[sssd PR#53][opened] Fixes in the config API related to secrets responder
by fidencio
URL: https://github.com/SSSD/sssd/pull/53
Author: fidencio
Title: #53: Fixes in the config API related to secrets responder
Action: opened
PR body:
"""
Those fixes were suggested by Lukaš in the following thread:
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahoste...
Changes:
28fa419 (Fabiano Fidêncio, 11 minutes ago)
SECRETS: Add allowed_sec_users_options
There are options (the proxying related ones) that only apply to the
secrets' subsections. In order to make config API able to catch those,
let's create a new section called allowed_sec_users_options) and move there
these proxying options.
Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com>
2aed214 (Fabiano Fidêncio, 2 hours ago)
SECRETS: Fix secrets rule in the allowed sections
We have been matching an invalid subsection of the secrets' section, like:
[secrets/users]
Let's ensure that we only match the following cases:
[secrets]
[secrets/users/[0-9]+?]
Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/53/head:pr53
git checkout pr53
6 years, 6 months
[sssd PR#43][opened] SUDO: Adding user name alias to sudoRule filter
by fidencio
URL: https://github.com/SSSD/sssd/pull/43
Author: celestian
Title: #43: SUDO: Adding user name alias to sudoRule filter
Action: opened
PR body:
"""
This patch adds another value to sudoUser attribute of sudoRule filter.
The value is 'user alias' which means it is cased version of user
(in domains where it matters).
Resolves:
https://fedorahosted.org/sssd/ticket/3203
-----
This is complement to #39 .
The idea is some domains are case sensitive and another not. If we would like to search ```sudoRules``` we need handle user names. With this patch we add user name alias (case sensitive form) of user name to the ```sudoRule``` filter.
Another point is we could save both forms of user name to cached ```sudoRules```. It could be extension of this patch.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/43/head:pr43
git checkout pr43
6 years, 6 months
[PATCHES] views: properly override group member names
by Sumit Bose
Hi,
this is my suggestion to solve https://fedorahosted.org/sssd/ticket/2948
"Handle overriden name of members in the memberUid attribute".
The first two patches are for the IPA provider and make sure that all
ghost members in a group get resolved because otherwise we cannot
determine if the name is overridden or not. This adds an overhead to
group lookups, especially for larger groups but I think it is an
requirement which cannot be skipped.
The third patch adds a sysdb call to recursively resolve all
user-members of a group. Since the groups in SSSD's cache are
hierarchically organized the member attribute only contains direct
user and group members. To get all users the group members must be
resolved recursively.
Finally the forth patch applies the code-path which is already used for
non-default views to the default case as well and adds a new list of
members, with correctly overridden names (hopefully :-) which is then
used in fill_grmem(). This adds some overhead to the overall group
processing in the NSS responder (as can be seen in the test changes
because the members are returned in different order in some cases). But
I think because the of memory cache this is acceptable and might even
help to remove the memberuid attribute in future and make the memberof
plugin simpler.
I worked on an alternative approach as well which tried to make the
memberof plugin aware of the defaultOverrideName attribute. My wip tree
is at
https://fedorapeople.org/cgit/sbose/public_git/sssd.git/log/?h=memberof_d...
but so far it does not work properly. Additionally I would prefer to not
touch the memberof plugin.
bye,
Sumit
6 years, 6 months