[sssd PR#395][opened] KCM: Three trivial fixes
by jhrozek
URL: https://github.com/SSSD/sssd/pull/395
Author: jhrozek
Title: #395: KCM: Three trivial fixes
Action: opened
PR body:
"""
I've been working on the KCM responder lately and found some minor issues
that can be merged right away.
1) KCM: Add some forgotten NULL checks
Several memory allocations across the KCM codebase did not check their
result for NULL. This patch fixes that.
2) KCM: Use the right memory context
Inside the tevent request, we should use 'state' as the intermediate memory
context and steal the result up to 'mem_ctx' on success.
'mem_ctx' itself should only be used to create the tevent_req as the first
thing during the request creation.
However, this bug is not very severe as the mem_ctx was always the KCM
operation memory context, so the memory was freed when the operation
terminated.
3) KCM: Do not leak newly created ccache in case the name is malformed
This is not a big deal as the mem_ctx parameter of the operation is
typically just a short-lived operation context. Nonetheless, it is best
practice to not rely on how the memory context is set up in utility
functions.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/395/head:pr395
git checkout pr395
6 years, 6 months
kinit on IPA server does not exclusively talk to local KDC
by Lukas Slebodnik
ehlo,
I realized that it might be better to discuss it here rather then in
pull requests because it seems to be related to two different commits.
I will describe a test case on master with already created replica on another
host.
* kinit as admin
// create user with dummy password
* echo $dummypw | ipa user-add $login --first "$firstname" --last "$lastname" \
--password
// adding sleep think that first kinit hits slave sometimes and the user is
// not replicated yet.
* sleep 2
* FirstKinitAs $login $dummypw $password
FirstKinitAs is a bash function which change initial password
something like: echo -e "$password\n$newpassword\n$newpassword" | kinit -V $username
Such test works reliably with 1.15.3 and kinit always talk to local master
(I didn't try to remove sleep 2)
But situation changed a little bit with git master due to following commits
IPA: Only generate kdcinfo files on clients
https://pagure.io/SSSD/sssd/c/a309525cc47da726461aec1f238165c17aade2a6
localauth plugin: change return code of sss_an2ln
https://pagure.io/SSSD/sssd/c/3f94a979eebd1c9496b49b4e07b7823550dec97e
It is enough to revert just one of these patches and situation is back stable
BTW failure is not 100% reliable but it happens quite often 40-60% of cases.
And I think kinit on IPA server should always talk to local KDC unless
it is down.
Attaching two logs with KRB5TRACE + SSSD_KRB5_LOCATOR_DEBUG
LS
6 years, 6 months
PRs priorities for this release
by Fabiano Fidêncio
People,
We have 27 PRs opened by the moment I'm writing this email and I'd
like to have a clear idea which ones are the *must* have for our next
release.
- Fix group renaming issue when "id_provider = ldap" is set
(https://github.com/SSSD/sssd/pull/128)
We have a bugzilla for this one. Code has been reviewed and last
comments addressed.
- Add "Wants=" to sssd unit (https://github.com/SSSD/sssd/pull/132)
We don't have a bugzilla for this one. IMO, this can be postponed
for the next release
- Initial revision of sssd pytest framework
(https://github.com/SSSD/sssd/pull/139)
This PR will be reviewed on a phone session. IMO, this can be
postponed for the next release.
- Add module for starting services (https://github.com/SSSD/sssd/pull/175)
This PR has been stalled for a quite long time. Although the
idea/work seems quite nice, I don't see this one as something that we
should prioritize. So, IMO, this can the postponed for the next
release.
- TEST: Adding krb5-libs to dependencies (https://github.com/SSSD/sssd/pull/218)
This PR has been stalled since celestian left the project. It's
something good to have but far from having high priority. IMO, this
can be postponed to the next release.
- changing all talloc_get_type() with talloc_get_type_abort()
(https://github.com/SSSD/sssd/pull/231)
This PR has been stalled for a quite long time. Can easily be
postponed to the next release.
- provider: Move hostid from ipa to sdap (https://github.com/SSSD/sssd/pull/237)
This PR comes from an external contributor and as far as I
understood they changed whatever has been requested. IMO this should
be part of this release.
- Subdomain inherit (https://github.com/SSSD/sssd/pull/247):
This PR has been stalled for a long time and according to the
dicussion in our phone meeting Today, it can be postponed to the next
release.
- Update sss_override.c (https://github.com/SSSD/sssd/pull/260)
This PR has been stalled for some time and, IMO, can be postponed to
the next release.
- Add support for ActiveDirectory's logonHorous restrictions
(https://github.com/SSSD/sssd/pull/269)
This PR comes from an external contributor and as far as I
understood there's still some work to be done. So, should be postponed
to the next release
- Merge sss_cache and sss_debuglevel into sssctl
(https://github.com/SSSD/sssd/pull/274)
This PR seems to be in a good shape and justin addressed the last
comments. IMO, should be part of this release.
- Implement access verification by rhost using ldap_access_order rhost
option (https://github.com/SSSD/sssd/pull/275)
By the comments I'm not sure whether we may or may not should have
it in the next release. In any case, we must provide a feedback to the
external contributor.
- Print a warning when enumeration is requested but disabled
(https://github.com/SSSD/sssd/pull/334)
Already acked.
- Fix for few el6 gcc warnings (https://github.com/SSSD/sssd/pull/371)
- This patch set fixes a bunch warnings (https://github.com/SSSD/sssd/pull/377)
PR 377 has all the patches contained in PR 371. Any of those have
high priority IMO and both could just be postponed to the next
release.
- ldap: Change ldap_user_certificate to userCertificate;binary
(https://github.com/SSSD/sssd/pull/372)
Already reviewed. Whoever pushes the patches could squash the
patches instead of keep waiting for the contributor. In any case,
should be part of this release.
- intg: Add sanity tests for pysss_nss_idmap
(https://github.com/SSSD/sssd/pull/373)
Already acked.
- IPA: Add threshold for sudo command and command group searches
(https://github.com/SSSD/sssd/pull/374)
Does it have some bugzilla linked? I guess it would be nice to be
reviewed and pushed for this release.
- sssd-1.13 Backported patches for ticket 3505
(https://github.com/SSSD/sssd/pull/375)
Doesn't affect our release at all
- [RFC] Use GNULIB's compiler warning code
(https://github.com/SSSD/sssd/pull/378)
IMO this one can be postponed to the next release
- CI: Enable pep8 check (https://github.com/SSSD/sssd/pull/379)
IMO this one can be postponed to the next release
- intg: prevent "TypeError: mustbe type, not classobj"
(https://github.com/SSSD/sssd/pull/386)
There's a small change requested that can be done by whoever pushes
the patches instead of keep waiting for the contributor
- Setting ldap_sudo_include_regexp to false
(https://github.com/SSSD/sssd/pull/387)
Should be part of 2.0 relase in the future
- sssd_client: add mutex protected call to the PAC responder
(https://github.com/SSSD/sssd/pull/389)
Should be part of this release
- NSS: Add option to disabled memcache (https://github.com/SSSD/sssd/pull/390)
IMO this one be postponed to the next release
- Use dbus-daemon in cwrap environment for test
(https://github.com/SSSD/sssd/pull/391)
IMO this one can be postponed to the next release
- GPO: Don't use freed LDAPURLDesc if domain for AD DC cannot be found
IMO this one should be part of this release
So, can we have an agreement that we're going to focus on reviewing:
- Fix group renaming issue when "id_provider = ldap" is set
(https://github.com/SSSD/sssd/pull/128)
- provider: Move hostid from ipa to sdap (https://github.com/SSSD/sssd/pull/237)
- Add support for ActiveDirectory's logonHorous restrictions
(https://github.com/SSSD/sssd/pull/269)
- Merge sss_cache and sss_debuglevel into sssctl
(https://github.com/SSSD/sssd/pull/274)
- Implement access verification by rhost using ldap_access_order rhost
option (https://github.com/SSSD/sssd/pull/275)
- IPA: Add threshold for sudo command and command group searches
(https://github.com/SSSD/sssd/pull/374)
- sssd_client: add mutex protected call to the PAC responder
(https://github.com/SSSD/sssd/pull/389)
- GPO: Don't use freed LDAPURLDesc if domain for AD DC cannot be found
And also, do we agree that the bugs mentioned above are the material
for this release and pretty much anything else that is already opened?
Best Regards,
--
Fabiano Fidêncio
6 years, 7 months
[sssd PR#377][opened] This patch set fixes a bunch RHEL6 warnings
by fidencio
URL: https://github.com/SSSD/sssd/pull/377
Author: fidencio
Title: #377: This patch set fixes a bunch RHEL6 warnings
Action: opened
PR body:
"""
Those patches were part of PR#50, which got stuck for a long time and ended up closed as it didn't seem interesting for the project.
However, after some time another PR (PR#371) fixes the very same issues. So, I'd like to have my patches (at least) considered and, if possible, reviewed.
In any case, this PR is basically PR#50 without the patch that makes use of gnulib many warnings.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/377/head:pr377
git checkout pr377
6 years, 7 months