wildcard chars for sssd.conf?
by David O'Brien
from IRC when everyone was sleeping ;-)
davido [Mon 18:28] is there such a thing as a wildcard character that
works in /etc/sssd/sssd.conf ?
davido [Mon 18:29] I tried filter_groups = * to see if I could break it
but it didn't work
davido [Mon 18:30] I should rephrase that... it didn't break
thanks
--
David O'Brien
Red Hat Asia Pacific
+61 7 3514 8189
http://freeipa.org/page/DocumentationPortal
http://git.fedorahosted.org/git/ipadocs.git
"The most valuable of all talents is that of never using two words when
one will do."
Thomas Jefferson
14 years, 5 months
Re integration of SSSD config into authconfig
by David O'Brien
Stephen,
Re Ticket #46: Integrate SSSD configuration into authconfig
How can I check this out (in the "have a look" sense, not the "check out
of repository" sense)? I remember reading something about using
authconfig and selecting LDAP, and then replacing LDAP with SSSD in the
appropriate files, but that doesn't seem like very extensive integration
(and I can't find that para right now, of course).
thanks
--
David O'Brien
Red Hat Asia Pacific
+61 7 3514 8189
http://freeipa.org/page/DocumentationPortal
http://git.fedorahosted.org/git/ipadocs.git
"The most valuable of all talents is that of never using two words when
one will do."
Thomas Jefferson
14 years, 5 months
[PATCH] implement cleanup task
by Simo Sorce
Ok, so far we have been sort of cheating as we never removed users once
added.
In the last few weeks, part of the work I did with various patches was
in preparation to add this clean-up task in a way that was at least
somewhat efficient and wouldn't keep hammering your ldap server too
much.
The biggest problem is that it is easy to search for users that exist,
but you can't easily ask the ldap server to tell you which users do not
exist anymore.
Some LDAP implementations have a tombstone that we might decide to use
to further optimize this task, but this is not always a given and they
are usually product specific so we needed a generic way first.
The task can be used in 2 ways.
1. with enumerations
2. when enumerations are disabled
The way it work is that is uses the recently added expiration date to
search all entries that have "expired". If you do this right after an
enumeration you normally hit only entries that have not been updated and
therefore most probably entries that need to be deleted.
Once we have a list of entries to check we proceed validating one by one
using a base search and the originalDN stored in the entry.
For cases where enumeration is not used, this basically means a refresh
of the entries that have been retrieved so far.
So when enumerations are enabled we don't actually run an independent
cache_purge task, we just attach a purge_cache operation after the
enumeration completed successfully.
When enumerations are not enabled instead the ldap_purge_cache_timeout
determines how often this task is run.
By default we run this task only once every hour.
Additionally this patch fixes the code to actually remove entries if a
normal lookup call fails, we weren't actually doing that for the ldap
driver case (it was implemented in the proxy backend case).
So here are 2 patches:
0001 add some functions I needed for the task to sysdb and reworks a few
others
0002 the actual cleanup task files.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
14 years, 5 months
[PATCH] Simplify krb5 child handler
by Sumit Bose
Hi,
this patch simplifies then child handling of the kerberos provider to
reduce the number of missleading debug messages.
bye,
Sumit
14 years, 5 months
[PATCH] Fix segfault on unknown user/domain
by Stephen Gallagher
The root cause was that preq->domain was set to NULL, because it
couldn't locate a corresponding domain for this user.
I have reordered this conditional such that we first test that we are in
the PAM_SUCCESS case of an SSS_PAM_AUTHENTICATE call. In this situation,
preq->domain is guaranteed to be valid.
I could have added an explicit check, but it seemed wasteful.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
14 years, 5 months
[PATCH] Fix for #236
by Simo Sorce
Except some rare cases out use of tevent_req_is_error() was dangerous.
Almost everywhere where we used it it was probably ok, but given the
semantics of that function I think using the macro in this patch is much
safer.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
14 years, 5 months
[PATCH] Assorted manpage fixes
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Tracked as #255
Assorted manpage fixes, found by David during his review of documentation.
* do not mention the sbus_timeout parameter at all
* document the config_file_version parameter
* different wording for negative cache
Jakub
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkr4EmcACgkQHsardTLnvCVPVgCg3aO/x/K+rKMhfE+BQ5mGMHDC
pFQAoNgaIESbOcgLsNUs5Vn59ktSXaZv
=cDZq
-----END PGP SIGNATURE-----
14 years, 5 months