/head:pr697 git checkout pr697

2 11

[sssd PR#694][opened] SSSCTL: user-show says that user is expired
by thalman 22 Nov '18

22 Nov '18

URL: https://github.com/SSSD/sssd/pull/694 Author: thalman Title: #694: SSSCTL: user-show says that user is expired Action: opened PR body: """ sssctl user-show says that user is expired if the user comes from files provider. This is ok because files user's expiration time is always set to 0 but we should print a better, less confusing message. The same change apply to groups. Resolves: https://pagure.io/SSSD/sssd/issue/3858 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/694/head:pr694 git checkout pr694

4 17

[sssd PR#686][opened] nss: use enumeration context as talloc parent for cache req result
by pbrezina 22 Nov '18

22 Nov '18

URL: https://github.com/SSSD/sssd/pull/686 Author: pbrezina Title: #686: nss: use enumeration context as talloc parent for cache req result Action: opened PR body: """ Otherwise we end up with memory leak since the result is never freed. Resolves: https://pagure.io/SSSD/sssd/issue/3870 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/686/head:pr686 git checkout pr686

2 9

[sssd PR#680][opened] pytest: Add test case for Expired sudo rule
by mrniranjan 22 Nov '18

22 Nov '18

URL: https://github.com/SSSD/sssd/pull/680 Author: mrniranjan Title: #680: pytest: Add test case for Expired sudo rule Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/680/head:pr680 git checkout pr680

2 14

Cannot start sssd from source [libsss_ldap_common.so: undefined symbol: ldap_tls_inplace]
by Amit Kumar 19 Nov '18

19 Nov '18

Hello, I build sssd-1.16.0-19 from source. #./configure; make; make install # /usr/local/sbin/sssd -i -d 1 ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [dp_module_open_lib] (0x0010): Unable to load module [ad] with path [/usr/local/lib/sssd/libsss_ad.so]: /usr/local/lib/sssd/libsss_ldap_common.so: undefined symbol: ldap_tls_inplace (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [dp_load_module] (0x0020): Unable to create DP module. (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [dp_target_init] (0x0010): Unable to load module ad (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [dp_load_targets] (0x0020): Unable to load target [id] [80]: Accessing a corrupted shared library. (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [dp_init] (0x0020): Unable to initialize DP targets [1432158209]: Internal Error (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [be_process_init] (0x0010): Unable to setup data provider [1432158209]: Internal Error (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [main] (0x0010): Could not initialize backend [1432158209] ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [dp_module_open_lib] (0x0010): Unable to load module [ad] with path [/usr/local/lib/sssd/libsss_ad.so]: /usr/local/lib/sssd/libsss_ldap_common.so: undefined symbol: ldap_tls_inplace (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [dp_load_module] (0x0020): Unable to create DP module. (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [dp_target_init] (0x0010): Unable to load module ad (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [dp_load_targets] (0x0020): Unable to load target [id] [80]: Accessing a corrupted shared library. (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [dp_init] (0x0020): Unable to initialize DP targets [1432158209]: Internal Error (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [be_process_init] (0x0010): Unable to setup data provider [1432158209]: Internal Error (Mon Nov 19 12:49:31 2018) [sssd[be[atest.com]]] [main] (0x0010): Could not initialize backend [1432158209] ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header (Mon Nov 19 12:49:33 2018) [sssd[be[atest.com]]] [dp_module_open_lib] (0x0010): Unable to load module [ad] with path [/usr/local/lib/sssd/libsss_ad.so]: /usr/local/lib/sssd/libsss_ldap_common.so: undefined symbol: ldap_tls_inplace (Mon Nov 19 12:49:33 2018) [sssd[be[atest.com]]] [dp_load_module] (0x0020): Unable to create DP module. (Mon Nov 19 12:49:33 2018) [sssd[be[atest.com]]] [dp_target_init] (0x0010): Unable to load module ad (Mon Nov 19 12:49:33 2018) [sssd[be[atest.com]]] [dp_load_targets] (0x0020): Unable to load target [id] [80]: Accessing a corrupted shared library. (Mon Nov 19 12:49:33 2018) [sssd[be[atest.com]]] [dp_init] (0x0020): Unable to initialize DP targets [1432158209]: Internal Error (Mon Nov 19 12:49:33 2018) [sssd[be[atest.com]]] [be_process_init] (0x0010): Unable to setup data provider [1432158209]: Internal Error (Mon Nov 19 12:49:33 2018) [sssd[be[atest.com]]] [main] (0x0010): Could not initialize backend [1432158209] (Mon Nov 19 12:49:36 2018) [sssd] [services_startup_timeout] (0x0020): Providers did not start in time, forcing services startup! ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header (Mon Nov 19 12:49:36 2018) [sssd[ssh]] [sbus_client_init] (0x0020): check_file failed for [/usr/local/var/lib/sss/pipes/private/sbus-dp_atest.com]. (Mon Nov 19 12:49:36 2018) [sssd[ssh]] [sss_dp_init] (0x0010): Failed to connect to monitor services. (Mon Nov 19 12:49:36 2018) [sssd[ssh]] [sss_process_init] (0x0010): fatal error setting up backend connector (Mon Nov 19 12:49:36 2018) [sssd[ssh]] [ssh_process_init] (0x0010): sss_process_init() failed (Mon Nov 19 12:49:36 2018) [sssd[pam]] [sbus_client_init] (0x0020): check_file failed for [/usr/local/var/lib/sss/pipes/private/sbus-dp_atest.com]. (Mon Nov 19 12:49:36 2018) [sssd[pam]] [sss_dp_init] (0x0010): Failed to connect to monitor services. (Mon Nov 19 12:49:36 2018) [sssd[pam]] [sss_process_init] (0x0010): fatal error setting up backend connector (Mon Nov 19 12:49:36 2018) [sssd[pam]] [pam_process_init] (0x0010): sss_process_init() failed (Mon Nov 19 12:49:36 2018) [sssd[nss]] [sbus_client_init] (0x0020): check_file failed for [/usr/local/var/lib/sss/pipes/private/sbus-dp_atest.com]. (Mon Nov 19 12:49:36 2018) [sssd[nss]] [sss_dp_init] (0x0010): Failed to connect to monitor services. (Mon Nov 19 12:49:36 2018) [sssd[nss]] [sss_process_init] (0x0010): fatal error setting up backend connector (Mon Nov 19 12:49:36 2018) [sssd[nss]] [nss_process_init] (0x0010): sss_process_init() failed ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header (Mon Nov 19 12:49:36 2018) [sssd[nss]] [sbus_client_init] (0x0020): check_file failed for [/usr/local/var/lib/sss/pipes/private/sbus-dp_atest.com]. (Mon Nov 19 12:49:36 2018) [sssd[nss]] [sss_dp_init] (0x0010): Failed to connect to monitor services. (Mon Nov 19 12:49:36 2018) [sssd[nss]] [sss_process_init] (0x0010): fatal error setting up backend connector (Mon Nov 19 12:49:36 2018) [sssd[nss]] [nss_process_init] (0x0010): sss_process_init() failed ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header (Mon Nov 19 12:49:36 2018) [sssd[ssh]] [sbus_client_init] (0x0020): check_file failed for [/usr/local/var/lib/sss/pipes/private/sbus-dp_atest.com]. (Mon Nov 19 12:49:36 2018) [sssd[ssh]] [sss_dp_init] (0x0010): Failed to connect to monitor services. (Mon Nov 19 12:49:36 2018) [sssd[ssh]] [sss_process_init] (0x0010): fatal error setting up backend connector (Mon Nov 19 12:49:36 2018) [sssd[ssh]] [ssh_process_init] (0x0010): sss_process_init() failed (Mon Nov 19 12:49:36 2018) [sssd[pam]] [sbus_client_init] (0x0020): check_file failed for [/usr/local/var/lib/sss/pipes/private/sbus-dp_atest.com]. (Mon Nov 19 12:49:36 2018) [sssd[pam]] [sss_dp_init] (0x0010): Failed to connect to monitor services. (Mon Nov 19 12:49:36 2018) [sssd[pam]] [sss_process_init] (0x0010): fatal error setting up backend connector (Mon Nov 19 12:49:36 2018) [sssd[pam]] [pam_process_init] (0x0010): sss_process_init() failed ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header (Mon Nov 19 12:49:37 2018) [sssd[be[atest.com]]] [dp_module_open_lib] (0x0010): Unable to load module [ad] with path [/usr/local/lib/sssd/libsss_ad.so]: /usr/local/lib/sssd/libsss_ldap_common.so: undefined symbol: ldap_tls_inplace (Mon Nov 19 12:49:37 2018) [sssd[be[atest.com]]] [dp_load_module] (0x0020): Unable to create DP module. (Mon Nov 19 12:49:37 2018) [sssd[be[atest.com]]] [dp_target_init] (0x0010): Unable to load module ad (Mon Nov 19 12:49:37 2018) [sssd[be[atest.com]]] [dp_load_targets] (0x0020): Unable to load target [id] [80]: Accessing a corrupted shared library. (Mon Nov 19 12:49:37 2018) [sssd[be[atest.com]]] [dp_init] (0x0020): Unable to initialize DP targets [1432158209]: Internal Error (Mon Nov 19 12:49:37 2018) [sssd[be[atest.com]]] [be_process_init] (0x0010): Unable to setup data provider [1432158209]: Internal Error (Mon Nov 19 12:49:37 2018) [sssd[be[atest.com]]] [main] (0x0010): Could not initialize backend [1432158209] (Mon Nov 19 12:49:37 2018) [sssd] [monitor_restart_service] (0x0010): Process [atest.com] definitely stopped! (Mon Nov 19 12:49:37 2018) [sssd] [monitor_quit] (0x0020): Terminating [nss][12122] (Mon Nov 19 12:49:37 2018) [sssd] [monitor_quit] (0x0020): Couldn't kill [nss][12122]: [No such process] (Mon Nov 19 12:49:37 2018) [sssd] [monitor_quit] (0x0020): Terminating [pam][12121] (Mon Nov 19 12:49:37 2018) [sssd] [monitor_quit] (0x0020): Couldn't kill [pam][12121]: [No such process] (Mon Nov 19 12:49:37 2018) [sssd] [monitor_quit] (0x0020): Terminating [ssh][12120] (Mon Nov 19 12:49:37 2018) [sssd] [monitor_quit] (0x0020): Couldn't kill [ssh][12120]: [No such process] (Mon Nov 19 12:49:37 2018) [sssd] [monitor_cleanup] (0x0010): Error removing pidfile! (2 [No such file or directory]) # # ldd /usr/local/lib/sssd/libsss_ldap_common.so linux-vdso.so.1 => (0x00007ffc5c391000) libsss_krb5_common.so => /usr/local/lib/sssd/libsss_krb5_common.so (0x00007f9f0364f000) libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007f9f0344b000) libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007f9f03163000) libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007f9f02f30000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007f9f02d2c000) libsss_idmap.so.0 => /usr/local/lib/libsss_idmap.so.0 (0x00007f9f02b25000) libsss_util.so => /usr/local/lib/sssd/libsss_util.so (0x00007f9f0289f000) librt.so.1 => /lib64/librt.so.1 (0x00007f9f02697000) libpopt.so.0 => /lib64/libpopt.so.0 (0x00007f9f0248d000) libldb.so.1 => /lib64/libldb.so.1 (0x00007f9f0225c000) libdbus-1.so.3 => /lib64/libdbus-1.so.3 (0x00007f9f0200c000) libpcre.so.1 => /lib64/libpcre.so.1 (0x00007f9f01daa000) libini_config.so.5 => /usr/local/lib/libini_config.so.5 (0x00007f9f01b91000) libpath_utils.so.1 => /usr/local/lib/libpath_utils.so.1 (0x00007f9f0198d000) libbasicobjects.so.0 => /usr/local/lib/libbasicobjects.so.0 (0x00007f9f0178a000) libref_array.so.1 => /usr/local/lib/libref_array.so.1 (0x00007f9f01587000) libcollection.so.4 => /usr/local/lib/libcollection.so.4 (0x00007f9f0137b000) libldap-2.4.so.2 => /usr/local/lib/libldap-2.4.so.2 (0x00007f9f01139000) liblber-2.4.so.2 => /usr/local/lib/liblber-2.4.so.2 (0x00007f9f00f2a000) libresolv.so.2 => /lib64/libresolv.so.2 (0x00007f9f00d11000) libsasl2.so.3 => /lib64/libsasl2.so.3 (0x00007f9f00af4000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f9f008cd000) libtdb.so.1 => /lib64/libtdb.so.1 (0x00007f9f006b6000) libsystemd.so.0 => /lib64/libsystemd.so.0 (0x00007f9f00485000) libglib-2.0.so.0 => /lib64/libglib-2.0.so.0 (0x00007f9f00171000) libsss_child.so => /usr/local/lib/sssd/libsss_child.so (0x00007f9efff6b000) libtevent.so.0 => /usr/local/lib/libtevent.so.0 (0x00007f9effd57000) libsss_cert.so => /usr/local/lib/sssd/libsss_cert.so (0x00007f9effb52000) libsss_crypt.so => /usr/local/lib/sssd/libsss_crypt.so (0x00007f9eff94b000) libdhash.so.1 => /usr/local/lib/libdhash.so.1 (0x00007f9eff747000) libsss_debug.so => /usr/local/lib/sssd/libsss_debug.so (0x00007f9eff543000) libsss_certmap.so.0 => /usr/local/lib/libsss_certmap.so.0 (0x00007f9eff334000) libtalloc.so.2 => /lib64/libtalloc.so.2 (0x00007f9eff124000) libssl3.so => /lib64/libssl3.so (0x00007f9efeed2000) libsmime3.so => /lib64/libsmime3.so (0x00007f9efecab000) libnss3.so => /lib64/libnss3.so (0x00007f9efe97e000) libnssutil3.so => /lib64/libnssutil3.so (0x00007f9efe74f000) libplds4.so => /lib64/libplds4.so (0x00007f9efe54b000) libplc4.so => /lib64/libplc4.so (0x00007f9efe346000) libnspr4.so => /lib64/libnspr4.so (0x00007f9efe108000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f9efdeec000) libdl.so.2 => /lib64/libdl.so.2 (0x00007f9efdce8000) libc.so.6 => /lib64/libc.so.6 (0x00007f9efd91b000) libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007f9efd70d000) /lib64/ld-linux-x86-64.so.2 (0x00007f9f03b0c000) libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007f9efd4d6000) libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007f9efd289000) libcap.so.2 => /lib64/libcap.so.2 (0x00007f9efd084000) libm.so.6 => /lib64/libm.so.6 (0x00007f9efcd82000) liblzma.so.5 => /lib64/liblzma.so.5 (0x00007f9efcb5c000) liblz4.so.1 => /lib64/liblz4.so.1 (0x00007f9efc947000) libgcrypt.so.11 => /lib64/libgcrypt.so.11 (0x00007f9efc6c6000) libgpg-error.so.0 => /lib64/libgpg-error.so.0 (0x00007f9efc4c1000) libdw.so.1 => /lib64/libdw.so.1 (0x00007f9efc27a000) libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007f9efc064000) libattr.so.1 => /lib64/libattr.so.1 (0x00007f9efbe5f000) libfreebl3.so => /lib64/libfreebl3.so (0x00007f9efbc5c000) libelf.so.1 => /lib64/libelf.so.1 (0x00007f9efba44000) libz.so.1 => /lib64/libz.so.1 (0x00007f9efb82e000) libbz2.so.1 => /lib64/libbz2.so.1 (0x00007f9efb61e000) # # ldd /usr/lib64/sssd/libsss_ldap_common.so linux-vdso.so.1 => (0x00007ffe6650c000) libsss_krb5_common.so => /usr/lib64/sssd/libsss_krb5_common.so (0x00007f4722c31000) libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007f4722a2d000) libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007f4722745000) libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007f4722512000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007f472230e000) libsss_idmap.so.0 => /lib64/libsss_idmap.so.0 (0x00007f4722107000) libsss_util.so => /usr/lib64/sssd/libsss_util.so (0x00007f4721e7c000) librt.so.1 => /lib64/librt.so.1 (0x00007f4721c74000) libpopt.so.0 => /lib64/libpopt.so.0 (0x00007f4721a6a000) libldb.so.1 => /lib64/libldb.so.1 (0x00007f4721839000) libdbus-1.so.3 => /lib64/libdbus-1.so.3 (0x00007f47215e9000) libpcre.so.1 => /lib64/libpcre.so.1 (0x00007f4721387000) libini_config.so.3 => /lib64/libini_config.so.3 (0x00007f472116d000) libbasicobjects.so.0 => /lib64/libbasicobjects.so.0 (0x00007f4720f6a000) libref_array.so.1 => /lib64/libref_array.so.1 (0x00007f4720d67000) libcollection.so.2 => /lib64/libcollection.so.2 (0x00007f4720b5a000) liblber-2.4.so.2 => /lib64/liblber-2.4.so.2 (0x00007f472094b000) libldap-2.4.so.2 => /lib64/libldap-2.4.so.2 (0x00007f47206f6000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f47204cf000) libtdb.so.1 => /lib64/libtdb.so.1 (0x00007f47202b8000) libglib-2.0.so.0 => /lib64/libglib-2.0.so.0 (0x00007f471ffa4000) libsss_child.so => /usr/lib64/sssd/libsss_child.so (0x00007f471fd9e000) libtevent.so.0 => /lib64/libtevent.so.0 (0x00007f471fb8e000) libsss_cert.so => /usr/lib64/sssd/libsss_cert.so (0x00007f471f989000) libsss_crypt.so => /usr/lib64/sssd/libsss_crypt.so (0x00007f471f782000) libdhash.so.1 => /lib64/libdhash.so.1 (0x00007f471f57e000) libsss_debug.so => /usr/lib64/sssd/libsss_debug.so (0x00007f471f379000) libsystemd.so.0 => /lib64/libsystemd.so.0 (0x00007f471f148000) libsss_certmap.so.0 => /lib64/libsss_certmap.so.0 (0x00007f471ef39000) libtalloc.so.2 => /lib64/libtalloc.so.2 (0x00007f471ed29000) libssl3.so => /lib64/libssl3.so (0x00007f471ead7000) libsmime3.so => /lib64/libsmime3.so (0x00007f471e8b0000) libnss3.so => /lib64/libnss3.so (0x00007f471e583000) libnssutil3.so => /lib64/libnssutil3.so (0x00007f471e354000) libplds4.so => /lib64/libplds4.so (0x00007f471e150000) libplc4.so => /lib64/libplc4.so (0x00007f471df4b000) libnspr4.so => /lib64/libnspr4.so (0x00007f471dd0d000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f471daf1000) libdl.so.2 => /lib64/libdl.so.2 (0x00007f471d8ed000) libc.so.6 => /lib64/libc.so.6 (0x00007f471d520000) libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007f471d312000) libresolv.so.2 => /lib64/libresolv.so.2 (0x00007f471d0f9000) /lib64/ld-linux-x86-64.so.2 (0x00007f47230f0000) libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007f471cec2000) libpath_utils.so.1 => /lib64/libpath_utils.so.1 (0x00007f471ccbe000) libsasl2.so.3 => /lib64/libsasl2.so.3 (0x00007f471caa1000) libssl.so.10 => /lib64/libssl.so.10 (0x00007f471c830000) libcrypto.so.10 => /lib64/libcrypto.so.10 (0x00007f471c3cf000) libcap.so.2 => /lib64/libcap.so.2 (0x00007f471c1ca000) libm.so.6 => /lib64/libm.so.6 (0x00007f471bec8000) liblzma.so.5 => /lib64/liblzma.so.5 (0x00007f471bca2000) liblz4.so.1 => /lib64/liblz4.so.1 (0x00007f471ba8d000) libgcrypt.so.11 => /lib64/libgcrypt.so.11 (0x00007f471b80c000) libgpg-error.so.0 => /lib64/libgpg-error.so.0 (0x00007f471b607000) libdw.so.1 => /lib64/libdw.so.1 (0x00007f471b3c0000) libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007f471b1aa000) libfreebl3.so => /lib64/libfreebl3.so (0x00007f471afa7000) libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007f471ad5a000) libz.so.1 => /lib64/libz.so.1 (0x00007f471ab44000) libattr.so.1 => /lib64/libattr.so.1 (0x00007f471a93f000) libelf.so.1 => /lib64/libelf.so.1 (0x00007f471a727000) Thanks Amit

2 1

PAM Authentication is returning failure when I am trying to use MFA
by MOHIT KUMAR 19 Nov '18

19 Nov '18

I have hooked one pam implementation module pam_custom.so which does multi factor authentication for a user I am trying to use pam_get_item for otp in my internal pam pam_custom.so module with msg.style type as PAM_TEXT_INFO. But it is failing as i am getting error message as Conversation style 3 not supported. This is breaking my existing functionality and I am not able to use sssd. Is it a limitation with sssd? Although normal username and password is authenticated successfully for which MFA is not there. sssd.conf --------------------[sssd] config_file_version = 2 services = nss, pam domains = proxy_proxy [nss] [pam] [domain/proxy_proxy] auth_provider = proxy id_provider = proxy proxy_lib_name = customnss proxy_pam_target = sssdproxycustom enumerate = false cache_credentials = false debug_level = 9 min_id = 500 sssdproxycustom -------------------------- auth required pam_custom.so account required pam_custom.so password required pam_custom.so session required pam_custom.so

2 7

[sssd PR#692][opened] pam_sss: return PAM_AUTHINFO_UNAVAIL if sc options are set
by sumit-bose 13 Nov '18

13 Nov '18

URL: https://github.com/SSSD/sssd/pull/692 Author: sumit-bose Title: #692: pam_sss: return PAM_AUTHINFO_UNAVAIL if sc options are set Action: opened PR body: """ If pam_sss is called for PAM_USER root it currently returns PAM_USER_UNKNOWN since SSSD does not handle root. To meet the documented behavior if one to the sc options is used pam_sss should return PAM_AUTHINFO_UNAVAIL in this case as well. Related to https://pagure.io/SSSD/sssd/issue/3876 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/692/head:pr692 git checkout pr692

2 4

[sssd PR#685][opened] Hi,
by jhrozek 07 Nov '18

07 Nov '18

URL: https://github.com/SSSD/sssd/pull/685 Author: jhrozek Title: #685: Hi, Action: opened PR body: """ this PR allows the administrator to only restart the KCM service in order to apply changes in sssd.conf's [kcm] section. I think this would be nice for admins, but the code feels already a bit hackish to me. I think we should keep on working on the static files with the read-only configuration, because then: - we could get rid of the special case to remove the section, because the section would always be there - we could remove different cases for adding/replacing sections - ..and of course the other things like config-show or running with no config file, just snippets I also didn't enable this functionality for the other responders. I don't know if it makes sense without more testing and in general I don't think there are too many users of socket activated responders except kcm. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/685/head:pr685 git checkout pr685

2 14

[sssd PR#691][opened] CI: Make the c-ares suppression file more relaxed to prevent failures on Debian
by jhrozek 07 Nov '18

07 Nov '18

URL: https://github.com/SSSD/sssd/pull/691 Author: jhrozek Title: #691: CI: Make the c-ares suppression file more relaxed to prevent failures on Debian Action: opened PR body: """ Prevents tests running under valgrind from failing with: ==9189== 2 bytes in 1 blocks are possibly lost in loss record 1 of 195 ==9189== at 0x48357BF: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==9189== by 0x60C7EF9: strdup (strdup.c:42) ==9189== by 0x6E6C0EE: ares_init_options (in /usr/lib/x86_64-linux-gnu/libcares.so.2.2.0) ==9189== by 0x5F96674: recreate_ares_channel (async_resolv.c:430) ==9189== by 0x5F967D6: resolv_init (async_resolv.c:471) ==9189== by 0x5F83147: be_res_init (data_provider_fo.c:884) ==9189== by 0x5F83147: be_res_init (data_provider_fo.c:865) ==9189== by 0x5F832B8: be_init_failover (data_provider_fo.c:70) ==9189== by 0x127876: test_ipa_server_create_trusts_setup (test_ipa_subdomains_server.c:311) ==9189== by 0x48541E2: ??? (in /usr/lib/x86_64-linux-gnu/libcmocka.so.0.5.1) ==9189== by 0x4854A16: _cmocka_run_group_tests (in /usr/lib/x86_64-linux-gnu/libcmocka.so.0.5.1) ==9189== by 0x1146CC: main (test_ipa_subdomains_server.c:999) The failure is expected as the tests fork but the child processes never clean up after themselves. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/691/head:pr691 git checkout pr691

2 6

[sssd PR#689][opened] IFP: Use subreq, not req when calling RefreshRules_recv
by jhrozek 05 Nov '18

05 Nov '18

URL: https://github.com/SSSD/sssd/pull/689 Author: jhrozek Title: #689: IFP: Use subreq, not req when calling RefreshRules_recv Action: opened PR body: """ This emits a failure when refreshing access control rules from e.g. sssctl access-report. Resolves: https://pagure.io/SSSD/sssd/issue/3874 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/689/head:pr689 git checkout pr689

2 5

[sssd PR#687][opened] sbus: allow access for sssd user
by pbrezina 05 Nov '18

05 Nov '18

URL: https://github.com/SSSD/sssd/pull/687 Author: pbrezina Title: #687: sbus: allow access for sssd user Action: opened PR body: """ D-Bus allows access for root and euid by default, however when running in non-root mode monitor continues to run as root but responsers as sssd user. Therefore monitor euid != sssd user and the connection is terminated. We must explicitly allow the connection for sssd user uid. Resolves: https://pagure.io/SSSD/sssd/issue/3871 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/687/head:pr687 git checkout pr687

2 5

[sssd PR#682][opened] DYNDNS: Drop support for legacy NSUPDATE
by thalman 05 Nov '18

05 Nov '18

URL: https://github.com/SSSD/sssd/pull/682 Author: thalman Title: #682: DYNDNS: Drop support for legacy NSUPDATE Action: opened PR body: """ We should drop support for legacy versions of NSUPDATE that doesn't support 'realm' option. The option 'realm' was added in BIND 9.8.0a1. Resolves: https://pagure.io/SSSD/sssd/issue/2817 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/682/head:pr682 git checkout pr682

2 5

[sssd PR#688][opened] Allow non-privileged sssd user connect to private dbus
by stanislavlevin 01 Nov '18

01 Nov '18

URL: https://github.com/SSSD/sssd/pull/688 Author: stanislavlevin Title: #688: Allow non-privileged sssd user connect to private dbus Action: opened PR body: """ During startup SSSD monitor launches the children and stands on a private dbus to waiting for a reply from them. But by default dbus auth rules connection is allowed if the client is root or has the same UID or anonymous is allowed. The forked children drop their root privileges in favor of non-privileged user (e.g sssd). In such a case there is no access to the monitor dbus connection to say: "Hey, i'm here.". Thus, sssd service becomes failed. This patch changes the default dbus authorization rules for a private connections to allow incomings from root or sssd user. Fixes: https://pagure.io/SSSD/sssd/issue/3871 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/688/head:pr688 git checkout pr688

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel November 2018