[PATCH] add IPA backend
by Simo Sorce
This patcheset does the minimal necessary work to separate
initialization from actual providers code for ldap and kerberos and uses
this to introduce a first basic ipa provider skeleton that simply reuses
the ldap and krb5 providers code.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
13 years, 5 months
Design question
by Dmitri Pal
Hi,
Couple questions about async processing.
The communication usually consists of several parts. Imagine that you
have an object that is responsible for some sort of communication
(socket, pipe, file, bus - whatever).
Here are the basic things that can happen with such object:
* Object is created
* Communication channel is opened
* Message is sent (and may be you get response back)
* Communication channel is closed
* Object is destructed
Object creation and destruction are the same regardless of whether the
communication is synchronous or asynchronous.
They are pretty straightforward. So let us talk about the other three.
Definitely communication on the channel can (and should) be asynchronous
- this is the whole purpose.
But what about opening the channel. Should a file or socket be always
opened as "O_NONBLOCK" or
the event library would set the flag on the FD itself?
I guess the question who is responsible for making socket/fd nonblocking
the creator of it or the async library that provided the event loop?
Now imagine the situation: the opening of the channel includes actually
two steps, establishing the channel itself (TCP for example) and sending
some sort of the HELLO message.
Can this hello message be done synchronously or the connection should
be established in async way and the hello message should be treated as
any other message?
I understand that the preferred way is to do it asynchronously but the
question is: is it acceptable not to at least in the first implementation?
Same question about closing the channel when this operation involves
sending some sort of good bye message first. Is it acceptable to send
and close in one step synchronously or not?
--
Thank you,
Dmitri Pal
Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
13 years, 5 months
[PATCHES] Clean up some warnings
by Stephen Gallagher
Most of these warnings are seen only on older platforms like RHEL5.
0001: Clean up warnings in pysss.c
On older versions of the python headers, some arguments used
'char *' instead of 'const char *', which means that assigning a
constant string such as "adduser" threw a warning about discarding
qualifiers.
This patch cleans up most of these warnings in this file. There
remain several warnings in the sss_local_methods initialization
that I do not know how to fix.
0002: Remove warnings caused by 5e2301b8a75d10e5cbbe11e26e5192b894af6ad7
There were unused functions still being compiled. This will
suppress them until we turn live configuration updates back on.
0003: Remove two unused functions.
These functions were used when reconnecting to the DP after losing
the connection. Since there is no DP any longer, there's no reason
to have these functions.
--
Stephen Gallagher
RHCE 804006346421761
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
13 years, 5 months
[PATCH] set chpass_provider implicit if not set explicit
by Sumit Bose
Hi,
if auth_provider is set to a provider which can handle change password
request, e.g. LDAP, but chpass_provider is not set at all the user might
be surprised that the password connet be changed. This patch sets
chpass_provider implicit if an auth_provider is available and can handle
change password requests. If you want to disallow password changes
explicitly use 'chpass_provider = none'.
This patch should fix one part of #220.
bye,
Sumit
13 years, 5 months
[PATCH] enable debugging of krb5_child
by Sumit Bose
Hi,
Although there are lots of DEBUG calls in krb5_child it always runs with
debug_level=0. This patch starts krb5_child with the debugging options
of the backend.
There is a problem with --debug-to-files. krb5_child runs as the user
requesting the ticket so the path to krb5_child.log needs to have
matching permissions. A possible solution would be to create the file
with 666 permissions during the setup of the kerberos backend. Any other
ideas?
bye,
Sumit
13 years, 5 months
[PATCH] Check for expired passwords in LDAP provider
by Sumit Bose
Hi,
with this patch the LDAP provider check typical attributes which
determines the lifetime of a password. If there is more than one scheme
available the following order is user:
- server side password policies
- Kerberos password attributes
- shadow attributes
Currently only in the case of server side password policies the password
can actually be changed. Kerberos password should be changed with the
Kerberos backend.
bye,
Sumit
13 years, 5 months
[PATCH] fix offline auth
by Simo Sorce
Offline authentication got broken when we removed the Data Provider.
Before the bug was masked by the DP itself, so it became evident only
when DP has been removed.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
13 years, 5 months