attached are three man page patches.
[PATCH 1/3] MAN: clarify the default access provider for AD
After we added a section that clarified what access_provider=ad did,
some users were confused and thought that "ad" was also the default
access provider if "id_provider=ad" was specified.
[PATCH 2/3] MAN: IP addresss does not work when used for ad_server
Currently using IP address as value of ad_server is not supported, so
the man pages should not mention that as an option.
[PATCH 3/3] MAN: Clarify the min_id/max_id limits further
Some users were confused by our description of min_id/max_id and thought
the limits only applied to returning entries from the NSS responder.
However, the limits are actually enforced on the back end side, so the
entries are not even saved to cache.
There is a rather strange workaround in the nested groups processing
code that calls tevent_req_post outside _send(). However, it broke in
certain situations where the tevent_req_call resulted in req being freed,
which freed state by extension and then the subsequent _post call was a
use-after-free. This patch saves the two variables used outside state so
that it's safe to use them even after the callback.
Yassir who was going through the PAM code recently pointed out two
strange issues with the PAM responder's usage of negative cache. Please
see the attached patches for more details, but simplified version is:
1) The negative cache was only ever checked for domainless searches
2) The negative cache was only checked, never set
I don't think this is a pressing issue because in most occasions, the
negative cache would be hit by the application calling getpwnam() and so
the PAM responder would not be called at all, but I think the code
should at least be consistent.
The alternative is of course to stop using negative cache in the PAM
respnder completely, but I think it has some benefit if the application
would only call the PAM conversation.
I created a separate ticket to support subdomain users and groups in
There is a bug in PAC responder at the moment which makes simple access
provider to always deny access to subdomain users. PAC responder
currently fails to resolve group membership, thus we get error in access
provider when looking up groups and access is denied. Jakub will look
Simple script make_srpm.sh was added to git repo few weeks ago.
With this script, source rpm file can be created without installed sssd build
dependencies. I forgot to add this file to Makefile.am and therefore
this script is not bundled to tarball.
Simple patch attached.
This patch (hopefully) fixes an interop issues with AD servers where
they fail to realize the connection is indeed integrity protected.
It's a bit of a hack as we need to work around openldap initialization
of cyrus sasl libraries. But it should work unitl we get openldap
libraries to expose SASL_CB_GETOPT to us.
Simo Sorce * Red Hat, Inc * New York