I have been working on sssd being able to flush hosts from it's cache.
Here is an initial patch to add the options to the cli of sss_cache.
I have noticed that there are some methods already in src/db/sysdb_ssh.c
like sysdb_update_ssh_known_host_expire: Does that seem like the right
function to call to expire a host?
Advice is appreciated.
William Brown <william(a)firstyear.id.au>
attached patch is the first of many to solve
"The return codes of various sysdb operations differ. Some search
operations would return ENOENT if they don't find a matching object some
would return EOK but an empty result list."
I think it would be best if in case that no results were found both
ENOENT value and 'properly' empty list were returned.
Thank for opinions or/and review.
In theory, it could be possible to build current master without samba
on rhel5, but the spec file would be very complicated.
It is better to simplify spec file.
Patch is attached.
1 file changed, 43 deletions(-) :-)
This patch fixes incorrect assumption of cmocka missing from RHEL6 by CI and
correspondingly enables coverage percentage check there.
It requires "CI: Allow disabling distro-(in)dependent tests" as it is, but can
be rebased, if necessary.
Some quick background on this small patch I prepared. I run sssd on my
desktop (and servers) to authenticate against a Samba 4 DC. I found
that when I attempted to log in via KDM and misentered my password, I
got an error about the authentication system failing. Similarly, `su`
would return an error message I was not familar with: "Failure setting
After some inspection of the sssd sources, I found that per
sssd's PAM module is returning the wrong error code when a user
entered bad credentials. PAM_CRED_ERR is being returned instead of
Applying the attached patch and recompliing sssd brought back the more
familiar "Authentication failure" when su'ing with a bad password. KDM
also doesn't freak out when I enter an incorrect password.
If you have any questions about the patch, please be sure to include
me in the reply as I'm not on the sssd-devel list.
Thanks for sssd, it has been awesome!
As CI mock builds are taking a god-awful long time sometimes and Clang doesn't
help it either, I've implemented support for running distro-dependent and
distro-independent tests separately and set up CI to run distro-independent
tests only once, on a separate host. This cut execution time roughly in half.
I'll be working on reducing mock build times to reduce it further.
Here is an example of a separated job:
Please find the patch attached.
with the current SSSD code, an LDAP search that results in a referral
fails completely with EIO and usually sends the whole backend to
offline mode. I think this is too strict and if the admin chose to
ignore referrals, we should just skip these results.
John Hodrien in particular was hit by us treating referrals as fatal in
environment where he needs to restrict the search scope by using custom
LDAP search bases.
Also, in cases where Global Catalog support is disabled or GC not available
and a group contains a user from a trusted domain, trying to search for
this DN yields a referral.
Attached is a patch that ignores referrals when the admin set
ldap_referrals=false in the config file.
Given the sdap async code is quite old and I don't remember all the
use-cases, I CC-ed Stephen directly to get some advice. Is there any
risk in ignoring referrals?
If there is a problem with GPO configuration on AD, then function
ad_gpo_access_done set error to the request and authentication was rejected
with pam system error. It should not happen in permissive mode.
Patch is attached. I can modify debug messages or add some logging to the
syslog. Any suggestion is welcomed.