November 2020 - sssd-devel - Fedora mailing-lists

[sssd PR#175][opened] Add module for starting services
by lslebodn 22 Nov '21

22 Nov '21

URL: https://github.com/SSSD/sssd/pull/175 Author: lslebodn Title: #175: Add module for starting services Action: opened PR body: """ This is a WIP version of reducing code duplication in our cwrap integration tests. I am still not sure whether we should also reuse function `create_sssd_fixture`. And if yes; then probably in different nodule then `services` And comments are welcome. BTW I wrote patches few weeks ago; therefore new tests are not converted. I am just sending patches to get some feedback. Site effect of this patches is that tests are cca 20% faster (IIRC) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/175/head:pr175 git checkout pr175

5 5

[sssd PR#844][opened] sssd-ad and gpo_child: GPO apply fixes during reading fails
by mastersin 03 Aug '21

03 Aug '21

URL: https://github.com/SSSD/sssd/pull/844 Author: mastersin Title: #844: sssd-ad and gpo_child: GPO apply fixes during reading fails Action: opened PR body: """ Ignore AD GPO errors: - if SecEdit/GptTmpl.inf is missing or - if reading sysvol_gpt_version fails and cached_gpt_version already exists """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/844/head:pr844 git checkout pr844

7 16

[sssd PR#5419][opened] Adding tests to cover ad discovery improvements using cldap
by sidecontrol 17 Jun '21

17 Jun '21

URL: https://github.com/SSSD/sssd/pull/5419 Author: sidecontrol Title: #5419: Adding tests to cover ad discovery improvements using cldap Action: opened PR body: """ * This test requires a primary and secondary domain controller so AD can be moved between sites * Currently contains four test cases ** Two DCs in one site no restrictions. ** Two DCs in one site, traffic blocked to the other DC ** DCs in seperate sites no restrictions ** DCs in seperate sites, traffic blocked to the other DC Signed-off-by: Dan Lavu <dlavu(a)redhat.com> SSSD-2497 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5419/head:pr5419 git checkout pr5419

4 10

[sssd PR#5245][opened] RESOLV: Avoid DNS search to improve fail-over reaction
by thalman 16 Mar '21

16 Mar '21

URL: https://github.com/SSSD/sssd/pull/5245 Author: thalman Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction Action: opened PR body: """ In case of unreachable DNS server or invalid hostname sssd/c-ares tries to search in multiple domains based on the search directive in resolv.conf But the hostnames in config file are fully qualified and this just extends the time spent with DNS resolution. This patch set the c-ares library flags to avoid DNS search Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1608496 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5245/head:pr5245 git checkout pr5245

5 31

[sssd PR#5407][opened] kcm: check socket path loaded from configuration
by ikerexxe 19 Feb '21

19 Feb '21

URL: https://github.com/SSSD/sssd/pull/5407 Author: ikerexxe Title: #5407: kcm: check socket path loaded from configuration Action: opened PR body: """ There are three major execution flows for this change: 1. If kcm socket path is not defined in sssd configuration, then log it and fall back to the default location. 2. If kcm socket path is defined in sssd configuration but the location is invalid, then log it and fall back to the default location. 3. If kcm socket path is defined in sssd configuration and the location is valid, then use it. Apart from that some unit-tests have been implement to check that the changes work as expected. I wonder if the changes included in confdb_get_string() should be ported to all confdb_get_*() methods. Resolves: https://github.com/SSSD/sssd/issues/5406 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5407/head:pr5407 git checkout pr5407

4 49

[sssd PR#5264][opened] Utils: White space replace with another character
by elkoniu 08 Feb '21

08 Feb '21

URL: https://github.com/SSSD/sssd/pull/5264 Author: elkoniu Title: #5264: Utils: White space replace with another character Action: opened PR body: """ Function responsible for replacing white space has wrong log levels set. It can create false positive critical error messages broadcasted across the system without any real reason. This patch adjusts those log levels to be on the debug level rather than criticar error level. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1818671 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5264/head:pr5264 git checkout pr5264

3 7

[sssd PR#5365][opened] Translations update from Weblate
by weblate 05 Feb '21

05 Feb '21

URL: https://github.com/SSSD/sssd/pull/5365 Author: weblate Title: #5365: Translations update from Weblate Action: opened PR body: """ Translations update from [Weblate](https://translate.fedoraproject.org/projects/sssd/sssd-master/) for SSSD/sssd. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5365/head:pr5365 git checkout pr5365

2 10

[sssd PR#5268][opened] proxy_child hardening
by alexey-tikhonov 29 Jan '21

29 Jan '21

URL: https://github.com/SSSD/sssd/pull/5268 Author: alexey-tikhonov Title: #5268: proxy_child hardening Action: opened PR body: """ Fixes #3730 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5268/head:pr5268 git checkout pr5268

4 32

[sssd PR#5357][opened] Provide missing defines which otherwise are available on glibc system…
by akuster 29 Jan '21

29 Jan '21

URL: https://github.com/SSSD/sssd/pull/5357 Author: akuster Title: #5357: Provide missing defines which otherwise are available on glibc system… Action: opened PR body: """ … headers Signed-off-by: Armin Kuster <akuster808(a)gmail.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5357/head:pr5357 git checkout pr5357

4 16

[sssd PR#616][opened] become_user: add supplementary groups so ad provider can access keytab
by asheplyakov 28 Jan '21

28 Jan '21

URL: https://github.com/SSSD/sssd/pull/616 Author: asheplyakov Title: #616: become_user: add supplementary groups so ad provider can access keytab Action: opened PR body: """ For security reasons one might want to run providers as a non-privileged user (say, _sssd). However some providers (in particular ad) might need an access to restricted (non world-readable) files (for instance, /etc/krb5.keytab). One of the possible ways to solve the problem is to - add a special group (for instance, _keytab) - set the owner:group of the file in question to root:_keytab - set the permissions of the file in question to 640 - make the _sssd user a member of the _keytab group For this to work become_user should assign supplementary groups, which is what this patch does. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/616/head:pr616 git checkout pr616

5 13

[sssd PR#5251][opened] [wip] subdomains: allow to inherit case_sensitive=Preserving
by pbrezina 26 Jan '21

26 Jan '21

URL: https://github.com/SSSD/sssd/pull/5251 Author: pbrezina Title: #5251: [wip] subdomains: allow to inherit case_sensitive=Preserving Action: opened PR body: """ The first patch is just man page update to reflect current state. I think it makes sense to be able to show subdomain names in their original casing. Patches 2-3 make it work for AD provider. Patch 4 makes it work for IPA provider. There is apparantely a bug in winbind, but there is no link the any bugzilla so I do not know if it was already fixed. The commit is four years old. This patch requires case_sensitive=Preserving to be set also on the server, otherwise it does not work. It can be enabled without the server setting but we need to make nss_cmd_getpwnam_ex (and other _ex commands) to always return case preserving name. So before I continue the work I'd like to ask @sumit-bose if we can do it like this. Resolves: https://github.com/SSSD/sssd/issues/5250 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5251/head:pr5251 git checkout pr5251

3 28

[sssd PR#5376][opened] Update cert.c
by peptekmail 22 Jan '21

22 Jan '21

URL: https://github.com/SSSD/sssd/pull/5376 Author: peptekmail Title: #5376: Update cert.c Action: opened PR body: """ Sometimes generating a sshkey from a certificate fails. Looking at other implementations gives a hint about 0x80 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5376/head:pr5376 git checkout pr5376

6 8

[sssd PR#5413][opened] KCM: Increase client idle timeout to 5 minutes
by aborah-sudo 15 Jan '21

15 Jan '21

URL: https://github.com/SSSD/sssd/pull/5413 Author: aborah-sudo Title: #5413: KCM: Increase client idle timeout to 5 minutes Action: opened PR body: """ This change is to add automation of bug 1884205 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5413/head:pr5413 git checkout pr5413

4 39

[sssd PR#5422][opened] Logs review
by alexey-tikhonov 22 Dec '20

22 Dec '20

URL: https://github.com/SSSD/sssd/pull/5422 Author: alexey-tikhonov Title: #5422: Logs review Action: opened PR body: """ This is a set of patches intended to enable higher log level by default. Currently I target SSSDBG_OP_FAILURE (level 2) as a default (It seems SSSDBG_MINOR_FAILURE level contains legitimate messages that admin can deliberately ignore, and those messages can get quite spammy) Perhaps several patches are yet missing (I'm awaiting @sumit-bose response) but those already published are ready for review. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5422/head:pr5422 git checkout pr5422

3 36

[sssd PR#5401][opened] authtok: add label to Smartcard token
by sumit-bose 16 Dec '20

16 Dec '20

URL: https://github.com/SSSD/sssd/pull/5401 Author: sumit-bose Title: #5401: authtok: add label to Smartcard token Action: opened PR body: """ The key-id might not be sufficient to identify a certificate on a Smartcard since it is possible that multiple certificates will use the same key. This patch adds the certificate label to the Smartcard authtok item to about the ambiguity if the key-id is used for multiple certificates. Currently the key-id read from the Smartcard is used as key value for the gdm choice list dialog. Since it might be possible that multiple certificates use the same key and hence the same key-id this is not a suitable value. With this patch the string representation of a numerial counter is used. Resolves: https://github.com/SSSD/sssd/issues/5400 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5401/head:pr5401 git checkout pr5401

2 20

[sssd PR#5367][opened] pam: add pam_sss_gss module for gssapi authentication
by pbrezina 16 Dec '20

16 Dec '20

URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: opened PR body: """ The module configuration and usage should be clear from its manual page. Suggestions are welcome. The main use case is to enable password-less authentication for sudo where smartcards are not possible (because the reader is not available in the target host). It is not possible to set the service name or keytab at this moment so the module relies on `host/hostname@REALM` where hostname is provided by SSSD (based on the user's domain) and REALM is determined by GSSAPI. This principal is already stored in krb5_keytab location for IPA and AD providers so the functionality is for free. Because authorization is done by pam_sss and it is not needed for the use case, I would implement configurable ticket names and keytab location only when required by users. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367

5 48

[sssd PR#5410][opened] Bz1734040
by madhuriupadhye 04 Dec '20

04 Dec '20

URL: https://github.com/SSSD/sssd/pull/5410 Author: madhuriupadhye Title: #5410: Bz1734040 Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5410/head:pr5410 git checkout pr5410

5 33

[sssd PR#5343][opened] autofs: distinguish between empty cache and offline state
by pbrezina 04 Dec '20

04 Dec '20

URL: https://github.com/SSSD/sssd/pull/5343 Author: pbrezina Title: #5343: autofs: distinguish between empty cache and offline state Action: opened PR body: """ If the cache is empty and SSSD is offline we now return a proper error code to autofs so it can iplement a proper retry logic to fetch the maps when SSSD comes back offline. This also requires changes in autofs which are not yet available so the best way to test it with SSSD is to use the autofs test tool (autofs_test_client) to see that it returns correct error codes. Resolves: https://github.com/SSSD/sssd/issues/3413 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5343/head:pr5343 git checkout pr5343

2 29

[sssd PR#5375][opened] kcm: improve performance for large ccaches
by pbrezina 04 Dec '20

04 Dec '20

URL: https://github.com/SSSD/sssd/pull/5375 Author: pbrezina Title: #5375: kcm: improve performance for large ccaches Action: opened PR body: """ KCM protocol is not designed for highest performance and our impelmentation contained three huge bottle necks - encryption, json serialization and too much cache access. These are unnecessary - the encryption is meaningless since once you get access to the root-owned cache file you can also access the decryption key so there is no added security. JSON is unneccessarily large, requires base64 encoding of credentials and takes too long to parse. The cache was accessed with each GET_CRED_BY_UUID operation. This operation is called once for each credential when iterating over them. The iteration over credentials in Kerberos looks like this: ``` // GET_CRED_UUID_LIST - fetch list of credentials and create a cursor krb5_cc_start_seq_get(context, cache, &cur); // GET_CRED_BY_UUID - get credential by uuid while ((ret = krb5_cc_next_cred(context, cache, &cur, &creds)) == 0) { do_something(creds); krb5_free_cred_contents(context, &creds); } // destroy the cursor krb5_cc_end_seq_get(context, cache, &cur); ``` I have addressed these bottlenecks and the performance has improved dramatically. The test was to establish security context via GSSAPI with 200 services using [this testing app](https://github.com/pbrezina/gssapi-auth). ``` # run gssapi server ../gssapi-auth-server -s socket -k test.keytab & # get service tickets for i in $(seq 1 200); do ../gssapi-auth-client -s socket -n test$i(a)master.client.vm ; done # terminate server pkill gssapi-auth-server ``` Here are the results: | memory | secdb | keyring -------------------------------------------- before | 19m59.713s | 33m41.337s | after | 1m50.610s | 1m55.496s | 0m2.643s It is still pretty slow in comparison with keyring. The next bottleneck is communication over the socket. Keyring stores list of credentials directly in the cursor so `krb5_cc_next_cred` returns data immediately without calling to the keyring. We should do the same in KCM however this requires changes in the KCM protocol and needs to be communicated with its upstream. Resolves: https://github.com/SSSD/sssd/issues/5349 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5375/head:pr5375 git checkout pr5375

3 40

[sssd PR#5404][opened] nss: check if groups are filtered during initgroups
by sumit-bose 30 Nov '20

30 Nov '20

URL: https://github.com/SSSD/sssd/pull/5404 Author: sumit-bose Title: #5404: nss: check if groups are filtered during initgroups Action: opened PR body: """ If groups are filtered, i.e. SSSD should not handle them, they should not appear in the group list returned by an initgroups request. Resolves: https://github.com/SSSD/sssd/issues/5403 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5404/head:pr5404 git checkout pr5404

3 19

[sssd PR#5417][opened] KCM: avoid NULL deref
by alexey-tikhonov 30 Nov '20

30 Nov '20

URL: https://github.com/SSSD/sssd/pull/5417 Author: alexey-tikhonov Title: #5417: KCM: avoid NULL deref Action: opened PR body: """ Fixes following issue: ``` /src/responder/kcm/kcmsrv_op_queue.c:129: check_after_deref: Null-checking "entry" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. # 127| terminating = entry->queue->qctx->kctx->rctx->shutting_down; # 128| # 129|-> if (entry == NULL) { # 130| return 1; # 131| /* Prevent use-after-free of req when shutting down with non-empty queue */ ``` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5417/head:pr5417 git checkout pr5417

3 12

[sssd PR#5415][opened] winbind idmap plugin: Fix struct idmap_domain definition
by scabrero 30 Nov '20

30 Nov '20

URL: https://github.com/SSSD/sssd/pull/5415 Author: scabrero Title: #5415: winbind idmap plugin: Fix struct idmap_domain definition Action: opened PR body: """ The patch for samba bug 13052 was backported to samba >= 4.7.4 adding the dom_sid field to the idmap_domain struct. This missmatch in the struct definition causes the plugin to fail all unixids_to_sids and sids_to_unixids calls with NT_STATUS_INVALID_PARAMETER for samba versions between 4.7.4 and 4.8. Signed-off-by: Samuel Cabrero <scabrero(a)suse.de> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5415/head:pr5415 git checkout pr5415

3 11

[sssd PR#5416][opened] fp: fix original fix use-after-free - 1.16 version
by sumit-bose 25 Nov '20

25 Nov '20

URL: https://github.com/SSSD/sssd/pull/5416 Author: sumit-bose Title: #5416: fp: fix original fix use-after-free - 1.16 version Action: opened PR body: """ This should have been a cherry-pick of 3b158934cbb8f87cbfaf1650389b8dcd654b92ca but the cherry-pick of the original patch was broken and placed the change into a different function. This patch fixes this by directly placing the change at the right place. Resolves: https://github.com/SSSD/sssd/issues/5382 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5416/head:pr5416 git checkout pr5416

3 10

[sssd PR#5370][opened] nss: Use posix_fallocate() to alloc memcache file
by deastoe 25 Nov '20

25 Nov '20

URL: https://github.com/SSSD/sssd/pull/5370 Author: deastoe Title: #5370: nss: Use posix_fallocate() to alloc memcache file Action: opened PR body: """ If sssd_nss starts up while the filesystem where the memcache files will reside (SSS_NSS_MCACHE_DIR) does not have sufficient space, sssd_nss can be killed by SIGBUS while attempting to write to the mmap()'d address space. Replace the ftruncate() call with posix_fallocate(), which will fail in this scenario, so we can detect the condition and continue startup without the memcache functionality. Fixes #5369 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5370/head:pr5370 git checkout pr5370

4 54

[sssd PR#5399][opened] winbind idmap plugin: Fix struct idmap_domain definition
by scabrero 23 Nov '20

23 Nov '20

URL: https://github.com/SSSD/sssd/pull/5399 Author: scabrero Title: #5399: winbind idmap plugin: Fix struct idmap_domain definition Action: opened PR body: """ The patch for samba bug 13052 was backported to samba >= 4.7.4 adding the dom_sid field to the idmap_domain struct. This missmatch in the struct definition causes the plugin to fail all unixids_to_sids and sids_to_unixids calls with NT_STATUS_INVALID_PARAMETER for samba versions between 4.7.4 and 4.8. Signed-off-by: Samuel Cabrero <scabrero(a)suse.de> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5399/head:pr5399 git checkout pr5399

4 16

[sssd PR#5411][opened] ifp: fix original fix use-after-free
by sumit-bose 23 Nov '20

23 Nov '20

URL: https://github.com/SSSD/sssd/pull/5411 Author: sumit-bose Title: #5411: ifp: fix original fix use-after-free Action: opened PR body: """ The original fix stole the fqdn too earlier. Only for SSS_DP_USER requests the steal is important. For other request where the first result is returned to the caller the original version might even cause issues since the name does not belong to the memory hierarchy of the result anymore. Resolves: https://github.com/SSSD/sssd/issues/5382 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5411/head:pr5411 git checkout pr5411

3 16

[sssd PR#5398][opened] krb5: Remove secrets text from drop-in KCM file
by justin-stephenson 23 Nov '20

23 Nov '20

URL: https://github.com/SSSD/sssd/pull/5398 Author: justin-stephenson Title: #5398: krb5: Remove secrets text from drop-in KCM file Action: opened PR body: """ On my Fedora system I get `Failed to enable unit: Unit file sssd-secrets.socket does not exist.` I believe this secrets socket is no longer needed after KCM was decoupled from secrets. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5398/head:pr5398 git checkout pr5398

2 8

[sssd PR#5405][opened] Patch ldap group type
by tobias-gruenewald 23 Nov '20

23 Nov '20

URL: https://github.com/SSSD/sssd/pull/5405 Author: tobias-gruenewald Title: #5405: Patch ldap group type Action: opened PR body: """ Fix for reported bug: https://github.com/SSSD/sssd/issues/5402#issuecomment-728811398 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5405/head:pr5405 git checkout pr5405

3 9

[sssd PR#5409][opened] Missing ts
by thalman 23 Nov '20

23 Nov '20

URL: https://github.com/SSSD/sssd/pull/5409 Author: thalman Title: #5409: Missing ts Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5409/head:pr5409 git checkout pr5409

3 14

[sssd PR#5414][opened] SYSDB: merge_res_sysdb_attrs() fixed to avoid NULL ptr in msgs[]
by alexey-tikhonov 23 Nov '20

23 Nov '20

URL: https://github.com/SSSD/sssd/pull/5414 Author: alexey-tikhonov Title: #5414: SYSDB: merge_res_sysdb_attrs() fixed to avoid NULL ptr in msgs[] Action: opened PR body: """ This helps to avoid sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr() Resolves: https://github.com/SSSD/sssd/issues/5412 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5414/head:pr5414 git checkout pr5414

2 12

[sssd PR#5381][opened] pytest multihost tests for sssd
by sgoveas 13 Nov '20

13 Nov '20

URL: https://github.com/SSSD/sssd/pull/5381 Author: sgoveas Title: #5381: pytest multihost tests for sssd Action: opened PR body: """ PR includes all available pytest multihost tests written for sssd. configtest.py has been moved to basic as 'ad' and 'alltests' have their respective conftest.py files. PR CI change may be needed for the basic tests running in sssd-test-suite. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5381/head:pr5381 git checkout pr5381

3 19

[sssd PR#5361][opened] negcache: multiple fixes
by sumit-bose 12 Nov '20

12 Nov '20

URL: https://github.com/SSSD/sssd/pull/5361 Author: sumit-bose Title: #5361: negcache: multiple fixes Action: opened PR body: """ - make sure domain config does not leak into global - make sure short names are added to sub-domains - do not use default_domain_suffix Resolves: https://github.com/SSSD/sssd/issues/5238 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5361/head:pr5361 git checkout pr5361

3 22

How do I run unittests without a complete rebuild?
by Per-Erik Persson 12 Nov '20

12 Nov '20

I am writing tests to catch some not that common settings in third party smartcard CA:s. How can I run just a few tests and recompile just a single file? Rebuilding everything takes way too long for my patience. I just want to extract the public key, convert it to a ssh-key and watch the test fail.

2 1

[sssd PR#5352][opened] AD: do not override LDAP data during GC lookups
by sumit-bose 05 Nov '20

05 Nov '20

URL: https://github.com/SSSD/sssd/pull/5352 Author: sumit-bose Title: #5352: AD: do not override LDAP data during GC lookups Action: opened PR body: """ The Global Catalog contains user and group information of the whole forest and hence any Global Catalog server can be used. Currently when a Global Catalog server is looked up the data of the LDAP server is overwritten as well. I guess the original intention was to use a single server for both services. However since the Global Catalog server can come from any domain in the forest this might overwrite the LDAP data of a DC from the local domain with the data from a AD of a remote domain and as a result lookups for users and groups from the local domain might fail since the remote DC does not has this information available at the LDAP port. In most cases this overwrite is hidden by a following lookup to find a KDC for authentication which is searched only in the local domain again where the LDAP data is overwritten again to make sure the same DC is used for LDAP and Kerberos communication. But depending on the connection timeouts and lifetime of Kerberos tickets the KDC lookup might be skipped because new credentials are not needed and as a result the wrong LDAP data is used. To avoid this the LDAP data is now only set if the current lookup is not a Global Catalog lookup. Resolves: https://github.com/SSSD/sssd/issues/5351 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5352/head:pr5352 git checkout pr5352

2 10

[sssd PR#5373][opened] DEBUG: fixes program identifier as seen in syslog
by alexey-tikhonov 05 Nov '20

05 Nov '20

URL: https://github.com/SSSD/sssd/pull/5373 Author: alexey-tikhonov Title: #5373: DEBUG: fixes program identifier as seen in syslog Action: opened PR body: """ Commit 225fe9950f2807d5fb226f6b3be1ff4cefd731f0 changed `debug_prg_name` to accomodate needs of own SSSD logs, but this affected journal/syslog as well. This patch amends situation: - journal messages gets "umbrella" identifier "sssd[]" - syslog uses default which is program name Issue was reported at https://bugzilla.redhat.com/show_bug.cgi?id=1888409 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5373/head:pr5373 git checkout pr5373

3 15

[sssd PR#5383][opened] ifp: fix use-after-free
by sumit-bose 05 Nov '20

05 Nov '20

URL: https://github.com/SSSD/sssd/pull/5383 Author: sumit-bose Title: #5383: ifp: fix use-after-free Action: opened PR body: """ The variable fqdn is pointing to some data from state->res->msgs[0]. But before fqdn is used in the next search state->res and the memory hierarchy below is freed. As a result the location where fqdn is pointing to might hold the expected data or other data and the search will fail intermittently. Resolves: https://github.com/SSSD/sssd/issues/5382 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5383/head:pr5383 git checkout pr5383

2 9

[sssd PR#5378][opened] sbus: change socket file name to sbus-dp_DOMAIN
by ikerexxe 04 Nov '20

04 Nov '20

URL: https://github.com/SSSD/sssd/pull/5378 Author: ikerexxe Title: #5378: sbus: change socket file name to sbus-dp_DOMAIN Action: opened PR body: """ Socket file name changes from sbus-dp_DOMAIN_PID to sbus-dp_DOMAIN to avoid leaving orphaned socket files when sssd crashes. As there is only one socket opened per domain it makes no sense to include PID number in the file name. Besides, remove socket's symlink creation. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1875981 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5378/head:pr5378 git checkout pr5378

3 16

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel November 2020