[sssd PR#5663][opened] cache_req: replace FQNs by shortnames
by ikerexxe
URL: https://github.com/SSSD/sssd/pull/5663
Author: ikerexxe
Title: #5663: cache_req: replace FQNs by shortnames
Action: opened
PR body:
"""
Replace FQNs by shortnames in cache_req_XYZ_by_name_send() when the FQN
already contains the domain name. This is done to avoid appending again
the domain name to the FQN.
Includes a unit test to check that the FQN to shortname replacement
works correctly.
It also includes an integration test to check that UpdateMemberList()
and GetAll() return the correct users that are members of a group. This
is done by first adding a member to a group and checking that it is
returned correctly. Then, the member is deleted and the interface returns
no members.
Resolves: https://github.com/SSSD/sssd/issues/4255
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5663/head:pr5663
git checkout pr5663
2 years, 9 months
[sssd PR#5419][opened] Adding tests to cover ad discovery improvements using cldap
by sidecontrol
URL: https://github.com/SSSD/sssd/pull/5419
Author: sidecontrol
Title: #5419: Adding tests to cover ad discovery improvements using cldap
Action: opened
PR body:
"""
* This test requires a primary and secondary domain controller so AD can be moved between sites
* Currently contains four test cases
** Two DCs in one site no restrictions.
** Two DCs in one site, traffic blocked to the other DC
** DCs in seperate sites no restrictions
** DCs in seperate sites, traffic blocked to the other DC
Signed-off-by: Dan Lavu <dlavu(a)redhat.com>
SSSD-2497
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5419/head:pr5419
git checkout pr5419
2 years, 10 months
[sssd PR#5647][opened] krb5_child: Honor Kerberos keytab location
by elkoniu
URL: https://github.com/SSSD/sssd/pull/5647
Author: elkoniu
Title: #5647: krb5_child: Honor Kerberos keytab location
Action: opened
PR body:
"""
Kerberos keytab location can be specified per domain in sssd.conf.
If it is not specified - default path is used: /etc/krb5.keytab
The problem is that default path itself can be redefined for kerberos
by adding entry in krb5.conf:
[libdefaults]
default_keytab_name = /<PATH>/krb5.keytab
krb5_child will still use /etc/krb5.keytab as default value which
will cause an error.
This patch adds config checking to krb5_child.
If keytab parameter will be set to /etc/krb5.keytab,
krb5_child will validate it against krb5.conf and eventually
overwritte with value presented there.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5647/head:pr5647
git checkout pr5647
2 years, 10 months
[sssd PR#5661][opened] pam: change default for pam_response_filter
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/5661
Author: sumit-bose
Title: #5661: pam: change default for pam_response_filter
Action: opened
PR body:
"""
So far pam_response_filter didn't had any default. It turned out that it
would be useful to filter the environment variable KRB5CCANME by default
for sudo. The reason is the e.g. in contrast to su the calling user is
authenticated and hence only the Kerberos credentials of the calling user
are available. But this causes a couple of inconsistencies. E.g. depending
on the credential cache type the target user might not have access to the
credential cache and even if the credential cache can be accessed it will
contain credentials which different privileges than the target user. As a
result it seems better to not make KRB5CCANME in the environment of the
target user and let him pick the matching default credential cache.
Resolves: https://github.com/SSSD/sssd/issues/5660
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5661/head:pr5661
git checkout pr5661
2 years, 10 months