[sssd PR#152][opened] Add a tevent wrapper around libcurl's asynchronous interface
by jhrozek
URL: https://github.com/SSSD/sssd/pull/152
Author: jhrozek
Title: #152: Add a tevent wrapper around libcurl's asynchronous interface
Action: opened
PR body:
"""
This patch set adds a generic utility module that uses libcurl's multi
interface to allow the caller to talk HTTP using libcurl. The patch set
was part of the KCM responder branch, but as it might be useful to unblock
pbrezina's development, I'm submitting it separately.
The iobuf module might seem like an overkill for the libcurl tevent wrapper,
but please also check the KCM branch during review -- there it proved
quite valuable, so I think it makes sense to just reuse the same code in
the curl wrapper as well.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/152/head:pr152
git checkout pr152
7 years, 1 month
[sssd PR#154][opened] Confront caches first
by fidencio
URL: https://github.com/SSSD/sssd/pull/154
Author: fidencio
Title: #154: Confront caches first
Action: opened
PR body:
"""
This patch set has been written on top of PR#141, thus PR#141 should be merged before this one and also the following patches* are don't have to be reviewed as part of this PR.
*:
- CACHE_REQ: Add cache_req_data_set_bypass_cache()
- PAM: Use cache_req to perform initgroups lookups
- TESTS: Adapt pam-srv-tests to deal with cache_req related changes
The other 2 patches, the important ones. are basically introducing a new configurable option to define whether the responder should query all the caches before querying the data providers and reasonable debug info for the work.
I'm not 100% sure those changes are the only changes needed (but seems so), so I'd like to ask @jhrozek and @pbrezina for a first review just in order to be sure this series is according to their ideas.
Those 2 important patches could be squashed, in case it's the preference of the reviewers.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/154/head:pr154
git checkout pr154
7 years, 1 month
[sssd PR#166][opened] Please see the commit message for commit description.
by jhrozek
URL: https://github.com/SSSD/sssd/pull/166
Author: jhrozek
Title: #166: Please see the commit message for commit description.
Action: opened
PR body:
"""
To reproduce, log in as a user from a trusted domain. Before the patch,
you should see an error message about the domain not being found such as:
(Wed Feb 22 20:35:33 2017) [sssd[nss]] [nss_update_initgr_memcache] (0x0040): Unknown domain (win.trust.test) requested by provider
and the memory cache wouldn't be in fact be invalidated.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/166/head:pr166
git checkout pr166
7 years, 1 month
Tlog integration and packages
by Nikolai Kondrashov
Hi everyone,
I'd like to continue the discussion of tlog integration, and also present you
the first release of tlog - a development preview, which has the configuration
interface necessary to implement the integration:
https://github.com/spbnick/tlog/releases/tag/v1
You're more than welcome to download RPMs, install, read tlog-rec(8) and
tlog-rec.conf(5), and experiment! Building from the Git tree and the tarball
works as well, if you're so inclined. I'm also attaching those manpages for
convenience.
Here are the integration plans so far, as discussed with Jakub on our
devconf.cz trip meetings and before on the list. Jakub, please correct me or
add details.
* We follow the route similar to that taken by SELinux rule control
implementation [1][2]. I.e. store the configuration in LDAP HBAC rules,
write to files on the client side and then specify them to tlog upon user
login.
However, I'm also rather fond of the idea of specifying the whole
configuration through an environment variable instead of through a file
referenced by an environment variable - it's not big at all, and we'll avoid
the hassle of managing the files.
I implemented support for both in tlog (was easy).
* We'll have to make nss_sss report user's shell as tlog-rec (how?) and
specify the actual shell to tlog-rec via an environment variable, through
pam_sss (with SSS_PAM_ENV_ITEM messages). I.e.:
* Nss_sss would always report tlog-rec as the user's shell.
* During login (e.g. through "login" or "sshd") pam_sss would add a variable
to the user environment, containing, or pointing at, a tlog-rec
configuration (TLOG_REC_CONF_TEXT or TLOG_REC_CONF_FILE). That
configuration would contain the user's actual shell. I can also implement
support for a separate variable just for the shell (TLOG_REC_SHELL?) to
simplify the implementation for the start.
* Tlog-rec would read the system-wide configuration and overlay it with the
one specified in the environment, adding the specific user shell, and then
would spawn it.
Please also see the draft integration design page [3] for reference.
I hope to refine and extend it in the coming weeks to match FreeIPA standards.
Please chime in and suggest, object, discuss!
Also, please report tlog bugs at https://github.com/spbnick/tlog/issues
Thank you!
Nick
[1]: http://www.freeipa.org/page/SELinux_user_mapping
[2]: http://www.freeipa.org/images/b/b9/Freeipa30_SELinuxUserMap.pdf
[3]: http://www.freeipa.org/page/Session_Recording
7 years, 1 month
[sssd PR#127][opened] ssh: use cache_req
by fidencio
URL: https://github.com/SSSD/sssd/pull/127
Author: pbrezina
Title: #127: ssh: use cache_req
Action: opened
PR body:
"""
This patches makes SSH responder use the cache_req interface.
Since this responder uses that same `cache-domain-cache` lookup logic
for host certificates I implemented `host by name` request in `cache_req`.
In order to achieve this I moved data provider lookup function from `cache_req`
code into plugins.
The first two patches fixes minor issues in the SSH responder and should be
pushed to earlier versions as well. The first patch fix a little issue
introduced probably by overrides and the second patch removes name qualification
since it is already qualified in the sysdb since fqname patches.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/127/head:pr127
git checkout pr127
7 years, 1 month