[PATCH] Check for controls before using them
by Simo Sorce
Some time ago I added code to fetch the rootdse on connection, but
didn't publicize it too much.
Attached find 2 patches.
1) Rework the way we store data fetched from the rootdse so the it is
more useful and is actually attached to the ldap handle.
2) Check controls are supported before using them.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
13 years, 2 months
[PATCH] Use service discovery in backends
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Integrate the failover improvements with our back ends. The DNS domain
used in the SRV query is always the SSSD domain name.
Please note that this patch changes the default value of ldap_uri from
"ldap://localhost" to "NULL" in order to use service discovery with no
server set.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkvVVoIACgkQHsardTLnvCWrzgCfRqT54ofqvmV8HIQeGcodxvSe
ttcAn3tq2yY60trBuALwPoIgyjxdbjt0
=aZOZ
-----END PGP SIGNATURE-----
13 years, 6 months
[PATCH] Try all servers during Kerberos auth
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The Kerberos backend would previously try only the first server and if
it was unreachable, it immediatelly went offline.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkvYKEIACgkQHsardTLnvCXzaQCgsqdFvrQd2ht0jf8x5m0Ktc8r
y7wAmgL37AN17gXBBn9j3vFlSmXSsdfi
=dkCL
-----END PGP SIGNATURE-----
13 years, 6 months
[PATCH] IPA password migration (master only)
by Sumit Bose
Hi,
these are the two patches for the IPA password migration for master.
Because master already contains the sync sysdb patches it is not easy to
rebase the first patch from the sssd-1-2 branch to master so I rewrote
it. The second patch is mainly the same with a substitution of an async
sysdb call with his sync version.
bye,
Sumit
13 years, 6 months
[PATCH] Use service discovery in backends (sssd 1.2)
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This is a rebased version of the patch that applies on top of the recent
changes that went into 1.2.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkva+nYACgkQHsardTLnvCU0mwCeI3089fLmEpEiMyJ33MFSY/uA
+d4AoKW2vzUrQmu/ZVZOddLrCWSXKjJH
=/zHm
-----END PGP SIGNATURE-----
13 years, 6 months
[PATCH] Add callback when the ID provider switches from offline to online
by Stephen Gallagher
Allow backends to set a callback in the be_ctx that should be
invoked when the ID provider goes online.
This can be used to perform regular maintenance tasks that are
valid only when going online.
Specifically, we can use this to perform a deferred kinit on behalf of
the user when we go online. We can also use this to trigger a dynamic
DNS update for the IPA provider.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
13 years, 6 months
[PATCH] Add more warnings about nearly expired passwords
by Sumit Bose
Hi,
this patch is (hopefully) the final patch in a series of patches to fix
#420 '[RFE] Password Expiration Notification'. The other patch in this
series are:
- 'Improvements for LDAP Password Policy support' which is already
commited and handles the case of LDAP server password policies
- 'Handle Krb5 password expiration warning' which handles the warning
for the Kerberos provider
bye,
Sumit
13 years, 6 months
[PATCH] Add support for delayed kinit if offline (sssd-1-2 only)
by Sumit Bose
Hi,
this patch should fix #305 'The kerberos provider should automatically
kinit users when it goes online'.
This patch depends on:
- 'Split pam_data utilities into a separate file'
- 'Add callback when the ID provider switches from offline to online'
This version only applies to sssd-1-2, I will rebase/rewrite it for
master later.
bye,
Sumit
13 years, 6 months
[PATCH] Handle Krb5 password expiration warning
by Sumit Bose
Hi,
this two patches add the support to display a warning to the user that
the Kerberos password is about to expire. The first patch just moves
some utility functions to a separate file to avoid linking the
krb5_child against libdbus.
I the second patch a prompter function is introduced to catch the
warning message which is generated by libkrb5. With the current API of
MIT Kerberos we have to rely on this message, because the the underlying
AS_REPLY data is not exposed by the library. As a consequece this message
cannot be translated, but this is true for messages which are generated
to indicate why a password change failed, too. The rest of the patch
changes the way the response from the child is packed and unpacked to
allow more than one response message.
bye,
Sumit
13 years, 6 months