[PATCH] Remove the NSS_LIBS and KRB5_LIBS variables from sssd.spec
by Stephen Gallagher
Due to the way RPM processes the %configure macro, these variables
were not actually being passed down to recursive configure
invocations. In other words, they were useless.
Futhermore, in more recent Fedora versions (13+), some of the
dependencies have moved from -lnss to -lnspr4. As a result, it is
safer to rely on the complete output of 'pkg-config nss --libs'
instead of restricting to -lnss. The downside to this is that it
may result in linking unnecessarily against other NSS components
such as libsmime3 and libplc4 (among others). However, since these
are already dependencies of libnss itself, there should be no risk
of them being unavailable on the platform when installed.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
13 years, 12 months
pam_pkcs11.so is missing for LOCAL domain?
by David O'Brien
I'm using the authconfig gui on rhel6 beta to set up SSSD, and I get the
following message:
Authentication module /lib/security/pam_pkcs11.so is missing.
Authentication process might not work correctly.
/var/log/sssd/sssd_pam.log is empty
/var/log/messages has nothing significant
The sssd service is running, but I don't know what's going to work (or not).
Is there something else I need to install for this?
I'll provide more info if I get it.
thanks
--
David O'Brien
Red Hat Asia Pacific Pty Ltd
He who asks is a fool for five minutes, but he who does not ask remains
a fool forever."
~ Chinese proverb
13 years, 12 months
[PATCH] Make sss_userdel check for logged in users
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
sss_userdel now refuses to delete users who are logged in unless --force
is used.
Fixes: #229
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkujfbIACgkQHsardTLnvCX4sACfZOYnwyRdRwP3vp6bSZXl0DbA
1oQAoK0FJuq6nnLl2pW4apXLhqK86PDS
=OKSx
-----END PGP SIGNATURE-----
13 years, 12 months
[Fwd: Re: #456: Register with NetworkManager for notifications]
by Dmitri Pal
Is there any way to determine is this is a primary interface or not?
I think we should treat interface through which we established
connection th the server (in my terms "primary" interface) differently
from other interfaces.
If we get notification from the NM about the interface that we used to
talk to server (i.e. "primary interface) we should go offline.
If we get notification from a different interface we should ignore it.
Thoughts?
Thanks
Dmitri
-------- Original Message --------
Subject: Re: [SSSD] #456: Register with NetworkManager for notifications
Date: Wed, 28 Apr 2010 15:02:49 -0000
From: SSSD <trac(a)fedorahosted.org>
Reply-To: nobody(a)fedoraproject.org
To: undisclosed-recipients:;
References: <048.d00731159f061af1a3cdebde3f0f8c95(a)fedorahosted.org>
#456: Register with NetworkManager for notifications
------------------------------+---------------------------------------------
Reporter: sgallagh | Owner: somebody
Type: enhancement | Status: new
Priority: major | Milestone: NEEDS_TRIAGE
Component: Data Provider | Version: 1.1.1
Resolution: | Keywords:
Fixedin: | Doc: 0
Tests: 1 | Docupdated: 0
Testsupdated: 0 |
------------------------------+---------------------------------------------
Comment (by simo):
Note: this maybe harder then it seem at a first sight.
We can really force offline mode only if *all* interfaces have been shut
down.
If only one of many is stopped we can't just blindly go oflline.
Same sort of consideration for trying to go online apply.
--
Ticket URL: <https://fedorahosted.org/sssd/ticket/456#comment:2>
SSSD <http://fedorahosted.org/sssd>
System Security Services Daemon
--
Thank you,
Dmitri Pal
Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
13 years, 12 months
[PATCH] Two enhancements for PAM client
by Sumit Bose
Hi,
the two patches attached should fix #446 and #417 respectively.
For #417 a different solution, where the message is generated by SSSD
and send to the client, would be possilbe. But I decided against it,
because with the attached patch it is possilbe to support localized
messages.
bye,
Sumit
14 years
[PATCH] IPA password migration (sssd-1-2 only)
by Sumit Bose
Hi,
these two patches provides a new attempt for the IPA password migration
feature. The first one wraps the Kerberos authentication in the Kerberos
provider into a tevent request to make it easy accessible for IPA
authentication. The LDAP provider already has all needed features as
tevent requests.
The second patch changes IPA auth to use only tevent request from the
LDAP and Kerberos provider. The ipaMigrationEnabled flag is read from
the server, too.
Both patches only apply to sssd-1-2. Because of the sync sysdb patches
in master it is not easy to merge the first patch. I will rewrite the
first patch and provider the patches for master if we agree that the way
the two patches here handle password migration is the way we want to go.
bye,
Sumit
14 years
[PATCH] Make the handling of fd events opaque
by Sumit Bose
Hi,
to support the current effort to make the LDAP provider more robust this
patch removes all the #ifdef HAVE_LDAP_CONNCB calls from the main code
into a separate file which provides generic helper functions.
bye,
Sumit
14 years
[PATCH] Treat server names as case-insensitive in failover code
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
It didn't cause any issues, but I think hostnames should be treated as
case-insensitive
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkvQKJ4ACgkQHsardTLnvCXZ2ACfaK7vjNCHbKXjJ/EBjiuuxY9m
HKEAoNXLwycpG0qcXOcorbg0Yf6XUE1x
=uABF
-----END PGP SIGNATURE-----
14 years
[PATCH] Do not mark a request as failed twice
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This was causing occasional crashes during SRV testing as the callback
got called twice
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkvQeNIACgkQHsardTLnvCX2NgCg4Fn5QDHx1gU5eS+gq8W8QYlu
55AAnRPTE0psFK47QGeD8h+YazGmpXSt
=Jhz0
-----END PGP SIGNATURE-----
14 years