Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Dmitri Pal
On 11/06/2012 02:09 PM, Simo Sorce wrote: > On Tue, 2012-11-06 at 14:00 -0500, Stephen Gallagher wrote: >> On Tue 06 Nov 2012 01:54:46 PM EST, Dmitri Pal wrote: >>> On 11/06/2012 01:45 PM, Simo Sorce wrote: • If all lists are empty, access is granted • If

Re: [SSSD] [PATCH] sss_cache: Remove fastcache even if sssd is not running.

2012-11-06 Thread Sumit Bose
Hi, > + > +errno_t sss_br_lock_file(int fd, size_t start, size_t len, > + int retries, useconds_t wait) > +{ > +int ret; > +struct flock lock; > +int retries_left; > + > +lock.l_type = F_WRLCK; > +lock.l_whence = SEEK_SET; > +lock.l_start = start; >

Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Simo Sorce
On Tue, 2012-11-06 at 14:00 -0500, Stephen Gallagher wrote: > On Tue 06 Nov 2012 01:54:46 PM EST, Dmitri Pal wrote: > > On 11/06/2012 01:45 PM, Simo Sorce wrote: > >> • If all lists are empty, access is granted > >> • If any list is provided, the order of evaluatio

Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Stephen Gallagher
On Tue 06 Nov 2012 01:54:46 PM EST, Dmitri Pal wrote: On 11/06/2012 01:45 PM, Simo Sorce wrote: • If all lists are empty, access is granted • If any list is provided, the order of evaluation is allow,deny. This means that any matching deny rule

Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Dmitri Pal
On 11/06/2012 01:45 PM, Simo Sorce wrote: > On Tue, 2012-11-06 at 13:12 -0500, Dmitri Pal wrote: >> On 11/06/2012 10:50 AM, Simo Sorce wrote: >>> Just to be clear this is how I see it: >>> >>> config file | confdb | result >>> -- >>>

Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Simo Sorce
On Tue, 2012-11-06 at 13:12 -0500, Dmitri Pal wrote: > On 11/06/2012 10:50 AM, Simo Sorce wrote: > > Just to be clear this is how I see it: > > > > config file | confdb | result > > -- > > no attr | 'ALL' | all user can

Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Dmitri Pal
On 11/06/2012 10:50 AM, Simo Sorce wrote: > On Tue, 2012-11-06 at 10:26 -0500, Dmitri Pal wrote: >> On 11/06/2012 09:24 AM, Simo Sorce wrote: >>> On Tue, 2012-11-06 at 15:10 +0100, Ondrej Kos wrote: On 11/06/2012 02:52 PM, Simo Sorce wrote: > On Tue, 2012-11-06 at 14:46 +0100, Ondrej Kos w

Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Simo Sorce
On Tue, 2012-11-06 at 10:26 -0500, Dmitri Pal wrote: > On 11/06/2012 09:24 AM, Simo Sorce wrote: > > On Tue, 2012-11-06 at 15:10 +0100, Ondrej Kos wrote: > >> On 11/06/2012 02:52 PM, Simo Sorce wrote: > >>> On Tue, 2012-11-06 at 14:46 +0100, Ondrej Kos wrote: > On 11/02/2012 05:32 PM, Simo Sor

Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Dmitri Pal
On 11/06/2012 09:24 AM, Simo Sorce wrote: > On Tue, 2012-11-06 at 15:10 +0100, Ondrej Kos wrote: >> On 11/06/2012 02:52 PM, Simo Sorce wrote: >>> On Tue, 2012-11-06 at 14:46 +0100, Ondrej Kos wrote: On 11/02/2012 05:32 PM, Simo Sorce wrote: > On Fri, 2012-11-02 at 10:10 -0400, Dmitri Pal w

Re: [SSSD] [PATCH] sss_dp_get_domains_send(): set ret to EAGAIN if force is true

2012-11-06 Thread Sumit Bose
On Tue, Nov 06, 2012 at 03:36:37PM +0100, Pavel Březina wrote: > On 11/05/2012 06:16 PM, Sumit Bose wrote: > >On Mon, Nov 05, 2012 at 05:54:10PM +0100, Pavel Březina wrote: > >>I found this bug when setting my own trust environment. > >> > >>I was unable to match username@subdomain to subdomain. Th

Re: [SSSD] [PATCH] sss_dp_get_domains_send(): set ret to EAGAIN if force is true

2012-11-06 Thread Pavel Březina
On 11/05/2012 06:16 PM, Sumit Bose wrote: On Mon, Nov 05, 2012 at 05:54:10PM +0100, Pavel Březina wrote: I found this bug when setting my own trust environment. I was unable to match username@subdomain to subdomain. This patch puts me a step forward. I can match the subdomain now, but I can't g

Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Simo Sorce
On Tue, 2012-11-06 at 15:10 +0100, Ondrej Kos wrote: > On 11/06/2012 02:52 PM, Simo Sorce wrote: > > On Tue, 2012-11-06 at 14:46 +0100, Ondrej Kos wrote: > >> On 11/02/2012 05:32 PM, Simo Sorce wrote: > >>> On Fri, 2012-11-02 at 10:10 -0400, Dmitri Pal wrote: > On 11/02/2012 09:50 AM, Stef Wal

Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Ondrej Kos
On 11/06/2012 02:52 PM, Simo Sorce wrote: On Tue, 2012-11-06 at 14:46 +0100, Ondrej Kos wrote: On 11/02/2012 05:32 PM, Simo Sorce wrote: On Fri, 2012-11-02 at 10:10 -0400, Dmitri Pal wrote: On 11/02/2012 09:50 AM, Stef Walter wrote: On 11/02/2012 01:57 PM, Dmitri Pal wrote: First let us defi

[SSSD] [PATCH] MAN: Fix validation error caused by bad 'ca' translation

2012-11-06 Thread Stephen Gallagher
A manpage translation was accepted that violated the DTD. As a result, the Catalan translation for sssd-simple(5) was failing. This patch should fix it. >From 4e2b8e8792bebd0250c9f6057dcba6ef190ca714 Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Tue, 6 Nov 2012 08:51:35 -0500 Subject: [

Re: [SSSD] [PATCHES] Fix assorted issues around the 'force_timeout' option

2012-11-06 Thread Stephen Gallagher
On Tue 06 Nov 2012 02:44:09 AM EST, Jakub Hrozek wrote: Patch 0003: Fix the SSSDConfig API so that the 'force_timeout' option is accepted for services and domains (or else consumers of the API like ipa-client or authconfig might throw 'unknown option' errors). =

Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Simo Sorce
On Tue, 2012-11-06 at 14:46 +0100, Ondrej Kos wrote: > On 11/02/2012 05:32 PM, Simo Sorce wrote: > > On Fri, 2012-11-02 at 10:10 -0400, Dmitri Pal wrote: > >> On 11/02/2012 09:50 AM, Stef Walter wrote: > >>> On 11/02/2012 01:57 PM, Dmitri Pal wrote: > First let us define a general rule about h

Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Ondrej Kos
On 11/02/2012 05:32 PM, Simo Sorce wrote: On Fri, 2012-11-02 at 10:10 -0400, Dmitri Pal wrote: On 11/02/2012 09:50 AM, Stef Walter wrote: On 11/02/2012 01:57 PM, Dmitri Pal wrote: First let us define a general rule about how we treat the cases: X = Is it treated as X being undefined or X havin

Re: [SSSD] Unexpected behavior with 'simple_allow_users ='

2012-11-06 Thread Ondrej Kos
On 11/02/2012 11:50 AM, Jakub Hrozek wrote: On Thu, Nov 01, 2012 at 03:04:11PM -0400, Simo Sorce wrote: It's because the DB cannot hold an empty value. With the current interface empty value = No value. You can easily check for an option being present with confdb_get_param(). Then look at its

Re: [SSSD] [PATCH] sss_cache: Remove fastcache even if sssd is not running.

2012-11-06 Thread Jakub Hrozek
On Mon, Nov 05, 2012 at 01:26:04PM +0100, Michal Židek wrote: > On 11/01/2012 02:45 PM, Simo Sorce wrote: > >On Thu, 2012-11-01 at 09:14 -0400, Simo Sorce wrote: > >>On Thu, 2012-11-01 at 11:19 +0100, Michal Židek wrote: > >>>On 11/01/2012 06:54 AM, Simo Sorce wrote: > On Wed, 2012-10-31 at 12:

Re: [SSSD] [PATCH] sss_cache: Multiple domains not handled properly

2012-11-06 Thread Jakub Hrozek
On Mon, Nov 05, 2012 at 12:51:57PM +0100, Michal Židek wrote: > On 11/01/2012 12:09 PM, Jakub Hrozek wrote: > >On Thu, Oct 25, 2012 at 06:53:47PM +0200, Michal Židek wrote: > >>I found this bug while working on: > >>https://fedorahosted.org/sssd/ticket/1584 > >> > >>If no objects for deletion were

Re: [SSSD] [PATCH] RPMS: Move sss_cache tool to main package

2012-11-06 Thread Jakub Hrozek
On Thu, Oct 18, 2012 at 08:03:19PM +0200, Jakub Hrozek wrote: > On Thu, Oct 18, 2012 at 07:48:38PM +0200, Jakub Hrozek wrote: > > On Thu, Oct 18, 2012 at 04:28:52PM +0200, Ondrej Kos wrote: > > > On 10/17/2012 03:52 PM, Stephen Gallagher wrote: > > > >Fixes https://fedorahosted.org/sssd/ticket/1481

Re: [SSSD] [PATCH] exit original process after sssd is initialized

2012-11-06 Thread Jakub Hrozek
On Mon, Nov 05, 2012 at 08:48:19AM -0500, Simo Sorce wrote: > On Sat, 2012-11-03 at 12:37 +0100, Pavel Březina wrote: > > Hi, > > there were some more coding style issues (mostly missing space after > > comma). When I was in it I changed all debug levels there to macros. > > There was actually a

Re: [SSSD] [PATCH] sss_dp_get_domains_send(): set ret to EAGAIN if force is true

2012-11-06 Thread Pavel Březina
On 11/05/2012 09:18 PM, Simo Sorce wrote: On Mon, 2012-11-05 at 18:16 +0100, Sumit Bose wrote: On Mon, Nov 05, 2012 at 05:54:10PM +0100, Pavel Březina wrote: I found this bug when setting my own trust environment. I was unable to match username@subdomain to subdomain. This patch puts me a step

Re: [SSSD] [PATCH 4/5] Streamline ipa_account_info handler

2012-11-06 Thread Jakub Hrozek
On Wed, Oct 31, 2012 at 06:37:34PM -0400, Simo Sorce wrote: > --- > src/providers/ipa/ipa_id.c | 128 > > 1 files changed, 69 insertions(+), 59 deletions(-) > > diff --git a/src/providers/ipa/ipa_id.c b/src/providers/ipa/ipa_id.c > index > ab0d89240

Re: [SSSD] [PATCH 5/5] Use an entry type mask macro to filter entry types

2012-11-06 Thread Jakub Hrozek
On Wed, Oct 31, 2012 at 06:37:35PM -0400, Simo Sorce wrote: > Avoids hardcodinf magic numbers everywhere and selfdocuments why a > mask is being applied. > --- > src/providers/data_provider.h |1 + > src/providers/ipa/ipa_id.c|2 +- > src/providers/ipa/ipa_subdomains_id

Re: [SSSD] [PATCH 2/5] Fix ipa_subdomain_id names and tevent_req style

2012-11-06 Thread Jakub Hrozek
On Wed, Oct 31, 2012 at 06:37:32PM -0400, Simo Sorce wrote: > --- > src/providers/ipa/ipa_id.c|5 +- > src/providers/ipa/ipa_id.h| 10 ++-- > src/providers/ipa/ipa_subdomains_id.c | 73 > + > 3 files changed, 36 insertions(+), 52 del

Re: [SSSD] [PATCH 3/5] Fix tevent_req style for get_netgroup in ipa_id

2012-11-06 Thread Jakub Hrozek
On Wed, Oct 31, 2012 at 06:37:33PM -0400, Simo Sorce wrote: > Also do not intermix two tevent_req sequences > --- > src/providers/ipa/ipa_id.c | 151 > +--- > 1 files changed, 71 insertions(+), 80 deletions(-) > The code seems fine to me but can you just

Re: [SSSD] [PATCH 1/5] Fix tevent_req style for krb5_auth

2012-11-06 Thread Jakub Hrozek
On Wed, Oct 31, 2012 at 06:37:31PM -0400, Simo Sorce wrote: > No functionality changes, > just make the code respect the tevent_req style and naming conventions > and enhance readability by adding some helper functions. > --- > src/providers/krb5/krb5_access.c |6 +- > src/providers/krb5/k

Re: [SSSD] [PATCH 0/5] Fix various tevent_req style and naming issues

2012-11-06 Thread Jakub Hrozek
On Wed, Oct 31, 2012 at 06:37:30PM -0400, Simo Sorce wrote: > While I was working on an unrelated patchset I couldn't help fixing some > of the code to properly use tevent_req style and naming conventions. > I think the krb5_auth code is so old that it predates the tevent_req style. Up until now