[PATCHES] Add HBAC time rules parsing
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[PATCH 1/2] Add missing include
When compiling the IPA time rules with just minimal _SOURCES (see
Makefile.am changes in PATCH 2/2) I noticed that util.h is missing
sys/types.h needed for mode_t.
[PATCH 2/2] IPA time rules parsing routines
Adds an interface for parsing the time rules used in HBAC and associated
testsuite.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkrxfacACgkQHsardTLnvCUMiQCgkjdg/vhjhGqrxqITazPDWaIF
HRwAoMIlJaoFKtw2ms5QJiO2aTDg02TH
=8SqZ
-----END PGP SIGNATURE-----
14 years, 5 months
[PATCH] Cleanups
by Simo Sorce
This patch adds some cleanups and fixes coding style deviations.
There are some more in the resolve code.
In 0001:
Make sure common->hostent is zero-freed (defensive programming)
Fix return for resolv_gethostbyname_recv()
Change resolv_gethostbyname_recv() to follow conventions (req is always
the first parameter)
Check result from resolv_gethostbyname_recv()
Simo.
--
Simo Sorce * Red Hat, Inc * New York
14 years, 5 months
should not return "x" for password when there is no shadow information
by Brian J. Murrell
I was going to file this as a bug in Trac but it's not clear how one
creates an account there.
Witness the difference between nss_ldap and sssd (0.7.1) with regard to
the password in passwd map entries:
nss_ldap $ getent passwd brian
brian:*:1001:1001:Brian J. Murrell:/home/brian:/bin/bash
sssd $ getent passwd brian
brian:x:1001:1001:Brian J. Murrell:/home/brian:/bin/bash
Notice that sssd is reporting an "x" in the password field when nss_ldap
is reporting an "*". The reason nss_ldap is reporting an "*" is because
there is no password information for this user in LDAP because this user
authenticates with kerberos.
The way nss_ldap knows whether to return an "x" or an "*" for the
password entry is based on whether the ldap entry has a shadowAccount
object class defined. It all makes sense doesn't it?
So, sssd needs to be doing the same thing. The reason is that the
pam_unix pam module's account personality does sanity checks on the
shadow information (password expired, going to expire?, etc.) when the
passwd entry says there is shadow information by specifying "x" in the
password field. If there is no shadow information, which there is not
when there is no authentication data in ldap, then the sssd NSS module
should be returning something other than an "x".
I'd be happy to test a patch, or even do the hacking myself if somebody
wants to point me to where this "hardcoding" of the "x" is.
Cheers,
b.
14 years, 5 months
Re: [SSSD] building rpms on rhel5
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 11/09/2009 03:33 AM, Ville Salmela wrote:
> Hi,
>
>
>
> I spoke in irc about building sssd on rhel5.
>
>
>
> There is a different behavior in building the git and tar.gz release. In
> git I can do autoreconf and in tar.gz I cannot. So building git succeeds
> with autoreconf -if && ./configure && make rpms.
>
>
>
> In git the VERSION file still says 0.7.0 Shouldn't it say 0.7.1?
>
>
>
> Best regards,
>
> Ville Salmela
>
Hmm, you're supposed to be able to do an autoreconf in the tarballs. If
this is broken, then we have regressed
https://fedorahosted.org/sssd/ticket/137 and this needs to be fixed
ASAP. I will take a look.
The VERSION file in git isn't really the current release version.
Internally, when we do our nightly builds, we just clobber that file and
replace it with the current build number.
The only time we update that file is as the last commit before releasing
a tarball. The reason this still lists 0.7.0 is because 0.7.1 occurred
in a maintenance branch, so the VERSION was never updated in the main tree.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkr4CQAACgkQeiVVYja6o6O33QCfSPcjyrv9RKUVfUrTyJ9lPZmM
BWAAoJKlsSpEzFTjM/BajssZ1KXxX3ri
=Z8/h
-----END PGP SIGNATURE-----
14 years, 5 months
What does "Unable to register control with rootdse" mean?
by David O'Brien
I've been playing around with having domains and services configured and
not, just to see how sssd behaves. What does this mean? Is it indicative
of something specific that I should be including in the doc?
[root@alice ~]# sssd -d4
[sssd] [ldb] (3): server_sort:Unable to register control with rootdse!
sssd requires both at least one configured domain and one service before
it will start. That is, using the local SSSD domain database provider
you still need either NSS or PAM enabled before sssd will even start.
(This may fall under the heading of "well, d'uh", but I'm just a
beginner ;) )
thanks a lot
--
David O'Brien
Red Hat Asia Pacific
+61 7 3514 8189
http://freeipa.org/page/DocumentationPortal
http://git.fedorahosted.org/git/ipadocs.git
"The most valuable of all talents is that of never using two words when
one will do."
Thomas Jefferson
14 years, 5 months
Emergency build fix
by Simo Sorce
I pushed this patch to fix the ldap driver build.
Sorry for the mess-up.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
14 years, 5 months
[PATCH] added access module of IPA provider
by Sumit Bose
Hi,
this is the first part of the access target of the IPA provider. It is
not complete but I thought it might be easier to review if the next
features are coming in smaller patches. Currently the service and user
data of the HBAC rules are evaluate.
If you want to test it you need a current IPA v2 server together with
some uncommited patches, namely
- [PATCH] Make ldap2.convert_attr_synonyms more robust against schema
lookup fails.
- [Freeipa-devel] [PATCH] Handle ipaEnabledFlag as bool (TRUE/FALSE)
instead of string (enabled/disabled).
and if you use 1.9.0
- [Freeipa-devel] [PATCH] 303 proper syntax for fqdn
bye,
Sumit
14 years, 5 months
[PATCHES] Fail over helper functions and reference counting wrappers
by Martin Nagy
Hi,
attached are patches needed for the fail over functionality. The
service discovery is not there yet, I want to hold of with that until I
have at least a basic SRV-based one so I can test it properly. It's
possible that we will discover something missing when we'll be
integrating it into providers. Together with Steven we at least figured
out that for ldapi:// for example we need an "extra" treatment. So I
made the name resolution optional and you can provide a server with
user data. The commit messages and header files should explain it
better.
Martin
14 years, 5 months