Re: [SSSD] [PATCH] Backport ipa_hbac_support_srchost option to 1.5.x

2012-08-14 Thread Jakub Hrozek
On Mon, Aug 13, 2012 at 07:27:42PM -0400, Stephen Gallagher wrote: > On Mon, 2012-08-13 at 15:03 -0400, Stephen Gallagher wrote: > > This patch backports commit 6fb75e297bf7fc83e3db1f5ae8560624656ef319 to > > the 1.5.x branch. It makes one major change: 1.5.x does not have support > > for deref/ASQ

Re: [SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down. (Mark London)

2012-08-14 Thread Jakub Hrozek
On Tue, Aug 14, 2012 at 10:35:56AM -0400, Mark London wrote: > > Jakub Hrozek wrote > >On Mon, Aug 13, 2012 at 10:16:49PM -0400, Mark London wrote: > >>Mark London wrote: > >>>Hi - When our primary DNS is unreachable, SSSD with LDAP breaks, > >>>or is incredibly slow. I've traced it to the fact

Re: [SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down. (Mark London)

2012-08-14 Thread Mark London
Jakub Hrozek wrote On Mon, Aug 13, 2012 at 10:16:49PM -0400, Mark London wrote: Mark London wrote: Hi - When our primary DNS is unreachable, SSSD with LDAP breaks, or is incredibly slow. I've traced it to the fact that several of the LDAP timeout values are 6 seconds. This is not lo

[SSSD] Refactoring the realmd DBus interface

2012-08-14 Thread Stef Walter
Stephen did a quick review of the realmd DBus interface yesterday. Thanks Stephen! One of the main things he pointed out was that the realmd interface needed to be more extensible in order to be useful for non-kerberos realms in the future, like LDAP or others. Notes about some of the changes:

Re: [SSSD] [PATCH] Make TTL configurable for dynamic dns

2012-08-14 Thread James Hogarth
> Functional ack. There are two minor whitespace issues: > You have a line comprised of nothing but spaces in sssd-ipa.5.xml and a > tab in create_nsupdate_message() when setting ttl = 1200 > I've cleaned this up and properly configured eclipse to only use spaces and no tabs... 0001-Make-TTL-con

[SSSD] [PATCH] KRB5: Only return PAM error for unreachable kpasswd when performing chpass

2012-08-14 Thread Jakub Hrozek
I know this ticket is scheduled for RC2 but I suspect it is the root cause of problems we were seeing in production and I wanted to provide a scratch buil. https://fedorahosted.org/sssd/ticket/1452 We always try to resolve the kpasswd server even when we're just authenticating the user so that to

[SSSD] [PATCH] Failover: try all servers if name resolution doesn't work

2012-08-14 Thread Jakub Hrozek
[PATCH 1/2] FO: Don't retry the same server if it's not working This is a regression (luckily in master only) caused by my earlier patch to return the same server if it's already being resolved, which is the case in IPA provider where we need to kinit as part of id lookup. I broke the case where w

Re: [SSSD] [PATCH] Duplicate detection in fail over did not work.

2012-08-14 Thread Michal Zidek
On 08/14/2012 10:54 AM, Ondrej Kos wrote: Nack Working, but hard to read, use typedef for those strcmp casts. O. Ok. I now use typedef for the function type to make it easier to read. I also created separated functions to compare user_data for each provider, so it will be easy to change it

Re: [SSSD] [PATCH] Duplicate detection in fail over did not work.

2012-08-14 Thread Jakub Hrozek
On Tue, Aug 14, 2012 at 08:24:08AM -0400, Dmitri Pal wrote: > On 08/14/2012 04:54 AM, Ondrej Kos wrote: > > Nack > > > > Working, but hard to read, use typedef for those strcmp casts. > Ondrej's explanation on list was quite short, more details were provided in person, along with a reminder that

Re: [SSSD] [PATCH] Duplicate detection in fail over did not work.

2012-08-14 Thread Dmitri Pal
On 08/14/2012 04:54 AM, Ondrej Kos wrote: > Nack > > Working, but hard to read, use typedef for those strcmp casts. FYI http://www.freeipa.org/page/Coding_Style#Use_of_Typedefs > > O. > > On 08/13/2012 05:25 PM, Michal Zidek wrote: >> On 08/13/2012 11:13 AM, Jakub Hrozek wrote: >>> On Fri, Aug 10

Re: [SSSD] [PATCH] Make TTL configurable for dynamic dns

2012-08-14 Thread Stephen Gallagher
On Tue, 2012-08-14 at 12:46 +0100, James Hogarth wrote: > > > > Comments would be most welcome :) > > > > As per discussion on IRC the patch has bene reformatted properly with > git format-patch... please see attached. Functional ack. There are two minor whitespace issues: You have a line compri

Re: [SSSD] [PATCH] Make TTL configurable for dynamic dns

2012-08-14 Thread James Hogarth
> > Comments would be most welcome :) > As per discussion on IRC the patch has bene reformatted properly with git format-patch... please see attached. Regards, James 0001-Make-TTL-configurable-for-dynamic-dns-updates.patch Description: Binary data __

Re: [SSSD] [PATCH] Fix LOCAL domain lookups

2012-08-14 Thread Pavel Březina
On 08/13/2012 11:42 AM, Jakub Hrozek wrote: On Mon, Aug 13, 2012 at 11:10:36AM +0200, Jakub Hrozek wrote: On Fri, Aug 10, 2012 at 09:26:49AM +0200, Pavel Březina wrote: On 08/08/2012 04:24 PM, Jakub Hrozek wrote: On Wed, Aug 08, 2012 at 02:23:04PM +0200, Pavel Březina wrote: This bug was prob

[SSSD] [PATCH] Make TTL configurable for dynamic dns

2012-08-14 Thread James Hogarth
Hi all, Following the discussion previously for #1476 attached is a patch to current master that does the following: 1) If there is no value in sssd.conf it assumes a default of 1200 to fall in line with the current IPA code 2) Adds a new option to sssd.conf - ipa_dyndns_ttl - which is an integ

Re: [SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down.

2012-08-14 Thread Stephen Gallagher
On Tue, 2012-08-14 at 10:33 +0200, Jakub Hrozek wrote: > On Mon, Aug 13, 2012 at 10:16:49PM -0400, Mark London wrote: > > Mark London wrote: > > >Hi - When our primary DNS is unreachable, SSSD with LDAP breaks, > > >or is incredibly slow. I've traced it to the fact that several of > > >the LDAP ti

Re: [SSSD] Only create the SELinux login file if there are mappings on the server

2012-08-14 Thread Pavel Březina
On 08/07/2012 10:01 AM, Jakub Hrozek wrote: On Mon, Aug 06, 2012 at 09:31:07AM -0400, Simo Sorce wrote: On Mon, 2012-08-06 at 10:51 +0200, Jakub Hrozek wrote: [PATCH 1/2] Do not try to remove the temp login file if already renamed write_selinux_string() would try to unlink the temporary file e

Re: [SSSD] [PATCH] Duplicate detection in fail over did not work.

2012-08-14 Thread Ondrej Kos
Nack Working, but hard to read, use typedef for those strcmp casts. O. On 08/13/2012 05:25 PM, Michal Zidek wrote: On 08/13/2012 11:13 AM, Jakub Hrozek wrote: On Fri, Aug 10, 2012 at 07:12:38PM +0200, Jakub Hrozek wrote: On Fri, Aug 10, 2012 at 07:09:13PM +0200, Jakub Hrozek wrote: On Fri,

Re: [SSSD] Default LDAP/SSSD timeouts are too slow if primary DNS is down.

2012-08-14 Thread Jakub Hrozek
On Mon, Aug 13, 2012 at 10:16:49PM -0400, Mark London wrote: > Mark London wrote: > >Hi - When our primary DNS is unreachable, SSSD with LDAP breaks, > >or is incredibly slow. I've traced it to the fact that several of > >the LDAP timeout values are 6 seconds. This is not long enough, > >because