March 2020 - sssd-devel - Fedora mailing-lists

[sssd PR#175][opened] Add module for starting services
by lslebodn 22 Nov '21

22 Nov '21

URL: https://github.com/SSSD/sssd/pull/175 Author: lslebodn Title: #175: Add module for starting services Action: opened PR body: """ This is a WIP version of reducing code duplication in our cwrap integration tests. I am still not sure whether we should also reuse function `create_sssd_fixture`. And if yes; then probably in different nodule then `services` And comments are welcome. BTW I wrote patches few weeks ago; therefore new tests are not converted. I am just sending patches to get some feedback. Site effect of this patches is that tests are cca 20% faster (IIRC) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/175/head:pr175 git checkout pr175

5 5

[sssd PR#844][opened] sssd-ad and gpo_child: GPO apply fixes during reading fails
by mastersin 03 Aug '21

03 Aug '21

URL: https://github.com/SSSD/sssd/pull/844 Author: mastersin Title: #844: sssd-ad and gpo_child: GPO apply fixes during reading fails Action: opened PR body: """ Ignore AD GPO errors: - if SecEdit/GptTmpl.inf is missing or - if reading sysvol_gpt_version fails and cached_gpt_version already exists """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/844/head:pr844 git checkout pr844

7 16

[sssd PR#616][opened] become_user: add supplementary groups so ad provider can access keytab
by asheplyakov 28 Jan '21

28 Jan '21

URL: https://github.com/SSSD/sssd/pull/616 Author: asheplyakov Title: #616: become_user: add supplementary groups so ad provider can access keytab Action: opened PR body: """ For security reasons one might want to run providers as a non-privileged user (say, _sssd). However some providers (in particular ad) might need an access to restricted (non world-readable) files (for instance, /etc/krb5.keytab). One of the possible ways to solve the problem is to - add a special group (for instance, _keytab) - set the owner:group of the file in question to root:_keytab - set the permissions of the file in question to 640 - make the _sssd user a member of the _keytab group For this to work become_user should assign supplementary groups, which is what this patch does. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/616/head:pr616 git checkout pr616

5 13

[sssd PR#943][opened] files_ops: Fix cached password remove
by elkoniu 01 Oct '20

01 Oct '20

URL: https://github.com/SSSD/sssd/pull/943 Author: elkoniu Title: #943: files_ops: Fix cached password remove Action: opened PR body: """ When SSSD daemon will detect refresh of password (group) file it will delete all cached users (groups) data. With this change cached data will be deleted only for non existing users (groups). Resolves: https://pagure.io/SSSD/sssd/issue/3591 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/943/head:pr943 git checkout pr943

3 16

[sssd PR#269][opened] Add support for ActiveDirectory's logonHours restrictions
by NWilson 03 Sep '20

03 Sep '20

URL: https://github.com/SSSD/sssd/pull/269 Author: NWilson Title: #269: Add support for ActiveDirectory's logonHours restrictions Action: opened PR body: """ This is a straightforward patch for denying access to a user when the user is not permitted to access their account due to logonHours restrictions. This matches the default behaviour for domain-joined Windows machines. When outside the logonHours, all types of authentication are denied (password/Kerberos/certificate) - so it is appropriate to put this check inside the PAM "account" rules. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/269/head:pr269 git checkout pr269

9 30

[sssd PR#837][opened] p11_child: make OCSP digest configurable
by sumit-bose 18 Aug '20

18 Aug '20

URL: https://github.com/SSSD/sssd/pull/837 Author: sumit-bose Title: #837: p11_child: make OCSP digest configurable Action: opened PR body: """ Currently sha1 is used to create the certid for an OCSP request. Since sha1 is not recommend for new applications anymore and not FIPS compliant this patch changes the default to sha256 and makes the digest function configurable as well. Related to https://pagure.io/SSSD/sssd/issue/4032 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/837/head:pr837 git checkout pr837

6 36

[sssd PR#578][opened] proxy: proxy_child hardening
by amitkumar50 10 Aug '20

10 Aug '20

URL: https://github.com/SSSD/sssd/pull/578 Author: amitkumar50 Title: #578: proxy: proxy_child hardening Action: opened PR body: """ proxy_child will call chdir("/"), umask(022) and reset the environment with clearenv(). The --domain argument to be sanitized. Resolves: https://pagure.io/SSSD/sssd/issue/2689 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/578/head:pr578 git checkout pr578

5 14

[sssd PR#1011][opened] sysdb: check if the id override belongs to requested domain
by pbrezina 22 Apr '20

22 Apr '20

URL: https://github.com/SSSD/sssd/pull/1011 Author: pbrezina Title: #1011: sysdb: check if the id override belongs to requested domain Action: opened PR body: """ Steps to reproduce: 1. Setup an id override (administrator(a)ad.vm: uid -> 10001) 2. Request user by name to fill cache ``` $ id Administrator(a)ad.vm uid=10001(administrator(a)ad.vm) ... ``` 3. Request user by id and see that domain part is missing ``` $ id 10001 uid=10001(administrator) ... ``` First, the uid is looked up in IPA domain and the override object is found when we hit `sysdb_search_override_by_id` because id values are not qualified. Therefore the origin object (administrator(a)ad.vm) is returned as part of IPA domain. We need to check if the original object belongs to the requested domain. Resolves: https://pagure.io/SSSD/sssd/issue/4173 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1011/head:pr1011 git checkout pr1011

2 5

[sssd PR#1005][opened] pam: Use cache for users with existing session
by sumit-bose 21 Apr '20

21 Apr '20

URL: https://github.com/SSSD/sssd/pull/1005 Author: sumit-bose Title: #1005: pam: Use cache for users with existing session Action: opened PR body: """ Users that have an existing session do the bulk of their authentication to unlock services that do not make use of initgroups (used only to create a new login session). Forcing online initgroups calls for these users leads mostly to delays in providing those services and do not provide any useful data. Resolves: https://pagure.io/SSSD/sssd/issue/4098 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1005/head:pr1005 git checkout pr1005

2 3

[sssd PR#1010][opened] man: in sssd-ipa clarified trusted domains section
by ikerexxe 21 Apr '20

21 Apr '20

URL: https://github.com/SSSD/sssd/pull/1010 Author: ikerexxe Title: #1010: man: in sssd-ipa clarified trusted domains section Action: opened PR body: """ In sssd-ipa man page added a second option when configuring trusted domains Resolves: https://pagure.io/SSSD/sssd/issue/4041 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1010/head:pr1010 git checkout pr1010

4 10

[sssd PR#999][opened] Mem-cache fixes/improvements
by alexey-tikhonov 21 Apr '20

21 Apr '20

URL: https://github.com/SSSD/sssd/pull/999 Author: alexey-tikhonov Title: #999: Mem-cache fixes/improvements Action: opened PR body: """ This is set of patches consisting of the following: (1) fix of https://pagure.io/SSSD/sssd/issue/4160 (2) revival of @mzidek-gh's patch to make size of mem-caches configurable (#390) (3 & 4) slight improvements of (2) (5) additional debug&syslog message to signal user that cache is full and may require change of size This is to address https://github.com/SSSD/sssd/pull/390#issuecomment-371428333 (at least to some extent) I keep those patches separate to make review easier. But if PR will be accepted then it makes sense to squash (2, 3 & 4) into single patch before merging. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/999/head:pr999 git checkout pr999

4 18

[sssd PR#1015][opened] proxy: allow proxy provider to start without having proxy_resolver_lib_name set
by pbrezina 09 Apr '20

09 Apr '20

URL: https://github.com/SSSD/sssd/pull/1015 Author: pbrezina Title: #1015: proxy: allow proxy provider to start without having proxy_resolver_lib_name set Action: opened PR body: """ Proxy provider fails to start unless `proxy_resolver_lib_name` is set since recent hosts resolver addition. This would impact all existing proxy provider configurations. This patch makes sure that proxy resolver is disabled if the option is not set but other functions are not affected. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1015/head:pr1015 git checkout pr1015

2 21

[sssd PR#992][opened] This changes the default ldap_group_name attribute to sAMAccountName
by lfrancke 06 Apr '20

06 Apr '20

URL: https://github.com/SSSD/sssd/pull/992 Author: lfrancke Title: #992: This changes the default ldap_group_name attribute to sAMAccountName Action: opened PR body: """ This changes the default ldap_group_name attribute to sAMAccountName when the ad schema is used for the LDAP provider. This is to make it consistent with the AD provider which was changed in adb148603344a42d6edffdda0786a10af715dacb. "name" is an optional field for the group class. See https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… for a short discussion """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/992/head:pr992 git checkout pr992

2 17

[sssd PR#1009][opened] Use ndr_pull_steal_switch_value for modern samba versions
by noelpower 06 Apr '20

06 Apr '20

URL: https://github.com/SSSD/sssd/pull/1009 Author: noelpower Title: #1009: Use ndr_pull_steal_switch_value for modern samba versions Action: opened PR body: """ commit bc56b10aea999284458dcc293b54cf65288e325d attempted to fix the build error resulting from removal of 'ndr_pull_get_switch' However this just basically leaves the old code in place, the reason for the change in the samba code was to address a possible NDR crash from possible illegal large array allocations, please see https://bugzilla.samba.org/show_bug.cgi?id=13876 This change uses the new replacement method 'ndr_pull_steal_switch_value' if available and otherwise puts back the old method (which better describes what the code is doing) Signed-off-by: Noel Power <noel.power(a)suse.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1009/head:pr1009 git checkout pr1009

2 24

[sssd PR#1016][opened] proxy: set pwfield to x for files library
by pbrezina 06 Apr '20

06 Apr '20

URL: https://github.com/SSSD/sssd/pull/1016 Author: pbrezina Title: #1016: proxy: set pwfield to x for files library Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/4174 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1016/head:pr1016 git checkout pr1016

2 15

[sssd PR#1012][opened] config: add dns_resolver_op_timeout to option list
by thalman 03 Apr '20

03 Apr '20

URL: https://github.com/SSSD/sssd/pull/1012 Author: thalman Title: #1012: config: add dns_resolver_op_timeout to option list Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/3217 This is backport of commit 049f3906b9 into 1-16 branch """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1012/head:pr1012 git checkout pr1012

3 18

[sssd PR#1013][opened] SYSDB: override_gid not working for subdomains
by thalman 03 Apr '20

03 Apr '20

URL: https://github.com/SSSD/sssd/pull/1013 Author: thalman Title: #1013: SYSDB: override_gid not working for subdomains Action: opened PR body: """ The override_gid is not propagated to subdomain. This patch assigns subdomain's override_gid to the value comming from parent domain. Resolves: https://pagure.io/SSSD/sssd/issue/4061 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1013/head:pr1013 git checkout pr1013

2 13

[sssd PR#1014][opened] sysdb: sanitize certmap rule name before using it in DN
by sumit-bose 03 Apr '20

03 Apr '20

URL: https://github.com/SSSD/sssd/pull/1014 Author: sumit-bose Title: #1014: sysdb: sanitize certmap rule name before using it in DN Action: opened PR body: """ The name of a certificate mapping and matching rule might contain characters which are not allowed in RDNs an must be escaped before if can be used in the DN of the cached certmap object. Resolves: https://pagure.io/SSSD/sssd/issue/3721 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1014/head:pr1014 git checkout pr1014

2 11

[sssd PR#1006][opened] LDAP: Netgroups refresh in background task
by elkoniu 01 Apr '20

01 Apr '20

URL: https://github.com/SSSD/sssd/pull/1006 Author: elkoniu Title: #1006: LDAP: Netgroups refresh in background task Action: opened PR body: """ refresh_expired_interval config value spawns be_task responsible for refreshing expired cache entries in background. Netgroup related entries are stored in persistent cache rather than timestamp cache. After sdap_refresh_step() has been replaced by generic be_refresh_step() lookup routine was searching for entries only in timestamp cache. This result in LDAP netgroup entries not refreshing in background. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1779486 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1006/head:pr1006 git checkout pr1006

3 19

Heads up. Moving to github. (Date to be set)
by Pavel Březina 30 Mar '20

30 Mar '20

SSSD repository is currently spread over multiple places. We use Pagure [1][2] to manage upstream issues and documentation and Github [3] as our main development platform. We chose to move only to a single platform to reduce number of tools we use and to have everything at one place. We decided to move from Pagure to Github. This is only a heads up. Precise date will be set soon and I will notify you on sssd-users and sssd-devel mailing lists. There are several steps that needs to be done in order to achieve this change but the most significant for our users and contributors is: We will no longer accept new issues and pull request in Pagure and we will kindly ask you to use Github instead. Thank you. Best regards, Pavel. [1] https://pagure.io/SSSD/sssd [2] https://pagure.io/SSSD/docs [3] https://github.com/SSSD/sssd

2 1

[sssd PR#1008][opened] sssd.spec.in: added missing Requires
by alexey-tikhonov 26 Mar '20

26 Mar '20

URL: https://github.com/SSSD/sssd/pull/1008 Author: alexey-tikhonov Title: #1008: sssd.spec.in: added missing Requires Action: opened PR body: """ This resolves warnings of rpmdiff tool. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1008/head:pr1008 git checkout pr1008

2 13

[sssd PR#1007][opened] LDAP: Remove unused sdap_refresh code
by elkoniu 26 Mar '20

26 Mar '20

URL: https://github.com/SSSD/sssd/pull/1007 Author: elkoniu Title: #1007: LDAP: Remove unused sdap_refresh code Action: opened PR body: """ There was a refactoring of LDAP background refresh task in the middle of 2019 made by Jan Hrozek and Summit Bose. Now LDAP refresh is done by generic be_refresh. SDAP refresh functions are unused anymore. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1007/head:pr1007 git checkout pr1007

3 10

[sssd PR#693][opened] SYSDB: Fall back to the MPG result of getgrgid search if the non-MPG search for override doesn't match anything
by jhrozek 24 Mar '20

24 Mar '20

URL: https://github.com/SSSD/sssd/pull/693 Author: jhrozek Title: #693: SYSDB: Fall back to the MPG result of getgrgid search if the non-MPG search for override doesn't match anything Action: opened PR body: """ Commit cf4f5e031ecbdfba0b55a4f69a06175a2e718e67 changed the logic of getgrgid (and getpwnam, so far this patch only touches getgrgid) in the sense that if looking up a GID in a MPG domain, the code checks if the GID was overriden and if yes, it mandates that the overriden GID resolves to a group by falling back to a non-MPG search. This breaks the following use-case: $ ipa idoverrideuser-add --uid=13133 --gidnumber=13133 'Default Trust View' user@domain Most importantly, I'm on the fence about whether the current behaviour is a bug or not. In general, I would have expected that if a primary GID is overriden, you more or less break the MPG model, and then it's fair from SSSD to make sure the GID number resolves to an entry. But apparently our users were relying on the old behaviour where you can set the primary GID with an override and then still resolve the primary group by ID to the user entry. So the patch in the PR is just a quick hack which sort of falls back to using the user entry as the group if the overriden GID doesn't resolve to anything. Should we support this use-case at all? Should we maybe limit it to cases where the UID and GID are the same? """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/693/head:pr693 git checkout pr693

3 8

[sssd PR#596][opened] [CONFDB]:[RFE] Add "enabled" option to domain section
by amitkumar50 24 Mar '20

24 Mar '20

URL: https://github.com/SSSD/sssd/pull/596 Author: amitkumar50 Title: #596: [CONFDB]:[RFE] Add "enabled" option to domain section Action: opened PR body: """ Upstream Request: Instead of enabling domains using the "domains" option in [sssd] section we could have [domain/*] option "enabled". This would allow admins to configure and enable domain in the same snippet file. This Fix would be submitted in 2 patches: Patch-1(This Patch): - Introduces 'enabled' option in domain section - Introduces 'CONFDB_DOMAIN_ENABLED' variable to retrieve enabled value from confdb - Code to call start_service() routine only for domains having enabled=1 Patch-2(Upcoming): - Would remove 'domains' option from sssd section. - Would remove corresponding code to parse 'domains' option - Providing a check that atlest One domain have enabled option set. Resolves: https://pagure.io/SSSD/sssd/issue/3735 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/596/head:pr596 git checkout pr596

7 12

[sssd PR#1003][opened] Watchdog: fixes "off-by-one" error
by alexey-tikhonov 18 Mar '20

18 Mar '20

URL: https://github.com/SSSD/sssd/pull/1003 Author: alexey-tikhonov Title: #1003: Watchdog: fixes "off-by-one" error Action: opened PR body: """ 'man sssd.conf': timeout: "Note that after three missed heartbeats the process will terminate itself." But implementation was: ``` \#define WATCHDOG_MAX_TICKS 3 ... if (__sync_add_and_fetch(&watchdog_ctx.ticks, 1) > WATCHDOG_MAX_TICKS) { ... _exit(1); ``` -- since after reset ticks start from 0 effectively this was 4 heartbeats. Fixed to match man page. Resolves: https://pagure.io/SSSD/sssd/issue/4169 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1003/head:pr1003 git checkout pr1003

2 10

[sssd PR#1004][opened] sbus: commit complete generated code
by pbrezina 16 Mar '20

16 Mar '20

URL: https://github.com/SSSD/sssd/pull/1004 Author: pbrezina Title: #1004: sbus: commit complete generated code Action: opened PR body: """ 99ce117106b9c0d0e0167f1c10f5840a7912fa7f incorrectly commited generated code. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1004/head:pr1004 git checkout pr1004

2 8

[sssd PR#1001][opened] ssh: fix matching rules default
by sumit-bose 16 Mar '20

16 Mar '20

URL: https://github.com/SSSD/sssd/pull/1001 Author: sumit-bose Title: #1001: ssh: fix matching rules default Action: opened PR body: """ Before the ssh_use_certificate_matching_rules option was added the ssh responder returned ssh keys derived from all valid certificates. Since the default of the ssh_use_certificate_matching_rules option is 'all_rules' in a case where no matching rules are defined all certificated will be filtered out and no ssh keys are returned. The intention of the default was to allow the same same certificates which are allowed in the PAM responder for authentication. The missing default matching rule which is currently use by the PAM responder if no other rules are available is added by this patch. There might still be a small regression in case certificates without the extended key usage (EKU) clientAuth were used for ssh. In this case 'ssh_use_certificate_matching_rules = no_rules' or a suitable matching rule must be added to the configuration. Related to https://pagure.io/SSSD/sssd/issue/4121 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1001/head:pr1001 git checkout pr1001

4 16

[sssd PR#1002][opened] SBUS: fixed off-by-one error" in sbus_auto_reconnect()
by alexey-tikhonov 16 Mar '20

16 Mar '20

URL: https://github.com/SSSD/sssd/pull/1002 Author: alexey-tikhonov Title: #1002: SBUS: fixed off-by-one error" in sbus_auto_reconnect() Action: opened PR body: """ Fixed "off-by-one error" in `reconnection_retries` interpretation. Resolves: https://pagure.io/SSSD/sssd/issue/4168 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1002/head:pr1002 git checkout pr1002

3 16

Question regarding domain-local groups filtering
by Samuel Cabrero 11 Mar '20

11 Mar '20

Hi, I found the filtering of domain-local groups was implemented after a change to query the group memberships from the LDAP server of the domain the user belongs to instead of the global catalog, which had the side effect of retrieving the DLGs of trusted domains [1]. This DLGs are cached but treated as non-POSIX gruops (no gid number assigned and not returned), after the commit implementing the filter [2]. I have found an use case where not filtering domain-local groups would be useful. If you want to use group memberships in sudo rules to allow temporary sudo access, the replication latency of global groups is very high and can take up to 15 minutes, but using domain local groups replication is done in less than one minute. Would you willing to accept a patch adding a new parameter to disable the filtering of DLGs? Regards, [1] https://pagure.io/SSSD/sssd/issue/2161 [2] https://pagure.io/SSSD/sssd/issue/2178 -- Samuel Cabrero / SUSE Labs Samba Team GPG: D7D6 E259 F91C F0B3 2E61 1239 3655 6EC9 7051 0856 scabrero(a)suse.com scabrero(a)suse.de

2 8

[sssd PR#993][opened] configure: prefer python3 if available
by arkamar 06 Mar '20

06 Mar '20

URL: https://github.com/SSSD/sssd/pull/993 Author: arkamar Title: #993: configure: prefer python3 if available Action: opened PR body: """ We should prefer python3 every time when it is available regardless of whether python3 binding are generated, otherwise `sbus_generate.sh` fails in python3 only systems, where sssd is configured with `--without-python3-bindings` parameter. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/993/head:pr993 git checkout pr993

2 14

[sssd PR#998][opened] spec: Do not overwrite /etc/pam.d/sssd-shadowutils on update
by mzidek-gh 06 Mar '20

06 Mar '20

URL: https://github.com/SSSD/sssd/pull/998 Author: mzidek-gh Title: #998: spec: Do not overwrite /etc/pam.d/sssd-shadowutils on update Action: opened PR body: """ We should not overwrite this file when sssd-common is updated. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/998/head:pr998 git checkout pr998

2 11

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. pbrezina commented: """ Thank you for getting this done. Excellent work! """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-595124634

1 0

[sssd PR#918][closed] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Author: scabrero Title: #918: Add support for NSS hosts database lookup. Action: closed To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/918/head:pr918 git checkout pr918

1 0

[sssd PR#918][-Ready to push] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: -Ready to push

1 0

[sssd PR#918][-Accepted] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: -Accepted

1 0

[sssd PR#918][+Pushed] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: +Pushed

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. pbrezina commented: """ * `master` * 8a66d6e5a8abc9a89e12a5ef386541193f965b19 - TESTS: Add LDAP resolver target integration tests * e980b0f6a0aa2ded35f7cc81d8049eac159319da - PROXY: Add support for iphost enumeration * 45dbaddde02ac0c5b1af612ece19933d50c132a4 - AD: Implement iphost cleanup for expired cache entries * ae6d042cbb6b8a2bfecc37edeb3a1509796f6846 - LDAP: Implement iphost cleanup for expired cache entries * 10d9346afd1a415cb6c624e9134c977bc6aec8f8 - AD: Add support for iphost enumeration * 2be80a00cbd2227e828adb510c2d11cd3cfede48 - AD: Setup resolver enumeration tasks * 82b808d93ea8ffaea7a89f9196ad87a6f67441a9 - LDAP: Add support for iphost enumeration * 8a51bc0df6d9f45d00b561dc3f03373d0527ce96 - LDAP: Setup resolver enumeration tasks * 8b96109ffff823766ee5795f76bf17907392f6ee - CACHE_REQ: Add support for enumerating hosts * 11cc32e48b5cb70aecbe040b6629482cb497108e - SYSDB: Add support for enumerating hosts * bbcd849a4208bb54d83ebdb4b57e35f25b887dd7 - NSS: Add client support for [set|get|end]hostent() * 29b27395f39cb64834a054d1477467c045feaee3 - LDAP: Add support for iphost lookups (no enumeration) * b8fba016681aabf82eb7739259e323242aa4a8c4 - LDAP: Prepare for iphost lookups * 0498591eaeea0ff92e12e26e818fbf660d45c5b2 - AD: Initialize ldap_iphost_* options * 6a7775263cec46b577d3d25be2e2086136c7a134 - LDAP: Document new ldap_iphost_* options * a61c6d61c39e566eeda38ceceb8fa11831822d51 - LDAP: Initialize ldap_iphost_* options * 1402f10046eb830c9fcb591c8898f73dd13ddc95 - AD: Initialize resolver provider * 5672d2beb735d35bbf33efc25c48de4f31c33563 - LDAP: Initialize resolver provider * 29c583b6450af52fd0b93b526fda67b946d925ba - PROXY: Handle resolver hosts by address requests * 00bc7897163a9fed2bc7ba613f36c6b076e6d8c0 - SYSDB: Extend sysdb_store_host() to accept extra attributes * bbb7a45dfd16a7eb8e1b56da508a536e520e3bcd - PROXY: Store results from NSS library call into the cache * be791978953d0cfec64a08d7da2aae6d44af8e53 - PROXY: Handle resolver hosts by name requests * b1fe85eb0034f3aacb549322b4620976f09e39af - PROXY: Register resolver hosts handler method * 688e6a6b56966200e530c9e3a6de534e1f763b7e - PROXY: Load resolver NSS library * 0ec8bd578b55564182a21b05773c109393c16840 - PROXY: Create a module context to store id and auth contexts * b523fb6a03dbf6289159d4fb8b491fe35f1c2693 - UTIL: Allow to specify mandatory and optional symbols when loading nss libs * d6d03aafc49615ae1e4e88a692aa893214c3926d - CONFDB: Add a new resolver_timeout to timeout cached resolver entries * 6f6900374520b34b25199259731e410be7b7ebf3 - CONFDB: Add new options for resolver provider * 2c317ce9fc5a66ef82969baaf1d949fbee5dcd75 - DP: Implement resolver target handler * 014cd3a542bbb27d72c160a5c596b6797c6ed46e - TESTS: Add gethostbyname and gethostbyaddr NSS responder tests * 55cfacfe33e656840aed8bdb3ca7870a7bdad4dc - NSS: Add gethostbyname and gethostbyaddr support to the NSS responder * e931f27dfd3800c3931c6aba7e75e7499b64a913 - NSS: Add client support for hosts (non-enumeration) * 6e66e321797e52d7a9ed093683c45c678c9deec5 - CACHE_REQ: Implement ip_host_by_addr and ip_host_by_name plugins * dafdd066ef2358ee06796ce5bba8f0b0891c9d64 - CACHE_REQ: Add a data field to store network addresses * 1cb209556adad75264802de543f03e08f7058d23 - CACHE_REQ: Rename cache req host by name name plugin used by SSH * 469891df69faeceba2084efd8ce421b1ec11103e - RESPONDER: Add sss_dp_resolver_get_send * d76d818cb2015c4d5a4b70fac055f99134c5c858 - DP: Add a new filter type, filter by address * 99ce117106b9c0d0e0167f1c10f5840a7912fa7f - SBUS: Add new resolver target interface * 622849279be17cc9b7b59f81753aa05a0594df47 - SYSDB: Add index for hostAddress attribute * 860c457063fedf4c0020e705060b97cd5a80d1a7 - SYSDB: Add sysdb functions for hosts entries * d263fa9d643197bf0f3245e06149f7a3dd96f08d - UTIL: Add a function to canonicalize IP addresses * 12bd3f96ca101192ddc6b0afb424c183e68989c9 - STAP: Add missing session data provider target """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-595124324

1 0

[sssd PR#979][opened] sdap: provide error message when password change fail in ldap_modify mode
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/979 Author: pbrezina Title: #979: sdap: provide error message when password change fail in ldap_modify mode Action: opened PR body: """ Steps to reproduce: 1. Configure LDAP server to enable password constraints 2. Set ldap_pwmodify_mode = ldap_modify in [domain] 3. Run SSSD and authenticate as a user 4. Run passwd to change password, use password that does not meet requirements It will print "password change successful" without this patch and server error message with this patch applied. Resolves: https://pagure.io/SSSD/sssd/issue/4148 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/979/head:pr979 git checkout pr979

2 18

[sssd PR#996][opened] 1.16: failover: make sure we switch to anoter server if only port differs
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/996 Author: pbrezina Title: #996: 1.16: failover: make sure we switch to anoter server if only port differs Action: opened PR body: """ This is a regression introduced in 735af71a8e169f17fa5462db610a1567c9618e29. After this commit we checked only server name instead of name and port combo. Steps to reproduce: 1. Configure SSSD to use two servers with same name but different ports ``` [domain/LDAP] debug_level=0xFFF0 id_provider = ldap ldap_uri = ldap://$SERVER1:12345,ldap://$SERVER1:389 ldap_tls_cacertdir = /etc/openldap/certs ldap_search_base = dc=example,dc=com ``` 2. The first server port is unreachable, the second is working. 3. Run sssd and try to resolve user. 4. Without the patch SSSD tries to connect to the first server twice because new URI is not constructed and goes offline. Resolves: https://pagure.io/SSSD/sssd/issue/4112 Reviewed-by: Michal Židek <mzidek(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/996/head:pr996 git checkout pr996

2 14

[sssd PR#918][+Ready to push] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: +Ready to push

1 0

[sssd PR#918][+Accepted] Add support for NSS hosts database lookup.
by sumit-bose 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: +Accepted

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by sumit-bose 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. sumit-bose commented: """ Hi, thanks for the update, I'm fine with the changes. ACK. bye, Sumit """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-595107868

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. pbrezina commented: """ I removed accepted label since another review needs to be done. """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-595102930

1 0

[sssd PR#918][-Ready to push] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: -Ready to push

1 0

[sssd PR#918][-Accepted] Add support for NSS hosts database lookup.
by pbrezina 05 Mar '20

05 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: -Accepted

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by scabrero 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. scabrero commented: """ Sumit, the networks support is almost finished and I caught the (I think) last errors, pushed again. Thank you for you patience too. """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-594681086

1 0

[sssd PR#918][+Ready to push] Add support for NSS hosts database lookup.
by pbrezina 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: +Ready to push

1 0

[sssd PR#918][+Accepted] Add support for NSS hosts database lookup.
by sumit-bose 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: +Accepted

1 0

[sssd PR#918][-Changes requested] Add support for NSS hosts database lookup.
by sumit-bose 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. Label: -Changes requested

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by sumit-bose 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. sumit-bose commented: """ Hi, > Fixed, I have skipped `sssd-ldap-attributes.5.xml` because other `ldap_*_entry_usn` are not there either. That's ok, thanks. > I have also fixed a couple of issues I found while working in the networks support. I guess there is a fair chance that there still might be some copy-and-paste issues like the ones you fixed. Nevertheless, ACK. Thank you for you patience. bye, Sumit """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-594536408

1 0

[sssd PR#988][opened] man: fix typos
by miztake 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/988 Author: miztake Title: #988: man: fix typos Action: opened PR body: """ - add whitespace between words - correct manpage reference - correct wrong word - capitalize the first letter """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/988/head:pr988 git checkout pr988

2 17

[sssd PR#997][opened] Fix sssd-ldap man page
by tscherf 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/997 Author: tscherf Title: #997: Fix sssd-ldap man page Action: opened PR body: """ The option 'ldap_default_authtok_type' also accepts non clear text passwords in the meantime. Signed-off-by: Thorsten Scherf <tscherf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/997/head:pr997 git checkout pr997

3 11

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by scabrero 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. scabrero commented: """ Fixed, I have skipped `sssd-ldap-attributes.5.xml` because other `ldap_*_entry_usn` are not there either. I have also fixed a couple of issues I found while working in the networks support. """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-594436135

1 0

KCM notifications
by Pavel Březina 02 Mar '20

02 Mar '20

Hi devs, I'm thinking about ways to implement SSSD KCM notification that something has changed (i.e. user called kinit/kdestroy) [1]. The main use case is to notify Gnome Online Accounts (which is a daemon running under logged-in user) when something has changed and it is already a D-Bus service. The basic idea is that we would use D-Bus signals that would be emitted by SSSD KCM responder (sssd_kcm process). Signals are broadcasted messages that are delivered to client that chose to listen to them. The problem is that we 1) can't connect to specific user's session bus because KCM runs as root/sssd and connecting to other user's bus is not allowed 2) can't specify which user is allowed to get the signal 3) therefore we can't send the signal only to specific user So the solution is that KCM connects to system bus and sends org.sssd.kcm.Changed(uid) signal where uid is uid of the user which ccache has changed so the receiver can know which user is affected. This signal is broadcasted to everyone who listens to it. It is perfectly usable, however the question is whether we can broadcast this information (that user A run kinit/kdestroy/other modification of ccache) or it is a security leak that we must avoid and we should seek other solution. I asked this secalert and they reply that there is no security concern "but": > After looking at this issue, honestly I dont see an attack vector here, but i am afraid something like this could be used with some other security flaw to maybe gain privesc? For example a flaw which is some component which can be triggered only when kinit is run? where precise timing is required. > > So in conclusion if there is another "better" solution than it should be preferred. Or in worse case atleast have an option to disable this somehow via some config, so that such situations can be avoided. I don't think a precise timing is necessary and we can send the signal few miliseconds or a second later. That should eliminate this concern (I asked this, waiting for an answer). I can think of two more solutions currently: 1) Have client connect to KCM socket and await signal there. This however would mean that connection between client and KCM need to be always established and KCM responder would be running all the time (currently it is only short-lived socket activated process). 2) Create a temporary file in a directory owned by user. User can then setup inotify watch to the file and sssd would write to the file on changes. Since it is in directory owned by user, other users would not be able to setup the watch. Note that it is possile to setup inotify watch on FILE ccache (keeping distro settings out of the question the default ccache is FILE:/tmp/krb5cc_%{uid} as per krb5.conf manpage) so perhaps we really don't have to care about broadcasting this information. Thanks, Pavel. [1] https://pagure.io/SSSD/sssd/issue/3568

6 13

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by sumit-bose 02 Mar '20

02 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. sumit-bose commented: """ Thanks, sorry for nitpicking, but `ldap_iphost_entry_usn` is still missing in some files: ``` $ git grep -E '(ldap_iphost_name|ldap_iphost_entry_usn)' ../ ../src/config/SSSDConfig/sssdoptions.py: 'ldap_iphost_name': _('IP host name attribute'), ../src/config/cfg_rules.ini:option = ldap_iphost_name ../src/config/etc/sssd.api.d/sssd-ad.conf:ldap_iphost_name = str, None, false ../src/config/etc/sssd.api.d/sssd-ldap.conf:ldap_iphost_name = str, None, false ../src/man/sssd-ldap-attributes.5.xml: <term>ldap_iphost_name (string)</term> ../src/providers/ad/ad_opts.c: { "ldap_iphost_name", "cn", SYSDB_NAME, NULL }, ../src/providers/ad/ad_opts.c: { "ldap_iphost_entry_usn", NULL, SYSDB_USN, NULL }, ../src/providers/ldap/ldap_opts.c: { "ldap_iphost_name", "cn", SYSDB_NAME, NULL }, ../src/providers/ldap/ldap_opts.c: { "ldap_iphost_entry_usn", NULL, SYSDB_USN, NULL }, ``` bye, Sumit """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-593489917

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by scabrero 02 Mar '20

02 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. scabrero commented: """ Thanks, I should have noticed... All tests passing now. """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-593451935

1 0

[sssd PR#970][opened] sss_ptr_hash: pass new hash_entry_t to custom delete callback
by alexey-tikhonov 02 Mar '20

02 Mar '20

URL: https://github.com/SSSD/sssd/pull/970 Author: alexey-tikhonov Title: #970: sss_ptr_hash: pass new hash_entry_t to custom delete callback Action: opened PR body: """ This is backport of f95db37aa8486304d0569d12a876b1c74ee1b0d1 amended with PR 968 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/970/head:pr970 git checkout pr970

2 23

[sssd PR#971][opened] AD: use getaddrinfo with AI_CANONNAME to find the FQDN
by scabrero 02 Mar '20

02 Mar '20

URL: https://github.com/SSSD/sssd/pull/971 Author: scabrero Title: #971: AD: use getaddrinfo with AI_CANONNAME to find the FQDN Action: opened PR body: """ In systems where gethostbyname() does not return the FQDN try calling getaddrinfo(). The same happened to adcli, fixed by https://gitlab.freedesktop.org/sbose/adcli/commit/85b835f8258a57e3b23de47a2… """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/971/head:pr971 git checkout pr971

5 22

[sssd PR#994][opened] sssd.spec: Add recommended packages
by mzidek-gh 02 Mar '20

02 Mar '20

URL: https://github.com/SSSD/sssd/pull/994 Author: mzidek-gh Title: #994: sssd.spec: Add recommended packages Action: opened PR body: """ sssd-dbus is recommended for tools and SSSD's logrotate support can only be useful with the logrotate package in place. It makes sense to recommend them. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/994/head:pr994 git checkout pr994

2 22

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2020