[PATCH] Add common SIGCHLD handling.
by Pavel Zuna
Base on the second proposal:
https://fedorahosted.org/sssd/wiki/DesignDocs/SigChld
There is some old SIGCHLD handling code in src/providers/child_common.[ch], that
should probably go away if this gets accepted. There was also a naming conflict
with the sss_child_ctx structure. This structure is only used internally by
functions defined src/providers/child_common.c. I renamed the original structure
to sss_child_ctx_old for now.
Pavel
12 years, 5 months
[PATCH] Pass client context to sss_dp_get_account_send
by Jakub Hrozek
My recent fix "DP: Remove processed callbacks" uncovered another bug
which needs immediate attention - any NSS operation currently aborts in
git HEAD. That's my fault, I only tested my previous fix with cached user
data inside the PAM responder where the new bug does not hit. Sorry for that.
The problem is memory hierarchy. When user data update is requested
from check_cache(), the sss_dp_callback structures are created on
sss_domain_context. However, when the callback is called, it goes all the
way into nss_cmd_getpw_send_reply() where the command context is freed,
freeing also sss_domain_context and the sss_dp_callback data. That's a
problem because we are still looping over the callback data.
Attached is a patch that changes the memory context for the
sss_dp_callback to the client context so it's kept even when the command
finishes. The callbacks are freed in the sss_dp_get_account_int_done()
function after the callback finishes so we're not keeping them for long.
The other solution I was thinking about was to not call the callbacks
directly, but only schedule them with tevent_schedule_immediate() so
that we can safely loop over all the callbacks, free the sdp_req and
then let the clients do whatever they need to.
12 years, 5 months
Question about sssd and dns
by Marco Pizzoli
Hi,
I started to look at the documentation of FreeIPA and SSSD.
Now I'm curious to know about the relationship between sssd and the dns
servers.
As I can see, obviously, the deployment of all windows-style services are
led by a query/response by sssd to dns servers, possibly directly to the
FreeIPA dns server.
When deploying sssd I have to configure the resolv.conf file. Is hereafter
sssd the only service which is *required* to use that file?
I'm thinking to the unix/linux farm of my office in which, by taking a
weighted choice, they decided to not use the dns servers, relying only on
/etc/hosts files.
If you confirm this, do you think it would be a good idea the filing of a
feature request asking to have an option for sssd to choose the resolv.conf
file to point to?
So I could use a file called, for example, "/etc/resolv.conf.FreeIPA". So I
can be sure that no other services will use that dns's.
Thanks in advance
Marco
--
_________________________________________
Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi.
Jim Morrison
12 years, 5 months
Comment about SSSD LDAP Provider vs. Winbind
by Pasi Kärkkäinen
Hello,
Feedback about:
"[SSSD] IMPORTANT: Your input requested: SSSD LDAP Provider vs Winbind":
https://fedorahosted.org/pipermail/sssd-devel/2011-December/007721.html
Sorry, I wasn't subscribed to the list earlier, so I couldn't reply to the original thread..
Why people use Winbind:
- Allows integration between Linux and Active Directory easily.
- No changes/modifications needed to AD or AD schemas.
- No changes/modifications needed to AD users.
- UID/GID generation/mapping on Linux side, no need to add UNIX attributes to AD users.
- Linux computers using Winbind auth (joined to AD) show up as computer objects in AD.
So in short.. if you want/need to easily and quickly integrate a couple of Linux servers/computers with AD,
it's very simple and straight-forward with Winbind.
(Yes I realize using krb5+LDAP instead, and configuring UNIX attributes for users in AD, is much better,
but it's also more complicated to set up and might be "overkill" for some smaller environments).
So I think as long as SSSD LDAP Provider allows "Winbind style" easy setup,
mainly UID/GID generation/mapping on Linux side, it's good to replace Winbind..
My 2 (euro) cents..
-- Pasi
12 years, 5 months
Building for Red Hat/CentOS 4
by Juan Asensio Sánchez
Hi
I am trying to build SSSD in Red Hat 4U5 (perhaps something
impossible), but when I try to run "make rpms", as the howto says, I
get this error:
[root@rh4 sssd.git]# LANG=C make rpms
make: *** No rule to make target `rpms'. Stop.
I have no much experience compiling packages, but I have revised
Makefile.am ans there is a section about building that rule:
rpms: dist-gzip rpmroot
cp $(builddir)/contrib/sssd.spec $(RPMBUILD)/SPECS
cp $(distdir).tar.gz $(RPMBUILD)/SOURCES
cd $(RPMBUILD); \
rpmbuild --define "_topdir $(RPMBUILD)" -ba SPECS/sssd.spec
Perhaps I need a more recent version of compiling tools?
Regards and thanks in advance.
12 years, 5 months
[PATCH] Ability to set a domain as case sensitive or insensitive
by Jakub Hrozek
[PATCH 1/6] sss_utf8_tolower utility function+unit tests
This will be used later on to lowercase the usernames. Also includes
unit tests for the whole sss_utf8 module.
[PATCH 2/6] Responders: Split getting domain by name into separate function
A utility function originally written for the SUDO responder, but it
turns out it's useful earlier
[PATCH 3/6] Use the case sensitivity flag in responders
Reads the configuration option and includes its handling in the
responders.
Unfortunately some parts like negative cache are more complex because one
domain can be case sensitive and another insensitive during multidomain
searches.
[PATCH 4/6] Refactor saving sdap entities
There was too much code duplication between sdap_save_{user,group,netgroup}
and my later patch would add even more. This patch removes the most egregious
cases.
[PATCH 5/6] Use the case sensitivity flag in the LDAP provider
When saving users,groups and netgroups, saves the lowercase version of
the name as an alias in addition to the original name that is still
stored as name as well as part of RDN.
[PATCH 6/6] Use the case sensitivity flag in the simple access provider
Performs string comparisons in case sensitive or insensitive manner
depending on the configuration.
12 years, 5 months