The autofs integration, ssh integration and the PAC responder are not
experimental in the 1.9.0 release anymore.
The features are now built by default. I was wondering if that was a
good idea because other platforms than Fedora would have to turn the
features explicitly off -- but on the other hand, I've seen maintainers
mentioning that they would turn feature X on only if they knew it was
there. I think all stable features can be on by default.
-----BEGIN PGP SIGNED MESSAGE-----
* [PATCH 1/2] AD: Detect domain controller compatibility version
This patch allows us to read the domain controller version from the
RootDSE, if it exists. This will be used by the next patch to
determine if the SSSD can use tokenGroups for lookups.
* [PATCH 2/2] AD: Optimize initgroups lookups with tokenGroups
If we are doing ID-mapped lookups, we can take advantage of the
AD-specific option "tokenGroups", which allows us to retrieve a
pre-flattened list of all the group SIDs for which this user is a
member. From this, we can convert them to GIDs and conclude the
initgroups() lookup with only two LDAP queries (the search for the
user and the base search for the user's tokengroups; the latter must
be performed as a base search due to restrictions imposed on the
tokenGroups attribute by AD).
When we save these groups to the sysdb, if the group is being seen for
the first time it will be temporarily given the name of the SID
representing it. Later, when we look it up by name or GID, this group
will be replaced with the real one.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
-----END PGP SIGNATURE-----
Patch 1 - tools_util.h now provides signal_sssd function. It
replaces send_sighup function from sss_debuglevel.c. It can
be used to send any signal to monitor (used in patch 2).
Patch 2 - https://fedorahosted.org/sssd/ticket/1311
Patches are in attachment.
Previously, we were failing to start if ldap_idmap_autorid_compat
was True but the default domain SID was unspecified. This is the
recommended configuration, but it is functional without it. There
is just a slight risk that the IDs will be inconsistent between
machines if the first user requested is not from the default
fixes https://fedorahosted.org/sssd/ticket/1225 , krb5_child already
updated before. Adding more debuginfo into ldap_child. Also old debug
levels rewritten into new macros.
Patch is attached
Associate Software Engineer
Red Hat Czech
irc: okos @ #brno
this patch add specific default values for the regular expression to
split user names for the AD and IPA provider. In a perfect patch the
ID provider itself would report back what he would like to use as a
regular expression, but all solutions I could think of would require
some bigger changes to the startup process which are not suitable at
this stage of the 1.9 development. So I picked a more direct solution.