The attached patches resolve https://fedorahosted.org/sssd/ticket/3142
However, I am having difficult with the man page addition to
'src/man/sssd.conf.5.xml' for this new option. I have stared at the open
and close xml tags(for far too long) and it looks correct but when I
build sssd I never see the sssd.conf man page inclusion. Could anyone
tell me what I am missing here?
If you feel there is better wording for the description please let me know.
jhrozek's pull request #19: "KRB5: Send the output username, not internal fqname to krb5_child" was opened
krb5_child calls krb5_kuserok() during the access phase which checks if
a particular user is allowed to authenticate as a particular principal.
We used to pass the internal fqname to krb5_kuserok() which broke the
functionality and all users were denied access.
This patch changes that to send the 'output' username to krb5_child,
because that's the username the system receives through getpwnam() or
getpwuid() anyway. The patch also adds a new structure member fo the
krb5child_req structure to avoid reusing the pd->user variable but have
an explicit one that serves as the input for the child process.
See the full pull-request at https://github.com/SSSD/sssd/pull/19
... or pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/19/head:pr19
git checkout pr19
I couldn't reproduce manually so I used the second patch as a by-code
reproducer. If you apply the patch then sssd will try to resolve meta
server twice simultaneously and triggering the problematic code path.
You can search for RESOLV SRV DONE in logs.
Now I'm again approaching the implementation of tlog integration in pam_sss,
and as planned, I need to get the actual user shell to put it into
TLOG_REC_SHELL environment variable upon opening of the session.
However, the get_shell_override, which does all the hops and tricks to get it,
requires nss_ctx, which belongs to NSS responder, specifically various
shell-related configuration settings
(override_shell/allowed_shells/vetoed_shells/etc_shells). I.e. essentially the
PAM responder needs to be an NSS responder to get it.
To me it seems that there is no exit but to finally put that override
machinery into a library, instead of having it directly in the NSS responder.
Am I wrong? Is there perhaps another way?
Do you have any suggestion how to best do it?
Thanks a lot!
while converting my workflow scripts to github  I decided to polish
them, give them some help and publish them on github. Feel free to use
them and improve them as you wish.
I'll gladly learn about your workflow and simplification.