[PATCH] Do not remove man pages in released tar balls
by Sumit Bose
Hi,
make clean removes the generated man pages even in the distributed
version where they cannot be recreated because we do not ship the xml
sources. This patch checks if src/man/include, which we do not ship
either, exists before removing the files.
bye,
Sumit
13 years, 6 months
Announcing SSSD 1.2.4
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The SSSD team is proud to announce the immediate release of version
1.2.4 of the System Security Services Daemon. This update fixes several
serious bugs in the 1.2.x line of SSSD and is a recommended update for
all users.
It can be downloaded at https://fedorahosted.org/sssd
== Highlights ==
* Resolves long-standing issues related to group processing with
RFC2307bis LDAP servers
* Fixed bugs in RFC2307bis group memberships related to initgroups
* Fix tight-loop bug on systems with older OpenLDAP client libraries
(such as Red Hat Enterprise Linux 5)
== Detailed Changelog ==
Héctor Daniel Cabrera (1):
* Updating ES translation
Jakub Hrozek (9):
* Fix sysdb_group_dn_name
* Fix sysdb_attrs_to_list
* Request the correct attribute name
* End update_members request if there's nothing to do
* sysdb interface for adding incomplete group entries
* Add fake groups during initgroups
* sysdb interface for adding expired user entries
* Shortcut for save_group() to accept sysdb DNs as member attributes
* Add fake users during saving of RFC2307 group
Jan Zeleny (1):
* Disable events on ldap fd when offline.
Simo Sorce (1):
* Add option to limit nested groups
Stephen Gallagher (8):
* Request all group attributes during initgroups processing
* Add common hash table setup
* Make sdap_save_users_send handle zero users gracefully
* Handle nested groups in RFC2307bis
* Make user argument of sysdb_update_members_send a const
* Modify sysdb_add_group_member_send to accept users and groups
* Add proper nested initgroup support for RFC2307bis servers
* Releasing version 1.2.4
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkyvrhwACgkQeiVVYja6o6NG/gCgsIiRGlDSipnZJe9fr8wZAxaD
osIAoJKRu9XeY5y7BjBf8GMc1WyNHLjq
=fo2a
-----END PGP SIGNATURE-----
13 years, 6 months
[PATCHES] Initgroups support for RFC2307bis nested groups (sssd-1-2)
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
These patches must be applied atop my patches in the thread "Handle
nested groups in RFC2307bis (sssd-1-2)", which in turn must be applied
atop Jakub's patches in the thread "Fix initgroup processing for RFC2307
(sssd-1.2)".
These patches rely on the fake group functionality added by Jakub's patches.
Patch 0001: Make user argument of sysdb_update_members_send a const
This argument should have been const to begin with, as the function
should not modify it. This removes a const pointer issue from patch 3
(since it was more sensible to just send a const string than make a
useless copy)
Patch 0002: Modify sysdb_add_group_member_send to accept users and groups
Previously, it assumed that all members were users. This changes
the interface so that either a user or a group can be specified.
Patch 0003: Add proper nested initgroup support for RFC2307bis servers
This patch handles the general case, that of any RFC2307bis server. The
memberOf optimizations that we were previously relying on are still
available if ldap_schema=IPA is set in the sssd.conf.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkyuctsACgkQeiVVYja6o6P6fwCfZnXU1vD7YoUw+pwIo39G8TlA
56gAmwcR7hLw20DTerjis+N/fpeQNv8D
=6AP4
-----END PGP SIGNATURE-----
13 years, 6 months
[PATCHES] Handle nested groups in RFC2307bis (sssd-1-2)
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
These patches apply atop Jakub's "Fix initgroup processing for RFC2307
(sssd-1.2)" patches.
Patch 0002: Add option to limit nested groups
Patch 0003: Handle nested groups in RFC2307bis
This first approach handles the non-optimized "pure" RFC2307bis
case. It recursively calls into nested groups until it it has
found them all or hits the pre-defined nesting limit.
It then saves all member users first, then all groups to the sysdb
This patch only handles the general case of RFC2307bis nested groups. It
contains no optimizations for memberOf implementations. Given that we
have time constraints, this patch should handle all implementations of
RFC2307bis correctly (if not high-performance).
Support for partial (AD) and complete (IPA) memberOf will be added to
the master branch later.
Still to do: initgroups for RFC2307bis using Jakub's fake groups.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkysmk8ACgkQeiVVYja6o6MQRACfTOiHz0JwvJ5C1P2iaiMKXz7g
eS0An21yo8giW5uVR92mN+zeYwQFU3nK
=Qx3A
-----END PGP SIGNATURE-----
13 years, 6 months
[PATCH] Return all user members for RFC2307 groups (sssd-1.2)
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[PATCH 1/3] sysdb interface for adding expired user entries
These are added instead of looking up the members.
[PATCH 2/3] Shortcut for save_group() to accept sysdb DNs as member
attributes
This patch is a backport of original written by Ralf Haferkamp.
[PATCH 3/3] Add fake users during saving of RFC2307 group
Instead of looking up the user entries, we just add dummy expired users
that are refreshed when they are requested with getpwnam/getpwuid
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkyrXCUACgkQHsardTLnvCWpwACg33dycv5TL1CZsVwvl9SFyJIK
W4gAoL+FaNyFUJG155eM63df5C9xq9CT
=lvCd
-----END PGP SIGNATURE-----
13 years, 6 months
[PATCH] Fix initgroup processing for RFC2307 (sssd-1.2)
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
these patches supersede those in threads:
[PATCH] Save dummy groups to cache during initgroup (sssd-1.2)
and:
[PATCH] End update_members request if there's nothing to do(sssd-1.2)
I am sending them separately so that it's easier to test and apply them.
Patch #1 has already been acked, patches #2 and #3 were nacked on IRC
for a minor issue, so hopefully should be OK, too.
They apply directly on top of origin/sssd-1-2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkyskS8ACgkQHsardTLnvCVLNACg6m+nl1rUCUF45JiQJEvhCRCW
7i4An3J5SMfQZzuOOIzrbnW6j7KcKUZ7
=2ZDi
-----END PGP SIGNATURE-----
13 years, 6 months
[PATCH] Add common hash table setup
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
sss_hash_create() produces a dhash table living in the talloc
hierarchy.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkysmOoACgkQeiVVYja6o6NhBwCcCbhvJ/df1qtYRIqoGHvW0nIP
oFQAnAxd3MNFlg0tkYR91/cwIyEA22N1
=swMP
-----END PGP SIGNATURE-----
13 years, 6 months
[PATCH] Fix log filling with error message
by Jan Zelený
I'm sending a patch solving ticket #599 for review. After I tried some other
solutions, this one seemed to be the most simple one which didn't cause any
problems.
My only concern was whether monitoring the LDAP socket will be restored once
the backend goes online. Looking at the code, it should, because
sdap_install_callbacks is called every time sh->connected is set to true. But
still I wanted to be sure. From testing performed by Dmitri, it seems that I
was right and the backend is correctly restored.
Here is a complete test case:
1. Disconnect from the network
2. Try to log in
-- the data provider should now go offline
3. Connect to the network
4. Wait for the log filling message to appear in the log
-- ! The messsage should appear only once !
5. If the message doesn't appear, repeat from step 1
6. If the message appeared, try to log in
7. If successful, check that the login was performed online and not from
cached credentials
8. Step 7 might need to be repeated a couple times, it takes some time for
SSSD to go online again
Note: the reproduction of this issue might not be that easy. To achieve the
message appearing in the log, you would have to try different scenarios (NB
connected using VPN -> suspended -> woke up in the company network ->
suspended -> ...)
Jan
13 years, 6 months
Hash table for PAM requests
by Jan Zelený
Hi,
I have a question regarding PAM responder. I'm currently working on
implementation of a hash table for PAM requests (ticket #533). I have done a
large part, but now I found something which made me curios about the whole
concept of my implementation.
I'm assuming PAM responder works this way:
1) Receive PAM request
2) Delegate it to all domains
3) If any domain is marked as offline, ask the domain cache for that record
I've implemented the hash table to be used for requests going to domain
providers, not the local ones (i.e. those which are going to cache). I think
in the context of the ticket #533 this is the right approach, because when the
domain is offline, I won't get a kerberos ticket anyway, so there is no way that
two users simultaneously logging in will get two credential cache files. Or do
you think I should implement it for both domain and cache requests in case the
domain goes online after the first but before the second request?
Thanks for any advice
Jan
13 years, 6 months
Ordering of the group info and initgr patches for 1.2
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
as there are already many patches on the list, here is a simple
dependency chain between them:
3) group info fixes:
[PATCH 1/3] sysdb interface for adding expired user entries
[PATCH 2/3] Shortcut for save_group() to accept sysdb DNs as member
attributes
[PATCH 3/3] Add fake users during saving of RFC2307 group
2) initgroup fixes:
[PATCH 1/2] sysdb interface for adding expired group entries
[PATCH 2/2] Add fake groups during initgroups
1) [PATCH] End update_members request if there's nothing to do
0) origin/sssd-1-2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkysfc0ACgkQHsardTLnvCVFIwCgpoovwksxXCQn4x0mDV5+HsVv
l68An3BpvSwpnVeL8IHn9YOGNe4EeIyM
=WBc3
-----END PGP SIGNATURE-----
13 years, 6 months