September 2019 - sssd-devel - Fedora Mailing-Lists

[sssd PR#875][-Ready to push] 1.16: autofs: do not enumerate when only single entry is requested

by pbrezina

URL: https://github.com/SSSD/sssd/pull/875 Title: #875: 1.16: autofs: do not enumerate when only single entry is requested Label: -Ready to push

4 years, 7 months

1
0
0 / 0

[sssd PR#875][-Accepted] 1.16: autofs: do not enumerate when only single entry is requested

by pbrezina

URL: https://github.com/SSSD/sssd/pull/875 Title: #875: 1.16: autofs: do not enumerate when only single entry is requested Label: -Accepted

4 years, 7 months

1
0
0 / 0

[sssd PR#875][+Pushed] 1.16: autofs: do not enumerate when only single entry is requested

by pbrezina

URL: https://github.com/SSSD/sssd/pull/875 Title: #875: 1.16: autofs: do not enumerate when only single entry is requested Label: +Pushed

4 years, 7 months

1
0
0 / 0

[sssd PR#875][comment] 1.16: autofs: do not enumerate when only single entry is requested

by pbrezina

URL: https://github.com/SSSD/sssd/pull/875 Title: #875: 1.16: autofs: do not enumerate when only single entry is requested pbrezina commented: """ * `sssd-1-16` * 9131b90f08e69a4d71c6d1524e3b8929d947b7c7 - sss_cache: invalidate also autofs entries * 58f3d546954d7c2298a0b57865f7d5ad51f69aec - sysdb: invalidate also autofs entries * ac712654f07be9e9c05156c89af54eac483d75d6 - autofs: always refresh auto.master * 3e04a812772191e2c0e4f4be70584990a7235cbe - autofs: allow to run only setent without enumeration in test tool * 2e452583728b2596aba65a96d25f7f8312765538 - ldap: implement autofs get entry * fcb6f55c09d1d6f6487d771ac829e02565393c56 - ldap: implement autofs get map * bd15a135c1b73996208557f36718410a7a6b20b2 - ldap: rename sdap_autofs_get_map to sdap_autofs_enumerate * fb9a42d952924b5ff084a103d43b6192c4ff0c1f - ldap: add base_dn to sdap_search_bases * 0b780a0d50e4ebb279b3ba36869d8e62c3c38044 - dp: add additional autofs methods * ca1ee9933b9cdb474cef46bde127eaf85f1861d1 - dp: replace autofs handler with enumerate method * 61a7bf4d2a93f99a5c94da4367d350f8038bb935 - autofs: use cache_req to obtain map in setent * 27d2dcfb76625bffe34d2fe185d7677db3f372d6 - autofs: use cache_req to obtain single entry in getentrybyname * b0043a95f86b240d0beb551ef4e9ff9a4be99995 - autofs: convert code to cache_req * 6fe479a210adb53d419ca75512dec3a584296289 - cache_req: add autofs entry by name plugin * e683556dc6671a6047de8bb970d32360d5aa59dc - cache_req: add autofs map by name plugin * 01b7dc92180cf80080f657b80f72cec20eafa0e7 - cache_req: add autofs map entries plugin * 4665606235605b1d5d1ec7462257aaa86aa3d7b1 - autofs: move data provider functions to responder common code * 49b5baf0e6ef978d971427160677c2c95e89c418 - sysdb: add sysdb_del_autofsentry_by_key * efe44597a3f1181fe60771c0efbfcab54585dc42 - sysdb: store original dn in autofs map * 11ffb775d725172a4247a9826cadecb872c7d0dc - sysdb: store enumeration expiration time in autofs map * c366050029983969cbaf3795f05115893f7617e9 - sysdb: add enumerationExpireTimestamp * 57e33404e0f98d9358e8c31eb2c2f764ee380b13 - sysdb: add sysdb_get_autofsentry * ccf14f490985b96bd6f5871b55c1398024e34af0 - sysdb: add expiration time to autofs entries * 49ad0b9b84c88d52694c8e9f5582dc49d0f87e2a - autofs: fix typo in test tool * 00926ab450074741e2a2b5c699c440e6309e3bff - sss_ptr_hash: keep value pointer when destroying spy * 79560617790781384dda2751701b523aed6b5cb4 - sss_ptr_hash: add sss_ptr_get_value to make it useful in delete callbacks """ See the full comment at https://github.com/SSSD/sssd/pull/875#issuecomment-531686427

4 years, 7 months

1
0
0 / 0

[sssd PR#866][+Ready to push] autofs: do not enumerate when only single entry is requested

by pbrezina

URL: https://github.com/SSSD/sssd/pull/866 Title: #866: autofs: do not enumerate when only single entry is requested Label: +Ready to push

4 years, 7 months

1
0
0 / 0

[sssd PR#875][+Ready to push] 1.16: autofs: do not enumerate when only single entry is requested

by pbrezina

URL: https://github.com/SSSD/sssd/pull/875 Title: #875: 1.16: autofs: do not enumerate when only single entry is requested Label: +Ready to push

4 years, 7 months

1
0
0 / 0

Announcing SSSD 2.2.1

by Michal Židek

== SSSD 2.2.1 === The SSSD team is proud to announce the release of version 2.2.1 of the System Security Services Daemon. The tarball can be downloaded from: https://releases.pagure.org/SSSD/sssd/ RPM packages will be made available for Fedora shortly. Feedback -------- Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users Highlights ---------- New features ^^^^^^^^^^^^ * New options were added which allow sssd-kcm to handle bigger data. See manual pages for ``max_ccaches``, ``max_uid_caches`` and ``max_ccache_size``. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. Notable bug fixes ^^^^^^^^^^^^^^^^^ * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps:// * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when ``default_domain_suffix`` was used with ``id_provider = files`` and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with ``auth_provider = proxy`` that prevented logins Packaging Changes ----------------- None Documentation Changes --------------------- A new option ``dns_resolver_server_timeout`` was added A new option ``max_ccaches`` was added A new option ``max_uid_ccaches`` was added A new option ``max_ccache_size`` was added A new option ``ocsp_dgst`` was added Tickets Fixed ------------- * `2878 <https://pagure.io/SSSD/sssd/issue/2878>`_ - sssd failover does not work on connecting to non-responsive ldaps:// server * `3217 <https://pagure.io/SSSD/sssd/issue/3217>`_ - Conflicting default timeout values * `3386 <https://pagure.io/SSSD/sssd/issue/3386>`_ - sssd-kcm cannot handle big tickets * `3489 <https://pagure.io/SSSD/sssd/issue/3489>`_ - p11_child should work wit openssl1.0+ * `3685 <https://pagure.io/SSSD/sssd/issue/3685>`_ - KCM: Default to a new back end that would write to the secrets database directly * `3833 <https://pagure.io/SSSD/sssd/issue/3833>`_ - port to pcre2 * `3894 <https://pagure.io/SSSD/sssd/issue/3894>`_ - multihost tests: ldb-tools is needed for multihost tests * `3905 <https://pagure.io/SSSD/sssd/issue/3905>`_ - SSSD doesn't clear cache entries for IDs below min_id. * `4012 <https://pagure.io/SSSD/sssd/issue/4012>`_ - SSSD is not refreshing cached user data for the ipa sub-domain in a IPA/AD trust * `4026 <https://pagure.io/SSSD/sssd/issue/4026>`_ - EVP_PKEY_new_raw_private_key() was only added in OpenSSL 1.1.1 * `4028 <https://pagure.io/SSSD/sssd/issue/4028>`_ - sssd-kcm calls sssd-genconf which triggers nscd warning * `4037 <https://pagure.io/SSSD/sssd/issue/4037>`_ - Logins fail after upgrade to 2.2.0 * `4040 <https://pagure.io/SSSD/sssd/issue/4040>`_ - Reasonable to Restart sssd on crashes? * `4046 <https://pagure.io/SSSD/sssd/issue/4046>`_ - sudo: incorrect usn value for openldap * `4047 <https://pagure.io/SSSD/sssd/issue/4047>`_ - dyndns_update = True is no longer not enough to get the IP address of the machine updated in IPA upon sssd.service startup * `4050 <https://pagure.io/SSSD/sssd/issue/4050>`_ - nss_cmd_endservent resets the wrong index * `4052 <https://pagure.io/SSSD/sssd/issue/4052>`_ - sssd config option "default_domain_suffix" should not cause the files domain entries to be qualified * `3931 <https://pagure.io/SSSD/sssd/issue/3931>`_ - proxy provider is not working with enumerate=true when trying to fetch all groups * `4043 <https://pagure.io/SSSD/sssd/issue/4043>`_ - Typo in systemd.m4 prevents detection of systemd.pc * `3978 <https://pagure.io/SSSD/sssd/issue/3978>`_ - UPN negative cache does not use values from 'filter_users' config option * `4032 <https://pagure.io/SSSD/sssd/issue/4032>`_ - p11_child::do_ocsp() function implementation is not FIPS140 compliant * `4039 <https://pagure.io/SSSD/sssd/issue/4039>`_ - p11_child::sign_data() function implementation is not FIPS140 compliant * `4056 <https://pagure.io/SSSD/sssd/issue/4056>`_ - permission denied on logs when running sssd as non-root user * `4024 <https://pagure.io/SSSD/sssd/issue/4024>`_ - Non FIPS140 compliant usage of PRNG * `2854 <https://pagure.io/SSSD/sssd/issue/2854>`_ - FAIL test-find-uid * `3962 <https://pagure.io/SSSD/sssd/issue/3962>`_ - Problem with tests/cmocka/test_dyndns.c * `4022 <https://pagure.io/SSSD/sssd/issue/4022>`_ - utils: sss_hmac_sha1() function implementation is not FIPS140 compliant * `4024 <https://pagure.io/SSSD/sssd/issue/4024>`_ - Non FIPS140 compliant usage of PRNG * `4026 <https://pagure.io/SSSD/sssd/issue/4026>`_ - EVP_PKEY_new_raw_private_key() was only added in OpenSSL 1.1.1 Detailed changelog ------------------ Alex Rodin (1): tests/cmocka/test_dyndns.c: Switching from tevent_loop_once() to tevent_loop_wait() Alexey Tikhonov (14): util/crypto/libcrypto: changed sss_hmac_sha1() util/crypto/libcrypto: changed sss_hmac_sha1() util/secrets: memory leaks are fixed util/crypto/nss/nss_nite: params sanitization crypto/libcrypto/crypto_nite: HMAC calculation changed util/find_uid.c: fixed debug message util/find_uid.c: fixed race condition bug util/crypto: removed erroneous declaration util/crypto/sss_crypto.c: cleanup of includes util/crypto: generate_csprng_buffer() changed util/crypto: added sss_rand() crypto/libcrypto/crypto_nite.c: memory leak fixed FIPS140 compliant usage of PRNG crypto/nss: some nss_ctx_init() params made const Jakub Hrozek (34): Updating the version for the 2.2.1 release TESTS: Install expect to drive password-change modifications TESTS: Also add LDAP password when creating users TESTS: Test changing LDAP password with extended operation and modification TEST: Add a multihost test for not returning / for an empty home dir MONITOR: Don't check for the nscd socket while regenerating configuration SYSDB: Add sysdb_search_with_ts_attr BE: search with sysdb_search_with_ts_attr BE: Enable refresh for multiple domains BE: Make be_refresh_ctx_init set up the periodical task, too BE/LDAP: Call be_refresh_ctx_init() in the provider libraries, not in back end BE: Pass in attribute to look up with instead of hardcoding SYSDB_NAME BE: Change be_refresh_ctx_init to return errno and set be_ctx->refresh_ctx BE/LDAP: Split out a helper function from sdap_refresh for later reuse BE: Pass in filter_type when creating the refresh account request BE: Send refresh requests in batches BE: Extend be_ptask_create() with control when to schedule next run after success BE: Schedule the refresh interval from the finish time of the last run AD: Implement background refresh for AD domains IPA: Implement background refresh for IPA domains BE/IPA/AD/LDAP: Add inigroups refresh support BE/IPA/AD/LDAP: Initialize the refresh callback from a list to reduce logic duplication IPA/AD/SDAP/BE: Generate refresh callbacks with a macro MAN: Amend the documentation for the background refresh DP/SYSDB: Move the code to set initgrExpireTimestamp to a reusable function IPA/AD/LDAP: Increase the initgrExpireTimestamp after finishing refresh request MAN: Get rid of sssd-secrets reference MAN: Document that it is enough to systemctl restart sssd-kcm.service lately SECRETS: Use different option names from secrets and KCM for quota options SECRETS: Don't limit the global number of ccaches KCM: Pass confdb context to the ccache db initialization KCM: Configurable quotas for the secdb ccache back end TESTS: Add tests for the configurable quotas Don't qualify users from files domain when default_domain_suffix is set Jakub Jelen (1): pam_sss: Add missing colon to the PIN prompt Lukas Slebodnik (1): PROXY: Return data in output parameter if everything is OK Michal Židek (2): TESTS: ldb-tools and sssd-tools are required for multihost tests Update the translations for the 2.2.1 release Niranjan M.R (1): TESTS: Test kvno correctly displays vesion numbers of principals Pavel Březina (11): ci: disable timeout ci: switch to new tooling and remove 'Read trusted files' stage ci: rebase pull request on the target branch ci: print node on which the test is being run sudo: use proper datetime for default modifyTimestamp value systemd: add Restart=on-failure to sssd.service man: fix description of dns_resolver_op_timeout man: fix description of dns_resolver_timeout failover: add dns_resolver_server_timeout option failover: change default timeouts config: add dns_resolver_op_timeout to option list Sam Morris (1): build: fix detection of systemd.pc Samuel Cabrero (1): nss: Fix command 'endservent' resetting wrong struct member Sumit Bose (10): negcache: add fq-usernames of know domains to all UPN neg-caches p11_child: prefer better digest function if card supports it p11_child: fix a memory leak and other memory mangement issues pam: make sure p11_child.log has the right permissions ssh: make sure p11_child.log has the right permissions BE: make sure child log files have the right permissions utils: remove unused prototype (cert_to_ssh_key) utils: move parse_cert_verify_opts() into separate file p11_child: make OCSP digest configurable pam: fix loop in Smartcard authentication Tomas Halman (9): MAN: ldap_user_home_directory default missing pcre: port to pcre2 CACHE: SSSD doesn't clear cache entries LDAP: failover does not work on non-responsive ldaps CONFDB: Files domain if activated without .conf TESTS: adapt tests to enabled default files domain BE: Introduce flag for be_ptask_create BE: Convert be_ptask params to flags DYNDNS: dyndns_update is not enough Yuri Chornoivan (1): Fix minor typos in docs

4 years, 7 months

3
4
0 / 0

[sssd PR#875][comment] 1.16: autofs: do not enumerate when only single entry is requested

by pbrezina

URL: https://github.com/SSSD/sssd/pull/875 Title: #875: 1.16: autofs: do not enumerate when only single entry is requested pbrezina commented: """ Downstream tests passed. """ See the full comment at https://github.com/SSSD/sssd/pull/875#issuecomment-531171443

4 years, 7 months

1
0
0 / 0

[sssd PR#873][comment] pytest: Use idm:DL1 module to install 389-ds

by mrniranjan

URL: https://github.com/SSSD/sssd/pull/873 Title: #873: pytest: Use idm:DL1 module to install 389-ds mrniranjan commented: """ @pbrezina RHEL8 yum is symlinked to /usr/bin/dnf-3 . I have been told to use yum only on RHEL8 """ See the full comment at https://github.com/SSSD/sssd/pull/873#issuecomment-530929800

4 years, 7 months

1
0
0 / 0

[sssd PR#875][comment] 1.16: autofs: do not enumerate when only single entry is requested

by pbrezina

URL: https://github.com/SSSD/sssd/pull/875 Title: #875: 1.16: autofs: do not enumerate when only single entry is requested pbrezina commented: """ Thank you for review. I'm waiting for downstream tests to finish. """ See the full comment at https://github.com/SSSD/sssd/pull/875#issuecomment-530733488

4 years, 7 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2019