URL: https://github.com/SSSD/sssd/pull/560
Author: ChrisKowalczyk
Title: #560: NSS: close files after mmap
Action: opened
PR body:
"""
The files in MC cache folder were initialized by SSSD on startup, and mapped by using mmap function. due to the fact that they weren't closed afterwards, their File descriptors were still marker alive but marked as 'Deleted'.
This was noticed by a customer of SUSE, see more details here: https://bugzilla.suse.com/show_bug.cgi?id=1080156
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/560/head:pr560
git checkout pr560
URL: https://github.com/SSSD/sssd/pull/677
Author: thalman
Title: #677: pcre: port to pcre2
Action: opened
PR body:
"""
Some distributions want to drop pcre support. Sssd should work with
pcre2. With this patch sssd tries to use pcre2 if pcre is not present.
Resolves:
https://pagure.io/SSSD/sssd/issue/3833
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/677/head:pr677
git checkout pr677
URL: https://github.com/SSSD/sssd/pull/541
Author: pbrezina
Title: #541: memberof: keep memberOf attribute for nested member
Action: opened
PR body:
"""
If we have a member that is both direct and nested member,
memberOf attribute was removed if the direct membership
was deleted.
1)
user ----------> groupB -> groupC
-> groupA /
2)
user -> groupA -> groupB -> groupC
If we remove user->groupB from 1), we get 2) but groupB was still
removed from user memberOf attribute.
Resolves:
https://pagure.io/SSSD/sssd/issue/3636
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/541/head:pr541
git checkout pr541
URL: https://github.com/SSSD/sssd/pull/650
Author: jhrozek
Title: #650: Implement a hybrid mode of generating private groups
Action: opened
PR body:
"""
Related:
https://pagure.io/SSSD/sssd/issue/3822
Design page PR:
https://pagure.io/SSSD/docs/pull-request/72
Commit mesages follow, hopefully they are enough to explain what is going on.
SYSDB: Special case getgrnam and getgrgid searches in hybrid MPG mode
In hybrid MPG mode, we want to return the MPG group only in case the user
entry has no original GID set. To achieve this, we first search with the
non-MPG filter to find 'real' groups. If that fails, we try the MPG filter,
but throw away entries that has any real GID set.
Related: https://pagure.io/SSSD/sssd/issue/3822
SYSDB: Refactor the mpg and non-mpg searches out of sysdb_getgrnam() and sysdb_getgrgid() to make them more reusable
The getgrnam and getgrgid searches already special-case lookups with
overrides where in some cases the search falls back no a non-MPG search.
The upcoming special case for the hybrid mode would do something similar,
just in the opposite direction, so it makes sense to split out the
functions for just the MPG step and just the non-MPG step into reusable
functions.
Related: https://pagure.io/SSSD/sssd/issue/3822
CONFDB/NSS: Add the hybrid MPG mode
Permits a new option value 'hybrid' for the auto_private_groups option. The
option was even previously marked as a string option in both the configAPI
and the man pages, so we don't have to change the type now.
If the hybrid mode is selected and the user's original GID number is
available, then during initgroups and getpwnam, it is used as their primary
GID instead of the MPG group. The original group is also not added as a
secondary group during initgroups in this case.
Related: https://pagure.io/SSSD/sssd/issue/3822
CONFDB: Read auto_private_groups as string, not bool
In preparation to adding the third value of auto_private_groups, this patch
reads the confdb value as string and checks for the option values on its
own.
Related: https://pagure.io/SSSD/sssd/issue/3822
UTIL: Convert bool mpg to an enum mpg_mode
Instead of bool mpg inside struct sss_domain_info, let's introduce enum
mpg_mode that currently maps pretty much 1:1 to the boolean. In future
patches, a third value will be added.
Also adds a getter for the mpg_mode value because we want to discourage
getting or setting the value directly. Instead, the sss_domain_info
structure should be opaque in the future.
Related: https://pagure.io/SSSD/sssd/issue/3822
UTIL: Add a is_domain_mpg shorthand
Instead of looking into the domain structure directly, add a
sss_domain_is_mpg() function. This will make sense when we add a third
state instead of the boolean that will also be mpg-like.
Related: https://pagure.io/SSSD/sssd/issue/3822
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/650/head:pr650
git checkout pr650
URL: https://github.com/SSSD/sssd/pull/644
Author: joeFischetti
Title: #644: When multiple UIDs exist, use the username provided by the user as the first lookup
Action: opened
PR body:
"""
The current state of the code has no way of determining the "correct" UID to use when there are multiple values. If there are multiple values, and the RDN doesn't match, this update checks the UID's returned against the username that was provided by the user at the prompt. If that matches, it's used. If that doesn't match, it falls back to the existing code.
Example:
My ldap record includes multiple uid values, ["genericemployee1", "itstaff1"]
I need access to machines as "itstaff1". "genericemployee1" is used as an identifier in other systems/services.
If I log in with "itstaff1" at the prompt, and my ldap lookup with filter (uid=itstaff1) is successful, the array of UID's are checked against "itstaff1" and that's what *_primary is set to.
With the current code, if I try to log in with "itstaff1" at the prompt, I'm actually logged into the system as "genericemployee1". Based on the order that the values are returned... some other staff are logged into their "genericemployee" or the "itstaff" accounts.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/644/head:pr644
git checkout pr644
URL: https://github.com/SSSD/sssd/pull/686
Author: pbrezina
Title: #686: nss: use enumeration context as talloc parent for cache req result
Action: opened
PR body:
"""
Otherwise we end up with memory leak since the result is never freed.
Resolves:
https://pagure.io/SSSD/sssd/issue/3870
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/686/head:pr686
git checkout pr686
URL: https://github.com/SSSD/sssd/pull/685
Author: jhrozek
Title: #685: Hi,
Action: opened
PR body:
"""
this PR allows the administrator to only restart the KCM service in order
to apply changes in sssd.conf's [kcm] section.
I think this would be nice for admins, but the code feels already a bit
hackish to me. I think we should keep on working on the static files with
the read-only configuration, because then:
- we could get rid of the special case to remove the section, because
the section would always be there
- we could remove different cases for adding/replacing sections
- ..and of course the other things like config-show or running with
no config file, just snippets
I also didn't enable this functionality for the other responders. I don't
know if it makes sense without more testing and in general I don't think
there are too many users of socket activated responders except kcm.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/685/head:pr685
git checkout pr685