[PATCH] Allow more libldap debugging
by Jakub Hrozek
This patch should not be pushed to master, but I would like to get it
reviewed anyway.
It should be used to provide a custom build for users experiencing cases
where ldap_search_ext would block (c.f.
https://bugzilla.redhat.com/show_bug.cgi?id=728343)
For example:
export SSSD_DEBUG_LDAP_SEARCH="0xffff"
would set LDAP_DEBUG_ANY
The attached patch applies cleanly on the RHEL6.1 branch. I also have a
version that applies on master/1.5 if needed.
10 years, 6 months
[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal
Please see the attached patches. I tried to split the patches logically
into manageable sets.
Unfortunately I made a minor mistake and I am afraid I will do something
wrong to fix it.
I merged two wrong patches. Fortunately it was three liner with 1 liner
so it is not a big of the deal but I am really scared that I will do
something wrong and loose the work I have done.
So I hope it is Ok to send it as is.
0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted
earlier that I merged by mistake. I was supposed to merge it with patch
25 but picked the wrong one instead.
Patch 25 addresses the real issue found by Coverity as mentioned in
Stephen's review mail but it did not apply cleanly since it relies on
some code from the patches in the middle.
0002--INI-Adding-missing-function-declararion.patch <- this is the
patch that was rejected from the second set sent earlier. Fixed
according to review comment.
0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing
per component
The following set of patches introduces the merging of sections during
the reading of the file:
0004--INI-New-error-codes-and-messages.patch
0005--INI-New-merge-flags.patch
0006--INI-Add-new-vars-to-parse-structure.patch
0007--INI-Add-save_error-function.patch
0008--INI-Change-parse_error-to-use-save_error.patch
0009--INI-Preparing-for-merging-sections.patch
0010--INI-Enhance-value-processing.patch
0011--INI-Use-section-line-number.patch
0012--INI-Refactor-section-processing.patch
0013--INI-Return-error-in-DETECT-mode.patch
0014--INI-New-test-files-for-section-merge.patch
0015--INI-Test-DETECT-mode-and-use-new-file.patch
0016--INI-Test-for-all-section-merge-modes.patch
Patches related porting of the meta data from old way of doing things to
the new way of doing things:
0017--INI-Separate-close-and-destroy.patch
0018--INI-Function-to-reopen-file.patch
0019--INI-Metadata-collection-is-gone.patch
0020--INI-Check-access-function.patch
0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check)
0022--INI-Function-to-check-for-changes.patch
0023--INI-Tests-for-access-and-changes.patch
0024--INI-Rename-error-print-function.patch <- rename error printing
function for consistency with new interface
0025--INI-Initialize-variables-in-loops.patch <- Coverity issue
addressed. Related to patch 0001.
0026--INI-Exposing-functions.patch <- Make some internal functions reusable
There is also patch 27. It is a piece of new functionality. It is a
preview. Please see the comment before reviewing it.
Do I need to split it into multiple patches or it is Ok as is? It is
pretty big but all changes are in one file and logically related.
The UNIT test is missing so I am not claiming it actually works as
expected.
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
11 years, 2 months
[PATCHES] SUDO Integration
by Pavel Březina
https://fedorahosted.org/sssd/ticket/1105 (review ticket)
https://fedorahosted.org/sssd/ticket/623 (sudo integration)
Hello,
it is finally here.
These patches *assume* that "Responders: Split getting domain by name
into separate function" patch has been applied, it can be found in
"Ability to set a domain as case sensitive or insensitive" thread.
Design page:
https://fedorahosted.org/sssd/wiki/DesignDocs/SUDOIntegrationNewApproach
What's left:
1. implementing support of sssd in sudo sudoers plugin
2. periodical update of all rules
3. provide documentation
4. in memory cache in responder
5. refactor DP request using "RESPONDER: Refactor DP requests into
tevent_req style" patch
6. provide few more configuration options
7. support the IPA scheme
How to configure it:
1. configure --enable-all-experimental-features
2. sssd.conf:
services += sudo
domain options: sudo_provider, ldap_sudo_search_base
How to test it:
> sss_sudo_cli username
This will display rules for %username. It performs two lookups:
1. using native sssd api to get and display raw date (it prints every
byte as char so don't be scared of silly characters that are shown
instead of numbers)
2. using api that we provide to sudo and use it to display data in user
readable format
Big thanks to Jakub, who has written whole sysdb api and a big part of
responder.
Regards,
Pavel Březina.
11 years, 4 months
[PATCHES] SUDO Integration - periodical update
by Pavel Březina
https://fedorahosted.org/sssd/ticket/1110
[PATCH 1/4]
I've removed FIXME and move the DEBUG message to a better place.
[PATCH 2/4]
I've wrapped the data provider part with tevent request so I can reuse
the code in periodical updates.
[PATCH 3/4]
Adds two new functions in sudo sysdb api that can set/retrieve the value
of 'refreshed' attribute (equivalent to 'has_enumerated' attribute in
domain enumeration). If it is true, the first schedule will be delayed
for a few seconds so we don't slow down the start up process.
[PATCH 4/4]
Periodical update itself. It adds two new options:
ldap_sudo_refresh_enabled (bool) - equivalent to 'enumerate'
ldap_sudo_refresh_timeout (number) - equivalent to
'ldap_enumeration_refresh_timeout'
11 years, 4 months
SSSD and Kerberos
by Alexander Blair
Hello,
I've been working with FC 16 and SSSD for about two days now trying to
get SSSD to properly talk to our Kerberos server, and it seems to
continually ignore the fact I've got it configured to do so at this
time. Tracking the logs has shown me nothing useful as of yet, and
monitoring network traffic on the Krb server itself shows that there's
no network communication happening.
I've even gone as far as to completely purge the working directory for
it's caches, and force them to rebuild, restarting the box, nothing I've
done so far seems to force SSSD to contact Krb for auth information, any
ideas on where to take this would be most excellent.
I'm currently using SSSD 1.6.3 from the main FC repos. I've gone though
as much troubleshooting information as I can, but as there does not
appear to be any errors in my krb5_child.log log, or much else that
appears to be useful, so I'm a bit stumped.
/etc/sssd/sssd.conf:
[domain/domain]
ldap_id_use_start_tls = False
cache_credentials = True
ldap_search_base = dc=dc,dc=dc,dc=dc
krb5_realm = this.is.a.valid.realm
krb5_server = 192.168.100.100
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
ldap_uri = ldap://192.168.100.200/
krb5_kpasswd = 192.168.100.100
ldap_tls_cacertdir = /etc/openldap/cacerts
[sssd]
services = nss, pam
config_file_version = 2
domains = domain
[nss]
[pam]
/var/log/sssd/sssd_nss.log -- Debug level 4:
(Fri Dec 30 01:46:35 2011) [sssd[nss]] [accept_fd_handler] (4): Client
connected!
(Fri Dec 30 01:46:35 2011) [sssd[nss]] [nss_cmd_getpwnam] (4):
Requesting info for [user] from [<ALL>]
(Fri Dec 30 01:46:35 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4):
Requesting info for [user@default]
(Fri Dec 30 01:46:35 2011) [sssd[nss]] [nss_cmd_initgroups] (4):
Requesting info for [user] from [<ALL>]
(Fri Dec 30 01:46:35 2011) [sssd[nss]] [nss_cmd_initgroups_search] (4):
Requesting info for [user@default]
(Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam] (4):
Requesting info for [user] from [<ALL>]
(Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4):
Requesting info for [user@default]
(Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam] (4):
Requesting info for [user] from [<ALL>]
(Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4):
Requesting info for [user@default]
(Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam] (4):
Requesting info for [user] from [<ALL>]
(Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4):
Requesting info for [user@default]
Thank you,
Alexander Blair
11 years, 4 months
Announcing SSSD 1.6.2
by Stephen Gallagher
The SSSD team is proud to announce the version 1.6.2 enhancement and
bugfix release of the System Security Services Daemon.
As always, it can be downloaded from https://fedorahosted.org/sssd/
== Highlights ==
* Improved handling of users and groups with multi-valued name
attributes (aliases)
* Performance enhancements
* Initgroups on RFC2307bis/FreeIPA
* HBAC rule processing
* Improved process-hang detection and restarting
* Enabled the midpoint cache refresh by default (fewer cache misses on
commonly-used entries)
* Cleaned up the example configuration
== Detailed Changelog ==
Jakub Hrozek (23):
* Improve error message for LDAP password constraint violation
* Keep deref controls until the whole request is finished
* Fix uninitialized pointer read in sdap_gssapi_get_default_realm()
* IPA access: hostname comparison should be case-insensitive
* Add sysdb interface to get name aliases
* Add a sysdb_get_direct_parents function
* Store name aliases for users, groups
* Return users and groups based on alias
* Use explicit base 10 for converting strings to integers
* Fix typo in sysdb_get_direct_parents
* Add option to follow symlinks to check_file()
* Append PID to sbus server socket name, let clients use a symlink
* Streamline the example config
* Do not delete requests inside hash_iterate loop
* Check if dp_requests hash table exists before using it
* Fix off-by-one error in remove_socket_symlink()
* Report on errno, not return code in create_socket_symlink
* Add a missing break
* Sanitize DN in sysdb_get_direct_parents
* gitignore additions
* Utility functions for LDAP nested schema initgroups
* Use fewer transactions during RFC2307bis initgroups
* Use fewer transactions during IPA initgroups
Jan Zeleny (2):
* man page fix (lists are comma-separated)
* Fixed timeout handling in responders
Marko Myllynen (3):
* Add missing options to sssd.api.conf
* Unbreak ./configure
* Update sssd-example.conf
Pavel Březina (3):
* sss_ldap_err2string() - function created
* sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string()
* Added quiet option to pam_sss
Pavel Zuna (1):
* Fix small bug where TALLOC_CTX could end up unfreed.
Stephen Gallagher (18):
* Bumping version to 1.6.2
* Add option to specify the kerberos replay cache dir
* Fix typo in %configure
* Remove all libtool .la files from RPM
* Improve documentation of libipa_hbac
* Add libipa_hbac documentation to the -devel package
* MONITOR: Correctly detect lack of response from services
* Do not build documentation on RHEL 5
* Fix typo in specfile
* MAN: Add more information about internal credential storage
* Enable the midpoint cache update by default
* HBAC: fix typos preventing proper hostgroup evaluation
* HBAC: Do not save member/memberOf links
* HBAC: Use originalMember for identifying servicegroups
* HBAC: Use originalMember for identifying hostgroups
* BUILDSYS: Fix --without-manpages
* MONITOR: fix timeout conversion
* Updating translation files for string freeze
Sumit Bose (1):
* Do not access memory out of bounds
11 years, 5 months
ldap shadow policy
by Patrick Hemmer
Firstly, apologies if this isnt appropriate for this mailing list. This
was the only sssd mailing list I could find.
I'm trying to migrate a RHEL5 box from pam_ldap to sssd (version 1.5.1,
official redhat package) and am having an issue getting shadow
attributes working. For testing I set a shadowExpire attribute on my
account in LDAP. pam_ldap obeys this correctly and will not let me log
in (trying with ssh public key as the server enforces the password
policy). I have added the following settings to the ldap domain to try
and get this to work;
access_provider = ldap
ldap_access_order = expire
ldap_account_expire_policy = shadow
But the box sill lets me log in. For testing to make sure pam was
working, I set 'ldap_access_order=filter' without setting
ldap_access_filter, and it properly rejected my login.
Googling the subject only turns up the man page and the patch set where
these settings were added.
Any ideas what I'm missing here?
Thanks
11 years, 5 months
request for Heimdal support
by lists
Hi,
Would it be possible to extend SSSD and also support Heimdal as Kerberos
client implementation?
This patch seems to provide just that:
http://cvs.pld-linux.org/cgi-bin/viewvc.cgi/cvs/packages/sssd/sssd-heimda...
My setup is as follows:
- server with
- Heimdal KDC
- openldap
- pam_ldap / nss_ldap
- laptops/workstations with
- mit kerberos clients
- SSSD
I would like to use SSSD on all my machines, but because SSSD does not
support Heimdal I cannot replace pam_ldap/nss_ldap on the server.
Maybe you could consider this patch and add it to SSSD?
Thanks,
J.
11 years, 5 months
Announcing SSSD 1.7.0
by Stephen Gallagher
The SSSD team is proud to announce the version 1.7.0 enhancement release
of the System Security Services Daemon.
As always, it can be downloaded from https://fedorahosted.org/sssd/
== Highlights ==
* Support for case-insensitive domains
* Support for multiple search bases in the LDAP provider
* Support for the native FreeIPA netgroup implementation
* Reliability improvements to the process monitor
* New DEBUG facility with more consistent log levels
* New tool to change debug log levels without restarting SSSD
* SSSD will now disconnect from LDAP server when idle
* FreeIPA HBAC rules can choose to ignore srchost options for
significant performance gains
* Assorted performance improvements in the LDAP provider (reducing
disk-writes to the cache)
* '''Experimental''' support for looking up SUDO rules in ldap
* Not built by default
* Requires unreleased sudo binary. Very preliminary functionality.
* '''Experimental''' support for Heimdal Kerberos implementation
(buggy)
== Detailed Changelog ==
Jakub Hrozek (89):
* pyhbac: Do not convert int to bool
* Fix returning groups when gidNumber attribute is not ordered
* Prevent segfault if vetoed_shells are specified without
allowed_shells
* Remove unused temporary context
* Handle errno properly in set_debug_file_from_fd()
* Do not delete requests inside hash_iterate loop
* Handle timeout during sss_ldap_init_send
* IPA dyndns: do not segfault if the server cannot be resolved
* Return the first value of name if the multivalued name attribute does
not match RDN
* Add LDAP provider option to set LDAP_OPT_X_SASL_NOCANON
* Use the default Kerberos realm for LDAP with GSSAPI auth
* Fix moving to next entry in deref code
* Allow turning dereference off by setting the threshold to 0
* Change libnl monitor callback to only signal going online
* Discard carrier messages from non-ethernet devices
* Subscribe to netlink route and addr messages
* Improve error message for LDAP password constraint violation
* Keep deref controls until the whole request is finished
* Fix uninitialized pointer read in sdap_gssapi_get_default_realm()
* Fix wrong buffer size in has_phy_80211_subdir()
* Multiline macro cleanup
* IPA access: hostname comparison should be case-insensitive
* Add sysdb interface to get name aliases
* Add a sysdb_get_direct_parents function
* Store name aliases for users, groups
* Return users and groups based on alias
* Use explicit base 10 for converting strings to integers
* Fix typo in sysdb_get_direct_parents
* Add option to follow symlinks to check_file()
* Append PID to sbus server socket name, let clients use a symlink
* Streamline the example config
* Check if dp_requests hash table exists before using it
* Fix off-by-one error in remove_socket_symlink()
* Report on errno, not return code in create_socket_symlink
* Add a missing break
* Sanitize DN in sysdb_get_direct_parents
* gitignore additions
* Utility functions for LDAP nested schema initgroups
* Use fewer transactions during RFC2307bis initgroups
* Use fewer transactions during IPA initgroups
* Cancel transactions correctly during initgroups
* Plug memory leaks in LDAP provider
* Plug memory leaks in sysdb_ops
* Do not leak hash table iterator during proxy auth
* resolver: Free the whole hostent structure
* RFC2307bis initgroups: fix nested groups processing
* Steal result onto mem_ctx in sdap_initgr_nested_get_direct_parents
* Use LDAPDerefSpec properly
* Remove confusing do-while loop
* Fix segfault in sdap_get_initgr_user
* Use correct state struct in sdap_initgr_rfc2307bis_next_base
* configAPI: Fix removing in old domain when saving a new domain
* Squash transactions in sdap_initgr_common_store
* Use one transaction instead of two during RFC2307bis group processing
* Prevent printing NULL in several places of LDAP provider
* Cleanup: Remove unused parameters
* Fix sdap_id_ctx/ipa_id_ctx mismatch in IPA provider
* Provide means of forcing TLS and GSSAPI enabled/disabled for sdap
connections
* IPA migration fixes
* Fix two small bugs in group dereferencing
* Use dereference during IPA provider initgroups
* Pass the correct private data into Data Provider callback
* Always attempt to connect in sdap_async_sys_connect_done
* LDAP provider: Error while setting the nocanon option should not be
fatal
* Cancel ping_check if service goes away
* sss_utf8_tolower utility function+unit tests
* Responders: Split getting domain by name into separate function
* Canonicalize username in PAM provider
* Use the case sensitivity flag in responders
* Refactor saving sdap entities
* sysdb_get_real_name helper function
* Use the case sensitivity flag in the LDAP provider
* Use the case sensitivity flag in the simple access provider
* Use the case sensitivity flag in the proxy provider
* Export the function to convert ldb_result to sysdb_attrs
* SUDO Integration - sysdb interface
* SUDO Integration - LDAP provider - save sudo rules functions
* SUDO Integration - responder - get sudo rules logic
* DP: Remove processed callbacks
* Pass client context to sss_dp_get_account_send
* Pass sdap_id_ctx to online check from IPA provider
* Error out if local domain is case insensitive
* Resolver: Introduce a per-request timeout
* Do not touch resolve_service_state in fo_resolve_service_done
* Failover: Introduce a per-service timeout
* Save original memberof, not memberof
* sss_get_cased_name utility function
* Return user and group names lowercased in case insensitive domains
* Honor case sensitive flag when creating the ccname template
Jan Zeleny (37):
* sysdb refactoring: renamed ctx variable to sysdb
* Added sysdb_ctx_get_domain function
* sysdb refactoring: deleted domain variables in sysdb API
* sysdb refactoring: memory context deleted
* Remaining memory context variables renamed
* sdap_async_accounts.c split
* Confusing part of code cleared out
* Moved some functions in sdap_async_groups
* Moved some functions in sdap_async_initgroups
* Fixed bad logic in processing netgroups in LDAP provider
* man page fix (lists are comma-separated)
* Fixed timeout handling in responders
* Added krb5_fast_principal to SSSDConfig API
* Cleanup of unused function in ldap access provider
* Add wrapper for krb5_get_init_creds_opt_set_canonicalize
* Add support to request canonicalization on krb AS requests
* Support to request canonicalization in LDAP/IPA provider
* Handle group renaming correctly
* Fixed possible resource leak in get_uid_from_pid()
* Fixed possible resource leak in create_mail_spool()
* Fixed empty loginShell in proxy provider
* Fixed unchecked value of setenv() in check_and_export_options()
* Renamed some LDAP routines
* Modified sdap_parse_search_base()
* Added and modified options for IPA netgroups
* New IPA ID context
* Added support for fetching netgroups in IPA provider
* Added IPA account info handler
* Fixed a typo in sysdb_upgrade_07() declaration
* Fixed uninitialized pointer read in netgroups processing
* Fixed logically dead code in netgroup processing
* Add ipa_hbac_support_srchost option to IPA provider
* Fixed an error in macro for merging double linked lists
* Fixed incorrect return code in PAM client
* Add ldap_sasl_minssf option
* Fixed IPA netgroup processing
* Deleted declaration of nss_get_dom()
Krzysztof Klimonda (1):
* Fix FTBFS related to -Werror=format-security
Marko Myllynen (4):
* Add missing options to sssd.api.conf
* Unbreak ./configure
* Update sssd-example.conf
* Typo fixes
Pavel Březina (35):
* debug_timestamps fixes
* Fixed implicit declaration of function 'time' in
src/sss_client/common.c.
* New DEBUG facility - new levels
* New DEBUG facility - modified DEBUG
* New DEBUG facility - conversion
* New DEBUG facility - man pages
* New DEBUG facility - unit tests
* New DEBUG facility - SSSDBG_UNRESOLVED changed from -1 to 0
* --debug-timestamps=1 is not passed to providers
* sss_ldap_err2string() - function created
* sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string()
* sss_debuglevel - change the debug levels on the fly
* DEBUG timestamps offer higher precision
* DEBUG timestamps offer higher precision - man page updated
* DEBUG timestamps offer higher precision - unit tests updated
* DEBUG timestamps offer higher precision - SSSDConfig updated
* Added quiet option to pam_sss
* SysDB commands that save lastUpdate allows this value to be passed in
* Fixes debug-tests.c coverity issues: NEGATIVE_RETURNS, FORWARD_NULL
* sss_cli.h - fix: function declaration after the header guard
* Added sssd --version option
* Added sss_ldap_dn_in_search_bases()
* Support search bases in RFC2307bis enumeration
* Support search bases in netgroup members translation
* SUDO integration - client common interface
* SUDO integration - data provider backend handler
* SUDO Integration - LDAP configuration options
* SUDO integration - LDAP provider
* SUDO Integration - responder
* SUDO Integration - API for sudo
* SUDO Integration - pseudo client for testing
* Logically dead code in sdap_nested_group_lookup_group
* Use of uninitialized value in sss_ldap_dn_in_search_bases
* SUDO Integration - be_sudo_req removed from sudo_ctx
* SUDO Integration - fixed memory leak in sdap_sudo_handler()
Pavel Zuna (2):
* Fix small bug where TALLOC_CTX could end up unfreed.
* Add common SIGCHLD handling for providers.
Ralf Haferkamp (1):
* Allow the O_NONBLOCK flag to be reset correctly
Simo Sorce (1):
* Set more strict permissions on keyring
Stephen Gallagher (74):
* Bumping version to 1.7.0
* Revert "Allow LDAP to decide when an expiration warning is warranted"
* Rename sssd.conf to sssd-example.conf
* Include the configuration file as a %ghost entry
* Remove private shared object Provides: for pysss.so and pyhbac.so
* Cancel sysdb upgrade transaction if commit fails
* Fix potential double-free issue
* Fix broken RHEL5 build
* Use sysdb attribute name for GID, not LDAP attribute
* HBAC: Handle saving groups that have no members
* HBAC: Use of hostgroups for targethost or sourcehost was broken
* HBAC: Properly skip all non-group memberOf entries
* Add option to specify the kerberos replay cache dir
* Fix typo in %configure
* Remove all libtool .la files from RPM
* Improve documentation of libipa_hbac
* Add libipa_hbac documentation to the -devel package
* MONITOR: Correctly detect lack of response from services
* Do not build documentation on RHEL 5
* Fix typo in specfile
* MAN: Add more information about internal credential storage
* Enable the midpoint cache update by default
* HBAC: fix typos preventing proper hostgroup evaluation
* SYSDB: New source file for sysdb upgrade routines
* HBAC: Do not save member/memberOf links
* HBAC: Use originalMember for identifying servicegroups
* HBAC: Use originalMember for identifying hostgroups
* BUILDSYS: Fix --without-manpages
* TOOLS: Do not leak pid_file handle on error
* MONITOR: fix timeout conversion
* Updating translation files
* SSSDConfig: Handle integer parsing more leniently
* Remove unused sdap_options attributes
* Fix size return for split_on_separator()
* Make sdap_get_id_specific_filter() more strict
* LDAP: Add parser for multiple search bases
* LDAP: Support multiple user search bases (non-enumeration)
* LDAP: Support multiple netgroup search bases
* LDAP: Support multiple group search bases (non-enumeration, RFC2307)
* LDAP: Add multiple search bases for initgroups (users)
* LDAP: Add multiple search bases for initgroups (RFC2307 groups)
* LDAP: Add multiple search bases for initgroups (RFC2307bis groups)
* LDAP: Update manpages with multiple search base information
* LDAP: Convert ldap_*_search_filter
* LDAP: Add support for multiple search bases for user enumeration
* LDAP: Add support for multiple search bases for group enumeration
* RESPONDER: Fix segfault in sss_packet_send()
* SYSDB: add index for nameAlias
* Periodic translation file update
* LDAP: Remove redundant groups from the lookup list
* SBUS: Fix DEBUG log matching
* RESPONDER: Ensure that all input strings are valid UTF-8
* SYSDB: Make ENOENT log messages less threatening
* Fix broken build due to commit of IPA netgroup support
* Add -fno-strict-aliasing
* LDAP: Try next failover server on any error
* RESPONDER: Refactor DP requests into tevent_req style
* Allow using Glib for UTF8 support
* Ignore NULL-terminator when checking UTF8-validity
* LDAP: Fix missing break statements in force_tls
* Ignore NULL-terminator when checking UTF8-validity for netgroups
* Fix potential resource leak in backup_file.c
* Fix uninitialized value error in ipa_netgroups.c
* Add sdap_connection_expire_timeout option
* Update spec file to build with Glib on RHEL 5
* Fix typo in IPA SSSDConfig file
* Move child_common routines to util
* Reorder pidfile() function to guarantee NULL-termination
* Securely set umask when using mkstemp
* Update translations for string freeze
* MONITOR: use sigchld handler for monitoring SSSD services
* PAM: make initgroups timeout work across multiple clients
* Add compatibility layer for Heimdal Kerberos implementation
* Importing new translations for 1.7.0 release
Sumit Bose (2):
* Improve password policy error code and message
* Do not access memory out of bounds
Thorsten Scherf (1):
* Fixed translation bug
Yuri Chornoivan (2):
* Fix two man page typos
* Fix typos in manual pages
11 years, 5 months
[PATCH] Return user and group names lowercased in case insensitive domains
by Jakub Hrozek
The attached three patches reflect the discussion we had on #sssd and
sssd-devel mailing list. They also fix
https://fedorahosted.org/sssd/ticket/1123
[PATCH 1/3] sss_get_cased_name utility function
I moved the ternary operator expression into a separate function. It's
being used all over the place now.
[PATCH 2/3] Return user and group names lowercased in case insensitive
domains
Does what it says on the box. Is there a way to force the same for
initgroups? As far as I can see, we don't even send the netgroup name
back to the NSS module..
[PATCH 3/3] Honor case sensitive flag when creating the ccname
The homedir template is handled automatically in patch #2, but we need
to handle the ccname templates as well.
11 years, 5 months