this patches make the nss responder view aware. A number of new sysdb
calls is added as drop in replacements from existing ones. I preferred
this instead of modifying the existing ones to not break their usage in
other places. But I think they are a good targets, together with the
other user and group related sysdb calls, for a refactoring in an
attached are two patches that change the file ownership when SSSD runs
as as a non-root user. Please see the commit messages for more details.
I have one question -- is it wise to also set the permissions of
directories we create when we "install -d" them? Or is this something
typically done by the downstream?
I had this patch in my branch for a couple of days already so why not
send it out..
In a remote session with a customer we discovered that it's beneficial
for some scenarios to generate the capaths even on clients. The attached
patch does exactly this.
this patches contain the IPA provider part of
https://fedorahosted.org/sssd/ticket/2375 as described in the FreeIPA
Patches 0001, 0006 and 0007 contain new sysdb interfaces for views and
overrides. 0002 and 0003 refactor some already existing calls.
0004 adds the initial support for views and overrides and reads the view
name for the client from the FreeIPA server or sets it to 'default' when
running in ipa-server-mode. It adds some new options which currently
misses man page entries and are not added to the python config API. I
did this on purpose for the time being because I wanted to see first if
the list is complete or if some options ca be dropped.
0005 adds the request to get a specific override from the FreeIPA server
and finally in 0008 the overrides are read during a request and saves or
This patches must be applied on to of the extdom patch I send yesterday.
To add and manage views and override on the server side please have a
look at Tomas's patch set on the freeipa-devel list
New paragraph was added to the section "Removing password with OTP factor
from the PAM stack" in OTP design page.
You can see newly added paragraph in diff or in this mail.
In sssd-1.12, we will remove the password from the PAM stack when OTP is used
to make sure use-cases like gnome-keyring are not broken. We would need more
time for implementation of heuristic and proper testing. Currently, the
krb5_child returns that an OTP was used during authentication (details in
function parse_krb5_child_response). This OTP flag is used just in the
function krb5_auth_done. We will pass OTP flag to the pam responder (sssd_pam)
and from pam responder to the pam client (pam_sss.so). If the pam client
detects that OTP was used it will remove password from auth_token.
please see attached patches.
I have briefly discussed with Jakub how to handle saving users with uid
0 whether to resurrect sysdb_add_fake_user or modify existing fuctions
for storing users. I decided to add wrapper function around existing
ones to minimize changes in code which calls them.
this patch adds a new interface to the nss responder which is similar to
SSS_NSS_GETSIDBYNAME but can return more information about the given
object than just the SID and which is not available with the POSIX
interface as well. As mentioned in the commit messages the main use case
is the extdom plugin on the FreeIPA server.
my recent patch "sysdb_get_user_attr: use fqn for subdomain users" kinda
broke authentication (thx ab).
The problem was that sysdb_get_user_attr is often called with fully
qualified name and we basically ended up with "user@domain@domain" name.
One solution would be to translate the name to fq format in IFP. Other
would be to change the other places so they use just name without the
domain part. But since sysdb_get_user_attr now calls sss_get_domain_name
in the same way as other sysdb functions does I think the best solution
here is to check the name format in this function and response as