[sssd PR#5422][opened] Logs review
by alexey-tikhonov
URL: https://github.com/SSSD/sssd/pull/5422
Author: alexey-tikhonov
Title: #5422: Logs review
Action: opened
PR body:
"""
This is a set of patches intended to enable higher log level by default.
Currently I target SSSDBG_OP_FAILURE (level 2) as a default (It seems SSSDBG_MINOR_FAILURE level contains legitimate messages that admin can deliberately ignore, and those messages can get quite spammy)
Perhaps several patches are yet missing (I'm awaiting @sumit-bose response) but those already published are ready for review.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5422/head:pr5422
git checkout pr5422
3 years, 4 months
[sssd PR#5423][opened] Offline timeout man update
by elkoniu
URL: https://github.com/SSSD/sssd/pull/5423
Author: elkoniu
Title: #5423: Offline timeout man update
Action: opened
PR body:
"""
In some circumstances offline_timeout and offline_timeout_max values may lead to a scenario in which user thinks that
the whole offline interval incrementing mechanics is not working according to logs.
This is false positive error as in this kind of situation offline checking interval just instantly saturates.
This PR adds explanation to this kind of behavior to manual page of SSSD conf.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5423/head:pr5423
git checkout pr5423
3 years, 4 months
[sssd PR#5401][opened] authtok: add label to Smartcard token
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/5401
Author: sumit-bose
Title: #5401: authtok: add label to Smartcard token
Action: opened
PR body:
"""
The key-id might not be sufficient to identify a certificate on a Smartcard
since it is possible that multiple certificates will use the same key.
This patch adds the certificate label to the Smartcard authtok item to
about the ambiguity if the key-id is used for multiple certificates.
Currently the key-id read from the Smartcard is used as key value for the
gdm choice list dialog. Since it might be possible that multiple
certificates use the same key and hence the same key-id this is not a
suitable value.
With this patch the string representation of a numerial counter is used.
Resolves: https://github.com/SSSD/sssd/issues/5400
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5401/head:pr5401
git checkout pr5401
3 years, 4 months
[sssd PR#5367][opened] pam: add pam_sss_gss module for gssapi authentication
by pbrezina
URL: https://github.com/SSSD/sssd/pull/5367
Author: pbrezina
Title: #5367: pam: add pam_sss_gss module for gssapi authentication
Action: opened
PR body:
"""
The module configuration and usage should be clear
from its manual page. Suggestions are welcome.
The main use case is to enable password-less authentication
for sudo where smartcards are not possible (because the
reader is not available in the target host).
It is not possible to set the service name or keytab at this
moment so the module relies on `host/hostname@REALM` where hostname
is provided by SSSD (based on the user's domain) and REALM
is determined by GSSAPI. This principal is already stored in
krb5_keytab location for IPA and AD providers so the functionality
is for free.
Because authorization is done by pam_sss and it is not needed
for the use case, I would implement configurable ticket names
and keytab location only when required by users.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5367/head:pr5367
git checkout pr5367
3 years, 4 months
[sssd PR#5432][opened] kcm: decode base64 encoded secret on upgrade path
by pbrezina
URL: https://github.com/SSSD/sssd/pull/5432
Author: pbrezina
Title: #5432: kcm: decode base64 encoded secret on upgrade path
Action: opened
PR body:
"""
Previous unefficient code encoded the secret multiple times:
secret -> base64 -> masterkey -> base64
To allow smooth upgrade for already existant ccache we need to also decode
the secret if it is still in the old format (type == simple). Otherwise
users are not able to log in.
Resolves: https://github.com/SSSD/sssd/issues/5349
To test, build SSSD without recent KCM performance patches. Run SSSD,
login as a Kerberized user to create ccache and log out.
Then apply the patches, and rebuild. Make sure to restart sssd-kcm.
Try to log in - it should fail.
Apply this patch - the login should succeed.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5432/head:pr5432
git checkout pr5432
3 years, 4 months