sssd-devel December 2011

sssd-devel@lists.fedorahosted.org

27 participants
59 discussions

[PATCH] Allow more libldap debugging
by Jakub Hrozek 28 Nov '12

28 Nov '12

This patch should not be pushed to master, but I would like to get it reviewed anyway. It should be used to provide a custom build for users experiencing cases where ldap_search_ext would block (c.f. https://bugzilla.redhat.com/show_bug.cgi?id=728343) For example: export SSSD_DEBUG_LDAP_SEARCH="0xffff" would set LDAP_DEBUG_ANY The attached patch applies cleanly on the RHEL6.1 branch. I also have a version that applies on master/1.5 if needed.

4 7

[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal 06 Apr '12

06 Apr '12

Please see the attached patches. I tried to split the patches logically into manageable sets. Unfortunately I made a minor mistake and I am afraid I will do something wrong to fix it. I merged two wrong patches. Fortunately it was three liner with 1 liner so it is not a big of the deal but I am really scared that I will do something wrong and loose the work I have done. So I hope it is Ok to send it as is. 0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted earlier that I merged by mistake. I was supposed to merge it with patch 25 but picked the wrong one instead. Patch 25 addresses the real issue found by Coverity as mentioned in Stephen's review mail but it did not apply cleanly since it relies on some code from the patches in the middle. 0002--INI-Adding-missing-function-declararion.patch <- this is the patch that was rejected from the second set sent earlier. Fixed according to review comment. 0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing per component The following set of patches introduces the merging of sections during the reading of the file: 0004--INI-New-error-codes-and-messages.patch 0005--INI-New-merge-flags.patch 0006--INI-Add-new-vars-to-parse-structure.patch 0007--INI-Add-save_error-function.patch 0008--INI-Change-parse_error-to-use-save_error.patch 0009--INI-Preparing-for-merging-sections.patch 0010--INI-Enhance-value-processing.patch 0011--INI-Use-section-line-number.patch 0012--INI-Refactor-section-processing.patch 0013--INI-Return-error-in-DETECT-mode.patch 0014--INI-New-test-files-for-section-merge.patch 0015--INI-Test-DETECT-mode-and-use-new-file.patch 0016--INI-Test-for-all-section-merge-modes.patch Patches related porting of the meta data from old way of doing things to the new way of doing things: 0017--INI-Separate-close-and-destroy.patch 0018--INI-Function-to-reopen-file.patch 0019--INI-Metadata-collection-is-gone.patch 0020--INI-Check-access-function.patch 0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check) 0022--INI-Function-to-check-for-changes.patch 0023--INI-Tests-for-access-and-changes.patch 0024--INI-Rename-error-print-function.patch <- rename error printing function for consistency with new interface 0025--INI-Initialize-variables-in-loops.patch <- Coverity issue addressed. Related to patch 0001. 0026--INI-Exposing-functions.patch <- Make some internal functions reusable There is also patch 27. It is a piece of new functionality. It is a preview. Please see the comment before reviewing it. Do I need to split it into multiple patches or it is Ok as is? It is pretty big but all changes are in one file and logically related. The UNIT test is missing so I am not claiming it actually works as expected. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 30

[PATCHES] SUDO Integration
by Pavel Březina 17 Jan '12

17 Jan '12

https://fedorahosted.org/sssd/ticket/1105 (review ticket) https://fedorahosted.org/sssd/ticket/623 (sudo integration) Hello, it is finally here. These patches *assume* that "Responders: Split getting domain by name into separate function" patch has been applied, it can be found in "Ability to set a domain as case sensitive or insensitive" thread. Design page: https://fedorahosted.org/sssd/wiki/DesignDocs/SUDOIntegrationNewApproach What's left: 1. implementing support of sssd in sudo sudoers plugin 2. periodical update of all rules 3. provide documentation 4. in memory cache in responder 5. refactor DP request using "RESPONDER: Refactor DP requests into tevent_req style" patch 6. provide few more configuration options 7. support the IPA scheme How to configure it: 1. configure --enable-all-experimental-features 2. sssd.conf: services += sudo domain options: sudo_provider, ldap_sudo_search_base How to test it: > sss_sudo_cli username This will display rules for %username. It performs two lookups: 1. using native sssd api to get and display raw date (it prints every byte as char so don't be scared of silly characters that are shown instead of numbers) 2. using api that we provide to sudo and use it to display data in user readable format Big thanks to Jakub, who has written whole sysdb api and a big part of responder. Regards, Pavel Březina.

4 23

[PATCHES] SUDO Integration - periodical update
by Pavel Březina 17 Jan '12

17 Jan '12

https://fedorahosted.org/sssd/ticket/1110 [PATCH 1/4] I've removed FIXME and move the DEBUG message to a better place. [PATCH 2/4] I've wrapped the data provider part with tevent request so I can reuse the code in periodical updates. [PATCH 3/4] Adds two new functions in sudo sysdb api that can set/retrieve the value of 'refreshed' attribute (equivalent to 'has_enumerated' attribute in domain enumeration). If it is true, the first schedule will be delayed for a few seconds so we don't slow down the start up process. [PATCH 4/4] Periodical update itself. It adds two new options: ldap_sudo_refresh_enabled (bool) - equivalent to 'enumerate' ldap_sudo_refresh_timeout (number) - equivalent to 'ldap_enumeration_refresh_timeout'

4 10

SSSD and Kerberos
by Alexander Blair 11 Jan '12

11 Jan '12

Hello, I've been working with FC 16 and SSSD for about two days now trying to get SSSD to properly talk to our Kerberos server, and it seems to continually ignore the fact I've got it configured to do so at this time. Tracking the logs has shown me nothing useful as of yet, and monitoring network traffic on the Krb server itself shows that there's no network communication happening. I've even gone as far as to completely purge the working directory for it's caches, and force them to rebuild, restarting the box, nothing I've done so far seems to force SSSD to contact Krb for auth information, any ideas on where to take this would be most excellent. I'm currently using SSSD 1.6.3 from the main FC repos. I've gone though as much troubleshooting information as I can, but as there does not appear to be any errors in my krb5_child.log log, or much else that appears to be useful, so I'm a bit stumped. /etc/sssd/sssd.conf: [domain/domain] ldap_id_use_start_tls = False cache_credentials = True ldap_search_base = dc=dc,dc=dc,dc=dc krb5_realm = this.is.a.valid.realm krb5_server = 192.168.100.100 id_provider = ldap auth_provider = krb5 chpass_provider = krb5 ldap_uri = ldap://192.168.100.200/ krb5_kpasswd = 192.168.100.100 ldap_tls_cacertdir = /etc/openldap/cacerts [sssd] services = nss, pam config_file_version = 2 domains = domain [nss] [pam] /var/log/sssd/sssd_nss.log -- Debug level 4: (Fri Dec 30 01:46:35 2011) [sssd[nss]] [accept_fd_handler] (4): Client connected! (Fri Dec 30 01:46:35 2011) [sssd[nss]] [nss_cmd_getpwnam] (4): Requesting info for [user] from [<ALL>] (Fri Dec 30 01:46:35 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4): Requesting info for [user@default] (Fri Dec 30 01:46:35 2011) [sssd[nss]] [nss_cmd_initgroups] (4): Requesting info for [user] from [<ALL>] (Fri Dec 30 01:46:35 2011) [sssd[nss]] [nss_cmd_initgroups_search] (4): Requesting info for [user@default] (Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam] (4): Requesting info for [user] from [<ALL>] (Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4): Requesting info for [user@default] (Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam] (4): Requesting info for [user] from [<ALL>] (Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4): Requesting info for [user@default] (Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam] (4): Requesting info for [user] from [<ALL>] (Fri Dec 30 01:46:37 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4): Requesting info for [user@default] Thank you, Alexander Blair

3 7

Announcing SSSD 1.6.2
by Stephen Gallagher 04 Jan '12

04 Jan '12

The SSSD team is proud to announce the version 1.6.2 enhancement and bugfix release of the System Security Services Daemon. As always, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Improved handling of users and groups with multi-valued name attributes (aliases) * Performance enhancements * Initgroups on RFC2307bis/FreeIPA * HBAC rule processing * Improved process-hang detection and restarting * Enabled the midpoint cache refresh by default (fewer cache misses on commonly-used entries) * Cleaned up the example configuration == Detailed Changelog == Jakub Hrozek (23): * Improve error message for LDAP password constraint violation * Keep deref controls until the whole request is finished * Fix uninitialized pointer read in sdap_gssapi_get_default_realm() * IPA access: hostname comparison should be case-insensitive * Add sysdb interface to get name aliases * Add a sysdb_get_direct_parents function * Store name aliases for users, groups * Return users and groups based on alias * Use explicit base 10 for converting strings to integers * Fix typo in sysdb_get_direct_parents * Add option to follow symlinks to check_file() * Append PID to sbus server socket name, let clients use a symlink * Streamline the example config * Do not delete requests inside hash_iterate loop * Check if dp_requests hash table exists before using it * Fix off-by-one error in remove_socket_symlink() * Report on errno, not return code in create_socket_symlink * Add a missing break * Sanitize DN in sysdb_get_direct_parents * gitignore additions * Utility functions for LDAP nested schema initgroups * Use fewer transactions during RFC2307bis initgroups * Use fewer transactions during IPA initgroups Jan Zeleny (2): * man page fix (lists are comma-separated) * Fixed timeout handling in responders Marko Myllynen (3): * Add missing options to sssd.api.conf * Unbreak ./configure * Update sssd-example.conf Pavel Březina (3): * sss_ldap_err2string() - function created * sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string() * Added quiet option to pam_sss Pavel Zuna (1): * Fix small bug where TALLOC_CTX could end up unfreed. Stephen Gallagher (18): * Bumping version to 1.6.2 * Add option to specify the kerberos replay cache dir * Fix typo in %configure * Remove all libtool .la files from RPM * Improve documentation of libipa_hbac * Add libipa_hbac documentation to the -devel package * MONITOR: Correctly detect lack of response from services * Do not build documentation on RHEL 5 * Fix typo in specfile * MAN: Add more information about internal credential storage * Enable the midpoint cache update by default * HBAC: fix typos preventing proper hostgroup evaluation * HBAC: Do not save member/memberOf links * HBAC: Use originalMember for identifying servicegroups * HBAC: Use originalMember for identifying hostgroups * BUILDSYS: Fix --without-manpages * MONITOR: fix timeout conversion * Updating translation files for string freeze Sumit Bose (1): * Do not access memory out of bounds

5 32

ldap shadow policy
by Patrick Hemmer 31 Dec '11

31 Dec '11

Firstly, apologies if this isnt appropriate for this mailing list. This was the only sssd mailing list I could find. I'm trying to migrate a RHEL5 box from pam_ldap to sssd (version 1.5.1, official redhat package) and am having an issue getting shadow attributes working. For testing I set a shadowExpire attribute on my account in LDAP. pam_ldap obeys this correctly and will not let me log in (trying with ssh public key as the server enforces the password policy). I have added the following settings to the ldap domain to try and get this to work; access_provider = ldap ldap_access_order = expire ldap_account_expire_policy = shadow But the box sill lets me log in. For testing to make sure pam was working, I set 'ldap_access_order=filter' without setting ldap_access_filter, and it properly rejected my login. Googling the subject only turns up the man page and the patch set where these settings were added. Any ideas what I'm missing here? Thanks

2 1

request for Heimdal support
by lists 23 Dec '11

23 Dec '11

Hi, Would it be possible to extend SSSD and also support Heimdal as Kerberos client implementation? This patch seems to provide just that: http://cvs.pld-linux.org/cgi-bin/viewvc.cgi/cvs/packages/sssd/sssd-heimdal.… My setup is as follows: - server with - Heimdal KDC - openldap - pam_ldap / nss_ldap - laptops/workstations with - mit kerberos clients - SSSD I would like to use SSSD on all my machines, but because SSSD does not support Heimdal I cannot replace pam_ldap/nss_ldap on the server. Maybe you could consider this patch and add it to SSSD? Thanks, J.

4 15

Announcing SSSD 1.7.0
by Stephen Gallagher 22 Dec '11

22 Dec '11

The SSSD team is proud to announce the version 1.7.0 enhancement release of the System Security Services Daemon. As always, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Support for case-insensitive domains * Support for multiple search bases in the LDAP provider * Support for the native FreeIPA netgroup implementation * Reliability improvements to the process monitor * New DEBUG facility with more consistent log levels * New tool to change debug log levels without restarting SSSD * SSSD will now disconnect from LDAP server when idle * FreeIPA HBAC rules can choose to ignore srchost options for significant performance gains * Assorted performance improvements in the LDAP provider (reducing disk-writes to the cache) * '''Experimental''' support for looking up SUDO rules in ldap * Not built by default * Requires unreleased sudo binary. Very preliminary functionality. * '''Experimental''' support for Heimdal Kerberos implementation (buggy) == Detailed Changelog == Jakub Hrozek (89): * pyhbac: Do not convert int to bool * Fix returning groups when gidNumber attribute is not ordered * Prevent segfault if vetoed_shells are specified without allowed_shells * Remove unused temporary context * Handle errno properly in set_debug_file_from_fd() * Do not delete requests inside hash_iterate loop * Handle timeout during sss_ldap_init_send * IPA dyndns: do not segfault if the server cannot be resolved * Return the first value of name if the multivalued name attribute does not match RDN * Add LDAP provider option to set LDAP_OPT_X_SASL_NOCANON * Use the default Kerberos realm for LDAP with GSSAPI auth * Fix moving to next entry in deref code * Allow turning dereference off by setting the threshold to 0 * Change libnl monitor callback to only signal going online * Discard carrier messages from non-ethernet devices * Subscribe to netlink route and addr messages * Improve error message for LDAP password constraint violation * Keep deref controls until the whole request is finished * Fix uninitialized pointer read in sdap_gssapi_get_default_realm() * Fix wrong buffer size in has_phy_80211_subdir() * Multiline macro cleanup * IPA access: hostname comparison should be case-insensitive * Add sysdb interface to get name aliases * Add a sysdb_get_direct_parents function * Store name aliases for users, groups * Return users and groups based on alias * Use explicit base 10 for converting strings to integers * Fix typo in sysdb_get_direct_parents * Add option to follow symlinks to check_file() * Append PID to sbus server socket name, let clients use a symlink * Streamline the example config * Check if dp_requests hash table exists before using it * Fix off-by-one error in remove_socket_symlink() * Report on errno, not return code in create_socket_symlink * Add a missing break * Sanitize DN in sysdb_get_direct_parents * gitignore additions * Utility functions for LDAP nested schema initgroups * Use fewer transactions during RFC2307bis initgroups * Use fewer transactions during IPA initgroups * Cancel transactions correctly during initgroups * Plug memory leaks in LDAP provider * Plug memory leaks in sysdb_ops * Do not leak hash table iterator during proxy auth * resolver: Free the whole hostent structure * RFC2307bis initgroups: fix nested groups processing * Steal result onto mem_ctx in sdap_initgr_nested_get_direct_parents * Use LDAPDerefSpec properly * Remove confusing do-while loop * Fix segfault in sdap_get_initgr_user * Use correct state struct in sdap_initgr_rfc2307bis_next_base * configAPI: Fix removing in old domain when saving a new domain * Squash transactions in sdap_initgr_common_store * Use one transaction instead of two during RFC2307bis group processing * Prevent printing NULL in several places of LDAP provider * Cleanup: Remove unused parameters * Fix sdap_id_ctx/ipa_id_ctx mismatch in IPA provider * Provide means of forcing TLS and GSSAPI enabled/disabled for sdap connections * IPA migration fixes * Fix two small bugs in group dereferencing * Use dereference during IPA provider initgroups * Pass the correct private data into Data Provider callback * Always attempt to connect in sdap_async_sys_connect_done * LDAP provider: Error while setting the nocanon option should not be fatal * Cancel ping_check if service goes away * sss_utf8_tolower utility function+unit tests * Responders: Split getting domain by name into separate function * Canonicalize username in PAM provider * Use the case sensitivity flag in responders * Refactor saving sdap entities * sysdb_get_real_name helper function * Use the case sensitivity flag in the LDAP provider * Use the case sensitivity flag in the simple access provider * Use the case sensitivity flag in the proxy provider * Export the function to convert ldb_result to sysdb_attrs * SUDO Integration - sysdb interface * SUDO Integration - LDAP provider - save sudo rules functions * SUDO Integration - responder - get sudo rules logic * DP: Remove processed callbacks * Pass client context to sss_dp_get_account_send * Pass sdap_id_ctx to online check from IPA provider * Error out if local domain is case insensitive * Resolver: Introduce a per-request timeout * Do not touch resolve_service_state in fo_resolve_service_done * Failover: Introduce a per-service timeout * Save original memberof, not memberof * sss_get_cased_name utility function * Return user and group names lowercased in case insensitive domains * Honor case sensitive flag when creating the ccname template Jan Zeleny (37): * sysdb refactoring: renamed ctx variable to sysdb * Added sysdb_ctx_get_domain function * sysdb refactoring: deleted domain variables in sysdb API * sysdb refactoring: memory context deleted * Remaining memory context variables renamed * sdap_async_accounts.c split * Confusing part of code cleared out * Moved some functions in sdap_async_groups * Moved some functions in sdap_async_initgroups * Fixed bad logic in processing netgroups in LDAP provider * man page fix (lists are comma-separated) * Fixed timeout handling in responders * Added krb5_fast_principal to SSSDConfig API * Cleanup of unused function in ldap access provider * Add wrapper for krb5_get_init_creds_opt_set_canonicalize * Add support to request canonicalization on krb AS requests * Support to request canonicalization in LDAP/IPA provider * Handle group renaming correctly * Fixed possible resource leak in get_uid_from_pid() * Fixed possible resource leak in create_mail_spool() * Fixed empty loginShell in proxy provider * Fixed unchecked value of setenv() in check_and_export_options() * Renamed some LDAP routines * Modified sdap_parse_search_base() * Added and modified options for IPA netgroups * New IPA ID context * Added support for fetching netgroups in IPA provider * Added IPA account info handler * Fixed a typo in sysdb_upgrade_07() declaration * Fixed uninitialized pointer read in netgroups processing * Fixed logically dead code in netgroup processing * Add ipa_hbac_support_srchost option to IPA provider * Fixed an error in macro for merging double linked lists * Fixed incorrect return code in PAM client * Add ldap_sasl_minssf option * Fixed IPA netgroup processing * Deleted declaration of nss_get_dom() Krzysztof Klimonda (1): * Fix FTBFS related to -Werror=format-security Marko Myllynen (4): * Add missing options to sssd.api.conf * Unbreak ./configure * Update sssd-example.conf * Typo fixes Pavel Březina (35): * debug_timestamps fixes * Fixed implicit declaration of function 'time' in src/sss_client/common.c. * New DEBUG facility - new levels * New DEBUG facility - modified DEBUG * New DEBUG facility - conversion * New DEBUG facility - man pages * New DEBUG facility - unit tests * New DEBUG facility - SSSDBG_UNRESOLVED changed from -1 to 0 * --debug-timestamps=1 is not passed to providers * sss_ldap_err2string() - function created * sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string() * sss_debuglevel - change the debug levels on the fly * DEBUG timestamps offer higher precision * DEBUG timestamps offer higher precision - man page updated * DEBUG timestamps offer higher precision - unit tests updated * DEBUG timestamps offer higher precision - SSSDConfig updated * Added quiet option to pam_sss * SysDB commands that save lastUpdate allows this value to be passed in * Fixes debug-tests.c coverity issues: NEGATIVE_RETURNS, FORWARD_NULL * sss_cli.h - fix: function declaration after the header guard * Added sssd --version option * Added sss_ldap_dn_in_search_bases() * Support search bases in RFC2307bis enumeration * Support search bases in netgroup members translation * SUDO integration - client common interface * SUDO integration - data provider backend handler * SUDO Integration - LDAP configuration options * SUDO integration - LDAP provider * SUDO Integration - responder * SUDO Integration - API for sudo * SUDO Integration - pseudo client for testing * Logically dead code in sdap_nested_group_lookup_group * Use of uninitialized value in sss_ldap_dn_in_search_bases * SUDO Integration - be_sudo_req removed from sudo_ctx * SUDO Integration - fixed memory leak in sdap_sudo_handler() Pavel Zuna (2): * Fix small bug where TALLOC_CTX could end up unfreed. * Add common SIGCHLD handling for providers. Ralf Haferkamp (1): * Allow the O_NONBLOCK flag to be reset correctly Simo Sorce (1): * Set more strict permissions on keyring Stephen Gallagher (74): * Bumping version to 1.7.0 * Revert "Allow LDAP to decide when an expiration warning is warranted" * Rename sssd.conf to sssd-example.conf * Include the configuration file as a %ghost entry * Remove private shared object Provides: for pysss.so and pyhbac.so * Cancel sysdb upgrade transaction if commit fails * Fix potential double-free issue * Fix broken RHEL5 build * Use sysdb attribute name for GID, not LDAP attribute * HBAC: Handle saving groups that have no members * HBAC: Use of hostgroups for targethost or sourcehost was broken * HBAC: Properly skip all non-group memberOf entries * Add option to specify the kerberos replay cache dir * Fix typo in %configure * Remove all libtool .la files from RPM * Improve documentation of libipa_hbac * Add libipa_hbac documentation to the -devel package * MONITOR: Correctly detect lack of response from services * Do not build documentation on RHEL 5 * Fix typo in specfile * MAN: Add more information about internal credential storage * Enable the midpoint cache update by default * HBAC: fix typos preventing proper hostgroup evaluation * SYSDB: New source file for sysdb upgrade routines * HBAC: Do not save member/memberOf links * HBAC: Use originalMember for identifying servicegroups * HBAC: Use originalMember for identifying hostgroups * BUILDSYS: Fix --without-manpages * TOOLS: Do not leak pid_file handle on error * MONITOR: fix timeout conversion * Updating translation files * SSSDConfig: Handle integer parsing more leniently * Remove unused sdap_options attributes * Fix size return for split_on_separator() * Make sdap_get_id_specific_filter() more strict * LDAP: Add parser for multiple search bases * LDAP: Support multiple user search bases (non-enumeration) * LDAP: Support multiple netgroup search bases * LDAP: Support multiple group search bases (non-enumeration, RFC2307) * LDAP: Add multiple search bases for initgroups (users) * LDAP: Add multiple search bases for initgroups (RFC2307 groups) * LDAP: Add multiple search bases for initgroups (RFC2307bis groups) * LDAP: Update manpages with multiple search base information * LDAP: Convert ldap_*_search_filter * LDAP: Add support for multiple search bases for user enumeration * LDAP: Add support for multiple search bases for group enumeration * RESPONDER: Fix segfault in sss_packet_send() * SYSDB: add index for nameAlias * Periodic translation file update * LDAP: Remove redundant groups from the lookup list * SBUS: Fix DEBUG log matching * RESPONDER: Ensure that all input strings are valid UTF-8 * SYSDB: Make ENOENT log messages less threatening * Fix broken build due to commit of IPA netgroup support * Add -fno-strict-aliasing * LDAP: Try next failover server on any error * RESPONDER: Refactor DP requests into tevent_req style * Allow using Glib for UTF8 support * Ignore NULL-terminator when checking UTF8-validity * LDAP: Fix missing break statements in force_tls * Ignore NULL-terminator when checking UTF8-validity for netgroups * Fix potential resource leak in backup_file.c * Fix uninitialized value error in ipa_netgroups.c * Add sdap_connection_expire_timeout option * Update spec file to build with Glib on RHEL 5 * Fix typo in IPA SSSDConfig file * Move child_common routines to util * Reorder pidfile() function to guarantee NULL-termination * Securely set umask when using mkstemp * Update translations for string freeze * MONITOR: use sigchld handler for monitoring SSSD services * PAM: make initgroups timeout work across multiple clients * Add compatibility layer for Heimdal Kerberos implementation * Importing new translations for 1.7.0 release Sumit Bose (2): * Improve password policy error code and message * Do not access memory out of bounds Thorsten Scherf (1): * Fixed translation bug Yuri Chornoivan (2): * Fix two man page typos * Fix typos in manual pages

1 0

[PATCH] Return user and group names lowercased in case insensitive domains
by Jakub Hrozek 21 Dec '11

21 Dec '11

The attached three patches reflect the discussion we had on #sssd and sssd-devel mailing list. They also fix https://fedorahosted.org/sssd/ticket/1123 [PATCH 1/3] sss_get_cased_name utility function I moved the ternary operator expression into a separate function. It's being used all over the place now. [PATCH 2/3] Return user and group names lowercased in case insensitive domains Does what it says on the box. Is there a way to force the same for initgroups? As far as I can see, we don't even send the netgroup name back to the NSS module.. [PATCH 3/3] Honor case sensitive flag when creating the ccname The homedir template is handled automatically in patch #2, but we need to handle the ccname templates as well.

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel December 2011