[sssd PR#175][opened] Add module for starting services
by lslebodn
URL: https://github.com/SSSD/sssd/pull/175
Author: lslebodn
Title: #175: Add module for starting services
Action: opened
PR body:
"""
This is a WIP version of reducing code duplication in our cwrap integration tests.
I am still not sure whether we should also reuse function `create_sssd_fixture`.
And if yes; then probably in different nodule then `services`
And comments are welcome.
BTW I wrote patches few weeks ago; therefore new tests are not converted.
I am just sending patches to get some feedback.
Site effect of this patches is that tests are cca 20% faster (IIRC)
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/175/head:pr175
git checkout pr175
1 year, 6 months
[sssd PR#616][opened] become_user: add supplementary groups so ad provider can access keytab
by asheplyakov
URL: https://github.com/SSSD/sssd/pull/616
Author: asheplyakov
Title: #616: become_user: add supplementary groups so ad provider can access keytab
Action: opened
PR body:
"""
For security reasons one might want to run providers as a non-privileged
user (say, _sssd). However some providers (in particular ad) might need
an access to restricted (non world-readable) files (for instance,
/etc/krb5.keytab). One of the possible ways to solve the problem is to
- add a special group (for instance, _keytab)
- set the owner:group of the file in question to root:_keytab
- set the permissions of the file in question to 640
- make the _sssd user a member of the _keytab group
For this to work become_user should assign supplementary groups, which
is what this patch does.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/616/head:pr616
git checkout pr616
2 years, 4 months
[sssd PR#269][opened] Add support for ActiveDirectory's logonHours restrictions
by NWilson
URL: https://github.com/SSSD/sssd/pull/269
Author: NWilson
Title: #269: Add support for ActiveDirectory's logonHours restrictions
Action: opened
PR body:
"""
This is a straightforward patch for denying access to a user when the user is not permitted to access their account due to logonHours restrictions.
This matches the default behaviour for domain-joined Windows machines. When outside the logonHours, all types of authentication are denied (password/Kerberos/certificate) - so it is appropriate to put this check inside the PAM "account" rules.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/269/head:pr269
git checkout pr269
2 years, 9 months
Heads up. We are migrating issues to Github on May 2-3.
by Pavel Březina
This is a continuation of SSSD migration from Pagure to Github.
We reconsidered our previous decision to keep existing issues in Pagure
and we chose to clone all issues to github instead. As much as we would
like to keep in touch with users on Pagure we are not able to close
remaining tickets in reasonable amount of time and having increased
number of issue trackers would drive us crazy instead of becoming more
efficient.
All existing issues (both open and closed) will be cloned to github this
weekend (May 2-3). Please, disable notifications from our github
repository [1] for this weekend by clicking on "unwatch" button
otherwise you will get several thousand of notifications.
You might have already got some notification from migration test (from
pbrezina/sssd-test repository) if you have the same username in Pagure
and Github and you were @mentioned in the ticket. Please, ignore those.
Issues on Pagure will be marked read only after this weekend and we will
only accept new issues on Github.
Thank you for understanding and I apologize for any inconvenience.
[1] https://github.com/SSSD/sssd
3 years, 1 month
[sssd PR#1011][opened] sysdb: check if the id override belongs to requested domain
by pbrezina
URL: https://github.com/SSSD/sssd/pull/1011
Author: pbrezina
Title: #1011: sysdb: check if the id override belongs to requested domain
Action: opened
PR body:
"""
Steps to reproduce:
1. Setup an id override (administrator(a)ad.vm: uid -> 10001)
2. Request user by name to fill cache
```
$ id Administrator(a)ad.vm
uid=10001(administrator(a)ad.vm) ...
```
3. Request user by id and see that domain part is missing
```
$ id 10001
uid=10001(administrator) ...
```
First, the uid is looked up in IPA domain and the override object is
found when we hit `sysdb_search_override_by_id` because id values are
not qualified. Therefore the origin object (administrator(a)ad.vm) is
returned as part of IPA domain.
We need to check if the original object belongs to the requested domain.
Resolves:
https://pagure.io/SSSD/sssd/issue/4173
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1011/head:pr1011
git checkout pr1011
3 years, 1 month