[sssd PR#958][opened] ldap_child: do not try PKINIT
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/958
Author: sumit-bose
Title: #958: ldap_child: do not try PKINIT
Action: opened
PR body:
"""
if the PKINIT plugin is installed and pkinit_identities is set in
/etc/krb5.conf libkrb5 will try to do PKINIT although ldap_child only
wants to authenticate with a keytab. As a result ldap_child might try to
access a Smartcard which is either not allowed at all or might cause
unexpected delays.
To avoid this the current patch sets pkinit_identities for LDAP child
explicitly to make the PKINIT plugin fail because if installed libkrb5
will always use it.
It turned out the setting pre-authentication options requires some
internal flags to be set and krb5_get_init_creds_opt_alloc() must be
used to initialize the options struct.
Related to https://pagure.io/SSSD/sssd/issue/4126
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/958/head:pr958
git checkout pr958
4 years, 4 months
[sssd PR#954][opened] nss: use real primary gid if the value is overriden
by pbrezina
URL: https://github.com/SSSD/sssd/pull/954
Author: pbrezina
Title: #954: nss: use real primary gid if the value is overriden
Action: opened
PR body:
"""
SYSDB_PRIMARY_GROUP_GIDNUM contains original primary group id from AD
because any possible override may not be known at the time of storing
the user.
Now we try to lookup group by its originalADgidNumber and if it is found
we will replace the original id with real primary group id.
Steps to reproduce:
1. Enroll SSSD to IPA domain with AD trust
2. Add ID override to Domain Users `ipa idoverridegroup-add 'Default Trust View' "Domain Users(a)ad.vm" --gid=40000000`
3. On IPA server: Remove cache for the overrides to apply immediately and restart SSSD `sssctl cache-remove --stop --start`
4. On IPA server: Resolve user `id Administrator(a)ad.vm`
There will be visible both new and old gids without the patch.
Resolves:
https://pagure.io/SSSD/sssd/issue/4124
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/954/head:pr954
git checkout pr954
4 years, 4 months
[sssd PR#955][opened] tests: fix race confition in files provider tests
by pbrezina
URL: https://github.com/SSSD/sssd/pull/955
Author: pbrezina
Title: #955: tests: fix race confition in files provider tests
Action: opened
PR body:
"""
Lets give files provider more time to load changes from files to avoid
race condition failures. The files provider tests works like this:
1. File is changed
2. inotify callback is triggered in SSSD
3. Cache is updated
4. Assertions are done
This sleep is supposed to eliminated race condition between step 1 and 2
so tests do not continue before inotify callback had a chance to kick in.
One second was not enough in some slow virtual environments where the
test non-deterministicly failed (SSSD is starting, doing some initial tasks,
so it is possible that inotify callback is delayed a little bit).
Three seconds is a hopefully safe random value.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/955/head:pr955
git checkout pr955
4 years, 4 months