Neither systemd or our init script use pid file as a notification
that sssd is finished initializing. They will continue starting up
next service right after the original process is terminated.
After previous set of patches have been committed I started working on
the last remaining piece - the merge functionality.
Re-reading the code I started some time ago I realized that at the time
I left the question of whether the config object should allow
partitioned section or not was still open.
Consider an example of the config file:
Here we have an example of the case when the section is segmented or if
you look from another POW there are dup sections. So at first I thought
that it is OK to parse the file as is and have the internal config
object have two sections with same name. But after some deep thinking I
realized that it is a bad idea and creates a lot of unnecessary
complexity. So patch removes this code. This paves the way to a more
simple code in the merge function as we can assume that there are no dup
sections in the objects being merged.
I also noticed that doc build is spitting warnings so I opened a
separate ticket about it. That would be my next patch.
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
Looking to carve out IT costs?
We only read the configured SIGKILL time for services and actually used
the value of 0, which actually translated into
tevent_schedule_immediate. That meant that after we sent the SIGTERM we
also sent a SIGKILL right away, which is bad...
There are many places in the sdap_save_group() routine where we could exit due
to failure without logging a detailed message. This patch adds more log
messages in error conditions.
Stephen Gallagher (1):
LDAP: Better debug logging when saving groups
src/providers/ldap/sdap_async_groups.c | 86 +++++++++++++++++++++++++++++-----
1 file changed, 75 insertions(+), 11 deletions(-)
This patch introduces use_talloc_logs function. After this function is
called, talloc log messages are sended to DEBUG macro and shown in our logs.
Patch is attached.
I'm sorry but this patch series is a bit longer than I originally
expected. While testing password authentication I came across some
issues and inconsistencies, some of them were also already seen by
Steeve during his testings. And since they may prevent successful
password authentication I put the patches in the series as well. I also
tried to make the patches as small and self-contained as possible to
make the review easier.
[PATCH 01/14] subdomain-id: Generate homedir only for users
- this is the only patch not strictly related to password
authentication, it remove a useless operation for group requests
[PATCH 02/14] s2n: save user principal name of sub-domain user
- if the user is looked up via the extdom exop and the IPA server the
user principal name is generated and store in the cache so that it
can be used for password authentication
[PATCH 03/14] pac responder: fix copy-and-paste error
- this error prevent proper id-mapping in the PAC responder
[PATCH 04/14] sysdb: look for ranges in the parent tree
- always use the right sub-tree in the cache to search for ranges
[PATCH 05/14] pac responder: use only lower case user name
- since the extdom exop uses winbind to do the SID to name mapping and
winbind only returns names lower case we have to lower case the names
in the PAC responder as well to avoid inconsistent behaviour
[PATCH 06/14] pac responder: add user principal to cached user
- same as patch 0002 but for the case the user is stored by the PAC
[PATCH 07/14] Accept be_req instead if be_ctx in krb5 auth provider
- this patch was written by Jan some time ago and makes the same
changes to the auth provider which were already done for other
provider to better handle the needed data for different sub-domains
[PATCH 08/14] sysdb: add sysdb_base_dn()
- this just adds a helper which is needed by patch 9
[PATCH 09/14] check_ccache_files: search sub-domains as well
- this fixes a todo in Jan patch, now the renewal task checks the
ccache for sub-domain users as well
[PATCH 10/14] Detect subdomain request in IPA auth provider
- checks if the auth request is for a subdomain and creates that
creates the needed structs to access the cached data for the
[PATCH 11/14] Add replacement for krb5_find_authdata()
- add a replacement for a call only available in MIT Kerberos 1.10,
currently it returns only and error. Is it worth to implement some
basic functionality for platforms with older MIT versions?
[PATCH 12/14] krb5_auth: check if principal belongs to a different
- add a flag if the principal used for authentication does not belong
to our realm
[PATCH 13/14] krb5_auth: send different_realm flag to krb5_child
- send the flag from patch 12 to the krb5-child
[PATCH 14/14] krb5_child: send PAC to PAC responder
- look for a PAC and send it to the PAC responder if the principal does
not belong to our realm
Also while fixing this, I found that rpmbuild was broken due to missing
includes in ini_config-devel spec.
Patch is attached.
Associate Software Engineer
Red Hat Czech
loc: 1/5C Brno 1 office
irc: okos @ #brno