October 2019 - sssd-devel - Fedora mailing-lists

[sssd PR#175][opened] Add module for starting services
by lslebodn 22 Nov '21

22 Nov '21

URL: https://github.com/SSSD/sssd/pull/175 Author: lslebodn Title: #175: Add module for starting services Action: opened PR body: """ This is a WIP version of reducing code duplication in our cwrap integration tests. I am still not sure whether we should also reuse function `create_sssd_fixture`. And if yes; then probably in different nodule then `services` And comments are welcome. BTW I wrote patches few weeks ago; therefore new tests are not converted. I am just sending patches to get some feedback. Site effect of this patches is that tests are cca 20% faster (IIRC) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/175/head:pr175 git checkout pr175

5 5

[sssd PR#844][opened] sssd-ad and gpo_child: GPO apply fixes during reading fails
by mastersin 03 Aug '21

03 Aug '21

URL: https://github.com/SSSD/sssd/pull/844 Author: mastersin Title: #844: sssd-ad and gpo_child: GPO apply fixes during reading fails Action: opened PR body: """ Ignore AD GPO errors: - if SecEdit/GptTmpl.inf is missing or - if reading sysvol_gpt_version fails and cached_gpt_version already exists """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/844/head:pr844 git checkout pr844

7 16

[sssd PR#616][opened] become_user: add supplementary groups so ad provider can access keytab
by asheplyakov 28 Jan '21

28 Jan '21

URL: https://github.com/SSSD/sssd/pull/616 Author: asheplyakov Title: #616: become_user: add supplementary groups so ad provider can access keytab Action: opened PR body: """ For security reasons one might want to run providers as a non-privileged user (say, _sssd). However some providers (in particular ad) might need an access to restricted (non world-readable) files (for instance, /etc/krb5.keytab). One of the possible ways to solve the problem is to - add a special group (for instance, _keytab) - set the owner:group of the file in question to root:_keytab - set the permissions of the file in question to 640 - make the _sssd user a member of the _keytab group For this to work become_user should assign supplementary groups, which is what this patch does. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/616/head:pr616 git checkout pr616

5 13

[sssd PR#269][opened] Add support for ActiveDirectory's logonHours restrictions
by NWilson 03 Sep '20

03 Sep '20

URL: https://github.com/SSSD/sssd/pull/269 Author: NWilson Title: #269: Add support for ActiveDirectory's logonHours restrictions Action: opened PR body: """ This is a straightforward patch for denying access to a user when the user is not permitted to access their account due to logonHours restrictions. This matches the default behaviour for domain-joined Windows machines. When outside the logonHours, all types of authentication are denied (password/Kerberos/certificate) - so it is appropriate to put this check inside the PAM "account" rules. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/269/head:pr269 git checkout pr269

9 30

[sssd PR#837][opened] p11_child: make OCSP digest configurable
by sumit-bose 18 Aug '20

18 Aug '20

URL: https://github.com/SSSD/sssd/pull/837 Author: sumit-bose Title: #837: p11_child: make OCSP digest configurable Action: opened PR body: """ Currently sha1 is used to create the certid for an OCSP request. Since sha1 is not recommend for new applications anymore and not FIPS compliant this patch changes the default to sha256 and makes the digest function configurable as well. Related to https://pagure.io/SSSD/sssd/issue/4032 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/837/head:pr837 git checkout pr837

6 36

[sssd PR#578][opened] proxy: proxy_child hardening
by amitkumar50 10 Aug '20

10 Aug '20

URL: https://github.com/SSSD/sssd/pull/578 Author: amitkumar50 Title: #578: proxy: proxy_child hardening Action: opened PR body: """ proxy_child will call chdir("/"), umask(022) and reset the environment with clearenv(). The --domain argument to be sanitized. Resolves: https://pagure.io/SSSD/sssd/issue/2689 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/578/head:pr578 git checkout pr578

5 14

[sssd PR#693][opened] SYSDB: Fall back to the MPG result of getgrgid search if the non-MPG search for override doesn't match anything
by jhrozek 24 Mar '20

24 Mar '20

URL: https://github.com/SSSD/sssd/pull/693 Author: jhrozek Title: #693: SYSDB: Fall back to the MPG result of getgrgid search if the non-MPG search for override doesn't match anything Action: opened PR body: """ Commit cf4f5e031ecbdfba0b55a4f69a06175a2e718e67 changed the logic of getgrgid (and getpwnam, so far this patch only touches getgrgid) in the sense that if looking up a GID in a MPG domain, the code checks if the GID was overriden and if yes, it mandates that the overriden GID resolves to a group by falling back to a non-MPG search. This breaks the following use-case: $ ipa idoverrideuser-add --uid=13133 --gidnumber=13133 'Default Trust View' user@domain Most importantly, I'm on the fence about whether the current behaviour is a bug or not. In general, I would have expected that if a primary GID is overriden, you more or less break the MPG model, and then it's fair from SSSD to make sure the GID number resolves to an entry. But apparently our users were relying on the old behaviour where you can set the primary GID with an override and then still resolve the primary group by ID to the user entry. So the patch in the PR is just a quick hack which sort of falls back to using the user entry as the group if the overriden GID doesn't resolve to anything. Should we support this use-case at all? Should we maybe limit it to cases where the UID and GID are the same? """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/693/head:pr693 git checkout pr693

3 8

[sssd PR#596][opened] [CONFDB]:[RFE] Add "enabled" option to domain section
by amitkumar50 24 Mar '20

24 Mar '20

URL: https://github.com/SSSD/sssd/pull/596 Author: amitkumar50 Title: #596: [CONFDB]:[RFE] Add "enabled" option to domain section Action: opened PR body: """ Upstream Request: Instead of enabling domains using the "domains" option in [sssd] section we could have [domain/*] option "enabled". This would allow admins to configure and enable domain in the same snippet file. This Fix would be submitted in 2 patches: Patch-1(This Patch): - Introduces 'enabled' option in domain section - Introduces 'CONFDB_DOMAIN_ENABLED' variable to retrieve enabled value from confdb - Code to call start_service() routine only for domains having enabled=1 Patch-2(Upcoming): - Would remove 'domains' option from sssd section. - Would remove corresponding code to parse 'domains' option - Providing a check that atlest One domain have enabled option set. Resolves: https://pagure.io/SSSD/sssd/issue/3735 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/596/head:pr596 git checkout pr596

7 12

[sssd PR#911][opened] Update pam_sss.8.xml
by alexal 03 Feb '20

03 Feb '20

URL: https://github.com/SSSD/sssd/pull/911 Author: alexal Title: #911: Update pam_sss.8.xml Action: opened PR body: """ pam_sss: Added return values on a man page Resolves: https://pagure.io/SSSD/sssd/issue/3672 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/911/head:pr911 git checkout pr911

6 31

[sssd PR#905][opened] WIP: Don't ignore host entries in Group Policy security filters
by dmulder 14 Jan '20

14 Jan '20

URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: WIP: Don't ignore host entries in Group Policy security filters Action: opened PR body: """ I'm posting my code here to hopefully receive some feedback while I work on host entries in gpo security filters. Any feedback/criticism is welcome! Finished: Validate against host sid in ad_gpo_evaluate_dacl(), also test. In progress: Host sid retrieval via sdap. TODO: Caching host sid in sysdb. Test sdap search for host sid. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/905/head:pr905 git checkout pr905

6 45

[sssd PR#132][opened] Add "Wants=" to sssd unit and avoid PAC responder to be always running
by fidencio 02 Jan '20

02 Jan '20

URL: https://github.com/SSSD/sssd/pull/132 Author: fidencio Title: #132: Add "Wants=" to sssd unit and avoid PAC responder to be always running Action: opened PR body: """ The first patch changes the current logic of having the services' sockets disabled by default as it adds a "Wants=" to the sssd unit file, making all the services' sockets enabled by the moment sssd service is enabled. The second patch takes advantage of the first patch and avoids running PAC responder in case its socket is active, leaving the service to be socket-activated when needed. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/132/head:pr132 git checkout pr132

3 40

[sssd PR#646][opened] proxy: access provider directly not through be_ctx
by pbrezina 18 Dec '19

18 Dec '19

URL: https://github.com/SSSD/sssd/pull/646 Author: pbrezina Title: #646: proxy: access provider directly not through be_ctx Action: opened PR body: """ See commit message for details. Resolves: https://pagure.io/SSSD/sssd/issue/3812 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/646/head:pr646 git checkout pr646

3 12

[sssd PR#915][opened] Fix krb5-related debug
by alexey-tikhonov 21 Nov '19

21 Nov '19

URL: https://github.com/SSSD/sssd/pull/915 Author: alexey-tikhonov Title: #915: Fix krb5-related debug Action: opened PR body: """ This PR is continuation of cleanup work done in #883. `KEYTAB_CLEAN_NAME` macro was replaced with `sss_printable_keytab_name()` function and a number of issues related with usage of `krb5_get_error_message()` were fixed. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/915/head:pr915 git checkout pr915

3 20

[sssd PR#891][opened] IPA: Utilize new protocol in IPA extdom plugin
by thalman 14 Nov '19

14 Nov '19

URL: https://github.com/SSSD/sssd/pull/891 Author: thalman Title: #891: IPA: Utilize new protocol in IPA extdom plugin Action: opened PR body: """ To allow @-sign in group name IPA extdom plugin had to be extended. Now the protocol distinguishes between resolving username and groupname. Until now name resolution was performed as it is a user and in case of not finding any user, group search was performed. But the SSSD knows the type of object, that is resolved. This change will improve the performance of the system. The @-sign issue is completely fixed on IPA side and will work for older clients too. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1383520 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/891/head:pr891 git checkout pr891

3 23

[sssd PR#912][opened] Created a new sssd-ldap-attributes.5 man page
by alexal 14 Nov '19

14 Nov '19

URL: https://github.com/SSSD/sssd/pull/912 Author: alexal Title: #912: Created a new sssd-ldap-attributes.5 man page Action: opened PR body: """ man: Created a new sssd-ldap-attributes.5 man page I've moved all SSSD LDAP mapping attributes from sssd-ldap.5 to a new sssd-ldap-attributes.5 man page Resolves: https://pagure.io/SSSD/sssd/issue/689 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/912/head:pr912 git checkout pr912

5 30

[sssd PR#919][opened] ci: improvements for on-demand builds
by pbrezina 14 Nov '19

14 Nov '19

URL: https://github.com/SSSD/sssd/pull/919 Author: pbrezina Title: #919: ci: improvements for on-demand builds Action: opened PR body: """ 1. Logs are now correctly archived in Jenkins. 2. Internal `sssd-ci` tool now allows to issue build only for specific systems (`sssd-ci build -s debian10 -s fedora-rawhide`) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/919/head:pr919 git checkout pr919

2 30

[sssd PR#916][opened] Fix one coverity issue
by alexey-tikhonov 07 Nov '19

07 Nov '19

URL: https://github.com/SSSD/sssd/pull/916 Author: alexey-tikhonov Title: #916: Fix one coverity issue Action: opened PR body: """ ...and reduce code duplication a little bit. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/916/head:pr916 git checkout pr916

3 19

ipa: kerberos locator plugin and AD sites - sssd 1.13.x
by Ziomek, M. (Maciej) 05 Nov '19

05 Nov '19

Hello everyone, I would kindly ask whether there are any plans / possibilities to port features introduced in sssd 1.16.3 back to sssd 1.13.x (LTM) ? These features are: 1. Since 1.16.3 the kdcinfo files are generated automatically also for trusted domains in setups that use id_provider=ad and IPA masters in a trust relationship with an AD domain. 2. SSSD Kerberos locator plugin can now process multiple address if SSSD generates more than one. 3. On IPA clients the AD DCs or the AD site which should be used to authenticate users can now be listed in a subdomain section. These three mentioned features help us a lot but at the same time we are suffering from their lack in 1.13.x ( LTM ). We are still using systems where version 1.13.x is the only one officially available. Have a nice day, Regards Maciej Ziomek ING Business Shared Services B.V. z siedzibą w Amsterdamie, Holandia, VAT PL 526-319-58-54, działająca w Polsce w formie oddziału, pod firmą ING Business Shared Services B.V. spółka z ograniczoną odpowiedzialnością Oddział w Polsce z siedzibą w Katowicach, ul. Konduktorska 35, 40-155 Katowice, NIP: 2050005130, wpisana do rejestru przedsiębiorców Krajowego Rejestru Sądowego prowadzonego przez Sąd Rejonowy Katowice-Wschód w Katowicach, VIII Wydział Gospodarczy Krajowego Rejestru Sądowego pod numerem KRS 0000702305.

2 1

[sssd PR#841][opened] DEBUG: Add debug to display ldapsearch requests
by thalman 05 Nov '19

05 Nov '19

URL: https://github.com/SSSD/sssd/pull/841 Author: thalman Title: #841: DEBUG: Add debug to display ldapsearch requests Action: opened PR body: """ The existing debug output from SSSD is quite helpful in this respect, but it would be better if a small enhancement were made so that for a specific debug level SSSD would print out all the details of the LDAP search it is doing, ie the LDAP server, the base dn, the scope, filter and attributes requested. Server address is already in the log nowadays so this change writes missing search scope. Also received attributes are logged with SSSDBG_TRACE_LIBS debug level. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1542137 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/841/head:pr841 git checkout pr841

4 37

[sssd PR#922][opened] Fix timing to save errno
by miztake 05 Nov '19

05 Nov '19

URL: https://github.com/SSSD/sssd/pull/922 Author: miztake Title: #922: Fix timing to save errno Action: opened PR body: """ The timing to save some errnos is after DEBUG output, not immediately after the system call. Fix to save errno before DEBUG output so that errno is not overwritten by DEBUG output processing. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/922/head:pr922 git checkout pr922

4 17

[sssd PR#558][opened] WIP: Add a test for sss_nss_getgrouplist_timeout and fix invalidating the initgroups cache
by jhrozek 04 Nov '19

04 Nov '19

URL: https://github.com/SSSD/sssd/pull/558 Author: jhrozek Title: #558: WIP: Add a test for sss_nss_getgrouplist_timeout and fix invalidating the initgroups cache Action: opened PR body: """ This is a WIP on adding tests for the sss_nss_ex interface. I covered only the sss_nss_getgrouplist_timeout function so far. I'm submitting the PR already in this state to get some feedback if this coverage is enough and the other functions can be covered similarly or if there is some issue with this approach. Also, I found a bug in invalidating the initgroups memory cache, that's the first of the two patches. Here I'm really not sure if the fix is even how the issue should be fixed, so I just hacked something up, even without allocation checks etc. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/558/head:pr558 git checkout pr558

3 10

[sssd PR#914][opened] bash_rc: Build with systemtap
by mzidek-rh 04 Nov '19

04 Nov '19

URL: https://github.com/SSSD/sssd/pull/914 Author: mzidek-rh Title: #914: bash_rc: Build with systemtap Action: opened PR body: """ We build with --enable-systemtap in Fedora and RHEL by default. We should do the same in the helper script in contrib/fedora/bashrc_sssd. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/914/head:pr914 git checkout pr914

3 9

[sssd PR#920][opened] Add comment to workaround for libsemanage issue
by elkoniu 04 Nov '19

04 Nov '19

URL: https://github.com/SSSD/sssd/pull/920 Author: elkoniu Title: #920: Add comment to workaround for libsemanage issue Action: opened PR body: """ libsemanage < 2.6 use to not set right file mask in our usecase. It has been fixed by manual umask() call but is no longer needed. Fix will be keept as a precaution for future libsemanage versions. Related bug: https://bugzilla.redhat.com/show_bug.cgi?id=1186422 Related issue: https://pagure.io/SSSD/sssd/issue/3583 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/920/head:pr920 git checkout pr920

5 14

[sssd PR#921][opened] util/server.c: fix handling when error occurs in waitpid()
by miztake 04 Nov '19

04 Nov '19

URL: https://github.com/SSSD/sssd/pull/921 Author: miztake Title: #921: util/server.c: fix handling when error occurs in waitpid() Action: opened PR body: """ -1 is returned if an error occurs in waitpid(). Fixed inappropriate error handling. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/921/head:pr921 git checkout pr921

5 12

[sssd PR#923][opened] PRNG usage amended
by alexey-tikhonov 04 Nov '19

04 Nov '19

URL: https://github.com/SSSD/sssd/pull/923 Author: alexey-tikhonov Title: #923: PRNG usage amended Action: opened PR body: """ This PR is intended to address https://pagure.io/SSSD/sssd/issue/4024#comment-603526 sss_rand() was: - moved out of crypto lib, - non security relevant purpose was emphasized - attempt to "use RAND_bytes() if available" was removed to simplify things and make return value compatible with rand() MMAP_CACHE: use CSPRNG to init hash table seed """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/923/head:pr923 git checkout pr923

3 9

[sssd PR#909][opened] sssctl/sssctl_domains.c: null dereference fixed
by alexey-tikhonov 31 Oct '19

31 Oct '19

URL: https://github.com/SSSD/sssd/pull/909 Author: alexey-tikhonov Title: #909: sssctl/sssctl_domains.c: null dereference fixed Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/4102 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/909/head:pr909 git checkout pr909

3 23

[sssd PR#913][opened] Updated test_pam_responder.py
by alexal 31 Oct '19

31 Oct '19

URL: https://github.com/SSSD/sssd/pull/913 Author: alexal Title: #913: Updated test_pam_responder.py Action: opened PR body: """ Integration tests/CI: Updated test_pam_responder.py and removed libnss3-dev from Debian dependency list - Functions create_nssdb_fixture and create_nssdb_no_cert_fixture inside test_pam_responder.py file will be called only if environment variable HAVE_NSS is defined - Since CI build for Debian is using OpenSSL this improvement allowed to drop libnss3-dev from Debian dependency list in contrib/ci/deps.sh Resolves: https://pagure.io/SSSD/sssd/issue/3914 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/913/head:pr913 git checkout pr913

5 42

[sssd PR#917][opened] sss_client/idmap/common_ex.c: fix sss_nss_timedlock() to return errno
by miztake 31 Oct '19

31 Oct '19

URL: https://github.com/SSSD/sssd/pull/917 Author: miztake Title: #917: sss_client/idmap/common_ex.c: fix sss_nss_timedlock() to return errno Action: opened PR body: """ sss_nss_timedloc() should return errno, but returns -1 if clock_gettime(2) fails. Fix sss_nss_timedlock() to return errno if clock_gettime(2) fails. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/917/head:pr917 git checkout pr917

4 10

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by scabrero 31 Oct '19

31 Oct '19

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. scabrero commented: """ Hi @sumit-bose, I fixed the PEP8 errors, the remaining CI failure seems unrelated to this PR. """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-548274238

1 0

[sssd PR#457][opened] ipa: Removal of umask(0) in selinux_child
by amitkumar50 30 Oct '19

30 Oct '19

URL: https://github.com/SSSD/sssd/pull/457 Author: amitkumar50 Title: #457: ipa: Removal of umask(0) in selinux_child Action: opened PR body: """ Code for calling umask(0) was added to address bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=1186422. Now this bugzilla is fixed, removing the workaround. Resolves: https://pagure.io/SSSD/sssd/issue/3583 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/457/head:pr457 git checkout pr457

11 27

[sssd PR#908][opened] ifp: implement connection-wide access check
by pbrezina 29 Oct '19

29 Oct '19

URL: https://github.com/SSSD/sssd/pull/908 Author: pbrezina Title: #908: ifp: implement connection-wide access check Action: opened PR body: """ Currently only a small subset of infopipe methods performed access check. This change makes sure that we do this check global for everything. Steps to reproduce: 1. Call an infopipe method as a user not-listed in [ifp] allowed_uids 2. Without the patch the access is granted E.g. ``` $ dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.FindByName string:user-1 ``` Resolves: https://pagure.io/SSSD/sssd/issue/4105 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/908/head:pr908 git checkout pr908

2 6

New in the project & problem
by Iker Pedrosa 29 Oct '19

29 Oct '19

Hi team, I'm new to the project and I have been looking at the documentation that is available in pagure on how to start contributing to it. So far I have been able to configure, compile, install and launch the unit tests but I'm stuck with the integration tests. Whenever I execute the command to launch them (make intgcheck) I get the following error: You must have the header file http_parser.h installed to build sssd with secrets responder. If you want to build sssd without secret responder then specify --without-secrets when running configure. The problem is that I don't know if I should deactivate secrets responder. Which would be the impact if I disable it? I've been reading the man page and it states that this is a way of not exposing sensitive key material, but it's not clear for me if I would have this type of data in an integration test. Moreover, how do I apply this configuration? Am i right if I suppose that it should be applied when configuring the compilation (reconfig --without-secrets && chmake)?

2 2

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by sumit-bose 28 Oct '19

28 Oct '19

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. sumit-bose commented: """ Hi @scabrero, thank you very much for this substantial contribution. May I asked you to fix the Python pep8 issues identified by the CI test so that the other CI tests can be run? For your convenience I add them here as well: ``` Start: Mon Oct 28 15:41:33 UTC 2019 + find . -path ./src/config -prune -o -name '*.py' -exec pep8 --ignore=E121,E123,E126,E226,E24,E704,W503,W504,W605,E722 '{}' + ./src/tests/intg/ds_openldap.py:278:80: E501 line too long (84 > 79 characters) ./src/tests/intg/test_resolver.py:37:1: E265 block comment should start with '# ' ./src/tests/intg/test_resolver.py:41:1: E302 expected 2 blank lines, found 1 ./src/tests/intg/test_resolver.py:77:80: E501 line too long (84 > 79 characters) ./src/tests/intg/test_resolver.py:208:32: E251 unexpected spaces around keyword / parameter equals ./src/tests/intg/test_resolver.py:208:34: E251 unexpected spaces around keyword / parameter equals ./src/tests/intg/test_resolver.py:213:32: E251 unexpected spaces around keyword / parameter equals ./src/tests/intg/test_resolver.py:213:34: E251 unexpected spaces around keyword / parameter equals ./src/tests/intg/sssd_hosts.py:31:1: E302 expected 2 blank lines, found 1 ./src/tests/intg/sssd_hosts.py:38:1: E302 expected 2 blank lines, found 1 ./src/tests/intg/sssd_nss.py:32:1: E302 expected 2 blank lines, found 1 ./src/tests/intg/sssd_nss.py:51:1: E302 expected 2 blank lines, found 1 ./src/tests/intg/sssd_nss.py:60:1: E302 expected 2 blank lines, found 1 ./src/tests/intg/sssd_nss.py:70:1: E302 expected 2 blank lines, found 1 ./src/tests/intg/ldap_ent.py:150:26: E201 whitespace after '(' ./src/tests/intg/ldap_ent.py:150:57: E202 whitespace before ')' End: Mon Oct 28 15:41:36 UTC 2019 ``` bye, Sumit """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-547020549

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by centos-ci 28 Oct '19

28 Oct '19

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. centos-ci commented: """ Can one of the admins verify this patch? """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-547004870

1 0

[sssd PR#854][opened] LDAP: Do not require START_TLS for loopback connections
by scabrero 28 Oct '19

28 Oct '19

URL: https://github.com/SSSD/sssd/pull/854 Author: scabrero Title: #854: LDAP: Do not require START_TLS for loopback connections Action: opened PR body: """ If the ldap uri is resolved to a loopback address then do not require START_TLS. Signed-off-by: Samuel Cabrero <scabrero(a)suse.de> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/854/head:pr854 git checkout pr854

5 10

[sssd PR#907][opened] Update README.md
by alexal 23 Oct '19

23 Oct '19

URL: https://github.com/SSSD/sssd/pull/907 Author: alexal Title: #907: Update README.md Action: opened PR body: """ A few changes in README.md file: 1. Google+ is no longer available for consumer (personal) and brand accounts. I've removed the link to Google+ page as that link is no longer available. 2. I've added a link to a COPYING file. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/907/head:pr907 git checkout pr907

5 18

[sssd PR#910][opened] Added PRINT macro in the sssctl tool
by alexal 23 Oct '19

23 Oct '19

URL: https://github.com/SSSD/sssd/pull/910 Author: alexal Title: #910: Added PRINT macro in the sssctl tool Action: opened PR body: """ sssctl: Added PRINT macro in the sssctl tool As a continuation of PR #902 I've added a few more PRINT macros to the sssctl tool. Resolves: https://pagure.io/SSSD/sssd/issue/3078 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/910/head:pr910 git checkout pr910

5 13

[sssd PR#390][opened] NSS: Add option to disable memcache
by mzidek-rh 21 Oct '19

21 Oct '19

URL: https://github.com/SSSD/sssd/pull/390 Author: mzidek-rh Title: #390: NSS: Add option to disable memcache Action: opened PR body: """ Added option use_memcache to centrally disable memcache for all clients without the need to specify SSS_NSS_USE_MEMCACHE=NO environment variable. Resolves: https://pagure.io/SSSD/sssd/issue/3496 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/390/head:pr390 git checkout pr390

8 106

[sssd PR#851][opened] Update __init__.py.in
by alexal 21 Oct '19

21 Oct '19

URL: https://github.com/SSSD/sssd/pull/851 Author: alexal Title: #851: Update __init__.py.in Action: opened PR body: """ COMPONENT: SSSDConfig The default value for sudo_provider, auth_provider, and autofs_provider will be the value of id_provider, if those options weren't set in the configuration file Resolves: https://pagure.io/SSSD/sssd/issue/3995 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/851/head:pr851 git checkout pr851

6 60

[sssd PR#883][opened] Minor fixes to util/sss_krb5
by alexey-tikhonov 21 Oct '19

21 Oct '19

URL: https://github.com/SSSD/sssd/pull/883 Author: alexey-tikhonov Title: #883: Minor fixes to util/sss_krb5 Action: opened PR body: """ Main purpose of this patches is to resolve: https://pagure.io/SSSD/sssd/issue/4081 It also fixes one coverity issue: ``` Error: DEADCODE (CWE-561): sssd-2.2.3/src/util/sss_krb5.c:375: cond_const: Condition "(kt_err = krb5_kt_next_entry(ctx, keytab, &entry, &cursor)) == 0", taking true branch. Now the value of "kt_err" is equal to 0. sssd-2.2.3/src/util/sss_krb5.c:406: const: At condition "kt_err != 0", the value of "kt_err" must be equal to 0. sssd-2.2.3/src/util/sss_krb5.c:406: dead_error_condition: The condition "kt_err != 0" cannot be true. sssd-2.2.3/src/util/sss_krb5.c:406: dead_error_line: Execution cannot reach the expression "kt_err != -1765328202L" inside this statement: "if (kt_err != 0 && kt_err !...". # 404| # 405| /* check if we got any errors from krb5_kt_next_entry */ # 406|-> if (kt_err != 0 && kt_err != KRB5_KT_END) { # 407| DEBUG(SSSDBG_CRIT_FAILURE, "Error while reading keytab.\n"); # 408| goto done; ``` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/883/head:pr883 git checkout pr883

4 44

[sssd PR#899][opened] sss_ptr_hash: pass new hash_entry_t to custom delete callback
by pbrezina 21 Oct '19

21 Oct '19

URL: https://github.com/SSSD/sssd/pull/899 Author: pbrezina Title: #899: sss_ptr_hash: pass new hash_entry_t to custom delete callback Action: opened PR body: """ Setting `item->ptr = ptr` actually overwrote the original hash entry stored in the hash. If this entry is looked up in the delete callback it contains the overwritten value instead of the original. Steps to reproduce: ``` 1. Run sssd 2. Call e.g. `id user-1` 3. Terminate SSSD ``` You will see these `Invalid data type` messages. (Snippet from domain log) ``` [dp_client_destructor] (0x0400): Removed IFP client [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged on /org/freedesktop/DBus [sbus_senders_delete] (0x2000): Removing identity of sender [sssd.ifp] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success [sbus_senders_delete] (0x2000): Removing identity of sender [:1.5] [sbus_issue_request_done] (0x0400): org.freedesktop.DBus.NameOwnerChanged: Success [sbus_dispatch_reconnect] (0x0400): Connection lost. Terminating active requests. [sss_ptr_hash_check_type] (0x0020): Invalid data type detected. Expected [struct sss_ptr_hash_value], got [struct sbus_connection]. [sss_ptr_hash_check_type] (0x0020): Invalid data type detected. Expected [struct sss_ptr_hash_value], got [struct sbus_connection]. ``` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/899/head:pr899 git checkout pr899

2 18

[sssd PR#903][opened] Gpo man page updates
by mzidek-rh 21 Oct '19

21 Oct '19

URL: https://github.com/SSSD/sssd/pull/903 Author: mzidek-rh Title: #903: Gpo man page updates Action: opened PR body: """ Hi, this PR contains two patches. One is from another PR (already acked by me and does not need a review, I just have it here to avoid conflicts and want to finally push it. It is from our probably oldest PR, that is still not merged https://pagure.io/SSSD/sssd/pull-request/3320) I will try to merge the patches from that PR together with some other GPO patches, but this PR is just about the man page changes. The second patch adds a note to the man page that current version of GPO does not support built-in groups in AD. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/903/head:pr903 git checkout pr903

3 11

[sssd PR#904][opened] KCM: Set kdc_offset to zero initially
by jhrozek 21 Oct '19

21 Oct '19

URL: https://github.com/SSSD/sssd/pull/904 Author: jhrozek Title: #904: KCM: Set kdc_offset to zero initially Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/4100 KCM assumed that the client library would always set the KDC offset, but that's not always the case, especially when using multiple krb contexts from the client application: https://bugzilla.redhat.com/show_bug.cgi?id=1757224#c64 Heimdal also creates ccaches with zero kdc_offset: https://github.com/heimdal/heimdal/commit/9f58896af958ae5e6e3ebde8c48dad4ed… so we should do the same.. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/904/head:pr904 git checkout pr904

4 11

[sssd PR#906][opened] memcache: Stop using the word fastcache for memcache
by mzidek-rh 21 Oct '19

21 Oct '19

URL: https://github.com/SSSD/sssd/pull/906 Author: mzidek-rh Title: #906: memcache: Stop using the word fastcache for memcache Action: opened PR body: """ This patch removes the word fastche from our codebase. We do not reffer to the fast in-memory mmaped cache consistantly. Sometimes we call it fastcache, sometimes memcache and sometimes mmap cache. While we can not get rid of memcache, because it is rooted in some config option names and in the documentation and mmap cache is used a lot internally in our code, so getting rid of that would require a lot of code changes, we can easyly get rid of the 'fastcache' word because it is only in a handful of places. I think we should really stick to calling it memcache in the documentation and debug messages and ideally also in code comments to avoid confusion. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/906/head:pr906 git checkout pr906

3 16

[sssd PR#858][opened] ldap: do not store empty attribute with ldap_rfc2307_fallback_to_local_users = true
by pbrezina 17 Oct '19

17 Oct '19

URL: https://github.com/SSSD/sssd/pull/858 Author: pbrezina Title: #858: ldap: do not store empty attribute with ldap_rfc2307_fallback_to_local_users = true Action: opened PR body: """ This caused an error when saving local user as a fallback: ``` [sdap_save_user] (0x0400): Storing info for user testuser(a)ldap.vm [sysdb_ldb_msg_difference] (0x2000): Added attr [gecos] to entry [name=testuser(a)ldap.vm,cn=users,cn=ldap.vm,cn=sysdb] [sysdb_set_cache_entry_attr] (0x0080): ldb_modify failed: [Invalid attribute syntax](21)[Element gecos has empty attribute in ldb message (name=testuser(a)ldap.vm,cn=users,cn=ldap.vm,cn=sysdb) [sysdb_set_cache_entry_attr] (0x0040): Error: 22 (Invalid argument) [sysdb_set_entry_attr] (0x0080): Cannot set attrs for name=testuser(a)ldap.vm,cn=users,cn=ldap.vm,cn=sysdb, 22 [Invalid argument] [sysdb_store_user] (0x0040): Cache update failed: 22 [sysdb_store_user] (0x0400): Error: 22 (Invalid argument) [sdap_save_user] (0x0020): Failed to save user [testuser(a)ldap.vm] ``` Steps to reproduce: 1. create local user `testuser` 2. add it to LDAP group memberUid 3. set `passwd: sss files`, `group: sss files` (sss must be before files) 4. set enable_files_domain = false and ldap_rfc2307_fallback_to_local_users = true 5. run sssd 6. id testuser -> it does not contain the LDAP group without the patch Resolves: https://pagure.io/SSSD/sssd/issue/4013 Note: this fix only the case when the nsswitch order is `sss files` but no files domain is available. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/858/head:pr858 git checkout pr858

2 14

[sssd PR#864][opened] Monitor resolv.conf symlink
by scabrero 17 Oct '19

17 Oct '19

URL: https://github.com/SSSD/sssd/pull/864 Author: scabrero Title: #864: Monitor resolv.conf symlink Action: opened PR body: """ If resolv.conf is a symlink and sssd starts before getting an address from dhcp the data provider will remain forever offline, as the watched parent directory is the directory containing the symlink. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/864/head:pr864 git checkout pr864

4 18

[sssd PR#898][opened] util/server: amended close_low_fds()
by alexey-tikhonov 17 Oct '19

17 Oct '19

URL: https://github.com/SSSD/sssd/pull/898 Author: alexey-tikhonov Title: #898: util/server: amended close_low_fds() Action: opened PR body: """ Rewrote close_low_fds() to use freopen() as it fits better here and some flags passed to open() previously didn't make a sense. Also fixed a number of identical Coverity issues: ``` Error: RESOURCE_LEAK (CWE-772): sssd-2.2.3/src/util/server.c:58: open_fn: Returning handle opened by "open". [Note: The source code implementation of the function has been overridden by a user model.] sssd-2.2.3/src/util/server.c:58: var_assign: Assigning: "fd" = handle returned from "open("/dev/null", 1, 0)". sssd-2.2.3/src/util/server.c:56: overwrite_var: Overwriting handle "fd" in "fd = open("/dev/null", 2, 0)" leaks the handle. 54| library routines writing to stdout etc. won't cause havoc */ 55| for (i = 0; i < 3; i++) { 56|-> fd = open("/dev/null", O_RDWR, 0); 57| if (fd < 0) 58| fd = open("/dev/null", O_WRONLY, 0); ``` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/898/head:pr898 git checkout pr898

3 10

[sssd PR#900][opened] SSS_CLIENT: got rid of using PRNG
by alexey-tikhonov 17 Oct '19

17 Oct '19

URL: https://github.com/SSSD/sssd/pull/900 Author: alexey-tikhonov Title: #900: SSS_CLIENT: got rid of using PRNG Action: opened PR body: """ 1) no reason to expect "thundering herd issue" 2) randomization as it was done (strictly 1 or 2 secs) would not help much anyway 3) usage of PRNG might break app that depends on deterministic PRNG behaviour Resolves: https://pagure.io/SSSD/sssd/issue/4094 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/900/head:pr900 git checkout pr900

3 10

[sssd PR#901][opened] Update sss_ssh.c
by alexal 17 Oct '19

17 Oct '19

URL: https://github.com/SSSD/sssd/pull/901 Author: alexal Title: #901: Update sss_ssh.c Action: opened PR body: """ SSH: Adds a message to the syslog if an SSH key is malformed If an SSH key contains trailing whitespace (or newlines), it will be considered as malformed by sss_ssh_format_pubkey() function. With the current version the only way to detect that problem is to enable --debug option for /usr/bin/sss_ssh_authorizedkeys utility. I'm adding an additional message to the syslog which will help to determine such problems without enabling debug. Resolves: https://pagure.io/SSSD/sssd/issue/3864 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/901/head:pr901 git checkout pr901

5 12

[sssd PR#902][opened] Added ERROR and PRINT macros to the tools
by alexal 17 Oct '19

17 Oct '19

URL: https://github.com/SSSD/sssd/pull/902 Author: alexal Title: #902: Added ERROR and PRINT macros to the tools Action: opened PR body: """ Tools: Added ERROR and PRINT macros to the tools Replaced functions printf and fprintf with corresponding PRINT and ERROR macro in the tools. Resolves: https://pagure.io/SSSD/sssd/issue/3078 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/902/head:pr902 git checkout pr902

5 24

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel October 2019