April 2021 - sssd-devel - Fedora Mailing-Lists

[sssd PR#5549][opened] data_provider: Configure backend probing interval

by elkoniu

URL: https://github.com/SSSD/sssd/pull/5549 Author: elkoniu Title: #5549: data_provider: Configure backend probing interval Action: opened PR body: """ When be_ptask is created to monitor backend when SSSD is in offline mode checks are happening in specified intervals: delay = delay + (sss_rand() % task->random_offset); New configuration option is introduced in this commit: * refresh_max_random_offset Using this option allows end client to decide what should be the size of random offset when new interval for probing backend is calculated. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1925608 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5549/head:pr5549 git checkout pr5549

3 years

4
31
0 / 0

[sssd PR#5539][opened] [WIP] NSS: Clear negative cache when SIGHUP received

by elkoniu

URL: https://github.com/SSSD/sssd/pull/5539 Author: elkoniu Title: #5539: [WIP] NSS: Clear negative cache when SIGHUP received Action: opened PR body: """ When NSS receives SIGHUP signal it clears memory cache. As a part of signal handling procedure negative cache should be also cleared. Resolves: https://github.com/SSSD/sssd/issues/4973 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5539/head:pr5539 git checkout pr5539

3 years

3
44
0 / 0

[sssd PR#5537][opened] negcache: use right domain in nss_protocol_fill_initgr()

by sumit-bose

URL: https://github.com/SSSD/sssd/pull/5537 Author: sumit-bose Title: #5537: negcache: use right domain in nss_protocol_fill_initgr() Action: opened PR body: """ When checking if a group returned by an initgroups request is filtered in the negative cache the domain of the user was used. This does not work reliable if the user can be a member of groups from multiple domains. With this patch th domain the group belongs to is determined and used while checking the negative cache. Resolves: https://github.com/SSSD/sssd/issues/5534 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5537/head:pr5537 git checkout pr5537

3 years

3
25
0 / 0

[sssd PR#5560][opened] pam_sss: fixed potential mem leak

by alexey-tikhonov

URL: https://github.com/SSSD/sssd/pull/5560 Author: alexey-tikhonov Title: #5560: pam_sss: fixed potential mem leak Action: opened PR body: """ Fixes following covscan issue: ``` Error: RESOURCE_LEAK (CWE-772): [#def1] src/sss_client/pam_sss.c:1714: alloc_arg: "asprintf" allocates memory that is stored into "prompt". src/sss_client/pam_sss.c:1765: leaked_storage: Variable "prompt" going out of scope leaks the storage it points to. # 1763| free(response); # 1764| # 1765|-> return ret; # 1766| #else # 1767| return ENOTSUP; ``` https://bugzilla.redhat.com/show_bug.cgi?id=1938876 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5560/head:pr5560 git checkout pr5560

3 years

2
11
0 / 0

[sssd PR#5562][opened] AD GPO: respect ad_gpo_implicit_deny if no GPO is present

by sumit-bose

URL: https://github.com/SSSD/sssd/pull/5562 Author: sumit-bose Title: #5562: AD GPO: respect ad_gpo_implicit_deny if no GPO is present Action: opened PR body: """ Currently ad_gpo_implicit_deny=True is not applied if there is no GPO at all for the given client. With this patch this case is handled as expected as well. Resolves: https://github.com/SSSD/sssd/issues/5561 :fixes: respect ad_gpo_implicit_deny if no GPO is present """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5562/head:pr5562 git checkout pr5562

3 years

3
12
0 / 0

[sssd PR#5566][opened] Fix exponent padding when deriving rsapubkey to ssh

by peptekmail

URL: https://github.com/SSSD/sssd/pull/5566 Author: peptekmail Title: #5566: Fix exponent padding when deriving rsapubkey to ssh Action: opened PR body: """ Padding is sometimes needed if a nonstandard exponent is chosen. The fix is just a couple of lines in cert.c But the integration-test requires a certificate to be pushed to LDAP and the output should match the pubkey derived from THE original certificate via p11-tool and openssh. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5566/head:pr5566 git checkout pr5566

3 years

4
26
0 / 0

[sssd PR#5569][opened] SYSV files updates

by alexey-tikhonov

URL: https://github.com/SSSD/sssd/pull/5569 Author: alexey-tikhonov Title: #5569: SYSV files updates Action: opened PR body: """ - removed unused SUSE/sssd.id - replaced '-f' option in gentoo/sssd.in """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5569/head:pr5569 git checkout pr5569

3 years

3
14
0 / 0

[sssd PR#5580][opened] ipa subdomains: do not fail completely if one step fails

by sumit-bose

URL: https://github.com/SSSD/sssd/pull/5580 Author: sumit-bose Title: #5580: ipa subdomains: do not fail completely if one step fails Action: opened PR body: """ Currently while updating server side data stored on an IPA server during a subdomains request the whole request will fail if a single step fails. As a result the remaining server side data which would have been looked up after the failed attempt are missing. With this patch a failure in a single lookup is not considered fatal and SSSD will try to read the remaining data after an error occurred. Resolves: https://github.com/SSSD/sssd/issues/5571 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5580/head:pr5580 git checkout pr5580

3 years

2
8
0 / 0

[sssd PR#5565][opened] Tests: Tests if shadow-utils are immune against bugs in 2006:0032

by aborah-sudo

URL: https://github.com/SSSD/sssd/pull/5565 Author: aborah-sudo Title: #5565: Tests: Tests if shadow-utils are immune against bugs in 2006:0032 Action: opened PR body: """ Tests if shadow-utils are immune against bugs in 2006:0032 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5565/head:pr5565 git checkout pr5565

3 years

4
16
0 / 0

[sssd PR#5558][opened] p11_child: Add partial verification support

by 3v1n0

URL: https://github.com/SSSD/sssd/pull/5558 Author: 3v1n0 Title: #5558: p11_child: Add partial verification support Action: opened PR body: """ From the main commit: <blockquote> As per the switch to libcrypto by default, the CA certificates DB needs to contain the whole certificates key-chain in order to verify a leaf certificate. This means that if an intermediate CA authority signed a leaf certificate the CA DB we provide to SSSD needs to contain the whole key-chain, up to the root CA cert in order to verify the leaf one. Now, while this is indeed more secure, it may break previous configurations that were based on an NSS database that contained only trusted intermediate CA certificates. To allow such setups to continue working (once the NSS db is migrated) we need to permit a "weaker" setup where an x509 certificate is verified when the CA database we test against contains only the intermediate CA certificate that was used to sign it. As per this, support `partial_chain` value to be used as `certification_verification` parameter that will add the `X509_V_FLAG_PARTIAL_CHAIN` verify param flag to the store, as the openssl's verify `-partial-chain` parameter works. This setup can still be considered secure as it's still needed to have configured the SSSD ca db to contain the trusted certs. Add tests to check that we can verify a leaf certificate against its parent (only) when using such option. </blockquote> In particular in Ubuntu we [switched to use libcrypto by default in our current LTS](https://bugs.launchpad.net/ubuntu/focal/+source/sssd/+bug/1905790), even if we never supported properly the usage of NSS system DB, it was possible to setup one and so we did a [simple migration tool](https://github.com/3v1n0/nss-database-pem-exporter) to export all the trusted NSS certificates to the SSSD's `ca_db`. However, there are still some custom setups in which [may break when using openssl based implementation](https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1919563), because their NSS db was only containing the issuing CA certificates (and no their parent certs) and so it's not possible to verify their certificate. So using `pam_cert_verification = partial_chain` on upgrades (only and only if migrated) we can ensure that no such system will be broken. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5558/head:pr5558 git checkout pr5558

3 years

3
31
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel April 2021