[PATCH] Remove useless assignment to function parameter
by Lukas Slebodnik
ehlo,
Reported by: cppcheck
void free_fun(struct info *info)
free(info->name);
free(info);
info = NULL;
^^^^^^^^^^^
Assignment to function parameter has no effect outside the function.
Patch is attached.
LS
10 years, 2 months
1.11.4 can't update reverse zone
by steve
Hi
We have Samba4 AD with dyndns updates working fine for the forward zone:
(Tue Feb 18 16:12:37 2014) [sssd[be[default]]] [ad_dyndns_nsupdate_done]
(0x0040): DNS update finished
But not the reverse zone:
(Tue Feb 18 16:13:41 2014) [sssd[be[default]]] [ad_dyndns_nsupdate_done]
(0x0040): DNS update finished
update failed: REFUSED
(Tue Feb 18 16:13:51 2014) [sssd[be[default]]] [child_sig_handler]
(0x0020): child [27754] failed with status [2].
(Tue Feb 18 16:13:51 2014) [sssd[be[default]]] [nsupdate_child_handler]
(0x0040): Dynamic DNS child failed with status [512]
(Tue Feb 18 16:13:51 2014) [sssd[be[default]]] [be_nsupdate_done]
(0x0040): nsupdate child execution failed [1432158228]: Dynamic DNS
update failed
(Tue Feb 18 16:13:51 2014) [sssd[be[default]]]
[sdap_dyndns_update_ptr_done] (0x0080): nsupdate failed, retrying with
server name
update failed: REFUSED
And named with bind dlz over on the DC:
2014-02-18T16:11:51.243855+01:00 hh16 named[2657]: samba_dlz: starting
transaction on zone 1.168.192.in-addr.arpa
2014-02-18T16:11:51.246508+01:00 hh16 named[2657]: samba_dlz:
disallowing update of signer=CATRAL\$\(a)HH3.SITE
name=21.1.168.192.in-addr.arpa type=PTR error=insufficient access rights
2014-02-18T16:11:51.247290+01:00 hh16 named[2657]: client
192.168.1.21#39914/key CATRAL\$\(a)HH3.SITE: updating zone
'1.168.192.in-addr.arpa/NONE': update failed: rejected by secure update
(REFUSED)
2014-02-18T16:11:51.247830+01:00 hh16 named[2657]: samba_dlz: cancelling
transaction on zone 1.168.192.in-addr.arpa
2014-02-18T16:11:51.672609+01:00 hh16 named[2657]: samba_dlz: starting
transaction on zone 1.168.192.in-addr.arpa
2014-02-18T16:11:51.675807+01:00 hh16 named[2657]: samba_dlz:
disallowing update of signer=CATRAL\$\(a)HH3.SITE
name=21.1.168.192.in-addr.arpa type=PTR error=insufficient access rights
2014-02-18T16:11:51.676405+01:00 hh16 named[2657]: client
192.168.1.21#33287/key CATRAL\$\(a)HH3.SITE: updating zone
'1.168.192.in-addr.arpa/NONE': update failed: rejected by secure update
(REFUSED)
Question: Does the new code work against AD?
Thanks,
Steve
sssd.conf
[sssd]
#debug_level = 9
services = nss, pam, autofs
config_file_version = 2
domains = default
[nss]
[pam]
[autofs]
[domain/default]
#debug_level = 9
dyndns_update=true
dyndns_update_ptr=true
dyndns_refresh_interval = 8
ad_hostname = catral.hh3.site
ad_server = hh16.hh3.site
ad_domain = hh3.site
ldap_schema = ad
id_provider = ad
access_provider = ad
enumerate = false
cache_credentials = true
#entry_cache_timeout = 60
auth_provider = ad
chpass_provider = ad
krb5_realm = hh3.site
krb5_server = hh16.hh3.site
krb5_kpasswd = hh16.hh3.site
ldap_id_mapping=false
ldap_referrals = false
ldap_uri = ldap://hh16.hh3.site
ldap_search_base = dc=hh3,dc=site
ldap_user_object_class = user
ldap_user_name = samAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = loginShell
ldap_group_object_class = group
ldap_group_search_base = dc=hh3,dc=site
ldap_group_name = cn
ldap_group_member = member
ldap_sasl_mech = gssapi
ldap_sasl_authid = CATRAL$(a)HH3.SITE
krb5_keytab = /etc/krb5.keytab
ldap_krb5_init_creds = true
autofs_provider=ldap
ldap_autofs_search_base = OU=automount,DC=hh3,DC=site
ldap_autofs_map_object_class = automountMap
ldap_autofs_entry_object_class = automount
ldap_autofs_map_name = automountMapName
ldap_autofs_entry_key = automountKey
ldap_autofs_entry_value = automountInformation
10 years, 2 months
[PATCH] MAN: Clarify the ldap_access_filter option further
by Jakub Hrozek
The attached patch addresses:
https://fedorahosted.org/sssd/ticket/2235
The memberof example was misleading and was making aministrators think
that the ldap_access_filter can resolve nested group memberships.
The alternative I was considering was changing the example to use a
different attribute altogether, but I was struggling to come up with an
example that wouldn't be too artificial (like
ldap_access_filter=/bin/bash).
10 years, 2 months
Re: [SSSD] [PATCH] IPA: check ranges for collisions before saving them
by Sumit Bose
On Wed, Feb 19, 2014 at 04:23:55PM +0100, Jakub Hrozek wrote:
> On Wed, Feb 12, 2014 at 03:43:51PM +0100, Sumit Bose wrote:
> > Hi,
> >
> > currently we trust the idrange data we get from the IPA server. But it
> > turned out that some checks are missing on the server
> > (https://fedorahosted.org/freeipa/ticket/4137) so SSSD should check the
> > input before saving the data to the cache.
> >
> > The first two patches make some code which already exists available for
> > other callers. The third contains the actual functionality.
> >
> > bye,
> > Sumit
>
> Hi, I rebased your patches on top of master, can you check if they look
> OK to you and resend if they are fine? I'll continue testing with my
> version in the meantime.
sorry I forgot to send a version for master myself. The patches are
exactly the same as in my master tree.
Thanks
bye,
Sumit
10 years, 2 months
[PATCH] UTIL: Sanitize spaces.
by Lukas Slebodnik
ehlo,
resendig patch from trac to review.
Original patches submitted by: mpesari(Thanks!!)
It can cause problems if user will hit spaces before entering username.
(e.g in gdm). Spaces are ignored by LDAP; it's better to escape them.
Resolves:
https://fedorahosted.org/sssd/ticket/1955
Do we want to escape '\t' (horizontal tab) as well?
LS
10 years, 2 months
[PATCH][PUSHED] Fix DEBUG message formatting
by Jakub Hrozek
Hi,
I pushed the attached patch to master under the one-liner rule. It's
just amending the multi-line DEBUG messages so that there is a space
between the two words.
10 years, 2 months
Discussion: OpenLMI provider + D-Bus responder
by Pavel Březina
Hi folks,
for the first iteration of SSSD provider for OpenLMI I have created a
very simple model, that handles the most fundamental parts of SSSD:
domains and services (responders) - listing, activation and deactivation.
MOF class for this model is attached. It still lacks some annotation and
description but I think it is pretty much straightforward and doesn't
need any more explanation for developers.
The model contains four kinds of methods:
- get all supported (configured) services (domains)
- get active services (domains)
- enable service (domain)
- disable service (domain)
I've chosen this approach so we don't have to amend the model with each
new responder. So instead of EnableNSSService(), users will use
EnableService('nss').
Restart of SSSD deamon shall be handled by standard service provider, so
we don't have to deal with it - we just let users know that some changes
requires restarting. However, I'm inclined to create a method under SSSD
object (LMI_SSSD::Restart) to make the interface more complete in later
stage.
Now I'm looking for a way how the LMI provider will communicate with
SSSD. I've been playing with Jakub's D-Bus responder for a while and it
seems like a good way to go. We can expose everything we need over D-Bus
with proper access control and it all stays under SSSD control, having
LMI provider only as a simple client.
I would like to create a client wrapper over provided D-Bus interface
(say libsss_dbus), that will provide simple synchronous interface to
query D-Bus, encapsulating most of the D-Bus complexity. I have prepared
a proof of concept for this library, using both libdbus and recommended
libdbus-glib. It encapsulates ListDomains and property Get D-Bus method.
You can see both versions here:
- libdbus:
http://fedorapeople.org/cgit/pbrezina/public_git/sssd_gdbus.git/tree/src/...
- libdbus-glib:
http://fedorapeople.org/cgit/pbrezina/public_git/sssd_gdbus.git/tree/src/...
Probably the biggest advantage of libdbus-glib is the simplicity of work
with variants and dictionaries. However, I think it is quite an overkill
for our needs. I'm more inclined to use libdbus and write an automatized
parser for those data types, it won't be hard.
What do you say? Should I go this way?
Jakub, can you send the D-Bus responder to the list? It would be nice to
include it in master as an experimental feature and create tickets for
further work so we can work on it simultaneously.
10 years, 2 months