[sssd PR#585][opened] tcurl: do not log the payload
by fidencio
URL: https://github.com/SSSD/sssd/pull/585
Author: fidencio
Title: #585: tcurl: do not log the payload
Action: opened
PR body:
"""
We should never ever log the payload. In order to avoid doing this,
let's parse the data and replace the payload content for "...".
One example of the log before the patch is:
(Wed May 30 21:43:49 2018) [sssd[kcm]] [tcurl_write_data] (0x2000): ---> begin libcurl data
(Wed May 30 21:43:49 2018) [sssd[kcm]] [tcurl_write_data] (0x2000): {
"version": 1,
"kdc_offset": 0,
"principal": {
"type": 0,
"realm": "DOMAIN.TEST",
"components": [
"admin"
]
},
"creds": [
"uuid": "f87d2975-fc14-4cb8-8275-f0e474f82403",
"payload": "AAAAAAAAAAEAAAAPS05PV05IT1NUUy5URVNUAAAABWFkbWluAAAAAAAAAAMAAAAMWC1DQUNIRUNPTkY6AAAAFWtyYjVfY2NhY2hlX2NvbmZfZGF0YQAAAApmYXN0X2F2YWlsAAAAJmtyYnRndC9LTk9XTkhPU1RTLlRFU1RAS05PV05IT1NUUy5URVNUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADeWVzAAAAAA=="
}
]
}
(Wed May 30 21:43:49 2018) [sssd[kcm]] [tcurl_write_data] (0x2000): <--- end libcurl data
And after the patch:
(Wed May 30 21:45:19 2018) [sssd[kcm]] [tcurl_print_sanitized_data] (0x2000): ---> begin libcurl data
(Wed May 30 21:45:19 2018) [sssd[kcm]] [tcurl_print_sanitized_data] (0x2000): {
"version": 1,
"kdc_offset": 0,
"principal": {
"type": 0,
"realm": "DOMAIN.TEST",
"components": [
"admin"
]
},
"creds": [
{
"uuid": "727b7a15-eba7-4d44-aebe-dc6d1ecaf5f4",
"payload": "..."
}
]
}
(Wed May 30 21:45:19 2018) [sssd[kcm]] [tcurl_print_sanitized_data] (0x2000): <--- end libcurl data
Resolves:
https://pagure.io/SSSD/sssd/issue/3674
Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/585/head:pr585
git checkout pr585
5 years, 10 months
[sssd PR#582][opened] ipa: MPG realted fixes for lookups by GID
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/582
Author: sumit-bose
Title: #582: ipa: MPG realted fixes for lookups by GID
Action: opened
PR body:
"""
There are a few issues when a trusted AD user with an expired cache entry is
indirectly looked up be a GID lookup for the primary user private group (mpg).
One if the issues was that sysdb_search_group_by_gid() is not aware of MPGs in
contrast to sysdb_search_group_by_name(). Since sysdb_search_group_by_gid() is
used at other places as well I added sysdb_getgrgid_attrs() to replace
sysdb_search_group_by_gid() in get_object_from_cache() instead of modifying to
avoid regressions in the other callers. Maybe it would be worth a ticket to
check if MPG support can be added safely to sysdb_search_group_by_gid().
Related to https://pagure.io/SSSD/sssd/issue/3748
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/582/head:pr582
git checkout pr582
5 years, 10 months
RFC: 1.16.2 release notes
by Jakub Hrozek
Hi,
below are the release notes for 1.16.2. Please comment :-)
SSSD 1.16.2
===========
Highlights
----------
New Features
^^^^^^^^^^^^
* The smart card authentication, or in more general certificate authentication
code now supports OpenSSL in addition to previously supported NSS (#3489).
In addition, the SSH responder can now return public SSH keys derived from
the public keys stored in a X.509 certificate. Please refer to the
``ssh_use_certificate_keys`` option in the man pages.
* The files provider now supports mirroring multiple passwd or group
files. This enhancement can be used to use the SSSD files provider instead
of the nss_altfiles module
Notable bug fixes
^^^^^^^^^^^^^^^^^
* A memory handling issue in the ``nss_ex`` interface was fixed. This bug
would manifest in IPA environments with a trusted AD domain as a crash of
the ns-slapd process, because a ``ns-slapd`` plugin loads the ``nss_ex``
interface (#3715)
* Several fixes for the KCM deamon were merged (see #3687, #3671, #3633)
* The ``ad_site`` override is now honored in GPO code as well (#3646)
* Several potential crashes in the NSS responder's netgroup code were fixed
(#3679, #3731)
* The LDAP provider now supports group renaming (#2653)
* The GPO access control code no longer returns an error if one of the
relevant GPO rules contained no SIDs at all (#3680)
* A memory leak in the IPA provider related to resolving external AD
groups was fixed (#3719)
* Setups that used multiple domains where one of the domains had its ID
space limited using the ``min_id/max_id`` options did not resolve requests
by ID properly (#3728)
* Overriding IDs or names did not work correctly when the domain resolution
order was set as well (#3595)
* A version mismatch between certain newer Samba versions (e.g. those shipped
in RHEL-7.5) and the Winbind interface provided by SSSD was fixed. To further
prevent issues like this in the future, the correct interface is now detected
at build time (#3741)
* The files provider no longer returns a qualified name in case domain
resolution order is used (#3743)
* A race condition between evaluating IPA group memberships and AD group
memberships in setups with IPA-AD trusts that would have manifested as
randomly losing IPA group memberships assigned to an AD user was fixed
(#3744)
* Setting an SELinux login label was broken in setups where the domain
resolution order was used (#3740)
* SSSD start up issue on systems that use the libldb library with version
1.4.0 or newer was fixed.
Packaging Changes
-----------------
* Several new build requirements were added in order to support the OpenSSL
certificate authentication
Documentation Changes
---------------------
* The files provider gained two new configuration options ``passwd_files``
and ``group_files.`` These can be used to specify the additional files
to mirror.
* A new ``ssh_use_certificate_keys`` option toggles whether the SSH responder
would return public SSH keys derived from X.509 certificates.
* The ``local_negative_timeout`` option is now enabled by default. This
means that if SSSD fails to find a user in the configured domains,
but is then able to find the user with an NSS call such as getpwnam,
it would negatively cache the request for the duration of the
local_negative_timeout option.
5 years, 10 months