[sssd PR#247][opened] Subdomain inherit
by mzidek-rh
URL: https://github.com/SSSD/sssd/pull/247
Author: mzidek-rh
Title: #247: Subdomain inherit
Action: opened
PR body:
"""
I tested if the options that work in subdomain inherit also work in trusted domain section in sssd.conf. Most seem to work without any changes in the code except for two. With these two patches only one that does not work remains (I wanted to send patchset that adds all the options, but I got stuck on the option that sets the ldap principal, so I am sending this in the meantime).
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/247/head:pr247
git checkout pr247
5 years, 11 months
[sssd PR#464][opened] SYSDB: Properly handle name/gid override when using domain resolution order
by fidencio
URL: https://github.com/SSSD/sssd/pull/464
Author: fidencio
Title: #464: SYSDB: Properly handle name/gid override when using domain resolution order
Action: opened
PR body:
"""
When using name/gid override together with domain resolution order the
mpg name/gid may be returned instead of the overridden one.
In order to avoid that, let's add a check in case the domain supports
mpg so we can ensure that the originalADname and originalADgidNumber
attributes are the very same as the ones searched and then normally
proceed with the current flow in the code. In case those are not the
same, we *must* follow the code path for the non-mpg domains and then
return the proper values.
Resolves: https://pagure.io/SSSD/sssd/issue/3595
Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/464/head:pr464
git checkout pr464
5 years, 11 months
[sssd PR#128][opened] Fix group renaming issue when "id_provider = ldap" is set
by fidencio
URL: https://github.com/SSSD/sssd/pull/128
Author: fidencio
Title: #128: Fix group renaming issue when "id_provider = ldap" is set
Action: opened
PR body:
"""
Those two patches fix https://bugzilla.redhat.com/show_bug.cgi?id=1401241
The sssd.conf used in order to reproduce this issue looks like:
```
[sssd]
config_file_version = 2
services = nss, pam
domains = ad.fidencio.lan
[nss]
[pam]
[domain/ad.fidencio.lan]
ad_domain = ad.fidencio.lan
krb5_realm = AD.FIDENCIO.LAN
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
ldap_referrals = false
enumerate = false
id_provider = ldap
#id_provider = ad
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
ldap_sasl_mech = GSSAPI
ldap_schema = ad
ldap_user_object_class = user
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_group_object_class = group
ldap_access_order = expire
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
```
The reproducer can be found in the bug report.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/128/head:pr128
git checkout pr128
6 years
[sssd PR#378][opened] [RFC] Use GNULIB's compiler warning code
by fidencio
URL: https://github.com/SSSD/sssd/pull/378
Author: fidencio
Title: #378: [RFC] Use GNULIB's compiler warning code
Action: opened
PR body:
"""
This is the 3rd tentative to have this patch reviewed. For more references, please, see: PR #50.
So, I've re-worked those patches a little bit and here is the time difference when running reconfing with the patches:
```
real 0m26.047s
user 0m21.318s
sys 0m4.635s
```
And now without:
```
real 0m25.565s
user 0m20.696s
sys 0m4.433s
```
This patch set is rebased on top of PR #377.
I really would appreciate if someone could review and give their opinion.
The reason this PR was blocked is because this time difference has been considered a "performance issue".
@jhrozek , could you take a look on this?
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/378/head:pr378
git checkout pr378
6 years
[sssd PR#476][opened] IPA: Handle empty nisDomainName
by jhrozek
URL: https://github.com/SSSD/sssd/pull/476
Author: jhrozek
Title: #476: IPA: Handle empty nisDomainName
Action: opened
PR body:
"""
Resolves: https://pagure.io/SSSD/sssd/issue/3573
If nisdomain=, i.e. a blank NIS domain name, sssd was not processing the
netgroup at all. This is not in agreement with man innetgr which says "Any
of the elements in a triple can be empty, which means that anything
matches. The functions described here allow access to the netgroup
databases".
This patch instead returns an empty domain as well, which eventually
produces the same output as if the netgroup was requested from the compat
tree.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/476/head:pr476
git checkout pr476
6 years, 1 month
[sssd PR#488][opened] Two fixes for certificates in idoverrides
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/488
Author: sumit-bose
Title: #488: Two fixes for certificates in idoverrides
Action: opened
PR body:
"""
ipa: add SYSDB_USER_MAPPED_CERT for certs in idoverrides
Recent changes to support a rule based mapping between users and
certificates were not properly added for the case where a certificate was
added to an idoverride for a user. As a result authentication with the
certificate from the idoveride was not possible. With this patch the
certificate from to idoveride is properly added to the cache.
Related to https://pagure.io/SSSD/sssd/issue/3603
ipa: remove SYSDB_USER_CERT from sub-domain users
If there are no certificates returned for a sub-domain user from the IPA
server to the client we should make sure they are not present in the
client's cache anymore and remove the whole attribute from the cached user
entry.
Related to https://pagure.io/SSSD/sssd/issue/3603
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/488/head:pr488
git checkout pr488
6 years, 2 months