Some time ago I added code to fetch the rootdse on connection, but
didn't publicize it too much.
Attached find 2 patches.
1) Rework the way we store data fetched from the rootdse so the it is
more useful and is actually attached to the ldap handle.
2) Check controls are supported before using them.
Simo Sorce * Red Hat, Inc * New York
there is a change in libldb of f13 which makes the IPA access provider
fail if there a no memberof attributes in a host entry. I think this is
also the reason for #499. The first patch adds a new sysdb_attrs call
which does not create an empty element and the second patch add this
call to the IPA access provider.
For your convenience I have add patches against 1.2 and master.
this patch is already commited in the master branch but it makes sense
to have it in the 1.2 series too, because it is possilbe that the ccache
file of a user is removed before we know if it can be recreated.
this patch adds support for the new IPA HBAC schema to the master
branch. It has the same functionality as the corresponding patch to the
1.2 branch, i.e. it does not address the review comments of this patch.
I will post patches for 1.2 and master addressing these comments later
At the moment, if sssd is given the example sssd.conf file, sssd
reuses to start. In Debian and Ubuntu, the example sssd.conf file is
patched like this and installed in /etc/sssd/sssd.conf to make sure
the sssd package get an operational daemon when the package is
Any hope of having this patch included in the upstream tarball?
diff -urNad l-new-upstream~/server/examples/sssd.conf l-new-upstream/server/examples/sssd.conf
--- l-new-upstream~/src/examples/sssd.conf 2010-01-18 13:09:10.000000000 -0500
+++ l-new-upstream/src/examples/sssd.conf 2010-01-18 13:18:18.000000000 -0500
@@ -13,7 +13,7 @@
# Add new domain configurations as [domain/<NAME>] sections, and
# then add the list of domains (in the order you want them to be
# queried) to the "domains" attribute below and uncomment it.
-; domains = LOCAL,LDAP
+domains = LOCAL
# The following prevents SSSD from searching for the root user/group in
@@ -45,12 +45,12 @@
# Example LOCAL domain that stores all users natively in the SSSD internal
# directory. These local users and groups are not visible in /etc/passwd; it
# now contains only root and system accounts.
-; description = LOCAL Users domain
-; id_provider = local
-; enumerate = true
-; min_id = 500
-; max_id = 999
+description = LOCAL Users domain
+id_provider = local
+enumerate = true
+min_id = 500
+max_id = 999
# Example native LDAP domain
# ldap_schema can be set to "rfc2307", which uses the "memberuid" attribute
I tried sssd on Ubuntu 10.04 LTS but I did not get it working. Maybe I
missed a crucial step? Here is what I did:
What I did:
1) install sssd
2) edit /etc/sssd/sssd.conf and add LDAP entry
3) edit /etc/nsswitch.conf and add sss entry
However, getent passwd <username> only serves via LDAP directly. If I
remove ldap from my nsswitch.conf, I get no records.
Any help is appreciated!
I'm cruising through a lot of the man pages for SSSD and wonder if this
/usr/share/man/man8/sssd.8.gz : DESCRIPTION section
I can copy-edit bits of the language, but I wonder about the mention of
audit and policy services for freeIPA, which afaik haven't been
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane
"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.