sssd-devel October 2010

sssd-devel@lists.fedorahosted.org

14 participants
65 discussions

[PATCHES] Support for netgroups in the NSS client and responder
by Stephen Gallagher 13 Oct '10

13 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 These patches were tested on the local domain (by manually editing the sssd.ldb). I also ran them through valgrind. Patch 0001: Add utility function sss_strnlen() This is useful for guaranteeing the size of an input buffer. I'm using this in the nss client portion of the netgroups support. Patch 0002: Store entry_cache_timeout in sss_domain_info object This is useful so that the NSS responder can identify an domain's entry timeout for expiring the memory cache for a lookup such as with netgroups. Patch 0003: Require explicit setting of callback context for check_cache Previously, it was implicitly using the nss_dom_ctx, but there are situations where we would want to send a different private context. Specifically, we need to be able to send a step_ctx for the netgroups support in patch 0010. Patch 0004-0005: Sysdb interfaces for netgroups (and associated tests) These are identical to the last set I sent in the "Sysdb interface for netgroups" thread. I am retiring that thread to use this one for the review. Patch 0006: Rename group.c and passwd.c for clarity Prefixing group.c and passwd.c with "nss_" similar to the way the PAM client sources are prefixed with "pam_". This patch isn't strictly necessary, but I wanted it to be more clear which files were associated with NSS vs. PAM vs. common in the sss_client directory. Patch 0007 will create nss_netgroup.c as well. Patch 0007: Add support for netgroups to NSS sss_client There's one peculiarity about this patch that I have to note. I need to send back a true/false value to the setnetgrent call in order to properly report that there were no entries. This differs from the other set*ent functions because we are processing a specific requested entry rather than enumerating all entries. Without doing this, we actually return a netgroup containing no member triples, which is certainly not what the client app expects. Patch 0008: Add negative cache features for netgroups This patch just updates the negative cache interface to allow including netgroups in the negative cache like other entries. Patch 0009: Split out some helper functions for the NSS responder Create a new private header and make some functions available for other object files. The nsssrv_cmd.c file is getting far too large to be manageable. Patch 0010 will create a separate file (nsssrv_netgroup.c) to hold all of the netgroup-related code, but we need access to this set of functions in both places. Patch 0010: Add netgroup support to the NSS responder This is the big one. It borrows a lot of its design from the recently rewritten enumeration code, but it has a few gotchas (notably that we need to maintain state between setnetgrent and getnetgrent calls to ensure that we are still answering requests for the same requested entry. Remaining work on netgroups will be to add support for the LDAP backend to store the netgroups in the cache appropriately. In the future (https://fedorahosted.org/sssd/ticket/630) we will also add netgroups support to the proxy provider. This proxy support is not planned for 1.4.0. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyakSUACgkQeiVVYja6o6Or5ACgrYx+rlk4ux/MOCjqVQ9Ds8+6 BvQAn1KrVnr7J0HAreUTovg8B03WLp0R =71HE -----END PGP SIGNATURE-----

2 3

Behaviour of getgrnam/getgrgid
by Ralf Haferkamp 13 Oct '10

13 Oct '10

Hi, Is it really the intended behaviour of the sssd LDAP backend (I am running the current code from the master branch) to only return the group members that are already cached in sysdb and to silently ignore everything else? E.g. when I start sssd with empty caches and do a "getent group <random-ldap-group>" I will only get back the group without any members. Somehow I think this can't be intended :) I have started working on a patch to let sssd look up the non-cached users via LDAP (and save them into the cache). Find it attached. Note: That patch is not really complete (e.g. it doesn't handle rfc2307 groups correctly). But before putting more effort into this I like to make sure that I am not trying to fix a "feature" here. -- regards, Ralf

7 42

Man pages should mention supported providers
by Jan Zelený 13 Oct '10

13 Oct '10

Supported providers are mentioned in Description section, because there was already partial description present. Another possibility was to comment it as configuration option (e.g. create access_provider=ldap record there). I like this way more, but I'm not sure whether it is descriptive enough. -- Jan

2 4

[PATCH] Raise the required version of libdhash
by Sumit Bose 13 Oct '10

13 Oct '10

Hi, this patch increase the required version number of libdhash. Older version cannot update hash entries with hash_enter(). I think we currently do not use hash_enter() to update entries (I had a netgroup patch where it was used, but since we let glibc do all the unrolling and loop-detection it is not needed anymore). To avoid surprises we should check for the latest version of libdhash. bye, Sumit

2 2

[PATCH] Remove unused defines
by Sumit Bose 13 Oct '10

13 Oct '10

Hi, by chance I came across these two defines which are not used (anymore). bye, Sumit

3 2

[PATCH] Distribute XML sources instead of man-pages
by Sumit Bose 13 Oct '10

13 Oct '10

Hi, currently we distribute the generated man pages with the released tar balls. This patch replaces them with the XML source files. bye, Sumit

3 2

[PATCHES] Three minor cosmetic fixes
by Sumit Bose 13 Oct '10

13 Oct '10

Hi, the three attached patches fixes some compiler warnings, which might occur with a high warning level like -Wextra. bye, Sumit

3 2

Announcing the release of ding-libs 0.1.2
by Stephen Gallagher 12 Oct '10

12 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sumit discovered and fixed a serious bug in libdhash. Specifically, the hash_enter() function was incapable of updating an existing entry. We are releasing ding-libs 0.1.2 immediately with a fix for this incorrect behavior. ding-libs-0.1.2 is available for source tarball download at https://fedorahosted.org/sssd/wiki/Releases#DING-LIBSReleases - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky0rN4ACgkQeiVVYja6o6Pd+wCgh7WJJhgoSYsuOACGV8fOpNee Y+cAnRrQVWrD2Ma/CPAYY1MTJ7Hri3Cx =/Pbk -----END PGP SIGNATURE-----

1 0

[PATCH] dhash: Allow hash_enter() to update entries
by Sumit Bose 12 Oct '10

12 Oct '10

Hi, Patch 0003 add update capabilities to hash_enter(). The current behaviour was to keep the old entry and return HASH_SUCCESS. I have added an update test to the unit test. Maybe it make sense to update the version number to make it easier to detect if updates are possible or not. Patch 0001 adds a missing include file and 0002 makes hash_example pass valgrind without errors. bye, Sumit

2 2

12 Oct '10

hi we re using sssd 1.3.0 with ldap authentication and as soon as we have populated a lot of groups login just after reboot is very slow ( about 45 seconds ). After the first initial login all the subsequent login are immediate. I know that there were some performance problem with initgroup. Are they solved now? I 'm doing enumeration on my ldap server. Should i upgrade to 1.3.1 version?

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel October 2010