sssd-devel November 2010

sssd-devel@lists.fedorahosted.org

13 participants
55 discussions

[PATCH] Sanitize search filters in LDAP provider
by Stephen Gallagher 15 Nov '10

15 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This patch relies on the patches from the thread "Sanitize search filters in the sysdb" It should properly escape all LDAP search filters now. Fixes https://fedorahosted.org/sssd/ticket/639 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzZuskACgkQeiVVYja6o6On/wCggHGhZjxv7XnRylZVzML6Jz/g h40AoKkajYkt/l7+w6Un/xgqO8J7hzlb =5j24 -----END PGP SIGNATURE-----

2 2

Remote user use-case
by Stephen Gallagher 08 Nov '10

08 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 One of SSSD's intended primary use-cases is that of the laptop user. We support cached, offline authentications to the local machine so that when a laptop user picks their machine up from their desk and goes home with it, they can still log in. So what about the use-case of a user that never goes into the office? How can SSSD solve the problem of mailing a laptop to a new employee working out of a home-office? Specifically, how do we provide this user (probably a non-technical user) access to their account for the first time, if they don't have direct physical access to the network to perform that first authentication? One approach would be for GDM to provide an interface for a user who was not authenticated on the local machine to connect to a NetworkManager-controlled VPN like IPSEC or vpnc. This would require a lot of coordinating work done in the desktop environment (not to mention the security concerns of allowing an unauthenticated user access to VPN settings). Another approach might be setting up SSSD with a utility to allow us to set a temporary offline cached password. Essentially, an administrator could provision the machine ahead of time with one remote user (pre-caching their identity data, but not their real password). The machine could then be shipped to the user, and the temporary offline password would be overridden the first time that the user provides a valid online password. Is this something we should consider exploring in SSSD 1.5.0? I think the implementation of this would be fairly straightforward. All we'd need to do is write a new tool similar to sss_useradd that would pre-cache a user from the default domain. If the machine is online, it should be capable of pulling the standard user identity data from the identity provider, but if the machine is offline it should be possible to manually provide this information as well. Then the utility would hash the temporary password in the sysdb and the machine would be ready to ship off. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzUZooACgkQeiVVYja6o6PXJgCePruZSFyxyqNQiDdeiS0Im6gs QhYAoJZz/2BpAaVi/wxzDgt2sskK6GDc =8N0l -----END PGP SIGNATURE-----

4 9

[PATCH] Properly check the return value from semanage_commit
by Stephen Gallagher 05 Nov '10

05 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 semanage_commit() returns -1 on error, and can return a positive value on success. https://bugzilla.redhat.com/show_bug.cgi?id=649037 We were sort of accidentally succeeding on modern versions of libsemanage, because a change was introduced in recent versions that broke the return value, so it was actually returning zero on success (despite this being a violation of the API). On older libsemanage (e.g that of Red Hat Enterprise Linux 5), we would actually get the correct return value, which is a positive integer. This patch will fix the problem on both systems, and I have reported the return code regression as https://bugzilla.redhat.com/show_bug.cgi?id=649482 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzUAFsACgkQeiVVYja6o6OKXACeLI7kIJkE94tnswGGZgg/wSeL JVsAn01+2Pu7GmQ+t3u1udG3syIWs0Ma =eBbo -----END PGP SIGNATURE-----

2 2

[PATCHES] Create krb5 access provider
by Sumit Bose 05 Nov '10

05 Nov '10

Hi, this series of patches implements an access target for the Kerberos provider based on the krb5_kuserok() call which checks $HOME/.k5login. This patch should fix ticket #618. bye, Sumit

2 2

[PATCHES] Use namingContext to set empty search bases
by Sumit Bose 05 Nov '10

05 Nov '10

Hi, these two patches make the use of the ldap_search_base option optional and should fix ticket #558. bye, Sumit

3 6

[PATCH] Handle errors during log reopening better
by Stephen Gallagher 05 Nov '10

05 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This patch makes two changes: 1) If we receive an error from rotating the logs, add it to the syslog message 2) Check for EINTR when closing the debug file and retry. This will either resolve https://fedorahosted.org/sssd/ticket/668 or at minimum help identify it. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzSr2UACgkQeiVVYja6o6PvXQCfbRQThAgySoRpLtuvYLYDoTK4 A2AAn1VKOnnFDu8mlXk9lLl8o5l8NJrt =UxAX -----END PGP SIGNATURE-----

2 6

[PATCH] Store krb5 auth context for other targets
by Sumit Bose 04 Nov '10

04 Nov '10

Hi, this patch should fix ticket #628. It was reported the in the case of a timeout the KDC was contacted two times. This happened, because the KDC was added two times (one for the auth target the other for the chpass target). There is already some code which should detect multiple initialisation from different targets, but it didn't worked correctly. This patch should fix it. bye, Sumit

3 3

[PATCH]Don't clean up groups for which a user has it as primary GID
by Stephen Gallagher 04 Nov '10

04 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We were cleaning up all groups that were expired and for which there existed no user with memberOf: <thegroup> as an attribute. This patch modifies the search to also check for cached users with this group's GID as their primary GID. Fixes https://fedorahosted.org/sssd/ticket/624 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzRS1MACgkQeiVVYja6o6NhtACaA0B8c98/9cHnQFinKl8AomfG NFYAoIZx8mHuiigUwrNGREGfuN0p9be2 =HAhe -----END PGP SIGNATURE-----

2 4

[PATCH] Don't clean up groups for which a user has it as primary GID (1.2)
by Stephen Gallagher 03 Nov '10

03 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Backporting to 1.2.x. We were cleaning up all groups that were expired and for which there existed no user with memberOf: <thegroup> as an attribute. This patch modifies the search to also check for cached users with this group's GID as their primary GID. Fixes https://fedorahosted.org/sssd/ticket/624 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzRYqYACgkQeiVVYja6o6O5qgCeO1Cyyl1JbmZDzJp5n4iux14+ sdoAoJJnxGEP90HQYzLzBQS06FAgVgsq =KAf+ -----END PGP SIGNATURE-----

2 2

[PATCHES] Fixes for nss responder (for 1.2)
by Sumit Bose 02 Nov '10

02 Nov '10

Hi, please find attached the backports to the 1.2 series of the fixes for ticket #654. bye, Sumit

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel November 2010