[sssd PR#175][opened] Add module for starting services
by lslebodn
URL: https://github.com/SSSD/sssd/pull/175
Author: lslebodn
Title: #175: Add module for starting services
Action: opened
PR body:
"""
This is a WIP version of reducing code duplication in our cwrap integration tests.
I am still not sure whether we should also reuse function `create_sssd_fixture`.
And if yes; then probably in different nodule then `services`
And comments are welcome.
BTW I wrote patches few weeks ago; therefore new tests are not converted.
I am just sending patches to get some feedback.
Site effect of this patches is that tests are cca 20% faster (IIRC)
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/175/head:pr175
git checkout pr175
2 years, 4 months
[sssd PR#5847][opened] pam_sss: Allow offline authentication against non-ipa-desktopprofiles aware DC
by stanislavlevin
URL: https://github.com/SSSD/sssd/pull/5847
Author: stanislavlevin
Title: #5847: pam_sss: Allow offline authentication against non-ipa-desktopprofiles aware DC
Action: opened
PR body:
"""
IPA domain controller may not support desktop profiles since this
functionality is optional and distributed as the IPA plugin:
- in case of online authentication ipa_session detects such DC properly
and returns PAM_SUCCESS for ENOENT, nothing is cached on sysdb (see
ipa_deskprofile_get_config_send/ipa_deskprofile_get_config_done and
ipa_pam_session_handler_done for details).
- in case of offline authentication ipa_session falls back to cache and
receives ENOENT (since nothing was cached previously). But *any* error
is treated as actual error and overall result is PAM_SESSION_ERR (see
ipa_pam_session_handler_save_deskprofile_rules and
ipa_pam_session_handler_done for details). Note: actually, only
deskprofile_get_cached_priority breaks PAM session since
ipa_common_get_cached_rules successfully handles ENOENT.
- in either case sssd tries to send dbus notification to fleet
commander even if there are no desktop profile rules to apply.
With this change ENOENT result of cache query is treated similarly
to ENOENT result of actual backend query (PAM_SUCCESS).
Resolves: https://github.com/SSSD/sssd/issues/5846
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5847/head:pr5847
git checkout pr5847
2 years, 4 months
[sssd PR#5829][opened] DP: Resolve intermediate groups prior to SR overlay
by justin-stephenson
URL: https://github.com/SSSD/sssd/pull/5829
Author: justin-stephenson
Title: #5829: DP: Resolve intermediate groups prior to SR overlay
Action: opened
PR body:
"""
SSSD SR exclude_groups checking can fail when only intermediate
groups are fetched during the login process. Add a step to
resolve these groups during Initgroups processing to ensure
the exclude groups check matches against the group name correctly.
This logic exists already similarly in the simple access provider.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5829/head:pr5829
git checkout pr5829
2 years, 4 months
[sssd PR#5855][opened] CKM_RSA_PKCS support.
by alexey-tikhonov
URL: https://github.com/SSSD/sssd/pull/5855
Author: alexey-tikhonov
Title: #5855: CKM_RSA_PKCS support.
Action: opened
PR body:
"""
First patch is mostly cosmetic and I don't insist on its inclusion. But IMO it makes code a little bit more readable (matter of taste though) and handling of error conditions more accurate.
The "laziest" way to test 2nd patch is to reorder `prefs` in `get_preferred_rsa_mechanism()` putting `CKM_RSA_PKCS` first.
In this case existing `pam-srv-tests` will use this mechanism:
```
(2021-10-30 20:48:44:135177): [p11_child[3211403]] [get_preferred_rsa_mechanism] (0x0200): Using PKCS#11 mechanism [1][CKM_RSA_PKCS] with message digest [-none-].
(2021-10-30 20:48:44:135183): [p11_child[3211403]] [sign_data] (0x4000): Found RSA key using mechanism [1].
(2021-10-30 20:48:44:136646): [p11_child[3211403]] [do_card] (0x4000): Certificate verified and validated.
```
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5855/head:pr5855
git checkout pr5855
2 years, 4 months