URL: https://github.com/SSSD/sssd/pull/271 Author: sumit-bose Title: #271: pam: properly support UPN logon names Action: opened
PR body: """ Many logon applications like /bin/login or sshd canonicalize the user name before they call pam_start() and hence the UPN is not seen by SSSD's pam responder. But some like e.g. gdm don't and authentication might fail if a UPN is used.
The reason is that currently the already parsed short name of the user was used in the cache_req and hence the cache_req was not able to fall back to the UPN lookup code. This patch uses the name originally provided by the user as input to allow the fallback to the UPN lookup.
Resolves https://pagure.io/SSSD/sssd/issue/3240 """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/271/head:pr271 git checkout pr271
URL: https://github.com/SSSD/sssd/pull/271 Title: #271: pam: properly support UPN logon names
fidencio commented: """ @sumit-bose, the patch itself looks fine. I'll do some tests on my side here and get back with a final ACK by Tomorrow (probably). """
See the full comment at https://github.com/SSSD/sssd/pull/271#issuecomment-301449559
URL: https://github.com/SSSD/sssd/pull/271 Title: #271: pam: properly support UPN logon names
jhrozek commented: """ retest this please """
See the full comment at https://github.com/SSSD/sssd/pull/271#issuecomment-303037934
URL: https://github.com/SSSD/sssd/pull/271 Author: sumit-bose Title: #271: pam: properly support UPN logon names Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/271/head:pr271 git checkout pr271
URL: https://github.com/SSSD/sssd/pull/271 Title: #271: pam: properly support UPN logon names
sumit-bose commented: """ @fidencio found an issue with the patch while testing, cache_req_send() should not be called with the domain name to allow cache_req to properly split a fully-qualified name.
As a result a I found that the Initgroups by UPN does not use the right negative cache, this is fixed in 'cache_req: use the right negative cache for initgroups by upn'. @lslebodn, do we need a separate ticket/PR for this?
Finally I addded 'test: make sure p11_child is build for pam-srv-tests' so that 'make ./pam-srv-tests' can be called in a clean environment and the test will still pass. """
See the full comment at https://github.com/SSSD/sssd/pull/271#issuecomment-303103408
URL: https://github.com/SSSD/sssd/pull/271 Title: #271: pam: properly support UPN logon names
fidencio commented: """ @sumit-bose: Thanks for patches. This new version does work as expected.
IMO, you could just add "Related to: ..." in the cache_req patch and avoid a separate ticket/PR for this one.
ACK! """
See the full comment at https://github.com/SSSD/sssd/pull/271#issuecomment-303219616
URL: https://github.com/SSSD/sssd/pull/271 Title: #271: pam: properly support UPN logon names
Label: +Accepted
URL: https://github.com/SSSD/sssd/pull/271 Title: #271: pam: properly support UPN logon names
jhrozek commented: """ * master: * 29d063505c07127f7747405b1a61d8f782673645 * ec9ac22d699a17d590b1d4ba9ba3750eb719f340 * 870b58a6cc6b5cf92a6503c1578e5c21617c8d40 """
See the full comment at https://github.com/SSSD/sssd/pull/271#issuecomment-303344506
URL: https://github.com/SSSD/sssd/pull/271 Author: sumit-bose Title: #271: pam: properly support UPN logon names Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/271/head:pr271 git checkout pr271
URL: https://github.com/SSSD/sssd/pull/271 Title: #271: pam: properly support UPN logon names
Label: +Pushed
sssd-devel@lists.fedorahosted.org
-
fidencio -
jhrozek
-
sumit-bose