[PATCH 0/3]: New utility functions/headers
by Simo Sorce
>From [PATCH 0/0] A shared memory cache to perform better:
0/3: New utility functions/headers
These are also quite straightforward but they are useless without the
later patches
Simo.
--
Simo Sorce * Red Hat, Inc * New York
12 years, 3 months
[PATCH 0/2] changes to make life easier for later patches
by Simo Sorce
>From [PATCH 0/0] A shared memory cache to perform better:
0/2: changes to make life easier for later patches
These change some internals of fill_pwent() and fiull_grent() and can be
applied on their own. I think they also simplify, slightly, reading
those functions, but that's probably a matter of taste.
It would be nice to have these patches pushed (unless there are issues
with them) reasonably soon in order to avoid a lot of churn and rebases
if they stomp on some other people work.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
12 years, 3 months
[PATCH] HBAC: create empty groups with one NULL element
by Jakub Hrozek
https://fedorahosted.org/sssd/ticket/1130
Some places if HBAC would create a "{ NULL }" array when there are no
groups, some would just use a NULL pointer.
I think using the array is a safer solution because the loops we use
usually just go through safely. Shanks found one such issue today where
we would use a NULL pointer for the groups pointer in the srchost
element and SSSD would crash.
The attached patch standartizes on using the single element arrays.
12 years, 3 months
[PATCH 2/2] Do not call krb5_child when changing passwords and provider went offline
by Jakub Hrozek
https://fedorahosted.org/sssd/ticket/1131
If the SSSD back end goes offline during Kerberos auth, the back end calls
the child process for the second time in order to create an expired TGT.
In case the KDC server is used for KPASSWD operation, but the Kerberos
library returns that the KDC is not available during chpass, SSSD would
still attempt to call the krb5_child process for the second time. The
child would still attempt to changepw, which would fail, then SSSD would
go offline again and call the child again etc. The back end would go
into infinite loop.
A simple test case is to create an IPA user with an expired password,
shut down the ipa_kpasswd process and try to log in.
12 years, 3 months
[PATCH 0/1] general fixes for bugs I found while coding
by Simo Sorce
>From [PATCH 0/0] A shared memory cache to perform better:
0/1: general fixes for bugs I found while coding
These patches should be quite straight forward and would be nice to
apply them asap.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
12 years, 3 months
Announcing SSSD 1.6.2
by Stephen Gallagher
The SSSD team is proud to announce the version 1.6.2 enhancement and
bugfix release of the System Security Services Daemon.
As always, it can be downloaded from https://fedorahosted.org/sssd/
== Highlights ==
* Improved handling of users and groups with multi-valued name
attributes (aliases)
* Performance enhancements
* Initgroups on RFC2307bis/FreeIPA
* HBAC rule processing
* Improved process-hang detection and restarting
* Enabled the midpoint cache refresh by default (fewer cache misses on
commonly-used entries)
* Cleaned up the example configuration
== Detailed Changelog ==
Jakub Hrozek (23):
* Improve error message for LDAP password constraint violation
* Keep deref controls until the whole request is finished
* Fix uninitialized pointer read in sdap_gssapi_get_default_realm()
* IPA access: hostname comparison should be case-insensitive
* Add sysdb interface to get name aliases
* Add a sysdb_get_direct_parents function
* Store name aliases for users, groups
* Return users and groups based on alias
* Use explicit base 10 for converting strings to integers
* Fix typo in sysdb_get_direct_parents
* Add option to follow symlinks to check_file()
* Append PID to sbus server socket name, let clients use a symlink
* Streamline the example config
* Do not delete requests inside hash_iterate loop
* Check if dp_requests hash table exists before using it
* Fix off-by-one error in remove_socket_symlink()
* Report on errno, not return code in create_socket_symlink
* Add a missing break
* Sanitize DN in sysdb_get_direct_parents
* gitignore additions
* Utility functions for LDAP nested schema initgroups
* Use fewer transactions during RFC2307bis initgroups
* Use fewer transactions during IPA initgroups
Jan Zeleny (2):
* man page fix (lists are comma-separated)
* Fixed timeout handling in responders
Marko Myllynen (3):
* Add missing options to sssd.api.conf
* Unbreak ./configure
* Update sssd-example.conf
Pavel Březina (3):
* sss_ldap_err2string() - function created
* sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string()
* Added quiet option to pam_sss
Pavel Zuna (1):
* Fix small bug where TALLOC_CTX could end up unfreed.
Stephen Gallagher (18):
* Bumping version to 1.6.2
* Add option to specify the kerberos replay cache dir
* Fix typo in %configure
* Remove all libtool .la files from RPM
* Improve documentation of libipa_hbac
* Add libipa_hbac documentation to the -devel package
* MONITOR: Correctly detect lack of response from services
* Do not build documentation on RHEL 5
* Fix typo in specfile
* MAN: Add more information about internal credential storage
* Enable the midpoint cache update by default
* HBAC: fix typos preventing proper hostgroup evaluation
* HBAC: Do not save member/memberOf links
* HBAC: Use originalMember for identifying servicegroups
* HBAC: Use originalMember for identifying hostgroups
* BUILDSYS: Fix --without-manpages
* MONITOR: fix timeout conversion
* Updating translation files for string freeze
Sumit Bose (1):
* Do not access memory out of bounds
12 years, 3 months