please see attached patch set which contains some refactoring which is
in my opinion quite safe. It doesn't touch the recursive call of
pam_reply() as I think that changing that would be more risky change.
I saw some integration tests failures recently,
and I think there is a race condition between the
enumeration refresh timeout and the sleeps
after some operations that wait for this timeout.
SSSD fails to populate changes from LDAP in time
and some asserts can fail because of this.
So far I saw 4 tests to fail like this, which
is already quite a lot.
The attached patch modifies the timeout values
and hopefully removes the issue.
I have made some important changes to the design document of this
proposed feature. The difference is mainly changing regular expression
interpretation of URI to longest-prefix matching.
This change was done mainly because of upstream's reactions. I value any
further comments and particularly discussion about the two topics
mentioned at the end of the design page:
* For backwards compatibility, lack of URI in request means any URI is
matched (as described in the design document). Is it a good idea? Any
* How about multiple URI's in one HBAC rule? Is it a good idea? How to
interpret combinations of host+scheme+port (one field) and URI paths
(another field) in that case?
Associate Quality Engineer
this is a follow-up patch to 5a5f1e1053415efaa99bb4d5bc7ce7ac0a95b757
which removes another call to ipa_check_master() which might cause an
infinite loop on an IPA client if the server does not support views.
Please note that this patch is a different one than the one I used for
the first test build in
https://bugzilla.redhat.com/show_bug.cgi?id=1328108. See comment #12 for
I use special local user for building srpms in mock
and it caused failures for me with running integration tests.
Attached patch is a workaround. The proper solution would be to wrap
detection of active users in CWRAP enviroment.
the data provider code is basically ready for someone to start looking
into it. I'm in the process of converting old handlers to the new
interface (sudo and hostid is finished) and at this moment I don't plan
to do further changes to the dp interface itself unless something shows
up during the conversion.
I tried to keep the code separated for the moment so it can be split
into more commits to simplify review and current functionality and even
some future bisecting is not broken. For this the DP code itself is
quite self-contained and changes in the modules are done in separate
files (marked as $orig_new.c). The last commit switches the old files
for the new ones in the makefile so new code can be compiled, though at
this moment is is only for development purpose.
There are too many patches to be sent to the list at this incomplete
stage, you can check it out either from my fedorapeople repo  or
github repo , which Pavel forced me to create (meh :-)).
Pavel Reichl is currently working on unit tests -- thank you!
I just updated the design for the planned sss_confcheck tool.
It can be found here:
For convenience I paste it here as well:
There is no easy way to debug the SSSD configuration without having to
look into the debug logs. Moreover the debug logs can be difficult to
understand for people outside SSSD development team. Some common issues
can be identified during static offline analysis of the config files. To
find these issues soon we need a tool that performs this analysis and
provides human readable report.
- performing ad-hoc static analysis of the installed SSSD configuration
- performing ad-hoc static analysis of SSSD configuration files
retrieved from user with some SSSD problems
Overview of the solution - sss_confcheck tool
A new tool will be added to sss_* tools that will perform static
analysis of SSSD configuration files. This tool can be run without any
parameters in which case it will print a report to the standard output
in the following or similar format:
Number of identified issues: 1
[rule/allowed_nss_options]: Attribute 'foo' is not allowed in section
'nss'. Check for typos.
Used configuration file:
<Here will be the contents of sssd.conf file>
Number of used configuration override snippets: 2
List of configuration override snippets in order of priority (lowest
Content of configuration override snippets:
<content of snippet_name_1.conf>
<content of snippet_name_2.conf>
--config-file PATH_CONFIG_FILE Path to config file
that will be checked.
--snippets-dir PATH_TO_SNIPPETS_DIRECTORY Path to snippets directory.
--no-validators Do not use validators
(no analysis will be made).
--no-file-content Do not print config
file or snippet contents.
--no-snippets Ignore the snippets.
--silent If no errors are
detected, do not print anything.
The tool will use ding-libs validators feature described in this design
No configuration changes.
How To Test
Depending on the capabilities of validators used by SSSD, make an error
in configuration and run sss_confcheck to see if it was detected.
this patch-set should solve https://fedorahosted.org/sssd/ticket/2158 by
moving the main processing of the PAC data to the backends. The PAC
responder now only has to send one request to the backend to look up the
user based on its SID if the user's SID was not found in the cache. I
used the new cache_req here so the patches depend on Pavel's latest
cache_req patches which are currently under review.
Since new IPA server can provided group-membership data to IPA clients
via the extdom plugin the most important test-cases are currently
against older IPA servers e.g. version 3.3.3 provided by RHEL/CentOS 7.0
(7.1 already has a newer version with enhanced extdom plugin).
attached two patches resolve . This ticket has design page .
In my opinion it could be fine to have tests on sysdb_sudo. I have
started write some, but there were troubles with memory leak. Maybe I
haven't understood necessary logic properly.
However I could continue with tests or create new ticket for it.
And little question. Is the name of sudo rule case sensitive? If yes, I
have to do one little change.
I found a strange condition in the function sss_ncache_check_str().
This condition causes the cache is NOT checked and the result of
checking is automatically EEXIST.
I dind't find call of sss_ncache_check_str() with ttl = -1, except in tests.
Note: We use value 0 for permanent cache, no -1.