[sssd PR#175][opened] Add module for starting services
by lslebodn
URL: https://github.com/SSSD/sssd/pull/175
Author: lslebodn
Title: #175: Add module for starting services
Action: opened
PR body:
"""
This is a WIP version of reducing code duplication in our cwrap integration tests.
I am still not sure whether we should also reuse function `create_sssd_fixture`.
And if yes; then probably in different nodule then `services`
And comments are welcome.
BTW I wrote patches few weeks ago; therefore new tests are not converted.
I am just sending patches to get some feedback.
Site effect of this patches is that tests are cca 20% faster (IIRC)
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/175/head:pr175
git checkout pr175
1 year, 10 months
[sssd PR#616][opened] become_user: add supplementary groups so ad provider can access keytab
by asheplyakov
URL: https://github.com/SSSD/sssd/pull/616
Author: asheplyakov
Title: #616: become_user: add supplementary groups so ad provider can access keytab
Action: opened
PR body:
"""
For security reasons one might want to run providers as a non-privileged
user (say, _sssd). However some providers (in particular ad) might need
an access to restricted (non world-readable) files (for instance,
/etc/krb5.keytab). One of the possible ways to solve the problem is to
- add a special group (for instance, _keytab)
- set the owner:group of the file in question to root:_keytab
- set the permissions of the file in question to 640
- make the _sssd user a member of the _keytab group
For this to work become_user should assign supplementary groups, which
is what this patch does.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/616/head:pr616
git checkout pr616
2 years, 8 months
[sssd PR#269][opened] Add support for ActiveDirectory's logonHours restrictions
by NWilson
URL: https://github.com/SSSD/sssd/pull/269
Author: NWilson
Title: #269: Add support for ActiveDirectory's logonHours restrictions
Action: opened
PR body:
"""
This is a straightforward patch for denying access to a user when the user is not permitted to access their account due to logonHours restrictions.
This matches the default behaviour for domain-joined Windows machines. When outside the logonHours, all types of authentication are denied (password/Kerberos/certificate) - so it is appropriate to put this check inside the PAM "account" rules.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/269/head:pr269
git checkout pr269
3 years
[sssd PR#5171][opened] files: allow root membership
by pbrezina
URL: https://github.com/SSSD/sssd/pull/5171
Author: pbrezina
Title: #5171: files: allow root membership
Action: opened
PR body:
"""
SSSD design decision was to "never handle root" and we use uid=0 and gid=0 to indicate
various error states. root user and group is unconditionally added in negative cache.
This makes perfect sense for LDAP but introduced regressions in files provider
when compared to nss_files:
1) When a user is part of root group - the membership is not returned
2) When a user has root as primary group - the user is not returned and every other membership is broken.
The "never handle root" policy is basically kept, with few exceptions for files provider:
- it will not filter out root as group member if it is also files provider - solves 1)
- it will store user with gid=0 unless it also has uid=0 thus solving 2)
Direct request for root user or group will still not be handled.
Resolves:
https://github.com/SSSD/sssd/issues/5170
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5171/head:pr5171
git checkout pr5171
3 years, 3 months