[PATCH] autofs, sudo and ssh are not experimental anymore
by Jakub Hrozek
The autofs integration, ssh integration and the PAC responder are not
experimental in the 1.9.0 release anymore.
The features are now built by default. I was wondering if that was a
good idea because other platforms than Fedora would have to turn the
features explicitly off -- but on the other hand, I've seen maintainers
mentioning that they would turn feature X on only if they knew it was
there. I think all stable features can be on by default.
11 years, 7 months
[PATCHES] Performance enhancements for AD provider
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
* [PATCH 1/2] AD: Detect domain controller compatibility version
This patch allows us to read the domain controller version from the
RootDSE, if it exists. This will be used by the next patch to
determine if the SSSD can use tokenGroups for lookups.
* [PATCH 2/2] AD: Optimize initgroups lookups with tokenGroups
If we are doing ID-mapped lookups, we can take advantage of the
AD-specific option "tokenGroups", which allows us to retrieve a
pre-flattened list of all the group SIDs for which this user is a
member. From this, we can convert them to GIDs and conclude the
initgroups() lookup with only two LDAP queries (the search for the
user and the base search for the user's tokengroups; the latter must
be performed as a base search due to restrictions imposed on the
tokenGroups attribute by AD).
When we save these groups to the sysdb, if the group is being seen for
the first time it will be temporarily given the name of the SID
representing it. Later, when we look it up by name or GID, this group
will be replaced with the real one.
Fixes https://fedorahosted.org/sssd/ticket/1355
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlBbG2wACgkQeiVVYja6o6M9CQCdFwXQ2yBIlo7wPtJ4PAXW8Lt1
VLwAoINgdsNnq/2Z4Sl2KlQe68e3FXmJ
=uyEO
-----END PGP SIGNATURE-----
11 years, 7 months
[PATCH] Add provider specific default regular expressions
by Sumit Bose
Hi,
this patch add specific default values for the regular expression to
split user names for the AD and IPA provider. In a perfect patch the
ID provider itself would report back what he would like to use as a
regular expression, but all solutions I could think of would require
some bigger changes to the startup process which are not suitable at
this stage of the 1.9 development. So I picked a more direct solution.
bye,
Sumit
11 years, 7 months