sssd-devel December 2010

sssd-devel@lists.fedorahosted.org

17 participants
58 discussions

Start a nNew thread

[PATCHES] Fix even more bugs found by Coverity
by Sumit Bose 15 Dec '10

15 Dec '10

Hi, here are some more fixes for bugs found by Coverity. bye, Sumit

2 1

[PATCHES] Fixes for async resolver
by Stephen Gallagher 14 Dec '10

14 Dec '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patch 00001: Fix timeouts for DNS resolver options.tries specifies the number of retries. Setting this to zero means to try exactly once. Previously we were always trying twice (internally). We want to simply honor the SSSD configuration and fail over to the next server (or go offline) after one try. Patch 0002: Reschedule the fd timeout for secondary lookups We were unscheduling the timeout handler after the first lookup (A or AAAA) returned, but not rescheduling it if we went on to check the secondary record type. This resulted in the resolver never returning a result for the secondary lookup, which can mean that logins/screen unlocks after VPN drop or suspend/resume might never complete. Fixes https://fedorahosted.org/sssd/ticket/729 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk0HlwYACgkQeiVVYja6o6NChgCfaAh7e2tZLqfojBQXpXhxrTl6 F9cAn1JMPyyKv6TTzoej6BoiNsQ3n4F2 =UPAJ -----END PGP SIGNATURE-----

2 2

[PATCHES] Fix assorted bugs found by Coverity
by Stephen Gallagher 14 Dec '10

14 Dec '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patch 0001: Eliminate possible NULL-dereference in pam_check_user_search Fixes https://fedorahosted.org/sssd/ticket/719 Patch 0002: Add missing break statement to sss_hash_create Fixes https://fedorahosted.org/sssd/ticket/720 Patch 0003: Prevent uninitialized value error in monitor_quit Fixes https://fedorahosted.org/sssd/ticket/724 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk0H0Q4ACgkQeiVVYja6o6NAVACglsXyMjOLbMX2JX6a7GZ90uxA sx0An2N6XwtIaGITNgx7EGiJh6McQT5Q =4QdT -----END PGP SIGNATURE-----

2 2

SSSD and krb5.
by Patrik Martinsson 13 Dec '10

13 Dec '10

Hello, Quick question, in our krb5.conf we have defined pkinit_identities = PKCS11:/path_to_smartcard_lib pkinit_anchors = FILE:/path_to_cert to allow people to get a kerberos ticket whenever they login. Now, we also configured sssd to use kerberos as authentication method, which means sssd will try to do a pkinit to get the kerberos ticket (that is, when sssd makes a kinit to get a ticket, it will use the krb5.conf defaults and try to do a kinit with pkinit enabled, which will fail). Now, my question is, can i make sssd to not use pkinit when doing a kinit ? Does that makes sense ? Any suggestions are welcome. Best regards, Patrik Martinsson, Sweden.

2 2

[PATCH] Add group support to the simple access provider
by Stephen Gallagher 13 Dec '10

13 Dec '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This patch adds simple_allow_groups and simple_deny_groups options to the simple access provider. It makes it possible to grant or deny access based on a user's group memberships within the domain. This patch makes one minor change to previous functionality: now all deny rules will supersede allow rules. Previously, if both simple_allow_users and simple_deny_users were set with the same value, the allow would win. Fixes https://fedorahosted.org/sssd/ticket/440 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk0A86gACgkQeiVVYja6o6NElwCeI1H9O8tzCkAM++awKInGJr9R l0QAn20A7tbxmfOKdBuhXC4aMsyTes3V =K45L -----END PGP SIGNATURE-----

2 4

Group results.
by Patrik Martinsson 10 Dec '10

10 Dec '10

Hello, I've almost managed to get sssd to work as I want, however I have this problems with groupmembers. If I do an ldapsearch on a group I get this result, --------- member: CN=x1,OU=People,DC=x,DC=x,DC=x member: CN=x2,OU=People2,OU=People,DC=x,DC=x,DC=x member: CN=x3,OU=People,DC=x,DC=x,DC=x member: CN=x4,OU=People,DC=x,DC=x,DC=x member: CN=x5,OU=People,DC=x,DC=x,DC=x memberUid: x1 memberUid: x2 memberUid: x5 memberUid: x7 memberUid: x8 memberUid: x9 --------- A college told me that the difference (between members in 'member' and 'memberUid') is because 'member' is the attribute set up for windows accounts, and 'memberUid' is for the unixaccounts, and although these often should be synced it could be some cases where its not (in our setup anyway). So what I want is getting sssd to map groupmembers to the memberUid. Here's a snippet from my sssd.conf --------- ldap_user_object_class = User ldap_user_name = sAMAccountName ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_shell = loginShell ldap_user_gecos = mail ldap_user_principal = userPrincipalName ldap_user_member_of = memberOf ldap_user_home_directory = msSFUHomeDirectory ldap_group_object_class = Group ldap_group_name = cn ldap_group_gid_number = gidNumber ldap_group_member = memberuid # ldap_group_member = member # ldap_group_member = memberUid # ldap_group_uuid = memberUid --------- I've tried different setups here but I cant really seem to figure it out. If I run with the above settings i get no groups for users, and the following is printed in sssd debug, --------- [sysdb_search_entry_done] (6) Error : Entry not found! [sdap_fill_memberships] (7) member #60 (x): not found! --------- If I use the member instead of memberuid/Uid the users are mapped to groups from the 'member' attribute, which seems logical, however that's not what I want, as I said before, I want to map usergroups against the memberUid. I would appreciate any tips or recommendations around this matter. Best regards, Patrik Martinsson, Sweden.

5 12

test
by Stephen Gallagher 09 Dec '10

09 Dec '10

3 2

[PATCHES] Remove check_access_time() from IPA access provider
by Sumit Bose 08 Dec '10

08 Dec '10

Hi, due to recent changes in the IPA project the following two patches will remove the evaluation based on the ipa_timerules from the IPA access provider of SSSD. If you are evaluating the IPA alpha releases with respect to time ranges in HBAC rules please note that this patch will change the behaviour. The first patch removes all related calls from the IPA provider while the second removes the implementation of the checks and the corresponding tests. This patch should fix trac ticket #698. bye, Sumit

2 3

[PATCH][DING-LIBS] Fix typo which makes make prerelease-srpm fail
by Sumit Bose 08 Dec '10

08 Dec '10

Hi, just found this typo. bye, Sumit

2 2

[PATCH] Generate ccache name at the beginning of auth process
by Jan Zelený 08 Dec '10

08 Dec '10

After some complications I finally made the patch solving ticket #533 (different ccache files during multiple simultaneous logins of the same user). It is based on Simo's idea to determine the ccache file name in advance and count references to it. Jan

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel December 2010