[sssd PR#197][comment] KCM responder
by jhrozek
URL: https://github.com/SSSD/sssd/pull/197
Title: #197: KCM responder
jhrozek commented:
"""
I had an IRC discussion with @simo5 about the patches and he requested some changes:
* don't special case /kcm in the routing protocol and allow routing KCM to Custodia
* serialize write operations from the same UIDs (or all operations from the same UIDs if that's easier for start) to avoid races between operations that need multiple HTTP round-trips
* don't use HTTP PATCH until Custodia supports it. First, open an issue against Custodia to support PATCH and then support the same semantics
"""
See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-287802001
6 years, 2 months
https://pagure.io/SSSD/sssd/issue/3158 {where to find source code ini_rules_check(), may be sss_util.c}
by amit kumar
Hello,
sssctl config-check does not show what file contains the problem
./src/util/sss_ini.c:578: ret = ini_rules_check(rules_cfgobj,
data->sssd_config, NULL, *errobj*);
*errobj =*> This contains errorObjects which are thrown on screen.
# grep -rwn . -e "ini_rules_check"
Binary file ./src/util/.libs/libsss_util_la-sss_ini.o matches
./src/util/sss_ini.c:578: ret = ini_rules_check(rules_cfgobj,
data->sssd_config, NULL, errobj);
./src/util/sss_ini.c:581: "ini_rules_check failed %d
[%s]\n", ret, strerror(ret));
Binary file ./x86_64/src/util/.libs/libsss_util_la-sss_ini.o matches
Binary file ./x86_64/.libs/*libsss_util.so* matches <=Query[where
to find libsss_util.so source code (may be sss_util.c)]
Binary file ./x86_64/.libs/libsss_util.soT matches
Binary file ./.libs/libsss_util.so matches
Binary file ./.libs/libsss_util.soT matches
I know libsss_util.so is created during reconfig & chmake, as it creates
x86_64.
--
Thanks
Amit Kumar
There are three ways to get something done:
(1) Do it yourself.
(2) Hire someone to do it for you.
(3) Forbid your kids to do it.
6 years, 2 months
RFC: Migrating SSSD documentation to pagure.io
by Jakub Hrozek
Hi,
I started on migrating the wiki content from fedorahosted to pagure.
Because we are working hard on finishing the 1.15.1 and 1.15.2 releases,
I want to only migrate the content that we need right now, which is the
releases page (so that we can put the release notes somewhere) and
design pages for 1.15 features.
So far I was trying the documentation out in a sandbox repo:
https://pagure.io/docs/jhrozek-doctest/
I think it looks OK and I like the rst->sphinx->html workflow:
https://docs.pagure.org/pagure/usage/using_doc.html
Regarding the repositories, I propose we do this:
1) create a new repo under the SSSD namespace, perhaps:
https://pagure.io/SSSD/docs
This repo will only contain the rst sources. I would like to ask
Patrick to mirror this repo to github so we can use PRs to update
documentation.
2) When a PR to this repo is merged, one of the maintainers will run
"make html" in the docs repo. This will generate HTML documentation
from the rst sources.
3) This HTML documentation will be pushed to:
ssh://git@pagure.io/docs/SSSD/sssd.git
Since I would only like to put up the releases and changelogs for now, I
would like to ask to temporarily not review the RST changes with PRs
until we are done with 1.15 development.
Please speak up if you disagree :-)
6 years, 2 months
Announcing SSSD 1.15.2
by Jakub Hrozek
SSSD 1.15.2
===========
The SSSD team is proud to announce the release of version 1.15.2 of the
System Security Services Daemon.
The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback
--------
Please provide comments, bugs and other feedback via the sssd-devel or
sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Highlights
----------
* It is now possible to configure certain parameters of a trusted domain
in a configuration file sub-section. In particular, it is now possible
to configure which Active Directory DCs the SSSD talks to with a
configuration like this::
[domain/ipa.test]
# IPA domain configuration. This domain trusts a Windows domain win.test
[domain/ipa.test/win.test]
ad_server = dc.win.test
* Several issues related to socket-activating the NSS service, especially
if SSSD was configured to use a non-privileged userm were fixed.
The NSS service now doesn't change the ownership of its log files to
avoid triggering a name-service lookup while the NSS service is not
running yet. Additionally, the NSS service is started before any other
service to make sure username resolution works and the other service
can resolve the SSSD user correctly.
* A new option "cache_first" allows the administrator to change the way
multiple domains are searched. When this option is enabled, SSSD will
first try to "pin" the requested name or ID to a domain by searching
the entries that are already cached and contact the domain that contains
the cached entry first. Previously, SSSD would check the cache and the
remote server for each domain. This option brings performance benefit
for setups that use multiple domains (even auto-discovered trusted
domains), especially for ID lookups that would previously iterate over
all domains. Please note that this option must be enabled with care as the
administrator must ensure that the ID space of domains does not overlap.
* The SSSD D-Bus interface gained two new methods:
"FindByNameAndCertificate" and "ListByCertificate". These methods
will be used primarily by IPA and
`mod_lookup_identity <https://github.com/adelton/mod_lookup_identity/>
to correctly match multple users who use the same certificate for Smart
Card login.
* A bug where SSSD did not properly sanitize a username with a newline
character in it was fixed.
Packaging Changes
-----------------
None in this release
Documentation Changes
---------------------
* A new option "cache_first" was added. Please see the Highlights
section for more details
* The "override_homedir" option supports a new template expansion "l"
that expands to the first letter of username
Tickets Fixed
-------------
Please note that due to a bug in the pagure.io tracker, some tickets that
have dependencies set to other tickets cannot be closed at the moment.
* <https://pagure.io/SSSD/sssd/issue/3317> - Newline characters (\n) must be sanitized before LDAP requests take place
* <https://pagure.io/SSSD/sssd/issue/3316> - sssd-secrets doesn't exit on idle
* <https://pagure.io/SSSD/sssd/issue/3314> - sssd ignores entire groups from proxy provider if one member is listed twice
* <https://pagure.io/SSSD/sssd/issue/3164> - when group is invalidated using sss_cache dataExpireTimestamp entry in the domain and timestamps cache are inconsistent
* <https://pagure.io/SSSD/sssd/issue/2668> - [RFE] Add more flexible templating for override_homedir config option
* <https://pagure.io/SSSD/sssd/issue/2599> - Make it possible to configure AD subdomain in the server mode
* <https://pagure.io/SSSD/sssd/issue/3322> - chown in ExecStartPre of sssd-nss.service hangs forever
* <https://pagure.io/SSSD/sssd/issue/843> - Login time increases strongly if more than one domain is configured
* <https://pagure.io/SSSD/sssd/issue/2320> - use the sss_parse_inp request in other responders than dbus
Detailed Changelog
------------------
* Fabiano Fidêncio (7):
* RESPONDER: Wrap up the code to setup the idle timeout
* SECRETS: Shutdown the responder in case it becomes idle
* CACHE_REQ: Move cache_req_next_domain() into a new tevent request
* CACHE_REQ: Check the caches first
* NSS: Don't set SocketUser/SocketGroup as "sssd" in sssd-nss.socket
* NSS: Ensure the NSS socket is started before any other services' sockets
* NSS: Don't call chown on NSS service's ExecStartPre
* Ignacio Reguero (1):
* UTIL: first letter of user name template for override_homedir
* Jakub Hrozek (9):
* Updating the version for the 1.15.2 release
* Allow manual start for sssd-ifp
* NSS: Fix invalidating memory cache for subdomain users
* UTIL: Add a new macro SAFEALIGN_MEMCPY_CHECK
* UTIL: Add a generic iobuf module
* BUILD: Detect libcurl during configure
* UTIL: Add a libtevent libcurl wrapper
* TESTS: test the curl wrapper with a command-line tool
* Updating the translations for the 1.15.2 release
* Justin Stephenson (1):
* MAN: Add dyndns_auth option
* Lukas Slebodnik (3):
* test_secrets: Fail in child if sssd_secrets cannot start
* test_utils: Add test coverage for %l in override_homedir
* util-test: Extend unit test for sss_filter_sanitize_ex
* Michal Židek (4):
* data_provider: Fix typo in DEBUG message
* SUBDOMAINS: Configurable search bases
* SUBDOMAINS: Allow options ad(_backup)_server
* MAN: Add trusted domain section man entry
* Pavel Březina (4):
* cache_req: use rctx as memory context during midpoint refresh
* CACHE_REQ: Make "cache_req_{create_and_,}add_result()" more generic
* CACHE_REQ: Move result manipulation into a separate module
* CACHE_REQ: shortcut if object is found
* Petr Čech (2):
* sss_cache: User/groups invalidation in domain cache
* PROXY: Remove duplicit users from group
* Sumit Bose (7):
* sysdb: allow multiple results for searches by certificate
* cache_req: allow multiple matches for searches by certificate
* ifp: add ListByCertificate
* ifp: add FindByNameAndCertificate
* PAM: allow muliple users mapped to a certificate
* nss: ensure that SSS_NSS_GETNAMEBYCERT only returns a unique match
* IPA: get overrides for all users found by certificate
* Thorsten Scherf (1):
* Fixed typo in debug output
* Victor Tapia (1):
* UTIL: Sanitize newline and carriage return characters.
6 years, 2 months