In order to support the AD Domain\User style and the more usual kerberos
user@realm style, sssd needs per domain re_expression and
Attached is a rough patch implementing per domain qualified user names.
When discussing it on IRC we came up with the following plan: In order
to prevent conflicts between the regular expressions for different
domains, we parse with a domains regular expression and then check that
the resulting domain matches that domain's name.
It's not clear that we should support 'null-domains' in these regular
expressions and sss_parse_name_for_domains(). There's a TODO in the
patch to sort this out. It may be that we choose to have callers of
sss_parse_name_for_domains() which can accept unqualified user domains
use the full input string when parsing into a qualified name fails.
In other words, sss_parse_name_for_domains() would not support
returning a NULL *domain.
The global re_expression and full_name_format options remain as defaults
for the domains.
This patch is especially important for Samba integration. Samba only
allows Domain\User format, with the exception that the slash can be
replaced with another character.
On Mon, 2012-06-11 at 23:54 -0500, Ariel Barria wrote:
> Apology, I wanted to ask about ticket 1374.
> What is required is to look for debug so
> For Example:
> DEBUG(9, ("Checking for DNS timeouts\n"));
> and change it so
> DEBUG(SSSDBG_TRACE_ALL, ("Checking for DNS timeouts\n"));
> Thanks for you time.
CCing the sssd-devel list so others can chime in if they want to.
That's only a small piece of the work. We DO need to replace all of the
numeric values with the macro versions.
However, the bigger part of this job is going through and verifying that
the new macro levels actually make sense. For example, the one you cite
above doesn't really belong at SSSDBG_TRACE_ALL. That's probably better
at SSSDBG_TRACE_LIBS, unless it's very noisy (would show up in the logs
very often). In which case it belongs at SSSDBG_TRACE_INTERNAL.
SSSDBG_TRACE_ALL should be reserved for things that are really only used
for very specific reasons. Things like the pointer address of an SBUS
connection, or similar.
Backporting this fix to the 1.5.x LTM series.
This function alters the memory hierarchy of the be_req
to ensure memory safety during shutdown. It creates a
spy on the be_cli object so that it will free the be_req
if the client is freed.
It is generally allocated atop the private data context
for the appropriate back-end against which it is being
This functionality will be utilized by PAC responder once it lands in the
master branch. One round of review already done by Sumit. Also the patch has
been tested together with the PAC responder.
The query is performed only if there is missing information in the
cache. That means this should be done only once after restart when cache
doesn't exist. All subsequent requests for subdomains won't include the
request for master domain. This is done to save time since it is not possible
to change this information once IPA server is installed.
this patch allows us besides other conversions to convert the dom_sid
structure used by samba to strings and back. This structure is used by
various samba libraries, but there are no public inferfaces for the
conversion. I've seen Simo adding code to the IPA kdb plugin doing these
conversions and I need them for the PAC responder as well. So I thought
it might be useful to put it in a library.