On 12/12/2014 01:43 PM, Jakub Hrozek wrote:
On Thu, Dec 11, 2014 at 07:43:14PM +0100, Pavel Reichl wrote:
On 12/11/2014 11:41 AM, Jakub Hrozek wrote:
From 077971dc3d8cefc8df123ed1e1018f06d7679545 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek<jhrozek@redhat.com>
Date: Thu, 11 Dec 2014 11:19:58 +0100
Subject: [PATCH 3/4] MAN: Misspelled username in pam_trusted_users is not
 fatal

The man page claimed that failing to resolve an user name results in
failure to start SSSD, but it's not the case and shouldn't be, because
marking a user as trusted only elevates privileges, so it's safe to
ignore that failure.
---
 src/man/sssd.conf.5.xml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index 3525d78caff28fd05cc18061d023fec3c50d1a47..2002ccc7caf7013ead5b97c463fba46b734090ae 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -907,11 +907,6 @@ fallback_homedir =/home/%u
                             the PAM responder even in case it is not in the
                             pam_trusted_users list.
                         </para>
-                        <para>
-                            Also please note that if there is a user name in
-                            pam_trusted_users list which fails to be resolved
-                            it will cause that SSSD will not be started.
-                        </para>
                     </listitem>
                 </varlistentry>
                 <varlistentry>
-- 1.9.3
Hello Jakub,
patches LGTM, I have just a little problem with 3rd patch - actually I think
that the man page describes what really happens - this is form my
sss_pam.log:

(Thu Dec 11 18:35:21 2014) [sssd[pam]] [sss_process_init] (0x0400):
Responder Initialization complete
(Thu Dec 11 18:35:21 2014) [sssd[pam]] [sss_user_by_name_or_uid] (0x0040):
[xxxxxxxxx] is neither a valid UID nor a user name which could be resolved
by getpwnam().
(Thu Dec 11 18:35:21 2014) [sssd[pam]] [csv_string_to_uid_array] (0x0040):
List item [xxxxxxxxx] is neither a valid UID nor a user name which could be
resolved by getpwnam().
(Thu Dec 11 18:35:21 2014) [sssd[pam]] [get_trusted_uids] (0x0010): Failed
to set allowed UIDs.
(Thu Dec 11 18:35:21 2014) [sssd[pam]] [pam_process_init] (0x0010):
get_trusted_uids failed: 22:[Invalid argument].
(Thu Dec 11 18:35:21 2014) [sssd[pam]] [sss_responder_ctx_destructor]
(0x0400): Responder is being shut down


Oops, I must test better next time. Attached patch just makes sure that
we document properly what is and what is not checked.


_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
ACK to all.
Thanks.