sssd-1.4.1 nested groups rfc2307bis
by Sergei V. Kovylov
Hello everyone.
Can you clarify the situation about nested groups?
When I use rfc2307bis I'm not able to get membership from nested groups.
Example:
GRP-SVC-SSH-NODE
|- user1
|- user2
GRP-SVC-SSH-NODE1
|- GRP-SVC-SSH-NODE
Users from GRP-SVC-SSH-NODE are not members of GRP-SVC-SSH-NODE1.
In previous version 1.3.1 it works, but from 1.4 version it is not working.
As I may see in "src/providers/ldap/sdap_async_accounts.c":
/* FIXME: we ignore nested rfc2307bis groups for now */
filter = talloc_asprintf(grp_state, "(objectclass=%s)",
opts->user_map[SDAP_OC_USER].name);
Also the same situation with LDAP memberOf attribute. It just create
"originalMemberOf" entry, but do nothing with it.
Maybe the problem is because of groups are stored in different OU:
OU=COMPUTE
|-OU=GROUP-ACCESS
|- cn=GRP-SVC-SSH-NODE
|- ou=SSH-GROUPS
|-cn=GRP-SVC-SSH-NODE01
which means:
GRP-SVC-SSH-NODE = cn=GRP-SVC-SSH-NODE,ou=GROUP-ACCESS,ou=COMPUTE, dc......
GRP-SVC-SSH-NODE1 =
cn=GRP-SVC-SSH-NODE1,ou=SSH-GROUPS,ou=GROUP-ACCESS,ou=COMPUTE, dc.....
13 years, 5 months
[PATCH] Log startup errors to syslog
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Some users are experiencing failures when restarting SSSD during an
RPM upgrade. During RPM upgrade, the output from 'service sssd
restart' is suppressed, so if there are failures to restart, there is
no indication of why.
This patch moves the error messages into the syslog instead.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkzhnp8ACgkQeiVVYja6o6Ov0wCgpbWakBa09KTDQk4EXsthH1n4
4NMAmgIFZ+QeZvscm5vLVqKoFOGlrW2e
=Ludd
-----END PGP SIGNATURE-----
13 years, 5 months
Slight process change in Trac
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
For a while now, we've been informally following a policy of cloning
bugs into other milestones if they need to be fixed in multiple places.
I'd like to formalize this as part of the process. It makes tracking
much easier.
Since we're now doing this, the custom field "FixedIn" no longer has any
value whatsoever (originally it was meant to denote the lowest released
version that the fix could be seen in, unrelated to the milestone during
which it was being fixed. It was a relic of when our milestones were
time-based rather than release-based).
Unless anyone has any strong reservations about it, I'm going to
eliminate this unnecessary knob from our Trac instance.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkzhoZIACgkQeiVVYja6o6NonwCfSbsDy8Y9jzdKGSQLFSMJ14RS
XNsAnRTRc6vHCthw71UVjB7ymcIn2eGd
=dMbL
-----END PGP SIGNATURE-----
13 years, 5 months
[PATCH] Fix incorrect type comparison
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Fixes https://fedorahosted.org/sssd/ticket/657
sss_cli_check_socket returns an enum sss_status result code, but we were
assigning it to an enum nss_status variable before checking it.
Coincidentally, the success codes were the same, so we weren't seeing a
bug here, but it throws a warning on newer gcc and is just generally
wrong, so we'll fix it.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEUEARECAAYFAkzhlv4ACgkQeiVVYja6o6NedACYgEDBnCS9K3J9qIpoXaWtr2AF
cACeKpSiePGfbeN6YzX/PJpI/pb+G2Y=
=ymxA
-----END PGP SIGNATURE-----
13 years, 5 months
[PATCH] Introduce pam_verbosity config option
by Sumit Bose
Hi,
this patch should fix ticket #604, but maybe we want to add some more
levels to pam_verbosity and also handle other messages with this patch.
Currently I have two questions. First, is more granularity needed for
pam_verbosity or is it enough to switch between only important and all
messages? Second, if offline_credentials_expiration is set, the
'Authenticated with cached credentials' messages is always display. Is
this acceptable or shall we introduce a threshold parameter here?
bye,
Sumit
13 years, 5 months
[PATCH] Properly document ldap_purge_cache_timeout
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This option was missing from the manpage.
Also, this patch allows cache cleanup to be disabled entirely by setting
it to zero.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkzT/5YACgkQeiVVYja6o6NPqQCglPqrNcAiy8/8ChFVU5Hdldrv
uj8AoI8A0aHE5iA3X+5pJxHNVIRRFmtl
=0PM8
-----END PGP SIGNATURE-----
13 years, 5 months
[PATCH] Sanitize ldap attributes in the config file
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
https://fedorahosted.org/sssd/ticket/458
Previously, it was possible to perform a sort of LDAP filter injection
with careful crafting of the ldap attributes in the config file.
This guarantees that any attribute specified in the config file is
escaped properly, resulting in an inability to inject subfilters.
Note: this was not a security issue, as it was editable only by root and
even then, all checks were performed on the server, not the client.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkzdWXMACgkQeiVVYja6o6OivgCfUyMajTHDR15Vx2XhLcfwXUvr
sVsAniWHFXwyNjhu1Zm/WMXasA7zkg5M
=hlmE
-----END PGP SIGNATURE-----
13 years, 5 months
[PATCHES] Sanitize search filters in the sysdb
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This is the first part of a fix for https://fedorahosted.org/sssd/ticket/639
These patches address the various search filters we're using in the
sysdb. Patches for LDAP search filters will be coming later. I wanted to
get these reviewed first.
Patch 0001: Adds a utility function to sanitize search filters using the
method described in RFC 4515. Includes a unit test.
Patch 0002: Sanitize search filters internal to the public sysdb APIs.
Includes unit tests.
Patch 0003: Sanitize sysdb search filters in the IPA provider used with
sysdb_search_custom()
Patch 0004: Sanitize sysdb search filters used when processing nested
groups.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkzKGl0ACgkQeiVVYja6o6OSLQCeI9d1ITiVS4JcrZesZTXsyTyG
zS0AoIQeKBsatVL4Ed51D2nGwxaT7PVh
=qbgv
-----END PGP SIGNATURE-----
13 years, 5 months