sssd-devel February 2019

sssd-devel@lists.fedorahosted.org

9 participants
62 discussions

[sssd PR#757][opened] krb5_locator: Allow hostname in kdcinfo files
by thalman 19 Mar '19

19 Mar '19

URL: https://github.com/SSSD/sssd/pull/757 Author: thalman Title: #757: krb5_locator: Allow hostname in kdcinfo files Action: opened PR body: """ Currently we support only IP addresses in kdcinfo files. We need to resolv eventual dns name and then we have to iterate trough list of addresses because hostname can be resolved that way, including IPv4 and IPv6 addresses. Resolves part of: https://pagure.io/fork/jhrozek/SSSD/docs/blob/ \ 9cd7240a6b9de5ef1d41a21dc04adfdd4b143c93/f/ \ design_pages/kdcinfo_multiple_servers.rst """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/757/head:pr757 git checkout pr757

3 18

[sssd PR#760][opened] Add use_2fa_combined option to allow pam services to be configured as password+otp entry
by driskell 19 Mar '19

19 Mar '19

URL: https://github.com/SSSD/sssd/pull/760 Author: driskell Title: #760: Add use_2fa_combined option to allow pam services to be configured as password+otp entry Action: opened PR body: """ Hello, This is a rough idea and does build successfully but I'm still in the process of getting some testing arranged - I was pulled away from testing unfortunately but wanted to put the idea forward for examination in advance. I had been trying to get a service to use PAM with 2FA within a FreeIPA environment. However, I was having issues with it refusing to accept a password+otp entry as the single password entered. Having examined the logs it appeared that the 2FA token was being rejected as being incorrect. This confused me as SSHD was working fine and seemed to be configured identically. Looking at the code of the service I could see it was because it was responding to all PAM prompts with the same entered value - the password+otp combination - but was receiving two prompts. Checking SSSD I found the issue in that this behaviour is only allowed for SSHD service, and that the service name was hard-coded in. This PR adds a new option to pam_sssd, `use_2fa_combined` which allows any service to be configured to behave like `sshd` does, without breaking any compatibility with existing usage. Does this look like something that would be an acceptable feature to implement, assuming I finish testing and the overall idea works 👍 Thanks! """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/760/head:pr760 git checkout pr760

3 7

[sssd PR#742][opened] netgroups: honor cache_refresh_percent
by pbrezina 14 Mar '19

14 Mar '19

URL: https://github.com/SSSD/sssd/pull/742 Author: pbrezina Title: #742: netgroups: honor cache_refresh_percent Action: opened PR body: """ The value of cache refresh percent was not passed to cache_req. Steps to reproduce: 1. Configure SSSD like so: ```ini [nss] entry_cache_nowait_percentage=10 memcache_timeout=0 [domain/mydomain] entry_cache_timeout = 30 ``` 2. Run SSSD 3. Fetch netgroup for the first time 4. Wait 15 seconds (midpoint refresh will be triggered from 10-29 seconds interval) 5. Fetch netgroup again, see in logs that midpoint refresh was triggered Resolves: https://pagure.io/SSSD/sssd/issue/3947 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/742/head:pr742 git checkout pr742

2 5

Design document: Multiple server addresses or names in kdcinfo files
by Jakub Hrozek 01 Mar '19

01 Mar '19

Hi, I opened a pull request for the upcoming changes ot the locator plugin which enables a sort of a failover for libkrb5 applications. The PR is here: https://pagure.io/SSSD/docs/pull-request/78 the full text is also copied below for your convenience. If/when we agree on the design, tickets should be opened, because currently we only have a RHBZ tickets which are linked to the closed ticket https://pagure.io/SSSD/sssd/issue/941 Multiple server addresses or names in kdcinfo files =================================================== Related ticket(s): ------------------ * TBD Problem statement ----------------- When a user authenticates using Kerberos, the KDCs that will actually be used are either discovered by libkrb5 with the help of DNS SRV records, or the KDCs are configured explicitly in ``/etc/krb5.conf.`` or provided by a special `locator plugin`. Because the administrator expects that the servers they defined in ``sssd.conf`` would be used for both authentication through SSSD and by applications that use libkrb5, such the Kerberos command line tools like ``kinit``, SSSD provides a locator plugin for libkrb5 that allows SSSD to inform libkrb5 about the servers SSSD had configured. However, SSSD, at least in the typical use case, only writes the information about the single server it connects to and changes the address only when the daemon reconnects to a different server. This creates a problem in case the server whose address is written in the kdcinfo file is unreachable but no action towards sssd that would provoke a fail over (such as a user login over PAM) is executed. In that case, the kdcinfo file contains stale entries and because from libkrb5 point of view, the kdcinfo files are authoritative and if the information present there is not useful, libkrb5 cannot reach any KDCs from that domain. To improve the situation, this design page proposes adding a new sssd option that, if set, would enable sssd to write additional host names into the kdcinfo files which would then allow the plugin to iterate over these items and in turn allow libkrb5 to have sort of a failover for entries configured in sssd.conf or autodiscovered by SSSD. Use cases --------- A typical sequence that triggers this problem is this: * log in with a PAM service to a machine. This causes a KDC address to be written to the kdcinfo file * disable the KDC server, e.g. by enabling a restrictive firewall rule * call kinit on the client where the kdcinfo file was written Overview of the solution ------------------------ The Kerberos locator plugin reads the address(es) from per-realm text files written by SSSD located in the ``/var/lib/sss/pubconf`` directory. At the moment, the plugin can already read multiple entries, but currently only numerical addresses are supported. On a high level, implementing this RFE requires several changes: * change the Kerberos locator plugin so that it can also consume host names in addition to numerical addresses. These host names would be resolved in the plugin itself and passed to libkrb5 with the help of a callback function libkrb5 provides to the plugin * add a new SSSD option that would limit the number of entries that SSSD writes to the kdcinfo plugin. This is needed to avoid time outs in case the network was truly unreachable. The default value of the option could perhaps be different in master and sssd-1-16 where master could default to writing multiple entries, but sssd-1-16 would default the option to 0 in order to not change behaviour of a stable branch. * extend the online callback which the SSSD fail over component uses to write the current server to the kdcinfo files to also write additional server host names in addition to the current server address * to enable writing multiple server addresses, the request to resolve a server for a service should be extended to resolve host names up to the specified limit When it comes to resolving the servers, there are several scenarios to consider: * The servers can be enumerated using an option. This includes ``krb5_server/krb5_backup_server`` for the krb5 provider and ``ipa_server/ipa_backup_server`` and ``ad_server/ad_backup_server`` for the IPA and AD providers. * The servers can be completely autodiscovered. Typically this is done by either omitting the ``*_server`` options completely or using the ``_srv_`` identifier. As long as the list is omitted or the ``_srv_`` record is the first one in the list, any fail over service resolution would trigger the DNS SRV lookups and resolve the whole list. It is useful to note that the ``_srv_`` identifier is not permitted in the backup server list explicitly, but the AD provider does resolve a SRV query into the backup server list. That is done in case an AD site is used, then the servers from the AD site are added as 'primary' and the global servers form the 'backup' list. * A mix of the above. The most complex case from the point of this RFE is a list that starts with a host name, but includes the ``_srv_`` identifier later on, e.g. ``krb5_server = kdc.example.com, _srv_``. In this case, currently calling the fail over resolution would only resolve the host name of ``kdc.example.com``, but not the SRV query, so unless the fail over code is extended, the host names originating from the SRV query would not be known after the service resolution finishes. Implementation details ---------------------- The interface the locator plugin uses to communicate with libkrb5 is a callback function provided by the caller (libkrb5), SSSD is supposed to pass a struct sockaddr to the caller. The Kerberos locator plugin is already capable of iterating over multiple addresses, but currently really only numerical addresses are supported and the plugin converts the string representation of the address into struct sockaddr by calling ``getaddrinfo(3)`` with the ``AI_NUMERICHOST`` parameter. We should extend the locator plugin code by calling getaddrinfo for entries that do not represent an address to resolve a host name and pass its address. This can be a first self-contained step in the implementation. The kdcinfo files are written (using ``write_krb5info_file``) either during an online callback or in a special-case for IPA trust clients. The special case is already doing something similar to what this page is about by looking into a subsection representing a trusted domain (e.g. ``[domain/ipa.test/win.trust.test]``) and resolving all the servers in that list either by name or based on a site selection. However, this is done during the subdomain provider operation, not during a resolver callback and all the addresses configured in the ``sssd.conf`` file are always resolved and written to the config file. The ``write_krb5info_file`` receives a linked list of ``struct fo_server`` structures which contains the address, if already resolved, or at least a host name in the ``struct server_common`` member structure. Since the callback should already be synchronous and not do much work on its own, it would be best if the callback was already invoked with the data provided, There are two kinds of servers in the fail over module - primary and backup. The backup servers are supposed to only be used temporarily and sssd periodically tries to connect to one of the primary servers. However, from the fail over code point of view, even adding a "backup" server still means the server is added to the same linked list, just with a flag denoting that the server is not primary, therfore iterating over a single list would iterate over both the primary and backup servers. Before changing the online callbacks, it would be useful to implement and read the ``krb5_kdcinfo_lookahead`` option so that there is already an upper limit when the callbacks write the extra host names. The next step of implementation could be extending the online callbacks that call the ``write_krb5info_file`` functions. There are several of them, ``ad_resolve_callback``, ``ipa_resolve_callback`` and ``krb5_resolve_callback``. The callbacks receive the current ``struct fo_server`` instance. The callbacks would then keep iterating over the linked list until either the list is exhausted or as many as ``krb5_kdcinfo_lookahead`` items are processed. The host name from the ``struct server_common`` structure would be read using ``fo_get_server_name`` and written to the array passed to ``write_krb5info_file``. One question to consider is whether to use the ``fo_server`` instances before the current one, i.e. those that SSSD tried before and couldn't connect to. I think it would make sense to add them to the end of the list, at least for the primary servers not from a SRV query, because sssd never reconnects to a server earlier in the list as long as later server works. The SRV queries are different in this respect in the sense that they time out and force SSSD to resolve the whole list once a server is requested again (typically either during authentication or once the LDAP connection expires). Finally, the case where the fail over code needs to do additional lookups in order to resolve at least the amount of host names requested by the ``krb5_kdcinfo_lookahead`` should be addressed. The caller that initializes the fail over service (maybe with ``be_fo_add_service``) should provide a hint with the value of the lookahead option. Then, if a request for server resolution is triggered, the fail over code would resolve a server and afterwards check if enough ``fo_server`` entries with a valid hostname in the ``struct server_common`` structure. If not, the request would check if any of the ``fo_server`` structures represents a SRV query and try to resolve the query to receive more host names. Configuration changes --------------------- A new configuration option called ``krb5_kdcinfo_lookahead`` would be added. This option would default to a sensible non-zero value in the master branch, perhaps 3 so that attempting to resolve the extra host names does not cause the libkrb5 operation to time out. If the patches are backported to any stable branch, the option must default to 0 (disabled). In the first iteration, we might want to just read a single number, but in the future, the option should be extended to accept two numbers in the ``total:backup`` notation. This would mean write up to ``total`` servers, but include up to ``backup`` servers from the backup list. This would be useful in case none of the servers from the primary list are reachable, because e.g. they all come from the same AD site, but servers outside the site are reachable. This extension would only make sense if SSSD does not resolve the host names on its own, which might be another future extension. It might be a good idea to add a note to the ``sssd-ad`` and ``sssd-ipa`` man pages or even the shared fail over man page include file with a pointer to how the kdcinfo files work so that the information is easy to discover for administrators. How To Test ----------- Plugin test With any of the below tests or even after writing the host names to the kdcinfo files directly, make sure the first entry in the list is unreachable. Then call e.g. `kinit` and check that the operation succeeds. Backwards compatibility test Set the ``krb5_kdcinfo_lookahead`` option to 0. Define multiple servers and perform Kerberos authentication. Make sure that only the current server is written to the kdcinfo files. Write a list of servers Set the ``krb5_resolve_callback`` to a positive value. Make sure that the first entry in the kdcinfo files is an address and the other entries are host names from the configuration. This test case should be extended to make sure only so many entries as the value of the option are written, or if there are fewer entries in the config file, all are writen. Fail over test Similar to the above, except make sure the first entry in the list cannot be contacted. Then, SSSD should resolve the next entry to the address and if applicable write the rest of the list. Backup server test At the minimum, we should make sure that servers from the backup list are written to the kdcinfo files. If the option would implement the split ``total:backup`` value, then those should be tested as well. (Optional) writing a previously tried, not working server If it is agreed during design review that also not working servers are to be written to the kdcinfo files (see the section about not working servers), then a test case should make sure those are written to the end of the list. SRV resolution test Leave the server list (e.g. ``krb5_server``) option empty. Make sure a DNS SRV query for the configured realm returns valid servers and they are written to the config file. Combined SRV and server list Set the ``krb5_server`` option to ``hostname, _srv_``. Set the ``krb5_kdcinfo_lookahead`` option to a value greater than 1. Make sure that the host names from the DNS SRV query are also present in the kdcinfo files. IPA client test The test cases above should be repeated for an IPA client as well in case the IPA online callbacks are modified. AD site test Add an AD client to a site or set the site in the config file. Make sure that the servers from the site are written first, followed by the global servers up to the ``krb5_kdcinfo_lookahead`` value. How To Debug ------------ Any new code must be decorated with DEBUG messages. To debug the locator plugin changes, using ``KRB5_TRACE`` or even calling ``strace`` might be useful. Future development ------------------ First, it might be useful to extend the resolver or fail over code to resolve the names on its own to save some potentially blocking calls in the plugin. There is already an example of ``resolv_hostport_list_send`` that can perhaps be reused. Additionally, we already plan for some time to include connectivity checks with cLDAP ping or just plain ``connect()`` to make sure that servers that cannot be contacted at all are not tried. This is of course outside of the scope of this work, but should be kept in mind to not implement something incompatible. Authors ------- * Sumit Bose <sbose(a)redhat.com> * Tomas Halman <thalman(a)redhat.com> * Jakub Hrozek <jhrozek(a)redhat.com>

2 3

Announcing SSSD 2.1
by Jakub Hrozek 28 Feb '19

28 Feb '19

== SSSD 2.1 === The SSSD team is proud to announce the release of version 2.1 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora shortly. Feedback -------- Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users Highlights ---------- New features ^^^^^^^^^^^^ * Any provider can now match and map certificates to user identities. This feature enables to log in with a smart card without having to store the full certificate blob in the directory or in user overrides. Please see `The design page <https://docs.pagure.org/SSSD.sssd/design_pages/certmaps_for_LDAP_AD_file.ht…>`_ for more information (#3500) * ``pam_sss`` can now be configured to only perform Smart Card authentication or return an error if this is not possible. * ``pam_sss`` can also prompt the user to insert a Smart Card if, during an authentication it is not available. SSSD would then wait for the card until it is inserted or until timeout defined by ``p11_wait_for_card_timeout`` passes. * The device or reader used for Smart Card authentication can now be selected or restricted using a PKCS#11 URI (see RFC-7512) specified in the ``p11_uri`` option. * Multiple certificates are now supported for Smart Card authentication even if SSSD is built with OpenSSL * OCSP checks were added to the OpenSSL version of certificate authentication * A new option ``crl_file`` can be used to select a Certificate Revocation List (CRL) file to be used during verification of a certificate for Smart Card authentication. * Certificates with Elliptic Curve keys are now supported (#3887) * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon, just by modifying the ``[kcm]`` section of ``sssd.conf`` and running ``systemctl restart sssd-kcm.service``. * A new configuration option ``ad_gpo_implicit_deny`` was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. Normally users are allowed access in this situation. (#3701) * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction to reduce replication traffic in complex environments (#3829) * Configuration file snippets can now be used even when the main ``sssd.conf`` file does not exist. This is mostly useful to configure e.g. the KCM responder, the implicit files provider or the session recording with setups that have no explicit domain (#3439) * The ``sssctl user-checks`` tool can now display extra attributes set with the InfoPipe ``user_attributes`` configuraton option (#3866) Security issues fixed ^^^^^^^^^^^^^^^^^^^^^ * CVE-2019-3811: SSSD used to return "/" in case a user entry had no home directory. This was deemed a security issue because this flaw could impact services that restrict the user's filesystem access to within their home directory. An empty home directory field would indicate "no filesystem access", where sssd reporting it as "/" would grant full access (though still confined by unix permissions, SELinux etc). Notable bug fixes ^^^^^^^^^^^^^^^^^ * Many fixes for the internal "sbus" IPC that was rewritten in the 2.0 release including crash on reconnection (#3821), a memory leak (#3810), a proxy provider startup crash (#3812), sudo responder crash (#3854), proxy provider authentication (#3892), accessing the ``extraAttributes`` InfoPipe property (#3906) or a potential startup failure (#3924) * The Active Directory provider now fetches the user information from the LDAP port and switches to using the Global Catalog port, if available for the group membership. This fixes an issue where some attributes which are not available in the Global Catalog, typically the home directory, would be removed from the user entry. (#2474) * Session recording can now be enabled also for local users when the session recording is configured with ``scope=some`` and restricted to certain groups. * Smart Card authentication did not work with the KCM credentials cache because with KCM root cannot write to arbitrary user's credential caches (#3903) * A KCM bug that prevented SSH Kerberos credential forwarding from functioning was fixed (#3873) * The KCM responder did not work with completely empty database (#3815) * The sudo responder did not reflect the case_sensitive domain option (#3820) * The SSH responder no longer fails completely if the ``p11_child`` times out when deriving SSH keys from a certificate (#3937)t * An issue that caused SSSD to sometimes switch to offline mode in case not all domains in the forest ran the Global Catalog service was fixed (#3902) * If any of the SSSD responders was too busy, that responder wouldn't have refreshed the trusted domain list (#3967) * The IPA SELinux provider now sets the user login context even if it is the same as the system default. This is important in case the user has a non-standard home directory, because then only adding the user to the SELinux database ensures the home directory will be labeled properly. However, this fix causes a performance hit during the first login as the context must be written into the semanage database. * A memory leak when requesting netgroups repeatedly was fixed (#3870) * The ``pysss.getgrouplist()`` interface that was removed by accident in the 2.0 version was re-added (#3493) * Crash when requesting users with the ``FindByNameAndCertificate`` D-Bus method was fixed (#3863) * SSSD can again run as the non-privileged sssd user (#3871) * The cron PAM service name used for GPO access control now defaults to a different service name depending on the OS (Launchpad #1572908) Packaging Changes ----------------- * The sbus code generator no longer relies on existance of the "python" binary, the python2/3 binary is used depending on which bindings are being generated (#3807) * Very old libini library versions are no longer supported Documentation Changes --------------------- * Two new ``pam_sss`` options ``try_cert_auth`` and ``require_cert_auth`` can restrict authentication to use a Smart Card only or wait for a Smart Card to be inserted. * A new option ``p11_wait_for_card_timeout`` controls how long would SSSD wait for a Smart Card to be inserted before failing with ``PAM_AUTHINFO_UNAVAIL``. * A new option ``p11_uri`` is available to restrict the device or reader used for Smart Card authentication. Tickets Fixed ------------- * `3967 <https://pagure.io/SSSD/sssd/issue/3967>`_ - NSS responder does no refresh domain list when busy * `3961 <https://pagure.io/SSSD/sssd/issue/3961>`_ - sssd config-check reports an error for a valid configuration option * `3958 <https://pagure.io/SSSD/sssd/issue/3958>`_ - sssd_krb5_locator_plugin introduces delay in cifs.upcall krb5 calls * `3949 <https://pagure.io/SSSD/sssd/issue/3949>`_ - gdm login not prompting for username when smart card maps to multiple users * `3942 <https://pagure.io/SSSD/sssd/issue/3942>`_ - RemovedInPytest4Warning: Fixture "passwd_ops_setup" called directly * `3937 <https://pagure.io/SSSD/sssd/issue/3937>`_ - If p11_child spawned from sssd_ssh times out, sssd_ssh fails completely * `3936 <https://pagure.io/SSSD/sssd/issue/3936>`_ - Missing sssd-files in last section(SEE ALSO) of sssd man pages * `3924 <https://pagure.io/SSSD/sssd/issue/3924>`_ - "Corrupted" name of "Hello" method of org.freedesktop.DBus sssd sbus interface on Fedora Rawhide * `3921 <https://pagure.io/SSSD/sssd/issue/3921>`_ - crash when requesting extra attributes * `3919 <https://pagure.io/SSSD/sssd/issue/3919>`_ - sss_cache prints spurious error messages when invoked from shadow-utils on package install * `3917 <https://pagure.io/SSSD/sssd/issue/3917>`_ - Double free error in tev_curl * `3916 <https://pagure.io/SSSD/sssd/issue/3916>`_ - Wrong spelling of method * `3912 <https://pagure.io/SSSD/sssd/issue/3912>`_ - incorrect example in the man page of idmap_sss suggests using * for backend sss * `3911 <https://pagure.io/SSSD/sssd/issue/3911>`_ - Re-setting the trusted AD domain fails due to wrong subdomain service name being used * `3910 <https://pagure.io/SSSD/sssd/issue/3910>`_ - KCM destroy operation returns KRB5_CC_NOTFOUND, should return KRB5_FCC_NOFILE if non-existing ccache is about to be destroyed * `3909 <https://pagure.io/SSSD/sssd/issue/3909>`_ - SSSD 2.0 has drastically lower sbus timeout than 1.x, this can result in time outs * `3906 <https://pagure.io/SSSD/sssd/issue/3906>`_ - extraAttributes is org.freedesktop.DBus.Error.UnknownProperty: Unknown property * `3903 <https://pagure.io/SSSD/sssd/issue/3903>`_ - PKINIT with KCM does not work * `3902 <https://pagure.io/SSSD/sssd/issue/3902>`_ - SSSD must be cleared/restarted periodically in order to retrieve AD users through IPA Trust * `3901 <https://pagure.io/SSSD/sssd/issue/3901>`_ - sssd returns '/' for emtpy home directories * `3896 <https://pagure.io/SSSD/sssd/issue/3896>`_ - sss_cache shouldn't return ENOENT when no entries match * `3892 <https://pagure.io/SSSD/sssd/issue/3892>`_ - The proxy provider does not copy reply from the child * `3890 <https://pagure.io/SSSD/sssd/issue/3890>`_ - SSSD changes the memory cache file ownership away from the SSSD user when running as root * `3889 <https://pagure.io/SSSD/sssd/issue/3889>`_ - Abort LDAP authentication if the check_encryption function finds out the connection is not authenticated * `3887 <https://pagure.io/SSSD/sssd/issue/3887>`_ - sssd support for for smartcards using ECC keys * `3882 <https://pagure.io/SSSD/sssd/issue/3882>`_ - Missing concise documentation about valid options for sssd-files-provider * `3876 <https://pagure.io/SSSD/sssd/issue/3876>`_ - Unable to su to root when logged in as a local user * `3875 <https://pagure.io/SSSD/sssd/issue/3875>`_ - CURLE_SSL_CACERT is deprecated in recent curl versions * `3874 <https://pagure.io/SSSD/sssd/issue/3874>`_ - RefreshRules_recv marks the wrong request as done * `3873 <https://pagure.io/SSSD/sssd/issue/3873>`_ - Perform some basic ccache initialization as part of gen_new to avoid a subsequent switch call failure * `3872 <https://pagure.io/SSSD/sssd/issue/3872>`_ - SSSD 2.x does not sanitize domain name properly for D-bus, resulting in a crash * `3871 <https://pagure.io/SSSD/sssd/issue/3871>`_ - sbus: allow non-root execution * `3866 <https://pagure.io/SSSD/sssd/issue/3866>`_ - sssctl user-checks does not show custom IFP user_attributes * `3865 <https://pagure.io/SSSD/sssd/issue/3865>`_ - Off-by-one error in retrieving host name causes hostnames with exactly 64 characters to not work * `3863 <https://pagure.io/SSSD/sssd/issue/3863>`_ - sssd ifp crash when trying FindByNameAndCertificate * `3862 <https://pagure.io/SSSD/sssd/issue/3862>`_ - Restarting the sssd-kcm service should reload the configuration without having to restart the whole sssd * `3858 <https://pagure.io/SSSD/sssd/issue/3858>`_ - sssctl user-show says that user is expired if the user comes from files provider * `3855 <https://pagure.io/SSSD/sssd/issue/3855>`_ - session not recording for local user when groups defined * `3854 <https://pagure.io/SSSD/sssd/issue/3854>`_ - sudo: sbus2 related crash * `3849 <https://pagure.io/SSSD/sssd/issue/3849>`_ - Files: The files provider always enumerates which causes duplicate when running getent passwd * `3848 <https://pagure.io/SSSD/sssd/issue/3848>`_ - pam_unix unable to match fully qualified username provided by sssd during smartcard auth using gdm * `3845 <https://pagure.io/SSSD/sssd/issue/3845>`_ - The config file validator says that certmap options are not allowed * `3841 <https://pagure.io/SSSD/sssd/issue/3841>`_ - The simultaneous use of strncpy and a length-check in client code is confusing Coverity * `3830 <https://pagure.io/SSSD/sssd/issue/3830>`_ - Printing incorrect information about domain with sssctl utility * `3829 <https://pagure.io/SSSD/sssd/issue/3829>`_ - SSSD does not batch DDNS update requests * `3828 <https://pagure.io/SSSD/sssd/issue/3828>`_ - Invalid domain provider causes SSSD to abort startup * `3827 <https://pagure.io/SSSD/sssd/issue/3827>`_ - SSSD should log to syslog if a domain is not started due to a misconfiguration * `3826 <https://pagure.io/SSSD/sssd/issue/3826>`_ - Remove references of sss_user/group/add/del commands in man pages since local provider is deprecated * `3821 <https://pagure.io/SSSD/sssd/issue/3821>`_ - crash related to sbus_router_destructor() * `3815 <https://pagure.io/SSSD/sssd/issue/3815>`_ - KCM: The secdb back end might fail creating a new ID with a completely empty database * `3814 <https://pagure.io/SSSD/sssd/issue/3814>`_ - [RFE] Add option to specify a Smartcard with a PKCS#11 URI * `3813 <https://pagure.io/SSSD/sssd/issue/3813>`_ - sssd startup issues since 1.16.2 (PID file related) * `3812 <https://pagure.io/SSSD/sssd/issue/3812>`_ - sssd 2.0.0 segfaults on startup * `3810 <https://pagure.io/SSSD/sssd/issue/3810>`_ - sbus2: fix memory leak in sbus_message_bound_ref * `3807 <https://pagure.io/SSSD/sssd/issue/3807>`_ - The sbus codegen script relies on "python" which might not be available on all distributions * `3802 <https://pagure.io/SSSD/sssd/issue/3802>`_ - Reuse sysdb_error_to_errno() outside sysdb * `3798 <https://pagure.io/SSSD/sssd/issue/3798>`_ - When passwords are set to cache=false, userCertificate auth fails when backend is offline * `3797 <https://pagure.io/SSSD/sssd/issue/3797>`_ - When AD provider is offline, usercertmap fails * `3701 <https://pagure.io/SSSD/sssd/issue/3701>`_ - [RFE] Allow changing default behavior of SSSD from an allow-any default to a deny-any default when it can't find any GPOs to apply to a user login. * `3650 <https://pagure.io/SSSD/sssd/issue/3650>`_ - RFE: Require smartcard authentication * `3598 <https://pagure.io/SSSD/sssd/issue/3598>`_ - [RFE] Allow sssd to read the certificate attributes instead of blob look-up against the LDAP * `3576 <https://pagure.io/SSSD/sssd/issue/3576>`_ - sssd-kcm failed to start on F-27 after installing sssd-kcm * `3567 <https://pagure.io/SSSD/sssd/issue/3567>`_ - SYSDB: Lowercased email is stored as nameAlias * `3500 <https://pagure.io/SSSD/sssd/issue/3500>`_ - Make sure sssd is a replacement for pam_pkcs11 also for local account authentication * `3489 <https://pagure.io/SSSD/sssd/issue/3489>`_ - p11_child should work wit openssl1.0+ * `3451 <https://pagure.io/SSSD/sssd/issue/3451>`_ - When sssd is configured with id_provider proxy and auth_provider ldap, login fails if the LDAP server is not allowing anonymous binds. * `3439 <https://pagure.io/SSSD/sssd/issue/3439>`_ - Snippets are not used when sssd.conf does not exist * `3413 <https://pagure.io/SSSD/sssd/issue/3413>`_ - a bug in libkrb5 causes kdestroy -A to not work with more than 2 principals with KCM * `3334 <https://pagure.io/SSSD/sssd/issue/3334>`_ - sssctl config-check does not check any special characters in domain name of domain section * `3333 <https://pagure.io/SSSD/sssd/issue/3333>`_ - usermod -a -G bar foo fails due to some file providers races * `3276 <https://pagure.io/SSSD/sssd/issue/3276>`_ - Revert workaround in CI for bug in python-{request,urllib3} * `3263 <https://pagure.io/SSSD/sssd/issue/3263>`_ - consider adding sudo-i to the list of pam_response_filter services by default * `2817 <https://pagure.io/SSSD/sssd/issue/2817>`_ - dynamic dns - remove detection of 'realm' keyword support * `2474 <https://pagure.io/SSSD/sssd/issue/2474>`_ - AD: do not override existing home-dir or shell if they are not available in the global catalog * `1944 <https://pagure.io/SSSD/sssd/issue/1944>`_ - convert dyndns timer to be_ptask Detailed Changelog ------------------ * Adam Williamson (1): * sbus: use 120 second default timeout * Alexey Tikhonov (16): * Fix error in hostname retrieval * util/tev_curl: Fix double free error in schedule_fd_processing() * CONFIG: validator rules & test * sss_client/common.c: fix Coverity issue * sss_client/common.c: fix off-by-one error in sizes check * sss_client/common.c: comment amended * sss_client/nss_services.c: indentation fixed * sss_client/nss_services.c: fixed incorrect mutex usage * sss_client: global unexported symbols made static * providers/ldap: abort unsecure authentication requests * providers/ldap: fixed check of ldap_get_option return value * providers/ldap: init sasl_ssf in specific case * sbus/interface: fixed interface copy helpers * lib/cifs_idmap_sss: fixed unaligned mem access * Util: fixed mistype in error string representation * TESTS: fixed bug in guests startup function * George McCollister (1): * build: remove hardcoded samba include path * Jakub Hrozek (38): * Updating the version to track 2.1 development * KCM: Don't error out if creating a new ID as the first step * SELINUX: Always add SELinux user to the semanage database if it doesn't exist * pep8: Ignore W504 and W605 to silence warnings on Debian * TESTS: Add a test for whitespace trimming in netgroup entries * TESTS: Add two basic multihost tests for the files provider * FILES: The files provider should not enumerate * p11: Fix two instances of -Wmaybe-uninitialized in p11_child_openssl.c * UTIL: Suppress Coverity warning * PYSSS: Re-add the pysss.getgrouplist() interface * IFP: Use subreq, not req when calling RefreshRules_recv * CI: Make the c-ares suppression file more relaxed to prevent failures on Debian * INI: Return errno, not -1 on failure from sss_ini_get_stat * MONITOR: Don't check for pidfile if SSSD is already running * SSSD: Allow refreshing only certain section with --genconf * SYSTEMD: Re-read KCM configuration on systemctl restart kcm * TEST: Add a multihost test for sssd --genconf * TESTS: Add a multihost test for changing sssd-kcm debug level by just restarting the KCM service * RESPONDER: Log failures from bind() and listen() * LDAP: minor refactoring in auth_send() to conform to our coding style * LDAP: Only authenticate the auth connection if we need to look up user information * PROXY: Copy the response to the caller * NSS: Avoid changing the memory cache ownership away from the sssd user * KCM: Deleting a non-existent ccache should not yield an error * TESTS: Add a test for deleting a non-existent ccache with KCM * MAN: Explicitly state that not all generic domain options are supported for the files provider * AD/IPA: Reset subdomain service name, not domain name * IPA: Add explicit return after tevent_req_error * MULTIHOST: Do not use the deprecated namespace * KCM: Return a valid tevent error code if a request cannot be created * KCM: Allow representing ccaches with a NULL principal * KCM: Create an empty ccache on switch to a non-existing one * TESTS: Add a multihost test for ssh credentials forwarding * MAN: Add sssd-files(5) to the See Also section * TESTS: Add a simple integration test for retrieving the extraAttributes property * TESTS: Don't fail when trying to create an OU that already exists * Updating translations for the 2.1 release * Updating the version for the 2.1.0 release * Lukas Slebodnik (29): * BUILD: Fix issue with installation of libsss_secrets * BUILD: Add missing deps to libsss_sbus*.so * BUILD: Reduce compilation of unnecessary files * MAN: Fix typo in ad_gpo_implicit_deny default value * CONFIGURE: Add minimal required version for p11-kit * SBUS: Silence warning maybe-uninitialized * UTIL: Fix compilation with curl 7.62.0 * test_pac_responder: Skip test if pac responder is not installed * INTG: Show extra test summary info with pytest * p11_child: Fix warning cast discards ‘const’ qualifier from pointer target type * CI: Modify suppression file for c-ares-1.15.0 * sss_cache: Do not fail for missing domains * intg: Add test for sss_cache & shadow-utils use-case * sss_cache: Do not fail if noting was cached * test_sss_cache: Add test case for invalidating missing entries * pyhbac-test: Do not use assertEquals * SSSDConfigTest: Do not use assertEquals * SSSDConfig: Fix ResourceWarning unclosed file * SSSDConfigTest: Remove usage of failUnless * BUILD: Fix condition for building sssd-kcm man page * DIST: Do not use conditional include for template files * NSS: Do not use deprecated header files * sss_cache: Fail if unknown domain is passed in parameter * test_sss_cache: Add test case for wrong domain in parameter * Remove macro ZERO_STRUCT * test_files_provider: Do not use pytest fixtures as functions * test_ldap: Do not uses pytest fixtures as functions * Revert "intg: Generate tmp dir with lowercase" * ent_test: Update assertions for python 3.7.2 * Madhuri Upadhye (1): * pytest: Add test cases for configuration validation * Michal Židek (4): * GPO: Add gpo_implicit_deny option * CONFDB: Skip 'local' domain if not supported * confdb: Always read snippet files * CONFDB: Remove old libini support * Niranjan M.R (20): * Python3 changes to multihost tests * Minor fixes related to converting of ldap attributes to bytes * test-library: fixes related to KCM, TLS on Directory server * Multihost-SanityTests: New test case for ssh login with KCM as default * pytest: Remove installing idm module * pytest/testlib: Add function to create organizational Unit * pytest/testlib: Fix related to removing kerberos database * pytest: Add test for sudo: search with lower cased name for case insensitive domains * pytest/testlib: function to create sudorules in ldap * pytest/testlib: remove space in CA DN * pytest/conftest.py: Delete krb5.keytab as part of cleanup * pytest: split kcm test cases in to separate file. * testlib: Update update_resolv_conf() to decode str to bytes * testlib: Replace Generic Exception with SSSDException and LdapException * pytest/sudo: Modify fixture to restore sssd.conf * pytest/sudo: Rename create_sudorule to case_sensitive_sudorule * pytest/sudo: call case_sensitive_sudorule fixture instead of create_sudorule * pytest/sudo: Add 2 fixtures set_entry_cache_sudo_timeout and generic_sudorule * pytest/sudo: Add Testcase: sssd crashes when refreshing expired sudo rules. * pytest: use ConfigParser() instead of SafeConfigParser() * Pavel Březina (25): * sbus: register filter on new connection * sbus: fix typo * sbus: check for null message in sbus_message_bound * sbus: replace sbus_message_bound_ref with sbus_message_bound_steal * sbus: add unit tests for public sbus_message module * sudo: respect case sensitivity in sudo responder * proxy: access provider directly not through be_ctx * dp: set be_ctx->provider as part of dp_init request * sbus: read destination after sender is set * sbus: do not try to remove signal listeners when disconnecting * sbus: free watch_fd->fdevent explicitly * be: use be_is_offline for the main domain when asking for domain status * sudo: use correct sbus interface * sudo: fix error handling in sudosrv_refresh_rules_done * sbus: remove leftovers from previous implementation * sbus: allow access for sssd user * nss: use enumeration context as talloc parent for cache req result * sss_iface: prevent from using invalid names that start with digits * ci: add ability to run tests in jenkins * ci: add Fedora 29 * sbus: do not use signature when copying dictionary entry * sbus: avoid using invalid stack point in SBUS_INTERFACE * sbus: improve documentation of SBUS_INTERFACE * ci: add Fedora Rawhide * sbus: terminated active ongoing request when reconnecting * Sumit Bose (63): * intg: flush the SSSD caches to sync with files * sbus: dectect python binary for sbus_generate.sh * sysdb: extract sysdb_ldb_msg_attr_to_certmap_info() call * sysdb_ldb_msg_attr_to_certmap_info: set SSS_CERTMAP_MIN_PRIO * sysdb: add attr_map attribute to sysdb_ldb_msg_attr_to_certmap_info() * confdb: add confdb_certmap_to_sysdb() * AD/LDAP: read certificate mapping rules from config file * sysdb: sysdb_certmap_add() handle domains more flexible * confdb: add special handling for rules for the files provider * files: add support for Smartcard authentication * responder: make sure SSS_DP_CERT is passed to files provider * PAM: add certificate matching rules from all domains * doc: add certificate mapping section to man page * intg: user default locale * PAM: use better PAM error code for failed Smartcard authentication * test_ca: test library only for readable * test_ca: set a password/PIN to nss databases * getsockopt_wrapper: add support for PAM clients * intg: add Smartcard authentication tests * ci: add http-parser-devel for Fedora * p11: handle multiple certs during auth with OpenSSL * p11_child: add --wait_for_card option * PAM: add p11_wait_for_card_timeout option * pam_sss: make flags public * pam_sss: add try_cert_auth option * pam_sss: add option require_cert_auth * intg: require SC tests * p11_child: show PKCS#11 URI in debug output * p11_child: add PKCS#11 uri to restrict selection * PAM: add p11_uri option * tests: add PKCS#11 URI tests * PAM: return short name for files provider users * p11_child: add OCSP check ot the OpenSSL version * p11_child: add crl_file option for the OpenSSL build * files: add session recording flag * ifp: fix typo causing a crash in FindByNameAndCertificate * pam_sss: return PAM_AUTHINFO_UNAVAIL if sc options are set * p11_child(NSS): print key type in a debug message * pam_test_srv: set default value for SOFTHSM2_CONF * tests: add ECC CA * test_pam_srv: add test for certificate with EC keys * p11_child(openssl): add support for EC keys * utils: refactor ssh key extraction (OpenSSL) * utils: add ec_pub_key_to_ssh() (OpenSSL) * utils: refactor ssh key extraction (NSS) * utils: add ec_pub_key_to_ssh() (NSS) * BUILD: Accept krb5 1.17 for building the PAC plugin * tests: fix mocking krb5_creds in test_copy_ccache * tests: increase p11_child_timeout * LDAP: Log the encryption used during LDAP authentication * Revert "IPA: use forest name when looking up the Global Catalog" * ipa: use only the global catalog service of the forest root * p11_child(openssl): do not free static memory * krb5_child: fix permissions during SC auth * idmap_sss: improve man page * PAM: use user name hint if any domain has set it * utils: make N_ELEMENTS public * ad: replace ARRAY_SIZE with N_ELEMENTS * responder: fix domain lookup refresh timeout * ldap: add get_ldap_conn_from_sdom_pvt * ldap: prefer LDAP port during initgroups user lookup * ldap: user get_ldap_conn_from_sdom_pvt() where possible * krb5_locator: always use port 88 for master KDC * Thorsten Scherf (1): * CONFIG: add missing ldap attributes for validation * Tomas Halman (14): * doc: remove local provider reference from manpages * confdb: log an error when domain is misconfigured * doc: Add nsswitch.conf note to manpage * test_config: Test for invalid characker in domain * UTIL: move and rename sysdb_error_to_errno to utils * DYNDNS: Drop support for legacy NSUPDATE * SSSCTL: user-show says that user is expired * DYNDNS: Convert dyndns timer to be_ptask * DYNDNS: SSSD does not batch DDNS update requests * nss: sssd returns '/' for emtpy home directories * ifp: extraAttributes is UnknownProperty * SSSCTL: user-checks does not show custom attributes * ssh: sssd_ssh fails completely on p11_child timeout * ssh: p11_child error message is too generic * Victor Tapia (1): * GPO: Allow customization of GPO_CROND per OS * mateusz (1): * Added note about default value of ad_gpo_map_batch parameter

1 1

[sssd PR#752][opened] sbus: terminated active ongoing request when reconnecting
by pbrezina 28 Feb '19

28 Feb '19

URL: https://github.com/SSSD/sssd/pull/752 Author: pbrezina Title: #752: sbus: terminated active ongoing request when reconnecting Action: opened PR body: """ Connection to the remote dbus server was lost. If there are any outgoing requests they are waiting for a pretty long timeout. During this timeout we kept chaining even new requests that come after successful reconnection and these request were waiting for the timeout to ocurr as well because they were chain to request that started before reconnection. Now, we terminated all active outgoing request that have a key associated so we can immediately start sending new requests. Resolves: https://pagure.io/SSSD/sssd/issue/3907 This is a trivial solution for now. It would be also possible to resend existing request after reconnection so their consumers may get correct answer. This however requires some logic behind in order to detect requests that actually are causing the crash to avoid endless crash loop of sssd. I'm thinking on - retry once, if sssd crashes again then kill the request. Should I create a ticket for this? """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/752/head:pr752 git checkout pr752

3 8

RFC: 2.1 release notes
by Jakub Hrozek 27 Feb '19

27 Feb '19

Hi, let's release 2.1. I drafted the release notes. We should review these PRs to make sure the release fixes all known regressions: https://github.com/SSSD/sssd/pull/752 (Alexey assigned this PR) https://github.com/SSSD/sssd/pull/737 (Michal assigned this PR) In the meantime I'll move unfixed tickets from the 2.1 milestone to 2.2 and if some appear like they don't belong there, I'll either ask or just move them on my onw. The release notes follow: SSSD 2.1.0 ========== Highlights ---------- New features ^^^^^^^^^^^^ * Any provider can now match and map certificates to user identities. This feature enables to log in with a smart card without having to store the full certificate blob in the directory or in user overrides. Please see `The design page <https://docs.pagure.org/SSSD.sssd/design_pages/certmaps_for_LDAP_AD_file.ht…>`_ for more information (#3500) * ``pam_sss`` can now be configured to only perform Smart Card authentication or return an error if this is not possible. * ``pam_sss`` can also prompt the user to insert a Smart Card if, during an authentication it is not available. SSSD would then wait for the card until it is inserted or until timeout defined by ``p11_wait_for_card_timeout`` passes. * The device or reader used for Smart Card authentication can now be selected or restricted using a PKCS#11 URI (see RFC-7512) specified in the ``p11_uri`` option. * Multiple certificates are now supported for Smart Card authentication even if SSSD is built with OpenSSL * OCSP checks were added to the OpenSSL version of certificate authentication * A new option ``crl_file`` can be used to select a Certificate Revocation List (CRL) file to be used during verification of a certificate for Smart Card authentication. * Certificates with Elliptic Curve keys are now supported (#3887) * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon, just by modifying the ``[kcm]`` section of ``sssd.conf`` and running ``systemctl restart sssd-kcm.service``. * A new configuration option ``ad_gpo_implicit_deny`` was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. Normally users are allowed access in this situation. (#3701) * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction to reduce replication traffic in complex environments (#3829) * Configuration file snippets can now be used even when the main ``sssd.conf`` file does not exist. This is mostly useful to configure e.g. the KCM responder, the implicit files provider or the session recording with setups that have no explicit domain (#3439) * The ``sssctl user-checks`` tool can now display extra attributes set with the InfoPipe ``user_attributes`` configuraton option (#3866) Security issues fixed ^^^^^^^^^^^^^^^^^^^^^ * CVE-2019-3811: SSSD used to return "/" in case a user entry had no home directory. This was deemed a security issue because this flaw could impact services that restrict the user's filesystem access to within their home directory. An empty home directory field would indicate "no filesystem access", where sssd reporting it as "/" would grant full access (though still confined by unix permissions, SELinux etc). Notable bug fixes ^^^^^^^^^^^^^^^^^ * Many fixes for the internal "sbus" IPC that was rewritten in the 2.0 release including crash on reconnection (#3821), a memory leak (#3810), a proxy provider startup crash (#3812), sudo responder crash (#3854), proxy provider authentication (#3892), accessing the ``extraAttributes`` InfoPipe property (#3906) or a potential startup failure (#3924) * Session recording can now be enabled also for local users when the session recording is configured with ``scope=some`` and restricted to certain groups. * Smart Card authentication did not work with the KCM credentials cache because with KCM root cannot write to arbitrary user's credential caches (#3903) * A KCM bug that prevented SSH Kerberos credential forwarding from functioning was fixed (#3873) * The KCM responder did not work with completely empty database (#3815) * The sudo responder did not reflect the case_sensitive domain option (#3820) * The SSH responder no longer fails completely if the ``p11_child`` times out when deriving SSH keys from a certificate (#3937) * The IPA SELinux provider now sets the user login context even if it is the same as the system default. This is important in case the user has a non-standard home directory, because then only adding the user to the SELinux database ensures the home directory will be labeled properly. However, this fix causes a performance hit during the first login as the context must be written into the semanage database. * A memory leak when requesting netgroups repeatedly was fixed (#3870) * The ``pysss.getgrouplist()`` interface that was removed by accident in the 2.0 version was re-added (#3493) * Crash when requesting users with the ``FindByNameAndCertificate`` D-Bus method was fixed (#3863) * An issue that caused SSSD to sometimes switch to offline mode in case not all domains in the forest ran the Global Catalog service was fixed (#3902) * SSSD can again run as the non-privileged sssd user (#3871) Packaging Changes ----------------- * The sbus code generator no longer relies on existance of the "python" binary, the python2/3 binary is used depending on which bindings are being generated (#3807) * Very old libini library versions are no longer supported Documentation Changes --------------------- * Two new ``pam_sss`` options ``try_cert_auth`` and ``require_cert_auth`` can restrict authentication to use a Smart Card only or wait for a Smart Card to be inserted. * A new option ``p11_wait_for_card_timeout`` controls how long would SSSD wait for a Smart Card to be inserted before failing with ``PAM_AUTHINFO_UNAVAIL``. * A new option ``p11_uri`` is available to restrict the device or reader used for Smart Card authentication. Tickets Fixed ------------- To be autogenerated Detailed Changelog ------------------ To be autogenerated

1 1

[sssd PR#718][opened] NSS: Avoid changing the memory cache ownership away from the sssd user (sssd-1-16 backport)
by jhrozek 26 Feb '19

26 Feb '19

URL: https://github.com/SSSD/sssd/pull/718 Author: jhrozek Title: #718: NSS: Avoid changing the memory cache ownership away from the sssd user (sssd-1-16 backport) Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/3890 In case SSSD is compiled --with-sssd-user but run as root (which is the default on RHEL and derivatives), then the memory cache will be owned by the user that sssd_nss runs as, so root. This conflicts with the packaging which specifies sssd.sssd as the owner. And in turn, this means that users can't reliably assess the package integrity using rpm -V. This patch makes sure that the memory cache files are chowned to sssd.sssd even if the nss responder runs as root. Also, this patch changes the sssd_nss responder so that is becomes a member of the supplementary sssd group. Even though in traditional UNIX sense, a process running as root could write to a file owned by sssd:sssd, with SELinux enforcing mode this becomes problematic as SELinux emits an error such as: type=AVC msg=audit(1543524888.125:1495): avc: denied { fsetid } for pid=7706 comm="sssd_nss" capability=4 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=capability To make it possible for the sssd_nss process to write to the files, the files are also made group-writable. The 'others' permission is still set to read only. Reviewed-by: Michal Židek <mzidek(a)redhat.com> (cherry picked from commit 61e4ba58934b20a950255e05797aca25aadc1242) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/718/head:pr718 git checkout pr718

2 6

[sssd PR#748][opened] TESTS: Don't fail when trying to create an OU that already exists
by jhrozek 26 Feb '19

26 Feb '19

URL: https://github.com/SSSD/sssd/pull/748 Author: jhrozek Title: #748: TESTS: Don't fail when trying to create an OU that already exists Action: opened PR body: """ If a fixture that creates an OU was used twice, the second invocation would fail, because the OU already exists. This patch ignores the already exists error when adding an OU. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/748/head:pr748 git checkout pr748

2 8

[sssd PR#751][opened] TESTS: fixed bug in guests startup function
by alexey-tikhonov 26 Feb '19

26 Feb '19

URL: https://github.com/SSSD/sssd/pull/751 Author: alexey-tikhonov Title: #751: TESTS: fixed bug in guests startup function Action: opened PR body: """ `start-guest()` function always started `client` machine ignoring supplied argument. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/751/head:pr751 git checkout pr751

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel February 2019