sssd-devel October 2011

sssd-devel@lists.fedorahosted.org

19 participants
71 discussions

[PATCH] Allow more libldap debugging
by Jakub Hrozek 28 Nov '12

28 Nov '12

This patch should not be pushed to master, but I would like to get it reviewed anyway. It should be used to provide a custom build for users experiencing cases where ldap_search_ext would block (c.f. https://bugzilla.redhat.com/show_bug.cgi?id=728343) For example: export SSSD_DEBUG_LDAP_SEARCH="0xffff" would set LDAP_DEBUG_ANY The attached patch applies cleanly on the RHEL6.1 branch. I also have a version that applies on master/1.5 if needed.

4 7

[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal 05 Apr '12

05 Apr '12

Please see the attached patches. I tried to split the patches logically into manageable sets. Unfortunately I made a minor mistake and I am afraid I will do something wrong to fix it. I merged two wrong patches. Fortunately it was three liner with 1 liner so it is not a big of the deal but I am really scared that I will do something wrong and loose the work I have done. So I hope it is Ok to send it as is. 0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted earlier that I merged by mistake. I was supposed to merge it with patch 25 but picked the wrong one instead. Patch 25 addresses the real issue found by Coverity as mentioned in Stephen's review mail but it did not apply cleanly since it relies on some code from the patches in the middle. 0002--INI-Adding-missing-function-declararion.patch <- this is the patch that was rejected from the second set sent earlier. Fixed according to review comment. 0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing per component The following set of patches introduces the merging of sections during the reading of the file: 0004--INI-New-error-codes-and-messages.patch 0005--INI-New-merge-flags.patch 0006--INI-Add-new-vars-to-parse-structure.patch 0007--INI-Add-save_error-function.patch 0008--INI-Change-parse_error-to-use-save_error.patch 0009--INI-Preparing-for-merging-sections.patch 0010--INI-Enhance-value-processing.patch 0011--INI-Use-section-line-number.patch 0012--INI-Refactor-section-processing.patch 0013--INI-Return-error-in-DETECT-mode.patch 0014--INI-New-test-files-for-section-merge.patch 0015--INI-Test-DETECT-mode-and-use-new-file.patch 0016--INI-Test-for-all-section-merge-modes.patch Patches related porting of the meta data from old way of doing things to the new way of doing things: 0017--INI-Separate-close-and-destroy.patch 0018--INI-Function-to-reopen-file.patch 0019--INI-Metadata-collection-is-gone.patch 0020--INI-Check-access-function.patch 0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check) 0022--INI-Function-to-check-for-changes.patch 0023--INI-Tests-for-access-and-changes.patch 0024--INI-Rename-error-print-function.patch <- rename error printing function for consistency with new interface 0025--INI-Initialize-variables-in-loops.patch <- Coverity issue addressed. Related to patch 0001. 0026--INI-Exposing-functions.patch <- Make some internal functions reusable There is also patch 27. It is a piece of new functionality. It is a preview. Please see the comment before reviewing it. Do I need to split it into multiple patches or it is Ok as is? It is pretty big but all changes are in one file and logically related. The UNIT test is missing so I am not claiming it actually works as expected. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 30

Announcing SSSD 1.6.2
by Stephen Gallagher 04 Jan '12

04 Jan '12

The SSSD team is proud to announce the version 1.6.2 enhancement and bugfix release of the System Security Services Daemon. As always, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Improved handling of users and groups with multi-valued name attributes (aliases) * Performance enhancements * Initgroups on RFC2307bis/FreeIPA * HBAC rule processing * Improved process-hang detection and restarting * Enabled the midpoint cache refresh by default (fewer cache misses on commonly-used entries) * Cleaned up the example configuration == Detailed Changelog == Jakub Hrozek (23): * Improve error message for LDAP password constraint violation * Keep deref controls until the whole request is finished * Fix uninitialized pointer read in sdap_gssapi_get_default_realm() * IPA access: hostname comparison should be case-insensitive * Add sysdb interface to get name aliases * Add a sysdb_get_direct_parents function * Store name aliases for users, groups * Return users and groups based on alias * Use explicit base 10 for converting strings to integers * Fix typo in sysdb_get_direct_parents * Add option to follow symlinks to check_file() * Append PID to sbus server socket name, let clients use a symlink * Streamline the example config * Do not delete requests inside hash_iterate loop * Check if dp_requests hash table exists before using it * Fix off-by-one error in remove_socket_symlink() * Report on errno, not return code in create_socket_symlink * Add a missing break * Sanitize DN in sysdb_get_direct_parents * gitignore additions * Utility functions for LDAP nested schema initgroups * Use fewer transactions during RFC2307bis initgroups * Use fewer transactions during IPA initgroups Jan Zeleny (2): * man page fix (lists are comma-separated) * Fixed timeout handling in responders Marko Myllynen (3): * Add missing options to sssd.api.conf * Unbreak ./configure * Update sssd-example.conf Pavel Březina (3): * sss_ldap_err2string() - function created * sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string() * Added quiet option to pam_sss Pavel Zuna (1): * Fix small bug where TALLOC_CTX could end up unfreed. Stephen Gallagher (18): * Bumping version to 1.6.2 * Add option to specify the kerberos replay cache dir * Fix typo in %configure * Remove all libtool .la files from RPM * Improve documentation of libipa_hbac * Add libipa_hbac documentation to the -devel package * MONITOR: Correctly detect lack of response from services * Do not build documentation on RHEL 5 * Fix typo in specfile * MAN: Add more information about internal credential storage * Enable the midpoint cache update by default * HBAC: fix typos preventing proper hostgroup evaluation * HBAC: Do not save member/memberOf links * HBAC: Use originalMember for identifying servicegroups * HBAC: Use originalMember for identifying hostgroups * BUILDSYS: Fix --without-manpages * MONITOR: fix timeout conversion * Updating translation files for string freeze Sumit Bose (1): * Do not access memory out of bounds

5 32

[PATCH] Add common SIGCHLD handling.
by Pavel Zuna 19 Dec '11

19 Dec '11

Base on the second proposal: https://fedorahosted.org/sssd/wiki/DesignDocs/SigChld There is some old SIGCHLD handling code in src/providers/child_common.[ch], that should probably go away if this gets accepted. There was also a naming conflict with the sss_child_ctx structure. This structure is only used internally by functions defined src/providers/child_common.c. I renamed the original structure to sss_child_ctx_old for now. Pavel

3 18

[PATCHES] Support native IPA netgroups
by Jan Zelený 09 Dec '11

09 Dec '11

I'm sending couple patches which add support for IPA netgroups: #53 These routines were not static, so I renamed them in order to avoid confusion and possible collision with equivalent routines in IPA provider #54 Some new config options, please focus on this patch, I'm not entirely sure if my approach was the correct one. #55 This new context was necessary so I can pass ipa options to routine determining host search base. #56 This is netgroups support itself #57 IPA id provider which is utilizing previously added support of netgroup fetching Thanks Jan

3 15

[PATCH] Added sssd --version option
by Pavel Březina 08 Dec '11

08 Dec '11

https://fedorahosted.org/sssd/ticket/953

5 11

IPA migration fixes
by Jakub Hrozek 29 Nov '11

29 Nov '11

https://fedorahosted.org/sssd/ticket/924 started as a segfault ticket but we could never reproduce the crash afterwards. As Sumit noted it might have been caused by setting the O_NONBLOCK flag twice. However, the changes Sumit proposed in the ticket still make sense because they provide much cleaner solution. Attached are two patches: [PATCH 1/2] Provide means of forcing TLS and GSSAPI enabled/disabled for sdap connections This will be used to force TLS on the auth connection only and allow staying on GSSAPI-backed ID connection for the rest of the request. [PATCH 2/2] IPA migration fixes * use the id connection for looking up the migration flag * force TLS on the password based authentication connection

4 12

[PATCH] Allow using AD objectSid as uid source
by Marko Myllynen 25 Nov '11

25 Nov '11

Hi, this simple patch allows using AD objectSid as uid source making it possible to use SSSD against AD instances which do not have Identity Management for Unix Role Service enabled. The mapping matches winbind's idmap_rid(8) behaviour. If ldap_user_uid_number is not objectSid then nothing changes. https://fedorahosted.org/sssd/ticket/996 Cheers, -- Marko Myllynen

3 5

[PATCH] Providers cleanup: Remove unused parameters
by Jakub Hrozek 22 Nov '11

22 Nov '11

During the nested initgroups processing review, Jan requested removing unused "dom" parameter from the code. Instead of doing it on that one place, I compiled SSSD with -Wunused and cleaned up unused parameters in the providers code. It's mostly sss_domain_info no longer needed because of the sysdb refactoring. The patch brings no functional change, it's just cleanup.

2 5

[PATCHES] SUDO integration - first iteration
by Pavel Březina 15 Nov '11

15 Nov '11

https://fedorahosted.org/sssd/ticket/623 Helpful links: - SUDO plugin API http://www.gratisoft.us/sudo/man/1.8.1/sudo_plugin.man.html What does it do currently? 1. sudo plugin sends input data to responder 2. responder sends back to plugin that user is allowed to run the command What does it not do? - Doesn't require any PAM authentication - Doesn't read anything from LDAP - Doesn't set any environment variables (and reset current environment) This actually can cause some troubles to applications, so far I've encountered an error message in VIM (no $HOME specified) How to test it? 1. Install SUDO version 1.8 or greater I am running 1.8.2 built from source: ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.2.tar.gz 2. Enable SUDO plugin in /etc/sudo.conf Plugin sss_sudo_policy /usr/lib/sudo/libsss_sudoplugin.so Unfortunately, SUDO doesn't allow to have more than one policy plugin activated, so comment out standard sudoers plugin. 3. Enable it in sssd.conf ;-) services += sudo 4. Run sssd 5. Run sudo I left there some debug messages, so don't worry when you see: CMD Return code: 0 errnop: 0 Command exited with status 0 in the output. But tell me if there is anything else than 0 :-) [PATCH 1/5] Adds a client function that allows client to send data to responder. And set sudo responder protocol version. [PATCH 2/5] SUDO plugin. [PATCH 3/5] SUDO responder. [PATCH 4/5] Configure and Makefile updates so we can build plugin and responder. [PATCH 5/5] Just a little update that adds sudo responder to known services of monitor.

2 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel October 2011