[sssd PR#814][opened] certmap: allow missing KU in OpenSSL version
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/814
Author: sumit-bose
Title: #814: certmap: allow missing KU in OpenSSL version
Action: opened
PR body:
"""
Make sure a missing key-usage (KU) is not treated as an error and is
handled equally in the NSS and OpenSSL implementation
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1660899
Additionally this pull-request contains patches which adds two new certificate
related commands to the sssctl utility. 'sssctl cert-show' displays the content
of the certificate in a format used by SSSD's certificate mapping and matching
rules. 'sssctl cert-map' show the users the certificate is mapped to. Both
commands expect the base64 encoded certificate on the command line.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/814/head:pr814
git checkout pr814
4 years, 10 months
[sssd PR#783][opened] knownhostsproxy: friendly error msg for NXDOMAIN
by branen
URL: https://github.com/SSSD/sssd/pull/783
Author: branen
Title: #783: knownhostsproxy: friendly error msg for NXDOMAIN
Action: opened
PR body:
"""
This patch writes a brief, familiar error message to stderr when no addresses are able to be resolved for the host specified in argv:
```
(with patch)$ ssh the-void
sss_ssh_knownhostsproxy: Could not resolve hostname the-void
ssh_exchange_identification: Connection closed by remote host
```
Users accustomed to using SSH in environments where SSSD is not deployed may expect the usual "Could not resolve hostname" error from SSH when a domain name is misspelled or otherwise invalid:
```
(no sssd)$ ssh the-void
ssh: Could not resolve hostname the-void: Name or service not known
```
When such users begin using SSH in an SSSD-enabled environment, they may be confused when this familiar and straightforward message is replaced by a new one:
```
(sssd)$ ssh the-void
ssh_exchange_identification: Connection closed by remote host
```
If such users aren't aware that the system `ssh_config` is proxying their connection through `sss_ssh_knownhostsproxy`, they may mistakenly conclude that a connection had been made all the way to a remote host and, therefore, that the hostname they specified was valid and able to be resolved. This patch mitigates this opportunity for confusion.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/783/head:pr783
git checkout pr783
4 years, 10 months
[sssd PR#818][opened] DP: add NULL check to be_ptask_{enable|disable}
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/818
Author: sumit-bose
Title: #818: DP: add NULL check to be_ptask_{enable|disable}
Action: opened
PR body:
"""
Currently the files and the proxy provider do not provide a check online
method (DPM_CHECK_ONLINE). The files provider because it can never go
offline. The proxy provider because there is no generic way to check
since the nature of the actual provider is unknown.
Since the method is missing check_if_online() jumps into the error
handling block were we try to reset the offline state
unconditionally. If there is no check_if_online_ptask, which never
exists for the files provider and will not be available in the proxy
provider as long as the backend is online, be_ptask_{enable|disable}
will be called with a NULL pointer.
Related to https://pagure.io/SSSD/sssd/issue/4014
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/818/head:pr818
git checkout pr818
4 years, 10 months
SSSD SIGHUP re-read certificate
by Edvin Norling
Hi
Due to legacy reasons the place where i work need SSSD inside a container and we want to use SIP-TLS client side certificates.
These certificates have a short liveliness and we generate a new one every day.
Right now we have a written a small python script to listen for the new certificate and restart SSSD but it would be much nicer if we can send a SIGHUP instead.
Is this something that would be interesting? If so me and my team could give it a try to implement this.
But we don't want to put in those hours if this is a feature you don't want.
Thanks for any feedback.
Regards Edvin
4 years, 10 months