sssd-devel August 2019

sssd-devel@lists.fedorahosted.org

9 participants
59 discussions

[sssd PR#546][opened] TESTS: Re-add tests for `kdestroy -A`
by fidencio 23 Sep '19

23 Sep '19

URL: https://github.com/SSSD/sssd/pull/546 Author: fidencio Title: #546: TESTS: Re-add tests for `kdestroy -A` Action: opened PR body: """ This reverts commit 89726be5a05493b7af312f0be9ac5ecb6f1822e1 and also do a few modifications on it in order to ensure we don't have any regression on https://pagure.io/SSSD/sssd/issue/3413 As this patch depends on a krb5 patch applied to the distros we run our internal CI on, I've opened a bug report providing patches for Fedora[0] and Debian[1]. [0]: https://bugzilla.redhat.com/show_bug.cgi?id=1561917 [1]: https://salsa.debian.org/debian/krb5/merge_requests/1 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/546/head:pr546 git checkout pr546

4 27

[sssd PR#824][opened] CONFDB: Files domain if activated without .conf
by thalman 20 Sep '19

20 Sep '19

URL: https://github.com/SSSD/sssd/pull/824 Author: thalman Title: #824: CONFDB: Files domain if activated without .conf Action: opened PR body: """ Implicit files domain gets activated when no sssd.conf present and sssd is started. This does not respect --disable-files-domain configure option Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1713352 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/824/head:pr824 git checkout pr824

5 28

[sssd PR#832][opened] SPECFILE: Add 'make' as build dependency
by mzidek-rh 20 Sep '19

20 Sep '19

URL: https://github.com/SSSD/sssd/pull/832 Author: mzidek-rh Title: #832: SPECFILE: Add 'make' as build dependency Action: opened PR body: """ This caused some of my scripts fail when building SSSD after fetching build dependencies from srpm because make was not installed. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/832/head:pr832 git checkout pr832

3 10

[sssd PR#863][opened] ci: add Debian 10
by pbrezina 17 Sep '19

17 Sep '19

URL: https://github.com/SSSD/sssd/pull/863 Author: pbrezina Title: #863: ci: add Debian 10 Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/863/head:pr863 git checkout pr863

3 35

[sssd PR#560][opened] NSS: close files after mmap
by ChrisKowalczyk 17 Sep '19

17 Sep '19

URL: https://github.com/SSSD/sssd/pull/560 Author: ChrisKowalczyk Title: #560: NSS: close files after mmap Action: opened PR body: """ The files in MC cache folder were initialized by SSSD on startup, and mapped by using mmap function. due to the fact that they weren't closed afterwards, their File descriptors were still marker alive but marked as 'Deleted'. This was noticed by a customer of SUSE, see more details here: https://bugzilla.suse.com/show_bug.cgi?id=1080156 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/560/head:pr560 git checkout pr560

6 12

Announcing SSSD 2.2.1
by Michal Židek 16 Sep '19

16 Sep '19

== SSSD 2.2.1 === The SSSD team is proud to announce the release of version 2.2.1 of the System Security Services Daemon. The tarball can be downloaded from: https://releases.pagure.org/SSSD/sssd/ RPM packages will be made available for Fedora shortly. Feedback -------- Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users Highlights ---------- New features ^^^^^^^^^^^^ * New options were added which allow sssd-kcm to handle bigger data. See manual pages for ``max_ccaches``, ``max_uid_caches`` and ``max_ccache_size``. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. Notable bug fixes ^^^^^^^^^^^^^^^^^ * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps:// * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when ``default_domain_suffix`` was used with ``id_provider = files`` and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with ``auth_provider = proxy`` that prevented logins Packaging Changes ----------------- None Documentation Changes --------------------- A new option ``dns_resolver_server_timeout`` was added A new option ``max_ccaches`` was added A new option ``max_uid_ccaches`` was added A new option ``max_ccache_size`` was added A new option ``ocsp_dgst`` was added Tickets Fixed ------------- * `2878 <https://pagure.io/SSSD/sssd/issue/2878>`_ - sssd failover does not work on connecting to non-responsive ldaps:// server * `3217 <https://pagure.io/SSSD/sssd/issue/3217>`_ - Conflicting default timeout values * `3386 <https://pagure.io/SSSD/sssd/issue/3386>`_ - sssd-kcm cannot handle big tickets * `3489 <https://pagure.io/SSSD/sssd/issue/3489>`_ - p11_child should work wit openssl1.0+ * `3685 <https://pagure.io/SSSD/sssd/issue/3685>`_ - KCM: Default to a new back end that would write to the secrets database directly * `3833 <https://pagure.io/SSSD/sssd/issue/3833>`_ - port to pcre2 * `3894 <https://pagure.io/SSSD/sssd/issue/3894>`_ - multihost tests: ldb-tools is needed for multihost tests * `3905 <https://pagure.io/SSSD/sssd/issue/3905>`_ - SSSD doesn't clear cache entries for IDs below min_id. * `4012 <https://pagure.io/SSSD/sssd/issue/4012>`_ - SSSD is not refreshing cached user data for the ipa sub-domain in a IPA/AD trust * `4026 <https://pagure.io/SSSD/sssd/issue/4026>`_ - EVP_PKEY_new_raw_private_key() was only added in OpenSSL 1.1.1 * `4028 <https://pagure.io/SSSD/sssd/issue/4028>`_ - sssd-kcm calls sssd-genconf which triggers nscd warning * `4037 <https://pagure.io/SSSD/sssd/issue/4037>`_ - Logins fail after upgrade to 2.2.0 * `4040 <https://pagure.io/SSSD/sssd/issue/4040>`_ - Reasonable to Restart sssd on crashes? * `4046 <https://pagure.io/SSSD/sssd/issue/4046>`_ - sudo: incorrect usn value for openldap * `4047 <https://pagure.io/SSSD/sssd/issue/4047>`_ - dyndns_update = True is no longer not enough to get the IP address of the machine updated in IPA upon sssd.service startup * `4050 <https://pagure.io/SSSD/sssd/issue/4050>`_ - nss_cmd_endservent resets the wrong index * `4052 <https://pagure.io/SSSD/sssd/issue/4052>`_ - sssd config option "default_domain_suffix" should not cause the files domain entries to be qualified * `3931 <https://pagure.io/SSSD/sssd/issue/3931>`_ - proxy provider is not working with enumerate=true when trying to fetch all groups * `4043 <https://pagure.io/SSSD/sssd/issue/4043>`_ - Typo in systemd.m4 prevents detection of systemd.pc * `3978 <https://pagure.io/SSSD/sssd/issue/3978>`_ - UPN negative cache does not use values from 'filter_users' config option * `4032 <https://pagure.io/SSSD/sssd/issue/4032>`_ - p11_child::do_ocsp() function implementation is not FIPS140 compliant * `4039 <https://pagure.io/SSSD/sssd/issue/4039>`_ - p11_child::sign_data() function implementation is not FIPS140 compliant * `4056 <https://pagure.io/SSSD/sssd/issue/4056>`_ - permission denied on logs when running sssd as non-root user * `4024 <https://pagure.io/SSSD/sssd/issue/4024>`_ - Non FIPS140 compliant usage of PRNG * `2854 <https://pagure.io/SSSD/sssd/issue/2854>`_ - FAIL test-find-uid * `3962 <https://pagure.io/SSSD/sssd/issue/3962>`_ - Problem with tests/cmocka/test_dyndns.c * `4022 <https://pagure.io/SSSD/sssd/issue/4022>`_ - utils: sss_hmac_sha1() function implementation is not FIPS140 compliant * `4024 <https://pagure.io/SSSD/sssd/issue/4024>`_ - Non FIPS140 compliant usage of PRNG * `4026 <https://pagure.io/SSSD/sssd/issue/4026>`_ - EVP_PKEY_new_raw_private_key() was only added in OpenSSL 1.1.1 Detailed changelog ------------------ Alex Rodin (1): tests/cmocka/test_dyndns.c: Switching from tevent_loop_once() to tevent_loop_wait() Alexey Tikhonov (14): util/crypto/libcrypto: changed sss_hmac_sha1() util/crypto/libcrypto: changed sss_hmac_sha1() util/secrets: memory leaks are fixed util/crypto/nss/nss_nite: params sanitization crypto/libcrypto/crypto_nite: HMAC calculation changed util/find_uid.c: fixed debug message util/find_uid.c: fixed race condition bug util/crypto: removed erroneous declaration util/crypto/sss_crypto.c: cleanup of includes util/crypto: generate_csprng_buffer() changed util/crypto: added sss_rand() crypto/libcrypto/crypto_nite.c: memory leak fixed FIPS140 compliant usage of PRNG crypto/nss: some nss_ctx_init() params made const Jakub Hrozek (34): Updating the version for the 2.2.1 release TESTS: Install expect to drive password-change modifications TESTS: Also add LDAP password when creating users TESTS: Test changing LDAP password with extended operation and modification TEST: Add a multihost test for not returning / for an empty home dir MONITOR: Don't check for the nscd socket while regenerating configuration SYSDB: Add sysdb_search_with_ts_attr BE: search with sysdb_search_with_ts_attr BE: Enable refresh for multiple domains BE: Make be_refresh_ctx_init set up the periodical task, too BE/LDAP: Call be_refresh_ctx_init() in the provider libraries, not in back end BE: Pass in attribute to look up with instead of hardcoding SYSDB_NAME BE: Change be_refresh_ctx_init to return errno and set be_ctx->refresh_ctx BE/LDAP: Split out a helper function from sdap_refresh for later reuse BE: Pass in filter_type when creating the refresh account request BE: Send refresh requests in batches BE: Extend be_ptask_create() with control when to schedule next run after success BE: Schedule the refresh interval from the finish time of the last run AD: Implement background refresh for AD domains IPA: Implement background refresh for IPA domains BE/IPA/AD/LDAP: Add inigroups refresh support BE/IPA/AD/LDAP: Initialize the refresh callback from a list to reduce logic duplication IPA/AD/SDAP/BE: Generate refresh callbacks with a macro MAN: Amend the documentation for the background refresh DP/SYSDB: Move the code to set initgrExpireTimestamp to a reusable function IPA/AD/LDAP: Increase the initgrExpireTimestamp after finishing refresh request MAN: Get rid of sssd-secrets reference MAN: Document that it is enough to systemctl restart sssd-kcm.service lately SECRETS: Use different option names from secrets and KCM for quota options SECRETS: Don't limit the global number of ccaches KCM: Pass confdb context to the ccache db initialization KCM: Configurable quotas for the secdb ccache back end TESTS: Add tests for the configurable quotas Don't qualify users from files domain when default_domain_suffix is set Jakub Jelen (1): pam_sss: Add missing colon to the PIN prompt Lukas Slebodnik (1): PROXY: Return data in output parameter if everything is OK Michal Židek (2): TESTS: ldb-tools and sssd-tools are required for multihost tests Update the translations for the 2.2.1 release Niranjan M.R (1): TESTS: Test kvno correctly displays vesion numbers of principals Pavel Březina (11): ci: disable timeout ci: switch to new tooling and remove 'Read trusted files' stage ci: rebase pull request on the target branch ci: print node on which the test is being run sudo: use proper datetime for default modifyTimestamp value systemd: add Restart=on-failure to sssd.service man: fix description of dns_resolver_op_timeout man: fix description of dns_resolver_timeout failover: add dns_resolver_server_timeout option failover: change default timeouts config: add dns_resolver_op_timeout to option list Sam Morris (1): build: fix detection of systemd.pc Samuel Cabrero (1): nss: Fix command 'endservent' resetting wrong struct member Sumit Bose (10): negcache: add fq-usernames of know domains to all UPN neg-caches p11_child: prefer better digest function if card supports it p11_child: fix a memory leak and other memory mangement issues pam: make sure p11_child.log has the right permissions ssh: make sure p11_child.log has the right permissions BE: make sure child log files have the right permissions utils: remove unused prototype (cert_to_ssh_key) utils: move parse_cert_verify_opts() into separate file p11_child: make OCSP digest configurable pam: fix loop in Smartcard authentication Tomas Halman (9): MAN: ldap_user_home_directory default missing pcre: port to pcre2 CACHE: SSSD doesn't clear cache entries LDAP: failover does not work on non-responsive ldaps CONFDB: Files domain if activated without .conf TESTS: adapt tests to enabled default files domain BE: Introduce flag for be_ptask_create BE: Convert be_ptask params to flags DYNDNS: dyndns_update is not enough Yuri Chornoivan (1): Fix minor typos in docs

3 4

[sssd PR#868][opened] ifp: let cache_req parse input name so it can fallback to upn search
by pbrezina 03 Sep '19

03 Sep '19

URL: https://github.com/SSSD/sssd/pull/868 Author: pbrezina Title: #868: ifp: let cache_req parse input name so it can fallback to upn search Action: opened PR body: """ UPN search expects that the input name is in its fully qualified form. However, GetUserAttr calls cache_req with unqualified username therefore it never fallback to UPN search. Steps to reproduce: 1. Configure SSSD against AD 2. Set UPN to `TestUserUPN(a)ad.vm` 3. Run: ``` dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserAttr string:TestUserUPN@ad.vm array:string:name Error sbus.Error.NotFound: No such file or directory ``` Resolves: https://pagure.io/SSSD/sssd/issue/4065 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/868/head:pr868 git checkout pr868

2 10

[sssd PR#810][opened] TESTS: ability to run unit tests under valgrind (sssd-1-16 backport)
by alexey-tikhonov 02 Sep '19

02 Sep '19

URL: https://github.com/SSSD/sssd/pull/810 Author: alexey-tikhonov Title: #810: TESTS: ability to run unit tests under valgrind (sssd-1-16 backport) Action: opened PR body: """ Adds ability to run unit tests under valgrind with handy makefile targets. Enabled with --enable-valgrind passed to ./configure script. Reviewed-by: Pavel Březina <pbrezina(a)redhat.com> (cherry picked from commit e812151511f7b09908efb3c8ebed294a26efebc7) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/810/head:pr810 git checkout pr810

2 11

[sssd PR#876][opened] KCM: Fill in pre-created ccache instead of creating a new one in kcm_initialize
by jhrozek 30 Aug '19

30 Aug '19

URL: https://github.com/SSSD/sssd/pull/876 Author: jhrozek Title: #876: KCM: Fill in pre-created ccache instead of creating a new one in kcm_initialize Action: opened PR body: """ This is a continuation of https://pagure.io/SSSD/sssd/issue/3873 Some programs like openssh use the following sequence of calls: cc = krb5_cc_new_unique krb5_cc_switch(cc) krb5_cc_initialize(cc, principal) Since switch changes the default ccache, we create a 'dummy' ccache with krb5_cc_switch() and then the initialize call just fills in the details. The 'fills in the details' part was not properly implemented with the previous patchset, the previous patchset worked only for password-based authentication where nothing is cached initially. For delegation, we watch to make sure that the credentials that are being delegated are filled in to the new ccache and the new ccache is used as the default. What initialize did previously was that if there was a default ccache already (in this case the dummy one created with krb5_cc_switch()), it would treat it as obsolete, create a new one and switch to it. Then the client (openssh) would store the credential in a ccache that wouldn't be the default anymore, leaving the default ccache empty. Afterwards, klist or similar would see that the default ccache is empty and just pick the first non-empty one as a fallback, which would often be one of the previous expired ones. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/876/head:pr876 git checkout pr876

3 12

[sssd PR#807][opened] sudo: do not update last usn value on rules refresh
by pbrezina 30 Aug '19

30 Aug '19

URL: https://github.com/SSSD/sssd/pull/807 Author: pbrezina Title: #807: sudo: do not update last usn value on rules refresh Action: opened PR body: """ Refreshing specific rules may produce a higher usn value that the one that is already remembered if the rules changed on the server. However, there may be another rule that is not being refreshed which usn value is higher then the current value but lower then the value of some of the refreshed rules. If the highest usn value is updated in this case, the rule would not be found be smart refresh. Thus we must not update the usn value during rules refresh. Resolves: https://pagure.io/SSSD/sssd/issue/3996 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/807/head:pr807 git checkout pr807

2 11

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2019