[PATCH] Fix incorrect NULL check (sssd-1-2)
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Discovered with Coverity, the recent patch for RFC2307bis had an
incorrect NULL check.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxYUuwACgkQeiVVYja6o6NBcACghWI/XerS/m4pKuHNRcBurEp9
94gAn3IKGf52qYNG1SybMapdzdzR7uwO
=cJMs
-----END PGP SIGNATURE-----
12 years, 6 months
[PATCHES] Fix severe performance problems with initgroups (master)
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Attached are the patches to fix the initgroups performance issue for the
master branch. Patches 0001-0004 applied trivially to the master,
patches 0005 and 0006 had to be rewritten to take advantage of the
synchronous sysdb interface, but this has made them distinctly easier to
follow.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxW6yQACgkQeiVVYja6o6OyIACgkObEJVrkEP/vtfrp/fWEE9t9
Pc4An0eupHrASaNPA6Qe9I9oxK2RXc/e
=KYcj
-----END PGP SIGNATURE-----
12 years, 6 months
[PATCH] be_pam_handler(): Fix potential NULL dereference
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Discovered with Coverity, if we failed to allocate be_req in
be_pam_handler(), we would attempt to dereference a NULL value.
This patch is for both 1.2 and master.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxYUk4ACgkQeiVVYja6o6OBuQCfdq+XN9FxYHPgfzL5crb7sSOx
7LUAnA/klcFtVsUR24r/ZWqi7uD37GZJ
=IeAj
-----END PGP SIGNATURE-----
12 years, 6 months
Fix two bugs found by clang
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The attached patches fix two bugs found by the clang static analyser.
Both of them masked potential errors, the first one when parsing of a
HBAC rule fails, the second one when unexpected status of a service
lookup..the routines would return EOK instead of some error code in both
cases.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxYSBMACgkQHsardTLnvCXEEACfaTmUfsGD5nFuovDuqeUyL955
Y8cAoJSB5IAmf/CwDdpTl9jqbTYc48tS
=adMK
-----END PGP SIGNATURE-----
12 years, 6 months
[PATCH] Require -ltalloc for tevent configure check
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This configure check doesn't work when --as-needed is passed as a
configure flag to LDFLAGS. We need to explicitly include -ltalloc here.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxYMZIACgkQeiVVYja6o6O+AQCgk3NogK55mQLV/AuVML9MeC8q
xUUAoKuEcrkpZbj1s3gijXhZy/ggSl7H
=4Ro7
-----END PGP SIGNATURE-----
12 years, 6 months
[PATCH] Validate keytab at startup
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
In addition to validating the keytab everytime a TGT is requested, we
also validate the keytab on back end startup to give early warning that
the keytab is not usable.
Fixes: #556
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxHF4YACgkQHsardTLnvCUHuwCfdvEPJkqZqAs2XYW0g/TVgUCt
H5oAoKO1CG++6xQQi02dTss/Hjo5uPa2
=N5+t
-----END PGP SIGNATURE-----
12 years, 6 months
Announcing the release of SSSD 1.2.2
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The SSSD team is proud to announce the bugfix release 1.2.2 of the
System Security Services Daemon. As usual, it can be downloaded from
https://fedorahosted.org/sssd/
== Highlights ==
* The LDAP provider no longer requires access to the LDAP RootDSE. If
it is unavailable, we will continue on with our best guess
* The LDAP provider will now log issues with TLS and GSSAPI to the syslog
* Significant performance improvement when performing initgroups on
users who are members of large groups in LDAP.
* The sss_client will now reconnect properly to the SSSD if the daemon
is restarted.
* This resolves an issue causing GDM to crash when logging out of a
user after the SSSD had been restarted.
== Detailed Release Notes ==
Alexander Gordeev (1):
* Add explicit requests for several operational attrs
Dmitri Pal (1):
* Fixing types in queue and stack interfaces
Stephen Gallagher (14):
* Drop release requirement from versions
* Bump libini_config version to 0.5.1
* Make RootDSE optional
* Add sss_log() function
* Add log notifications for startup and shutdown.
* Add syslog messages for LDAP GSSAPI bind
* Log TLS errors to syslog
* Add sysdb_attrs_to_list() utility function
* Add diff_string_lists utility function
* Add sysdb_group_dn_name utility function
* Add dup_string_list() utility function
* Add sysdb_update_members function
* Clean up initgroups processing for RFC2307
* Release SSSD 1.2.2
Sumit Bose (2):
* Fix SASL authentication
* Allow sssd clients to reconnect
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxXFE4ACgkQeiVVYja6o6NGtQCffvp/LKIXBmGyFJzYcSuIeElE
b7AAn16ikvGVDald3nXSdoHasI8LbZSv
=T5Iu
-----END PGP SIGNATURE-----
12 years, 6 months
sssd and kerberos.
by Patrik Martinsson
Hello,
I've successfully setup'ed sssd on our systems to connect to our
Microsoft AD with ldap
authentication, now i want to use kerberos instead, and have I of course
ran into some problems :)
To start with, I'm not to familiar with kerberos so go easy on me here.
I've successfully created a machineaccount in AD (with msktutil, also
got it working with samba/net join)
and obtained a kerberos keytab. A user can obtain a ticket by running
'kinit foouser', thereafter he/she
can run for example 'ldapsearch -b 'ou=xx,dc=xx,dc=xx,dc=xx' -Omaxssf=0
"(&(objectclass=user)(cn=xx))" uid'
successfully.
Here's to my question, (maybe this rather should be in a kerberos
mailinglist, or maybe i should read a book however it's easiest to ask
here :))
Is the keytab used by sssd to authenticate to the kdc, is this even how
it works ? Since the sssd is runned by root and root has no ticket,
i figured it would work that way, but maybe I'm mistaken, maybe it's
suppose to work in some other way ?
Here's the krb5 part of the sssd.conf
auth_provider = krb5
krb5_kdcip = 123.123.123.123
krb5_realm = foo
krb5_changepw_principle = kadmin/changepw
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
krb5_auth_timeout = 15
krb5_keytab = /etc/krb5.keytab
When i start sssd with -d10 i cant really see much messages about the
kerberos authentication whether it fails or not, however i can see
'Search result: Operations error(1), 00000000: LdapErr: DSID-0C090627,
comment: In order to perform this operation a successful bind must be
completed on the connection., data 0, vece'
which suggest that i cannot bind to ldap, right ?
Any suggestions where to go from here, ?
Best regards,
Patrik Martinsson, Sweden.
12 years, 6 months