Dear friends,
Using sssd, for a long time, I have come across with a problem recently, which I would like to solve with your help.
I provide centralized authentication and authorization service for a huge heterogeneous network. And in my case it would be "nice and easy" if sssd used only shells(5). I believe this mechanism is sufficient for identification of an allowed shell.
I take a liberty to offer you this tiny patch, which will let use wildcard (*) in param allowed_shells in sssd.conf
What do you think about it?
On 01/30/2014 05:35 AM, Denis Kutin wrote:
Dear friends,
Using sssd, for a long time, I have come across with a problem recently, which I would like to solve with your help.
I provide centralized authentication and authorization service for a huge heterogeneous network. And in my case it would be "nice and easy" if sssd used only shells(5). I believe this mechanism is sufficient for identification of an allowed shell.
I take a liberty to offer you this tiny patch, which will let use wildcard (*) in param allowed_shells in sssd.conf
What do you think about it?
-- Denis Kutin
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Thanks for the patch. But let us start from the beginning. I see the problem that you want to solve so please file ticket so that we can track it for future.
I am not an expert in the code but: 1) The check is inside the loop, it probably should be outside the loop (not sure) 2) Debug message should be different because we want to differentiate from allowed but does not exist. 3) We are saying that we are using user shall but actually returning shall_fallback, is that right?
On Thu, Jan 30, 2014 at 02:35:57PM +0400, Denis Kutin wrote:
Dear friends,
Using sssd, for a long time, I have come across with a problem recently, which I would like to solve with your help.
I provide centralized authentication and authorization service for a huge heterogeneous network. And in my case it would be "nice and easy" if sssd used only shells(5). I believe this mechanism is sufficient for identification of an allowed shell.
I take a liberty to offer you this tiny patch, which will let use wildcard (*) in param allowed_shells in sssd.conf
What do you think about it?
Hi,
the patch itself looks OK except for lines being over 80 characters, but I don't think I understand the use case well. If a user has a shell specified that is outside /etc/shells he's kicked out anyway. If he does, he's permitted by default..
On 01/30/2014 11:35 AM, Denis Kutin wrote:
Dear friends,
Using sssd, for a long time, I have come across with a problem recently, which I would like to solve with your help.
I provide centralized authentication and authorization service for a huge heterogeneous network. And in my case it would be "nice and easy" if sssd used only shells(5). I believe this mechanism is sufficient for identification of an allowed shell.
I take a liberty to offer you this tiny patch, which will let use wildcard (*) in param allowed_shells in sssd.conf
What do you think about it?
-- Denis Kutin
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Hello Denis,
You patch seems to generally solve the problem. But there are some minor nitpicks with it: * it needs rebasing (update debug message format) * move check out of loop * do not make lines longer then 80 chars * probably document your use case would be helpful
Are you willing to do the changes? If you are too busy I can do the changes myself. You would still keep the authorship of the patch. I would be just named in Signed-off-by tag. Would that work for you?
Thanks again for the patch!
On 10/06/2014 11:20 AM, Pavel Reichl wrote:
On 01/30/2014 11:35 AM, Denis Kutin wrote:
Dear friends,
Using sssd, for a long time, I have come across with a problem recently, which I would like to solve with your help.
I provide centralized authentication and authorization service for a huge heterogeneous network. And in my case it would be "nice and easy" if sssd used only shells(5). I believe this mechanism is sufficient for identification of an allowed shell.
I take a liberty to offer you this tiny patch, which will let use wildcard (*) in param allowed_shells in sssd.conf
What do you think about it?
-- Denis Kutin
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Hello Denis,
You patch seems to generally solve the problem. But there are some minor nitpicks with it:
- it needs rebasing (update debug message format)
- move check out of loop
- do not make lines longer then 80 chars
- probably document your use case would be helpful
Are you willing to do the changes? If you are too busy I can do the changes myself. You would still keep the authorship of the patch. I would be just named in Signed-off-by tag. Would that work for you?
Thanks again for the patch!
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Hello,
I took the liberty and prepared the patch.
Thanks.
On Fri, Oct 10, 2014 at 02:09:03PM +0200, Pavel Reichl wrote:
On 10/06/2014 11:20 AM, Pavel Reichl wrote:
On 01/30/2014 11:35 AM, Denis Kutin wrote:
Dear friends,
Using sssd, for a long time, I have come across with a problem recently, which I would like to solve with your help.
I provide centralized authentication and authorization service for a huge heterogeneous network. And in my case it would be "nice and easy" if sssd used only shells(5). I believe this mechanism is sufficient for identification of an allowed shell.
I take a liberty to offer you this tiny patch, which will let use wildcard (*) in param allowed_shells in sssd.conf
What do you think about it?
-- Denis Kutin
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Hello Denis,
You patch seems to generally solve the problem. But there are some minor nitpicks with it:
- it needs rebasing (update debug message format)
- move check out of loop
- do not make lines longer then 80 chars
- probably document your use case would be helpful
Are you willing to do the changes? If you are too busy I can do the changes myself. You would still keep the authorship of the patch. I would be just named in Signed-off-by tag. Would that work for you?
Thanks again for the patch!
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Hello,
I took the liberty and prepared the patch.
Thanks.
Looks good to me, just specified a wrong ticket in the commit message. I can fix that before pushing.
Otherwise ACK.
On Wed, Oct 22, 2014 at 04:15:23PM +0200, Jakub Hrozek wrote:
On Fri, Oct 10, 2014 at 02:09:03PM +0200, Pavel Reichl wrote:
On 10/06/2014 11:20 AM, Pavel Reichl wrote:
On 01/30/2014 11:35 AM, Denis Kutin wrote:
Dear friends,
Using sssd, for a long time, I have come across with a problem recently, which I would like to solve with your help.
I provide centralized authentication and authorization service for a huge heterogeneous network. And in my case it would be "nice and easy" if sssd used only shells(5). I believe this mechanism is sufficient for identification of an allowed shell.
I take a liberty to offer you this tiny patch, which will let use wildcard (*) in param allowed_shells in sssd.conf
What do you think about it?
-- Denis Kutin
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Hello Denis,
You patch seems to generally solve the problem. But there are some minor nitpicks with it:
- it needs rebasing (update debug message format)
- move check out of loop
- do not make lines longer then 80 chars
- probably document your use case would be helpful
Are you willing to do the changes? If you are too busy I can do the changes myself. You would still keep the authorship of the patch. I would be just named in Signed-off-by tag. Would that work for you?
Thanks again for the patch!
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Hello,
I took the liberty and prepared the patch.
Thanks.
Looks good to me, just specified a wrong ticket in the commit message. I can fix that before pushing.
Otherwise ACK.
* master: e88d426def412c0dde83e15fe17cdf374ee70166
sssd-devel@lists.fedorahosted.org
-
Denis Kutin -
Dmitri Pal -
Jakub Hrozek -
Pavel Reichl