sssd-devel August 2022

sssd-devel@lists.fedorahosted.org

5 participants
4 discussions

Announcing SSSD 2.7.4
by Pavel Březina 26 Aug '22

26 Aug '22

# SSSD 2.7.4 The SSSD team is announcing the release of version 2.7.4 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.7.4 See the full release notes at: https://sssd.io/release-notes/sssd-2.7.4.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### General information * Lock-free client support will be only built if libc provides `pthread_key_create()` and `pthread_once()`. For glibc this means version 2.34+

1 0

Optimize memberOf lookups openldap
by Erik de Waard 22 Aug '22

22 Aug '22

When openldap is configured to make use of the dynlist module it can update the member and memberOf population recursively for nested groups by just quering with a searchfilter memberOf for it. This should eliminates the need for nested group searches because it returns all memberships Similar: issue: 2409 Can we have a setting to enable this like LDAP_MATCHING_RULE_IN_CHAIN for AD

2 1

Why does systemd implement its own wire protocol?
by Dominik George 02 Aug '22

02 Aug '22

Hi, during my evaluations and researches around implementing user and device management using OAuth and OIDC, I also caught up on the details of: * sssd's architecture [1] * Freedesktop's AccountsService [2] * the idea making sssd implement AccountsService [3] Currently, I am evaluating whether I should add an OIDC module to sssd, or write my own authentication daemon handling it (mimicing sssd to some extent). I will probably get back to the pros and cons around this later in a separate thread. One question though that I did not find an answer to, which is somewhat important for both approaches, is: Why does sssd implement its own wire protocol between client libraries and responders, instead of using the D-Bus system bus? Actually, designing a draft for my own authentication daemon, I decided to go with my own wire protocol (based on protobuf) as well, and then thought that if I was going to implement a realmd provider later on, I'd have to talk D-Bus anyway, so I could just as well use it everywhere. Since sssd decided to not do that, I assume there is a reason, so: If I were designing a system like sssd, why should I not use D-Bus to communicate between my PAM module and my backend daemon? Disclaimer: I am not seeking to replace sssd; right now, all of this is of purely academic nature, to understand the whole picture. Cheers, Nik [1] https://sssd.io/docs/architecture.html [2] https://www.freedesktop.org/wiki/Software/AccountsService/ [3] https://docs.pagure.org/sssd.sssd/design_pages/accounts_service.html

2 1

Documentation on how to write backends?
by Dominik George 01 Aug '22

01 Aug '22

Hi, I am currently working on integrating Linux desktops directly with web-based login services, using OAuth/OpenID Connect. For now, I have written my own NSS and PAM modules, but it would be better to decouple the time-consuming work of querying the data source. I was wondering whether third-party backends can be written for sssd? I cannot find documentation on that. Cheers and thank you, Nik

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2022