[sssd PR#226][opened] Config check regex
by mzidek-rh
URL: https://github.com/SSSD/sssd/pull/226
Author: mzidek-rh
Title: #226: Config check regex
Action: opened
PR body:
"""
Some updates for src/config/cfg_rules.ini
The most controversial is the third patch. It removes the special rule for application domains and only uses the rule for normal domains in both application and normal domains. The reason is that the validator ini_allowed_options checks all sections that match the regex in section_re and allows only listed options. This is done for all rules that use that validator *separately and there is not 'include' directive or anything like that. So we can either duplicate all the options from domain section or allow the one mistake where the inherit_from used in normal domain section will be undetected. I am more in favor of the second option, because adding inherit_from by mistake is unlikely and the rules look better this way.
However it would be good to enhance the libini to add solution for this by introducing the ability to somehow merger the rules.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/226/head:pr226
git checkout pr226
6 years, 10 months
[sssd PR#234][opened] HBAC: Use memberof ASQ search instead of originalMemberOf
by jhrozek
URL: https://github.com/SSSD/sssd/pull/234
Author: jhrozek
Title: #234: HBAC: Use memberof ASQ search instead of originalMemberOf
Action: opened
PR body:
"""
This PR should fix the bug we were seeing in the HBAC evaluation of users
from a trusted AD domain where the originalMemberOf didn't match the
memberOf attributes.
Because maintaining the originalMemberOf attributes is fragile, let's
instead dereference the memberOf attribute and look at the names of the groups
this way.
There is one unresolved issue in the patch - how to filter the groups from
a single domain. The most error-prone method would be to just do a search
by name with a domain set, but that would mean N searches for N groups.
Alternatively, if other developers don't think that is too much of a hack,
we could just construct a base DN of the IPA domain sysdb group container
and pop the RDN from the DN of the object examined and compare the two. That
would be reasonably fast.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/234/head:pr234
git checkout pr234
6 years, 10 months
[sssd PR#230][opened] Failure to filter out AD subdomain with flatname is used
by justin-stephenson
URL: https://github.com/SSSD/sssd/pull/230
Author: justin-stephenson
Title: #230: Failure to filter out AD subdomain with flatname is used
Action: opened
PR body:
"""
Ticket: https://pagure.io/SSSD/sssd/issue/3365
SSSD fails to filter out the child domain it is connected to when domain flatname is used instead of fully qualified domain name in `sssd.conf`, this leads to creation of an empty subdomain.
After the patch, no duplicate subdomain is created. Tested by performing `id` against user in connected-to child domain(used 2 AD domains:root and child for this).
```
[sssm_ad_subdomains_init] (0x2000): Initializing AD subdomains handler
[new_subdomain] (0x0400): Creating [AD.JSTEPHEN] as subdomain of [winchld]!
[ad_subdomains_process] (0x0400): Enabling subdomain WINCHLD.AD.JSTEPHEN
[ad_subdomains_process] (0x2000): Not including primary domain winchld in the subdomain list
[ad_subdomains_refresh_done] (0x0400): Subdomains refreshed.
```
I wrote a test for this but I may have gotten some talloc heirarchy incorrect so please let me know if there is a problem to fix here.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/230/head:pr230
git checkout pr230
6 years, 10 months
[sssd PR#249][opened] DP: Reduce Data Provider log level noise
by justin-stephenson
URL: https://github.com/SSSD/sssd/pull/249
Author: justin-stephenson
Title: #249: DP: Reduce Data Provider log level noise
Action: opened
PR body:
"""
Certain operations are not supported with certain providers
causing informational Data Provider log messages to be logged as
errors or failures. This patch lowers the log level to reduce overall
log noise and ensure only critical log messages are logged when
a low debug_level value is used.
Resolves:
https://pagure.io/SSSD/sssd/issue/3287
https://pagure.io/SSSD/sssd/issue/3278
Tested with the LDAP provider changing ``debug_level``
between 7 and 1 then checking for log messages:
* Before patch with **debug_level=1**
```
# egrep 'dp_find_method|dp_target_init|Data Provider returned' /var/log/sssd/*
[dp_target_init] (0x0020): Target [selinux] is not supported by module [ldap].
[dp_target_init] (0x0020): Target [hostid] is not supported by module [ldap].
[dp_target_init] (0x0020): Target [subdomains] is not supported by module [ldap].
[dp_find_method] (0x0020): Target [subdomains] is not initialized
[dp_find_method] (0x0020): Target [subdomains] is not initialized
[dp_find_method] (0x0020): Target [subdomains] is not initialized
[dp_find_method] (0x0020): Target [subdomains] is not initialized
[sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.NotSupported]
[sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.NotSupported]
[sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.NotSupported]
[sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.NotSupported]
```
* After patch with **debug_level=1**
```
# egrep 'dp_find_method|dp_target_init|Data Provider returned' /var/log/sssd/*
#
```
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/249/head:pr249
git checkout pr249
6 years, 10 months
[sssd PR#254][opened] Handling of sdap_domain lists in server mode
by mzidek-rh
URL: https://github.com/SSSD/sssd/pull/254
Author: mzidek-rh
Title: #254: Handling of sdap_domain lists in server mode
Action: opened
PR body:
"""
SERVER_MODE: Update sdap lists for each ad_ctx
We use separate AD context for each subdomain in the server mode.
Every such context has it's own sdap_domain list witch represents
sdap options such as filter and search bases for every domain.
However AD context can only fully initialize sdap_domain structure
for the same domain for which the whole context was created, which
resulted in the other sdap_domain structures to be have automatically
detected settings. This can cause problems if user is member of
groups from multiple domains.
Resolves:
https://pagure.io/SSSD/sssd/issue/3381
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/254/head:pr254
git checkout pr254
6 years, 10 months