September 2015 - sssd-devel - Fedora Mailing-Lists

[PATCH] PAM: Add pam environment variable AUTH_DOMAIN to pam reply

by Michal Židek

Hi! See the attached patch that adds the AUTH_DOMAIN variable to pam reply. Ticket: https://fedorahosted.org/sssd/ticket/2476 Thanks, Michal

8 years, 7 months

4
16
0 / 0

[PATCHES] test*: Create keytabs in unique directory

by Lukas Slebodnik

ehlo, attached patches should intermittent failures reported in ticket #2694. Few files could touch the same keytab which could cause issues. But I cannot guarantee it will completely fix problem. LS

8 years, 7 months

2
2
0 / 0

[PATCH] tests: Use unique name for TEST_PATH

by Lukas Slebodnik

ehlo, attached patch should prevent copy@paste errors in unit tests. e.g. e0f2a783439fb7d3b85469f34ad6d672abf7e1fa 0d0e787555efc1e6e4eb39a924bb9861bf2921d5 LS

8 years, 7 months

2
4
0 / 0

[PATCH] views: do not require overrideDN in groups when LOCAL view is set

by Pavel Březina

https://fedorahosted.org/sssd/ticket/2790 This is just a partial fix. If a group contains member which doesn't have overrideDN specified, we fail to resolve membership with LOCAL views. There is a bigger issue when group contains ghost members, we do not apply overrides and just ignore the group. As code says, this is expected. Sumit, do you remember why it is this way? sysdb_getgrgid_with_views: > if (el != NULL && el->num_values != 0) { > DEBUG(SSSDBG_TRACE_ALL, > "Group object [%s], contains ghost entries which must be " \ > "resolved before overrides can be applied.\n", > ldb_dn_get_linearized(orig_obj->msgs[0]->dn)); > ret = ENOENT; > goto done; > } As I see it, we can do: 1) If group contains ghosts and memberuid, resolve memberuid 2) For each ghost user either: a) Ignore b) Put the name in c) Try to find overrideObjectDN and apply possible name override, then put the name in

8 years, 7 months

3
7
0 / 0

[PATCH] IPA: Remove MPG groups if getgrgid was called before getpw()

by Jakub Hrozek

Hi, the attached patch fixes https://fedorahosted.org/sssd/ticket/2724 for me. I haven't yet heard back from the affected user, but they do have test packages available.

8 years, 7 months

3
9
0 / 0

[PATCH] KRB5: Don't error out reading a minimal krb5.conf

by Jakub Hrozek

Hi, I was seeing some loud debug messages with a direct AD client. I think it's safe to silence them by ignoring these krb5 error code (I saw a similar ignore blocks in libkrb5 itself), please see the attached patch.

8 years, 7 months

2
2
0 / 0

[PATCH] sss_override: support fqn in override name

by Pavel Březina

https://fedorahosted.org/sssd/ticket/2782

8 years, 7 months

2
4
0 / 0

sssd + pkcs11

by Nikos Mavrogiannopoulos

Hello, I've been writing some text to integrate freeipa/sssd with openconnect server [0], and for single password or OTP that seems to integrate seamlessly. However, when PAM-SSSD is configured to use smart cards, that only works with locally inserted cards. That is even if one uses the smart card to establish the channel used for VPN, the PAM module wouldn't know that. Would it make sense to use a flag (e.g., via pam_putenv()) and the caller of the PAM functions set the information provided by the certificate used for the session for SSSD to assume a card is present? (*) regards, Nikos [0]. https://github.com/openconnect/recipes/blob/master/ocserv-freeipa.md (*). Unfortunately with TLS you can verify a signature from a smart card but you cannot have a proof that you did it recently.

8 years, 7 months

3
7
0 / 0

[PATCH] DATA_PROVIDER: BE_REQ as string in log message

by Petr Cech

Hi, I investigated the situation around the log message, which mentioned Lukas. I prepared this patch. The result is that the original message > [sssd[be[cygnus.dev]]] [be_get_account_info] (0x0200): Got request for [0x1001][1][name=celestian] changed to > [sssd[be[cygnus.dev]]] [be_get_account_info] (0x0200): Got request for [0x1001][FAST BE_REQ_USER][1][name=celestian] A) I would like to ask if mark 'FAST' is useful, or if I should remove it. B) While writing a patch Lukas noticed another similar logging messages > [sssd[pam]] [sss_dp_get_account_msg] (0x0400): Creating request for [LDAP][3][1][name=mof_user6] I investigated it. This is the same thing -- BE_REQ_*, but it is no longer in the provider, but in the responder. Can you please advise me where I could the function 'be_req2str' write? The first message is coming from > src/providers/data_provider_be.c --> be_get_account_info, the second is from > src/responder/common/responder_dp --> sss_dp_get_account_msg Thanks. Petr

8 years, 7 months

4
15
0 / 0

[PATCH] Workaround for dyndns_test_ok failiure on mips(el). Child part has finished before the child handler was created.

by Jurica Stanojkovic

Hello, Package sssd_1.11.5.1-1 on Debian FTBFS for mips and mipsel. https://buildd.debian.org/status/fetch.php?pkg=sssd&arch=mips&ver=1.11.5.... https://buildd.debian.org/status/fetch.php?pkg=sssd&arch=mipsel&ver=1.11.... dyndns_test_ok is failing with following log: [ RUN ] dyndns_test_ok(Tue Jul 8 15:53:55:004476 2014) [sssd] [be_nsupdate_args] (0x0200): (Tue Jul 8 15:53:55:004521 2014) [sssd] [child_handler_setup] (0x2000): nsupdate auth type: GSS-TSIGSetting up signal handler up for pid [21397](Tue Jul 8 15:53:55:004693 2014) [sssd] [__wrap_execv] (0x0200): nsupdate success test case(Tue Jul 8 15:53:55:004825 2014) [sssd] [__wrap_execv] (0x1000): Child exiting with status 0(Tue Jul 8 15:53:55:005275 2014) [sssd] [child_handler_setup] (0x2000): Signal handler set up for pid [21397](Tue Jul 8 15:54:55:837623 2014) [sssd] [write_pipe_handler] (0x0020): write failed [32][Broken pipe].(Tue Jul 8 15:54:55:837801 2014) [sssd] [nsupdate_child_stdin_done] (0x1000): Sending nsupdate data complete(Tue Jul 8 15:54:55:837869 2014) [sssd] [nsupdate_child_stdin_done] (0x0040): Sending nsupdate data failed [32]: Broken pipe(Tue Jul 8 15:54:55:837947 2014) [sssd] [be_nsupdate_done] (0x0040): nsupdate child execution failed [1432158228]: Dynamic DNS update failed(Tue Jul 8 15:54:55:837985 2014) [sssd] [dyndns_test_ok] (0x1000): Child request returned [1432158228]: Unknown error 14321582280x555d0014 != 0../src/tests/cmocka/test_dyndns.c:222: error: Failure![ FAILED ] dyndns_test_okChild part has finished before the child handler was created. I have created and attached a patch which is workaround for this issue. Could someone please take a look and comment this? Thank you! Sincerely, Jurica

8 years, 7 months

4
6
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2015