[sssd PR#558][opened] WIP: Add a test for sss_nss_getgrouplist_timeout and fix invalidating the initgroups cache
by jhrozek
URL: https://github.com/SSSD/sssd/pull/558
Author: jhrozek
Title: #558: WIP: Add a test for sss_nss_getgrouplist_timeout and fix invalidating the initgroups cache
Action: opened
PR body:
"""
This is a WIP on adding tests for the sss_nss_ex interface. I covered only the sss_nss_getgrouplist_timeout function so far.
I'm submitting the PR already in this state to get some feedback if this
coverage is enough and the other functions can be covered similarly or
if there is some issue with this approach.
Also, I found a bug in invalidating the initgroups memory cache, that's
the first of the two patches. Here I'm really not sure if the fix is even
how the issue should be fixed, so I just hacked something up, even without
allocation checks etc.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/558/head:pr558
git checkout pr558
1 month
[sssd PR#596][opened] [CONFDB]:[RFE] Add "enabled" option to domain section
by amitkumar50
URL: https://github.com/SSSD/sssd/pull/596
Author: amitkumar50
Title: #596: [CONFDB]:[RFE] Add "enabled" option to domain section
Action: opened
PR body:
"""
Upstream Request:
Instead of enabling domains using the "domains" option in [sssd]
section we could have [domain/*] option "enabled". This would allow
admins to configure and enable domain in the same snippet file.
This Fix would be submitted in 2 patches:
Patch-1(This Patch):
- Introduces 'enabled' option in domain section
- Introduces 'CONFDB_DOMAIN_ENABLED' variable to retrieve enabled value
from confdb
- Code to call start_service() routine only for domains having enabled=1
Patch-2(Upcoming):
- Would remove 'domains' option from sssd section.
- Would remove corresponding code to parse 'domains' option
- Providing a check that atlest One domain have enabled option set.
Resolves: https://pagure.io/SSSD/sssd/issue/3735
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/596/head:pr596
git checkout pr596
2 months, 3 weeks
[sssd PR#693][opened] SYSDB: Fall back to the MPG result of getgrgid search if the non-MPG search for override doesn't match anything
by jhrozek
URL: https://github.com/SSSD/sssd/pull/693
Author: jhrozek
Title: #693: SYSDB: Fall back to the MPG result of getgrgid search if the non-MPG search for override doesn't match anything
Action: opened
PR body:
"""
Commit cf4f5e031ecbdfba0b55a4f69a06175a2e718e67 changed the logic of
getgrgid (and getpwnam, so far this patch only touches getgrgid) in the
sense that if looking up a GID in a MPG domain, the code checks if the GID
was overriden and if yes, it mandates that the overriden GID resolves to
a group by falling back to a non-MPG search.
This breaks the following use-case:
$ ipa idoverrideuser-add --uid=13133 --gidnumber=13133 'Default Trust View' user@domain
Most importantly, I'm on the fence about whether the current behaviour is
a bug or not. In general, I would have expected that if a primary GID is
overriden, you more or less break the MPG model, and then it's fair from
SSSD to make sure the GID number resolves to an entry. But apparently our
users were relying on the old behaviour where you can set the primary GID
with an override and then still resolve the primary group by ID to the user
entry.
So the patch in the PR is just a quick hack which sort of falls back to using
the user entry as the group if the overriden GID doesn't resolve to anything.
Should we support this use-case at all? Should we maybe limit it to
cases where the UID and GID are the same?
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/693/head:pr693
git checkout pr693
3 months
[sssd PR#705][opened] KCM: Add configurable quotas
by jhrozek
URL: https://github.com/SSSD/sssd/pull/705
Author: jhrozek
Title: #705: KCM: Add configurable quotas
Action: opened
PR body:
"""
This PR adds several patches that let the user configure quotas to store
their ccaches.
Please see the commit messages, I hope they are verbose enough. One thing
that should be pointed out is that the global number of ccaches is explicitly
unlimited. Does anyone see an issue with just enforcing the per-UID limits?
An upcoming PR(s) would implement warning when the quota is being exceeded
and a sssctl command to let the administrator display the quota taken.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/705/head:pr705
git checkout pr705
4 months