Has anyone tried installing sssd on Amazon Linux? I tried compiling but
there seem to be some dependencies that related to libtdb and libtevent
which are failing.
Wondering if anyone else has tried this.
1st patch fixes a typo in a debug message found by Kaushik.
While grepping the code for the typo I found it at a few more places -
please see 2nd patch.
I we decide to to ack 2nd patch, please feel free to squash it into the
Documentation to macro assert_return_code says:
Assert that the return_code is greater than or equal to 0.
The function prints an error message to standard error and terminates the
test by calling fail() if the return code is smaller than 0. If the function
you check sets an errno if it fails you can pass it to the function and
it will be printed as part of the error message.
So in case of error we will see more verbose message.
Simple patch is attached.
clang complains about remoing cant qualifier in casting
error: cast from 'int **' to 'const void **' must have all
intermediate pointers const qualified to be safe [-Werror,-Wcast-qual]
pam_get_data(pamh, "pam_sss:password_expired_flag", (const void **) &exp_data);
'int **' should not be casted to 'const void **'
The const must not be removed
There aren't warnings with following castings.
'const int **' - 'const void **'
'int **' - 'void **'
BTW you can see the same kind warning with icc
patch is attached.
So ... :)
... yesterday I had to work around a bug in the rawhide build of libkrb5
that rendered krb5-config buggy and broke gssproxy 0.4.0 build.
At the end I decided to avoid the problem completely by switching the
gssproxy packages to build using pkg-config instead of krb5-config.
Given other packages are in the same boat wrt rawhide and my general
dislike for the non-standard krb5-config I have made a patch to let SSSD
also drop the use of krbn5-config.
I am not entirely sure we want/can switch immediately if we want to keep
building on older krb5 releases, but the patch was simple and so I am
throwing it here for consideration.
Simo Sorce * Red Hat, Inc * New York
I created two wiki pages to help our users troubleshoot their setups and
file better bug reports. I hope the information captured there would
allow us to receive better information, avoid copying and explaning the
same principles over and over -- and ultimately have more time for
The Troubleshooting page is here:
And the Bug reporting page is here:
In the troubleshooting page, I tried to stay away from describing known
bugs and rather describe how SSSD works so the user can see which part
doesn't work and needs to be fixed or reconfigured.
I would also like to add a section about debugging sudo, but I know Dan
had some ideas and also I'd like to hear Pavel's opionion before doing
If the other developers agree on the wiki pages, I would like to link
them from the SSSD front page. I'd like to also unlink the obsolete
Howto, at least until/if a new one is created.
I'll be happy to hear reviews or comments.
In some cases, like broken replication, we might encounter malformed
objects in the cache when evaluating HBAC rules. Unless deny rules are
in effect, we can skip those -- as implemented in the first three
The fourth patch is meant for the 1-12 branch to signal the
ipa_hbac_treat_deny_as option should not be used anymore. And finally
the last patch removes the option completely. The last patch is only
suggested for the master branch.
This is a follow-up to my previous patches that read the TTL values from
SRV queries. Apparently, the failover code explicitly guarded against
timeout=0. I don't think it makes much sense, either the timeout is read
from DNS in which case we should retry always or it's a negative timeout
which should have the same semantics (and sholdn't be zero anyway).