I'm sending some sudo provider patches. I wanted to fix/improve things
in the ldap sudo provider prior my work on ipa provider so I get
familiar with it again and avoid making the same mistakes.
It fixes tevent style, shuffles the code around a little bit, convert
periodic task to use be_ptask module, renew hostinfo when needed, fix
sdap_id_op logic, recude code duplication, remove dead code, simplify
error handling, etc.
I let Dan run downstream tests on those patches. We had to fix one test
that was prone to a race condition which my patches revealed, but
everything is green now.
see the attached patches for ticket
Removing the user during cleanup task completely
removes that user from local database, so that
user is no longer part of any group in sysdb.
Such user may, or may not have been removed from
LDAP so the only way to figure out is check
on the next refresh otherwise we may get
The third patch adds integration test for this
Apply and run the intgcheck without the first 2
patches to see the failed test (you will also see that
all the tests after this failed one will end with
errors as well, that is probably due to incomplete
clean up after the ldap tests and I do not intend to
solve this as part of this patchset but will
investigate it later).
Senior Principal Intern
this patch fixes an issue in the IPA override code described in
https://fedorahosted.org/sssd/ticket/2874. If the user name is
overridden with itself the name is written to the alias attribute twice
causing an ldb error.
please see the attached patch. I tested it by following:
with the new patch, just adding:
autofs_provider = ad is enough.
I wrote the new provider because it's IMO the more systematic solution
to #2862 than any hacks in failover.
in some cases when an IPA-AD trust client is offline, the libkrb5
functions in krb5_child would error out with KRB5_REALM_UNKNOWN, because
the client is completely autoconfigured.
I think we should handle this error code as ERR_NETWORK_IO internally
and I hope this change would fix bugs like
https://fedorahosted.org/sssd/ticket/2866 but I haven't heard from the
this is more or less a cosmetic issue, but it can be irritating
nonetheless. If the krb5_child process times out during preauth, we
would print an EINVAL error message. I think the error should be more
graceful (and I don't insist on PAM_CRED_UNAVAIL).
there is little patch which adds clang-format support. More info is in
header of patch.
My previous patch set [PATCH SET] TEST_TOOLS_COLONDB: Add tests for
sss_colondb_* public API is formatted by clang-format.
On Fri, Nov 20, 2015 at 01:41:36PM -0500, Dan Lavu wrote:
> I think linking contribute makes more sense as it actually contains build instructions, but I don't see any harm in adding both.
I still had trouble applying the patch from the mail, but hopefully I
reconstructed it well:
CI wouldn't touch BUILD.txt, so ACK to this patch