sssd-devel February 2019

sssd-devel@lists.fedorahosted.org

9 participants
62 discussions

[sssd PR#758][opened] krb5_locator: always use port 88 for master KDC
by sumit-bose 26 Feb '19

26 Feb '19

URL: https://github.com/SSSD/sssd/pull/758 Author: sumit-bose Title: #758: krb5_locator: always use port 88 for master KDC Action: opened PR body: """ If the kpasswdinfo file exists and the found IP address includes a port number as well the master KDC lookup will use this port number which is most probably wrong. Better use the default port 88 always for master KDC lookups. This patch also updates the man page for the locator plugin which was quite outdated. Related to https://pagure.io/SSSD/sssd/issue/3958 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/758/head:pr758 git checkout pr758

2 7

[sssd PR#761][opened] ldap: prefer LDAP port during initgroups user lookup
by sumit-bose 26 Feb '19

26 Feb '19

URL: https://github.com/SSSD/sssd/pull/761 Author: sumit-bose Title: #761: ldap: prefer LDAP port during initgroups user lookup Action: opened PR body: """ The first step of an initgroups request is to lookup the user. When using the AD provider the Global Catalog will be the preferred source. But not all LDAP attributes of the user might be replicated to the Global Catalog and as a result some of the missing attributes might be removed from the cached user object. Related to https://pagure.io/SSSD/sssd/issue/2474 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/761/head:pr761 git checkout pr761

2 4

[sssd PR#762][opened] responder: fix domain lookup refresh timeout
by sumit-bose 26 Feb '19

26 Feb '19

URL: https://github.com/SSSD/sssd/pull/762 Author: sumit-bose Title: #762: responder: fix domain lookup refresh timeout Action: opened PR body: """ Currently the timeout to check for new domains is reset whenever there is a request with an unknown domain name. If those requests happen more then once a minute (the default timeout) the timeout is always reset before it can expire and as a result the domain list is never refreshed. If SSSD starts offline with an empty domain list the NSS responder might never be able to resolve sub-domain users or groups even if the backend has switched to the online state and already refreshed the domain list. Related to https://pagure.io/SSSD/sssd/issue/3967 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/762/head:pr762 git checkout pr762

2 4

[sssd PR#764][opened] GPO: Allow customization of GPO_CROND per OS
by vtapia 26 Feb '19

26 Feb '19

URL: https://github.com/SSSD/sssd/pull/764 Author: vtapia Title: #764: GPO: Allow customization of GPO_CROND per OS Action: opened PR body: """ For both Debian and Ubuntu, the cron PAM service is named "cron" instead of "crond", denying the use of the service by default. This patch enables the HAVE_$OS (HAVE_DEBIAN/HAVE_FEDORA...) macros to select the service name during build, allowing further customization if required. Resolves: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1572908 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/764/head:pr764 git checkout pr764

4 7

[sssd PR#759][opened] CONFIG: add missing ldap attributes for validation
by tscherf 20 Feb '19

20 Feb '19

URL: https://github.com/SSSD/sssd/pull/759 Author: tscherf Title: #759: CONFIG: add missing ldap attributes for validation Action: opened PR body: """ https://pagure.io/SSSD/sssd/issue/3961 This patch adds missing 'ldap_host_*' attributes for config validation. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/759/head:pr759 git checkout pr759

5 7

Design Document: Change password without Password Modify Extended Operation
by Pavel Březina 20 Feb '19

20 Feb '19

https://pagure.io/SSSD/docs/pull-request/77 .. highlight:: none Change password on LDAP server that does not support Password Mofify Extended Operation ======================================================================================= Related ticket(s): ------------------ https://pagure.io/SSSD/sssd/issue/1314 Problem statement ----------------- Some directory servers either do not support Password Mofify Extended Operation (OID 1.3.6.1.4.1.4203.1.11.1, RFC 3062) for password change or this feature is disabled by default. SSSD is unable to perform password change on such servers. Even though we recommend to upgrade to servers that supports this feature, there are still users that will benefit from SSSD being able to change password without it. Use cases --------- * A user wants to change his/her password against LDAP that does not support Password Modify Extended Operation. Overview of the solution ------------------------ Provide new configuration option ``ldap_pwmodify_exop`` that will default to true (use extended operation for password change). If this options is set to false, SSSD will use simple LDAP modify operation instead of extended operation. Implementation details ---------------------- When a password change is requested, ``sdap_pam_chpass_handler_send`` is called. This request first authenticates the user with current password and then in ``sdap_pam_chpass_handler_auth_done`` tries to change it with extended operation by calling ``sdap_exop_modify_passwd_send``. At this point we should check the value of ``ldap_pwmodify_exop`` option and decide whether to continue with extended operation or use ``ldap_modify_ext`` instead. Information on how to change the password using simple LDAP modify operation can be found `here <https://www.ibm.com/support/knowledgecenter/SSVJJU_6.3.0/com.ibm.IBMDS.doc/…>`_ Configuration changes --------------------- * New option: ``ldap_pwmodify_exop`` How To Test ----------- Set ``ldap_pwmodify_exop`` to false and try to change user's password. Authors ------- * Pavel Březina <pbrezina(a)redhat.com>

2 4

[sssd PR#754][opened] Util: fixed mistype in error string representation
by alexey-tikhonov 18 Feb '19

18 Feb '19

URL: https://github.com/SSSD/sssd/pull/754 Author: alexey-tikhonov Title: #754: Util: fixed mistype in error string representation Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/3916 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/754/head:pr754 git checkout pr754

2 5

fleet commander integration
by Levin Stanislav 18 Feb '19

18 Feb '19

Hello, I want to ask you about design of fleet commander integration, which I found on https://docs.pagure.org/SSSD.sssd/design_pages/fleet_commander_integration.…. > The JSON files will be stored in a new directory owned by the > |sssd-ipa| subpackage. The top-level directory could be at > |/var/lib/sss/deskprofile/| with per-user subdirectories. So each > per-user JSON file would be stored at > |/var/lib/sss/deskprofile/<domain>/<username>/<profilename>.json|. The > |<username>| directories need to be owned by the user being logged in. > /var/lib/sss/deskprofile/<domain>/<username>/<profilename>.json > ------------ -------- ---------- ------------------ > | | | | > v | | | > Created by sssd package as | | | > root:root (or sssd:sssd) | | | > and has permissions 0751 | | | > | | | > v | | > Owned by user:user_group | | > and has permissions 0751 | | > | | > | | > v | > Owned by user:user_group | > and has permissions 0700 | > | > v > Owned by user:user_group > and has permissions 0400 As I see FleetCommander is executed with root privileges (without CAPs dropping) and is allowed to read user profiles. Why is "user" owner of the directory "<username>"? and why should we grant "user" with any permissions for this path? Why is it not just 0700 for dirs, 0400 for profiles, owner root/sssd_user for all subpaths? Could you please explain? Thank you in advance!

6 8

[sssd PR#747][opened] Added note about default value of ad_gpo_map_batch parameter
by teluka 16 Feb '19

16 Feb '19

URL: https://github.com/SSSD/sssd/pull/747 Author: teluka Title: #747: Added note about default value of ad_gpo_map_batch parameter Action: opened PR body: """ Various distros uses different names for cron service. Ubuntu uses cron, Suse uses cronie (vixie-cron in the past) and Fedora uses crond. User should be aware that default value might not work as desired on his distro and that default should be updated accordingly. Example of some confusion that default value caused: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1572908 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/747/head:pr747 git checkout pr747

4 7

[sssd PR#744][opened] ssh: sssd_ssh fails completely on p11_child timeout
by thalman 16 Feb '19

16 Feb '19

URL: https://github.com/SSSD/sssd/pull/744 Author: thalman Title: #744: ssh: sssd_ssh fails completely on p11_child timeout Action: opened PR body: """ When p11_child fails or timeout is reached, ssh login fails. With this patch sssd_ssh proceeds to ssh key and password login. Resolves: https://pagure.io/SSSD/sssd/issue/3937 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/744/head:pr744 git checkout pr744

3 16

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel February 2019