[PATCH] MAN: quotation fix
by Ondrej Kos
I noticed that the proxy in auth_provider section of sssd.conf manpage
isn't quoted when all others are.
Patch is attached.
O.
--
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech
phone: +420-532-294-558
cell: +420-736-417-909
ext: 82-62558
loc: 1013 Brno 1 office
irc: okos @ #brno
11 years, 5 months
wiki cleanup
by Jakub Hrozek
Hi,
as we need a documentation on the IPC between different SSSD processes
and also gathering debug data and submitting nice bug reports, I started
by a little SSSD wiki cleanup. In particular:
* Fixed up the repo at https://fedorahosted.org/sssd/wiki/Repositories and
added a RHEL repo
* deleted the DevSetup page completely. It only listed how to
configure ReviewBoard tools to submit patches to the SSSD. I don't
think we'll be using ReviewBoard anytime soon.
* I split the Design Pages linked from
https://fedorahosted.org/sssd/wiki/Contribute into multiple
categories - one for generic concepts that are unlikely to change,
one for features that have been implemented in a release and one for
designs that never happened, such as the asynchronous LDAP bind or
are planned. I think there should even be a separate Designs page,
much like freeIPA has.
* several pages that referenced the ding-libs still linked into the
non-existing common/ subdirectory. They link to the ding-libs git
now.
I hope these changes are OK with everyone.
11 years, 5 months
Should we support sudoUser %#gid?
by Pavel Březina
Hi,
you can specify %#gid value in sudoUser attribute to match the rule to
specified gid. When I first started working on sudo integration %#gid
value wasn't supported so it is not supported by sssd.
Should we implement it? I personally don't think it is something we
need to bother with (at least not right now). What is your opinion?
Not working %#gid is a small part of a bug opened by Nikolai:
https://fedorahosted.org/sssd/ticket/1624
11 years, 5 months
[PATCH] SUDO: Fix compilation warning
by Jakub Hrozek
I'm sorry, I overlooked the compilation warning in the recent sudo
patches as I was testing on a VM that didn't have the silent rules
enabled. A patch is attached.
11 years, 5 months
[PATCHES] sudo failing for ad trusted user in IPA environment
by Pavel Březina
https://fedorahosted.org/sssd/ticket/1616
There where three main issues.
1. sssd_sudo didn't support subdomains at all
2. sudo sends two request - for default options and for rules
We match user with domain in default options request and send the
domain name back to sudo. Sudo sends it back to us in the form
"user@domain" in rules request.
If the username already contains domain name (subdomain case), sudo
sent us "user@domain@domain". I fixed this by changing the protocol.
Sudo sends user and domain separately now. The old protocol is also
supported, but a debug message is printed that it will not work with
subdomains.
3. subdomain users are stored in cn=subdomain,cn=sysdb, but rules are
stored in cn=ipadomain,cn=sysdb. I'm using subdomain sysdb context
for user lookups and ipadomain sysdb context for rules lookups.
[PATCH 1/6]
fix missing parameter in two debug messages
[PATCH 2/6]
use tmp_ctx in sudosrv_get_sudorules_from_cache()
[PATCH 3/6]
solves 1 and 3
[PATCH 4/6]
solves 2
[PATCH 5/6]
bumps libsss_sudo version
[PATCH 6/6]
adds useful debugging info
11 years, 5 months