March 2020 - sssd-devel - Fedora mailing-lists

[sssd PR#1004][opened] sbus: commit complete generated code
by pbrezina 16 Mar '20

16 Mar '20

URL: https://github.com/SSSD/sssd/pull/1004 Author: pbrezina Title: #1004: sbus: commit complete generated code Action: opened PR body: """ 99ce117106b9c0d0e0167f1c10f5840a7912fa7f incorrectly commited generated code. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1004/head:pr1004 git checkout pr1004

2 8

[sssd PR#1001][opened] ssh: fix matching rules default
by sumit-bose 16 Mar '20

16 Mar '20

URL: https://github.com/SSSD/sssd/pull/1001 Author: sumit-bose Title: #1001: ssh: fix matching rules default Action: opened PR body: """ Before the ssh_use_certificate_matching_rules option was added the ssh responder returned ssh keys derived from all valid certificates. Since the default of the ssh_use_certificate_matching_rules option is 'all_rules' in a case where no matching rules are defined all certificated will be filtered out and no ssh keys are returned. The intention of the default was to allow the same same certificates which are allowed in the PAM responder for authentication. The missing default matching rule which is currently use by the PAM responder if no other rules are available is added by this patch. There might still be a small regression in case certificates without the extended key usage (EKU) clientAuth were used for ssh. In this case 'ssh_use_certificate_matching_rules = no_rules' or a suitable matching rule must be added to the configuration. Related to https://pagure.io/SSSD/sssd/issue/4121 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1001/head:pr1001 git checkout pr1001

4 16

[sssd PR#1002][opened] SBUS: fixed off-by-one error" in sbus_auto_reconnect()
by alexey-tikhonov 16 Mar '20

16 Mar '20

URL: https://github.com/SSSD/sssd/pull/1002 Author: alexey-tikhonov Title: #1002: SBUS: fixed off-by-one error" in sbus_auto_reconnect() Action: opened PR body: """ Fixed "off-by-one error" in `reconnection_retries` interpretation. Resolves: https://pagure.io/SSSD/sssd/issue/4168 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1002/head:pr1002 git checkout pr1002

3 16

Question regarding domain-local groups filtering
by Samuel Cabrero 11 Mar '20

11 Mar '20

Hi, I found the filtering of domain-local groups was implemented after a change to query the group memberships from the LDAP server of the domain the user belongs to instead of the global catalog, which had the side effect of retrieving the DLGs of trusted domains [1]. This DLGs are cached but treated as non-POSIX gruops (no gid number assigned and not returned), after the commit implementing the filter [2]. I have found an use case where not filtering domain-local groups would be useful. If you want to use group memberships in sudo rules to allow temporary sudo access, the replication latency of global groups is very high and can take up to 15 minutes, but using domain local groups replication is done in less than one minute. Would you willing to accept a patch adding a new parameter to disable the filtering of DLGs? Regards, [1] https://pagure.io/SSSD/sssd/issue/2161 [2] https://pagure.io/SSSD/sssd/issue/2178 -- Samuel Cabrero / SUSE Labs Samba Team GPG: D7D6 E259 F91C F0B3 2E61 1239 3655 6EC9 7051 0856 scabrero(a)suse.com scabrero(a)suse.de

2 8

[sssd PR#993][opened] configure: prefer python3 if available
by arkamar 06 Mar '20

06 Mar '20

URL: https://github.com/SSSD/sssd/pull/993 Author: arkamar Title: #993: configure: prefer python3 if available Action: opened PR body: """ We should prefer python3 every time when it is available regardless of whether python3 binding are generated, otherwise `sbus_generate.sh` fails in python3 only systems, where sssd is configured with `--without-python3-bindings` parameter. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/993/head:pr993 git checkout pr993

2 14

[sssd PR#998][opened] spec: Do not overwrite /etc/pam.d/sssd-shadowutils on update
by mzidek-gh 06 Mar '20

06 Mar '20

URL: https://github.com/SSSD/sssd/pull/998 Author: mzidek-gh Title: #998: spec: Do not overwrite /etc/pam.d/sssd-shadowutils on update Action: opened PR body: """ We should not overwrite this file when sssd-common is updated. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/998/head:pr998 git checkout pr998

2 11

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. pbrezina commented: """ Thank you for getting this done. Excellent work! """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-595124634

1 0

[sssd PR#918][closed] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Author: scabrero Title: #918: Add support for NSS hosts database lookup. Action: closed To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/918/head:pr918 git checkout pr918

1 0

[sssd PR#918][-Ready to push] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: -Ready to push

1 0

[sssd PR#918][-Accepted] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: -Accepted

1 0

[sssd PR#918][+Pushed] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: +Pushed

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. pbrezina commented: """ * `master` * 8a66d6e5a8abc9a89e12a5ef386541193f965b19 - TESTS: Add LDAP resolver target integration tests * e980b0f6a0aa2ded35f7cc81d8049eac159319da - PROXY: Add support for iphost enumeration * 45dbaddde02ac0c5b1af612ece19933d50c132a4 - AD: Implement iphost cleanup for expired cache entries * ae6d042cbb6b8a2bfecc37edeb3a1509796f6846 - LDAP: Implement iphost cleanup for expired cache entries * 10d9346afd1a415cb6c624e9134c977bc6aec8f8 - AD: Add support for iphost enumeration * 2be80a00cbd2227e828adb510c2d11cd3cfede48 - AD: Setup resolver enumeration tasks * 82b808d93ea8ffaea7a89f9196ad87a6f67441a9 - LDAP: Add support for iphost enumeration * 8a51bc0df6d9f45d00b561dc3f03373d0527ce96 - LDAP: Setup resolver enumeration tasks * 8b96109ffff823766ee5795f76bf17907392f6ee - CACHE_REQ: Add support for enumerating hosts * 11cc32e48b5cb70aecbe040b6629482cb497108e - SYSDB: Add support for enumerating hosts * bbcd849a4208bb54d83ebdb4b57e35f25b887dd7 - NSS: Add client support for [set|get|end]hostent() * 29b27395f39cb64834a054d1477467c045feaee3 - LDAP: Add support for iphost lookups (no enumeration) * b8fba016681aabf82eb7739259e323242aa4a8c4 - LDAP: Prepare for iphost lookups * 0498591eaeea0ff92e12e26e818fbf660d45c5b2 - AD: Initialize ldap_iphost_* options * 6a7775263cec46b577d3d25be2e2086136c7a134 - LDAP: Document new ldap_iphost_* options * a61c6d61c39e566eeda38ceceb8fa11831822d51 - LDAP: Initialize ldap_iphost_* options * 1402f10046eb830c9fcb591c8898f73dd13ddc95 - AD: Initialize resolver provider * 5672d2beb735d35bbf33efc25c48de4f31c33563 - LDAP: Initialize resolver provider * 29c583b6450af52fd0b93b526fda67b946d925ba - PROXY: Handle resolver hosts by address requests * 00bc7897163a9fed2bc7ba613f36c6b076e6d8c0 - SYSDB: Extend sysdb_store_host() to accept extra attributes * bbb7a45dfd16a7eb8e1b56da508a536e520e3bcd - PROXY: Store results from NSS library call into the cache * be791978953d0cfec64a08d7da2aae6d44af8e53 - PROXY: Handle resolver hosts by name requests * b1fe85eb0034f3aacb549322b4620976f09e39af - PROXY: Register resolver hosts handler method * 688e6a6b56966200e530c9e3a6de534e1f763b7e - PROXY: Load resolver NSS library * 0ec8bd578b55564182a21b05773c109393c16840 - PROXY: Create a module context to store id and auth contexts * b523fb6a03dbf6289159d4fb8b491fe35f1c2693 - UTIL: Allow to specify mandatory and optional symbols when loading nss libs * d6d03aafc49615ae1e4e88a692aa893214c3926d - CONFDB: Add a new resolver_timeout to timeout cached resolver entries * 6f6900374520b34b25199259731e410be7b7ebf3 - CONFDB: Add new options for resolver provider * 2c317ce9fc5a66ef82969baaf1d949fbee5dcd75 - DP: Implement resolver target handler * 014cd3a542bbb27d72c160a5c596b6797c6ed46e - TESTS: Add gethostbyname and gethostbyaddr NSS responder tests * 55cfacfe33e656840aed8bdb3ca7870a7bdad4dc - NSS: Add gethostbyname and gethostbyaddr support to the NSS responder * e931f27dfd3800c3931c6aba7e75e7499b64a913 - NSS: Add client support for hosts (non-enumeration) * 6e66e321797e52d7a9ed093683c45c678c9deec5 - CACHE_REQ: Implement ip_host_by_addr and ip_host_by_name plugins * dafdd066ef2358ee06796ce5bba8f0b0891c9d64 - CACHE_REQ: Add a data field to store network addresses * 1cb209556adad75264802de543f03e08f7058d23 - CACHE_REQ: Rename cache req host by name name plugin used by SSH * 469891df69faeceba2084efd8ce421b1ec11103e - RESPONDER: Add sss_dp_resolver_get_send * d76d818cb2015c4d5a4b70fac055f99134c5c858 - DP: Add a new filter type, filter by address * 99ce117106b9c0d0e0167f1c10f5840a7912fa7f - SBUS: Add new resolver target interface * 622849279be17cc9b7b59f81753aa05a0594df47 - SYSDB: Add index for hostAddress attribute * 860c457063fedf4c0020e705060b97cd5a80d1a7 - SYSDB: Add sysdb functions for hosts entries * d263fa9d643197bf0f3245e06149f7a3dd96f08d - UTIL: Add a function to canonicalize IP addresses * 12bd3f96ca101192ddc6b0afb424c183e68989c9 - STAP: Add missing session data provider target """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-595124324

1 0

[sssd PR#979][opened] sdap: provide error message when password change fail in ldap_modify mode
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/979 Author: pbrezina Title: #979: sdap: provide error message when password change fail in ldap_modify mode Action: opened PR body: """ Steps to reproduce: 1. Configure LDAP server to enable password constraints 2. Set ldap_pwmodify_mode = ldap_modify in [domain] 3. Run SSSD and authenticate as a user 4. Run passwd to change password, use password that does not meet requirements It will print "password change successful" without this patch and server error message with this patch applied. Resolves: https://pagure.io/SSSD/sssd/issue/4148 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/979/head:pr979 git checkout pr979

2 18

[sssd PR#996][opened] 1.16: failover: make sure we switch to anoter server if only port differs
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/996 Author: pbrezina Title: #996: 1.16: failover: make sure we switch to anoter server if only port differs Action: opened PR body: """ This is a regression introduced in 735af71a8e169f17fa5462db610a1567c9618e29. After this commit we checked only server name instead of name and port combo. Steps to reproduce: 1. Configure SSSD to use two servers with same name but different ports ``` [domain/LDAP] debug_level=0xFFF0 id_provider = ldap ldap_uri = ldap://$SERVER1:12345,ldap://$SERVER1:389 ldap_tls_cacertdir = /etc/openldap/certs ldap_search_base = dc=example,dc=com ``` 2. The first server port is unreachable, the second is working. 3. Run sssd and try to resolve user. 4. Without the patch SSSD tries to connect to the first server twice because new URI is not constructed and goes offline. Resolves: https://pagure.io/SSSD/sssd/issue/4112 Reviewed-by: Michal Židek <mzidek(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/996/head:pr996 git checkout pr996

2 14

[sssd PR#918][+Ready to push] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: +Ready to push

1 0

[sssd PR#918][+Accepted] Add support for NSS hosts database lookup.
by sumit-bose 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: +Accepted

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by sumit-bose 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. sumit-bose commented: """ Hi, thanks for the update, I'm fine with the changes. ACK. bye, Sumit """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-595107868

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. pbrezina commented: """ I removed accepted label since another review needs to be done. """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-595102930

1 0

[sssd PR#918][-Ready to push] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: -Ready to push

1 0

[sssd PR#918][-Accepted] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: -Accepted

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by scabrero 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. scabrero commented: """ Sumit, the networks support is almost finished and I caught the (I think) last errors, pushed again. Thank you for you patience too. """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-594681086

1 0

[sssd PR#918][+Ready to push] Add support for NSS hosts database lookup.
by pbrezina 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: +Ready to push

1 0

[sssd PR#918][+Accepted] Add support for NSS hosts database lookup.
by sumit-bose 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: +Accepted

1 0

[sssd PR#918][-Changes requested] Add support for NSS hosts database lookup.
by sumit-bose 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: -Changes requested

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by sumit-bose 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. sumit-bose commented: """ Hi, > Fixed, I have skipped `sssd-ldap-attributes.5.xml` because other `ldap_*_entry_usn` are not there either. That's ok, thanks. > I have also fixed a couple of issues I found while working in the networks support. I guess there is a fair chance that there still might be some copy-and-paste issues like the ones you fixed. Nevertheless, ACK. Thank you for you patience. bye, Sumit """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-594536408

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2020