New sbus implementation
by Pavel Březina
Hi team,
as you know, I have been working on this occasionally for a long time
now. The code can be found at [1].
It is completely new implementation of our internal D-Bus API called
sbus. I took all the good things started by Steff Walter few years ago
and made them better and more flexible. In short, it is everything you
ever wanted and you will not use D-Bus with it at all.
There is a large README.md in the repo, that contains complete list of
features, explanation why I started working on this and what I wanted to
achieve. There is also shorter list of some chosen benefits to the SSSD
project so you can get the general idea without going through the all
feature list.
I really believe that this will be a big step forward for SSSD project
as it will make the code much simpler and testable and it will allow us
to extend our D-Bus interface both external and internal. It will give
us the opportunity to improve the InfoPipe responder (and finally allow
us to implement write interface) but it also allows us to improve the
communications between providers, responders and even tools --
especially sssctl.
There is also a showcase application so you can see most of the features
at work. All is described in the readme file.
It lacks unit tests at the moment. I would like to get some help from
you in this area, we should talk about it in the meeting or here. If we
choose to integrate this with our codebase, we should talk about
schedule and test plan.
Also, I would like to strip it from SSSD's dependencies eventually and
release it as a public library. But that will not happen in near future.
I hope you will like it.
Pavel.
[1] https://github.com/pbrezina/sbus
4 years, 10 months
[sssd PR#519][opened] DEBUG: Print simple access provider allow and deny lists
by justin-stephenson
URL: https://github.com/SSSD/sssd/pull/519
Author: justin-stephenson
Title: #519: DEBUG: Print simple access provider allow and deny lists
Action: opened
PR body:
"""
Prior to this PR, debug level 9 logs do not print the simple allow and deny user or group lists that are checked against during simple access checks when `access_provider = simple`
These debug statements helped to solve a downstream customer case where `simple_allow_users` was not working as expected, the administrator discovered when they saw the usernames printed in the logs that the `simple_allow_users` list was coming from a **/etc/sssd/conf.d/alternate.conf** file which was overriding what they set in **/etc/sssd/sssd.conf**.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/519/head:pr519
git checkout pr519
4 years, 10 months
[sssd PR#524][opened] CI: Add dbus into debian dependencies
by lslebodn
URL: https://github.com/SSSD/sssd/pull/524
Author: lslebodn
Title: #524: CI: Add dbus into debian dependencies
Action: opened
PR body:
"""
There is just weak dependency (recommends) between dbus
libraries and dbus daemon. It is installed by default but we should
not rely in integration tests on weak dependency if we directly need
binary dbus-daemon.
sh# apt-cache depends libdbus-1-dev libdbus-1-3
libdbus-1-dev
Depends: libdbus-1-3
Depends: pkg-config
pkgconf
libdbus-1-3
Depends: libc6
Depends: libsystemd0
Breaks: dbus
Recommends: dbus
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/524/head:pr524
git checkout pr524
4 years, 11 months
[sssd PR#476][opened] IPA: Handle empty nisDomainName
by jhrozek
URL: https://github.com/SSSD/sssd/pull/476
Author: jhrozek
Title: #476: IPA: Handle empty nisDomainName
Action: opened
PR body:
"""
Resolves: https://pagure.io/SSSD/sssd/issue/3573
If nisdomain=, i.e. a blank NIS domain name, sssd was not processing the
netgroup at all. This is not in agreement with man innetgr which says "Any
of the elements in a triple can be empty, which means that anything
matches. The functions described here allow access to the netgroup
databases".
This patch instead returns an empty domain as well, which eventually
produces the same output as if the netgroup was requested from the compat
tree.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/476/head:pr476
git checkout pr476
4 years, 11 months
[sssd PR#488][opened] Two fixes for certificates in idoverrides
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/488
Author: sumit-bose
Title: #488: Two fixes for certificates in idoverrides
Action: opened
PR body:
"""
ipa: add SYSDB_USER_MAPPED_CERT for certs in idoverrides
Recent changes to support a rule based mapping between users and
certificates were not properly added for the case where a certificate was
added to an idoverride for a user. As a result authentication with the
certificate from the idoveride was not possible. With this patch the
certificate from to idoveride is properly added to the cache.
Related to https://pagure.io/SSSD/sssd/issue/3603
ipa: remove SYSDB_USER_CERT from sub-domain users
If there are no certificates returned for a sub-domain user from the IPA
server to the client we should make sure they are not present in the
client's cache anymore and remove the whole attribute from the cached user
entry.
Related to https://pagure.io/SSSD/sssd/issue/3603
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/488/head:pr488
git checkout pr488
4 years, 11 months
[sssd PR#523][opened] IPA: Drop unused ifdef HAVE_SELINUX_LOGIN_DIR
by lslebodn
URL: https://github.com/SSSD/sssd/pull/523
Author: lslebodn
Title: #523: IPA: Drop unused ifdef HAVE_SELINUX_LOGIN_DIR
Action: opened
PR body:
"""
Macros ALL_SERVICES and selogin_path were conditionally defined
in case of existing selinux login directory at configure time
(defined macro AVE_SELINUX_LOGIN_DIR)
However, these macros were unused for quite a long 2.5 year
and last usage was removed in commit 9c47c8c59b5c9078f342f82367cd0ad7857acef8
"IPA: Use set_seuser instead of writing selinux login file"
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/523/head:pr523
git checkout pr523
4 years, 11 months
[sssd PR#514][opened] Backport several UPN related patches to sssd-1-13
by jhrozek
URL: https://github.com/SSSD/sssd/pull/514
Author: jhrozek
Title: #514: Backport several UPN related patches to sssd-1-13
Action: opened
PR body:
"""
There are several patches that were applied to master, but never to sssd-1-13. The patches are needed to enable UPN logins in both direct join and trust-based setup.
The patches were already tested by one affected RHEL customer, so I'm quite certain they work. It would be nice to run CI and Coverity to make sure we don't introduce any regressions.
I did some basic sanity testing when backporting the fixes, but if you want to test the patches, first create a user with an 'enterprise principal', see e.g. https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows... then create an UPN that is different than the realm name. Restart SSSD to make sure the subdomains are refreshed. With a trust setup, you also might need to run 'ipa trustdomain-fetch' to make sure the suffix shows up.
Then, login using the UPN as the username.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/514/head:pr514
git checkout pr514
4 years, 11 months