sssd-devel March 2020

sssd-devel@lists.fedorahosted.org

5 participants
59 discussions

[sssd PR#175][opened] Add module for starting services
by lslebodn 22 Nov '21

22 Nov '21

URL: https://github.com/SSSD/sssd/pull/175 Author: lslebodn Title: #175: Add module for starting services Action: opened PR body: """ This is a WIP version of reducing code duplication in our cwrap integration tests. I am still not sure whether we should also reuse function `create_sssd_fixture`. And if yes; then probably in different nodule then `services` And comments are welcome. BTW I wrote patches few weeks ago; therefore new tests are not converted. I am just sending patches to get some feedback. Site effect of this patches is that tests are cca 20% faster (IIRC) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/175/head:pr175 git checkout pr175

5 5

[sssd PR#844][opened] sssd-ad and gpo_child: GPO apply fixes during reading fails
by mastersin 03 Aug '21

03 Aug '21

URL: https://github.com/SSSD/sssd/pull/844 Author: mastersin Title: #844: sssd-ad and gpo_child: GPO apply fixes during reading fails Action: opened PR body: """ Ignore AD GPO errors: - if SecEdit/GptTmpl.inf is missing or - if reading sysvol_gpt_version fails and cached_gpt_version already exists """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/844/head:pr844 git checkout pr844

7 16

[sssd PR#616][opened] become_user: add supplementary groups so ad provider can access keytab
by asheplyakov 28 Jan '21

28 Jan '21

URL: https://github.com/SSSD/sssd/pull/616 Author: asheplyakov Title: #616: become_user: add supplementary groups so ad provider can access keytab Action: opened PR body: """ For security reasons one might want to run providers as a non-privileged user (say, _sssd). However some providers (in particular ad) might need an access to restricted (non world-readable) files (for instance, /etc/krb5.keytab). One of the possible ways to solve the problem is to - add a special group (for instance, _keytab) - set the owner:group of the file in question to root:_keytab - set the permissions of the file in question to 640 - make the _sssd user a member of the _keytab group For this to work become_user should assign supplementary groups, which is what this patch does. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/616/head:pr616 git checkout pr616

5 13

[sssd PR#943][opened] files_ops: Fix cached password remove
by elkoniu 01 Oct '20

01 Oct '20

URL: https://github.com/SSSD/sssd/pull/943 Author: elkoniu Title: #943: files_ops: Fix cached password remove Action: opened PR body: """ When SSSD daemon will detect refresh of password (group) file it will delete all cached users (groups) data. With this change cached data will be deleted only for non existing users (groups). Resolves: https://pagure.io/SSSD/sssd/issue/3591 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/943/head:pr943 git checkout pr943

3 16

[sssd PR#269][opened] Add support for ActiveDirectory's logonHours restrictions
by NWilson 03 Sep '20

03 Sep '20

URL: https://github.com/SSSD/sssd/pull/269 Author: NWilson Title: #269: Add support for ActiveDirectory's logonHours restrictions Action: opened PR body: """ This is a straightforward patch for denying access to a user when the user is not permitted to access their account due to logonHours restrictions. This matches the default behaviour for domain-joined Windows machines. When outside the logonHours, all types of authentication are denied (password/Kerberos/certificate) - so it is appropriate to put this check inside the PAM "account" rules. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/269/head:pr269 git checkout pr269

9 30

[sssd PR#837][opened] p11_child: make OCSP digest configurable
by sumit-bose 18 Aug '20

18 Aug '20

URL: https://github.com/SSSD/sssd/pull/837 Author: sumit-bose Title: #837: p11_child: make OCSP digest configurable Action: opened PR body: """ Currently sha1 is used to create the certid for an OCSP request. Since sha1 is not recommend for new applications anymore and not FIPS compliant this patch changes the default to sha256 and makes the digest function configurable as well. Related to https://pagure.io/SSSD/sssd/issue/4032 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/837/head:pr837 git checkout pr837

6 36

[sssd PR#578][opened] proxy: proxy_child hardening
by amitkumar50 10 Aug '20

10 Aug '20

URL: https://github.com/SSSD/sssd/pull/578 Author: amitkumar50 Title: #578: proxy: proxy_child hardening Action: opened PR body: """ proxy_child will call chdir("/"), umask(022) and reset the environment with clearenv(). The --domain argument to be sanitized. Resolves: https://pagure.io/SSSD/sssd/issue/2689 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/578/head:pr578 git checkout pr578

5 14

[sssd PR#1011][opened] sysdb: check if the id override belongs to requested domain
by pbrezina 22 Apr '20

22 Apr '20

URL: https://github.com/SSSD/sssd/pull/1011 Author: pbrezina Title: #1011: sysdb: check if the id override belongs to requested domain Action: opened PR body: """ Steps to reproduce: 1. Setup an id override (administrator(a)ad.vm: uid -> 10001) 2. Request user by name to fill cache ``` $ id Administrator(a)ad.vm uid=10001(administrator(a)ad.vm) ... ``` 3. Request user by id and see that domain part is missing ``` $ id 10001 uid=10001(administrator) ... ``` First, the uid is looked up in IPA domain and the override object is found when we hit `sysdb_search_override_by_id` because id values are not qualified. Therefore the origin object (administrator(a)ad.vm) is returned as part of IPA domain. We need to check if the original object belongs to the requested domain. Resolves: https://pagure.io/SSSD/sssd/issue/4173 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1011/head:pr1011 git checkout pr1011

2 5

[sssd PR#1005][opened] pam: Use cache for users with existing session
by sumit-bose 21 Apr '20

21 Apr '20

URL: https://github.com/SSSD/sssd/pull/1005 Author: sumit-bose Title: #1005: pam: Use cache for users with existing session Action: opened PR body: """ Users that have an existing session do the bulk of their authentication to unlock services that do not make use of initgroups (used only to create a new login session). Forcing online initgroups calls for these users leads mostly to delays in providing those services and do not provide any useful data. Resolves: https://pagure.io/SSSD/sssd/issue/4098 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1005/head:pr1005 git checkout pr1005

2 3

[sssd PR#1010][opened] man: in sssd-ipa clarified trusted domains section
by ikerexxe 21 Apr '20

21 Apr '20

URL: https://github.com/SSSD/sssd/pull/1010 Author: ikerexxe Title: #1010: man: in sssd-ipa clarified trusted domains section Action: opened PR body: """ In sssd-ipa man page added a second option when configuring trusted domains Resolves: https://pagure.io/SSSD/sssd/issue/4041 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/1010/head:pr1010 git checkout pr1010

4 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2020