[PATCH] Only build extract_and_send_pac on platforms that support it
by Jakub Hrozek
Attached is a patch that fixes a compilation problem of the SSSD on
RHEL-5. I split the original function into two to only link the child
process with the client libraries and not all consumers of sss_krb5.c
I have a hard stop today around this time, so I didn't have time to
fully test the patch, unfortunately.
11 years, 5 months
[PATCH] Add helper in mc code
by Simo Sorce
While looking at the mc code I came up with this patch that makes the
code a little bit cleaner.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
11 years, 5 months
Unexpected behavior with 'simple_allow_users ='
by Stef Walter
When I have the following in a domain in sssd.conf:
access_provider = simple
simple_allow_users =
... any user is allowed to log in, despite the list being empty. The
documentation states:
· If either or both "allow" lists are provided, all users are denied
unless they appear in the list.
The list is provided, albeit empty. The simple access provider however
treats it as if it is not provided.
Since sssd.conf is often machine driven, this sort of unexpected
behavior leads to security problems like: removing a user from the
simple_allow_users acl leads to any user being allowed.
I've worked around this behavior in realmd, by using a comma:
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=56027
Patch: https://bugs.freedesktop.org/attachment.cgi?id=68615
Attached is a rough patch to sssd which fixes the problem. If you think
it's worth fixing, I'll do more testing on it.
Cheers,
Stef
11 years, 5 months
[PATCH] sss_dp_get_domains_send(): set ret to EAGAIN if force is true
by Pavel Březina
I found this bug when setting my own trust environment.
I was unable to match username@subdomain to subdomain. This patch puts
me a step forward. I can match the subdomain now, but I can't get
account info:
[sssd[be[IPA-SUDO-SUBDOMAIN]]] [ipa_s2n_exop_send] (0x0400): Executing
extended operation
[sssd[be[IPA-SUDO-SUBDOMAIN]]] [sdap_get_generic_ext_step] (0x0400):
calling ldap_search_ext with
[objectclass=ipaNTTrustedDomain][cn=trusts,dc=*].
[sssd[be[IPA-SUDO-SUBDOMAIN]]] [ipa_s2n_exop_done] (0x0400):
ldap_extended_operation result: Operations error(1), (null)
[sssd[be[IPA-SUDO-SUBDOMAIN]]] [ipa_s2n_get_user_done] (0x0040): s2n
exop request failed.
[sssd[be[IPA-SUDO-SUBDOMAIN]]] [sdap_id_op_done] (0x0200): communication
error on cached connection, moving to next server
[sssd[nss]] [nss_cmd_getpwnam_dp_callback] (0x0040): Unable to get
information from Data Provider
11 years, 5 months
[PATCHES] Fix assorted issues around the 'force_timeout' option
by Stephen Gallagher
The manpages and the implementation differed significantly.
Patch 0001: Add some debugging messages to identify the ping timeouts
for each service/domain.
Patch 0002: Fix the manpages so that 'force_timeout' is listed in the
SERVICES and DOMAINS sections instead of the monitor section.
Patch 0003: Fix the SSSDConfig API so that the 'force_timeout' option is
accepted for services and domains (or else consumers of the API like
ipa-client or authconfig might throw 'unknown option' errors).
11 years, 5 months