[SSSD] ldap shadowLastChange update patch

Thanks, Jim Collins 0001-ldap-only-update-shadowLastChange-when-password-chan.patch Description: Binary data ___ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

Re: [SSSD] [PATCH] AD: Write out domain-realm mappings

On Wed, Jun 26, 2013 at 11:37:04PM +0200, Jakub Hrozek wrote: > I'm sorry for this bug, I initially tested on a VM where I manually > created the domain-realm mappings but then forgot to remove them. The > attached patches install domain-realm mappings in the same way IPA > provider does. > > If t

Re: [SSSD] [PATCH] Do not try to set password when authtok_length is zero

On 06/25/2013 02:55 PM, Lukas Slebodnik wrote: I tried this patch and you did not reach krb5 authentication in krb5_child, but reason is: #>[krb5_auth_send] (0x0020): Wrong authtok type for user [usersssd01]. #> Expected [1], got [0] So it failed in sssd_be I tried next

Re: [SSSD] [PATCH] sudo responder: use different callback for oob refresh

On 06/26/2013 05:32 PM, Lukas Slebodnik wrote: On (26/06/13 10:49), Pavel Březina wrote: https://fedorahosted.org/sssd/ticket/1693 The reason why sudo show different messages is that SSSD crashes (SIGABRT from talloc) when out of band refresh is finished. For some reason, Nikolai's test is much

Re: [SSSD] [PATCHES] SSH: When host is removed from LDAP remove it from the, cache as well

On 06/18/2013 05:07 PM, Jan Cholasta wrote: On 12.6.2013 11:46, Pavel Březina wrote: +if (state->count != 1) { +ret = sysdb_delete_ssh_host(state->domain->sysdb, state->domain, +state->name); +if (ret != EOK && ret != ENOENT) { +

[SSSD] [PATCH] Add missing argument to DEBUG message.

ehlo, Simple patch is attached. LS >From 59c28cdedfe69b18c2565231f108602917c13a37 Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik Date: Thu, 27 Jun 2013 10:44:32 +0200 Subject: [PATCH] Add missing argument to DEBUG message. --- src/util/sss_krb5.c | 2 +- 1 file changed, 1 insertion(+), 1 delet

Re: [SSSD] [PATCH] Add missing argument to DEBUG message.

On 06/27/2013 10:49 AM, Lukas Slebodnik wrote: ehlo, Simple patch is attached. LS Obvious ack. ___ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

Re: [SSSD] [PATCH] Do not copy special files when creating homedir

On 06/26/2013 03:16 PM, Ondrej Kos wrote: Hi, Attached find a patch addressing sssd trac issue https://fedorahosted.org/sssd/ticket/1778 Ondra The patch works as expected, I have just a comment to debug message. +/* Is a special file */ +DEBUG(SSSDBG_FUNC_DATA, ("Cannot copy

Re: [SSSD] [PATCH] sudo responder: use different callback for oob refresh

On (27/06/13 10:20), Pavel Březina wrote: >On 06/26/2013 05:32 PM, Lukas Slebodnik wrote: >>On (26/06/13 10:49), Pavel Březina wrote: >>>https://fedorahosted.org/sssd/ticket/1693 >>> >>>The reason why sudo show different messages is that SSSD crashes >>>(SIGABRT from talloc) when out of band refres

Re: [SSSD] [PATCH] Do not copy special files when creating homedir

On 06/27/2013 12:48 PM, Pavel Březina wrote: On 06/26/2013 03:16 PM, Ondrej Kos wrote: Hi, Attached find a patch addressing sssd trac issue https://fedorahosted.org/sssd/ticket/1778 Ondra The patch works as expected, I have just a comment to debug message. +/* Is a special file */

Re: [SSSD] [PATCH] Do not try to set password when authtok_length is zero

On 06/25/2013 02:55 PM, Lukas Slebodnik wrote: On (24/06/13 17:04), Ondrej Kos wrote: The problem here wasn't in returned error code, but in faultly read DBUS message, due to condition in sss_authtok_set_string. When password is empty, it passes 0 as length, which is misinterpreted, and the fun

[SSSD] [PATCH] KRB5: guess UPN for subdomain users

Hi, during testing I found out that we mishandle UPNs for subdomain users when using Kerberos authentication. If there is no userPrincipal attribute we guess based on username@REALM. But for subdomain users the username is already qualified, so so you end up with username@DOMAIN@REALM. Currently

Re: [SSSD] [PATCH] Do not try to set password when authtok_length is zero

On 06/27/2013 01:17 PM, Pavel Březina wrote: On 06/25/2013 02:55 PM, Lukas Slebodnik wrote: On (24/06/13 17:04), Ondrej Kos wrote: The problem here wasn't in returned error code, but in faultly read DBUS message, due to condition in sss_authtok_set_string. When password is empty, it passes 0 a

Re: [SSSD] [PATCH] Do not try to set password when authtok_length is zero

On Thu, Jun 27, 2013 at 01:32:59PM +0200, Ondrej Kos wrote: > On 06/27/2013 01:17 PM, Pavel Březina wrote: > >On 06/25/2013 02:55 PM, Lukas Slebodnik wrote: > >>On (24/06/13 17:04), Ondrej Kos wrote: > >>>The problem here wasn't in returned error code, but in faultly read > >>>DBUS message, due to

Re: [SSSD] [PATCH] AD: Write out domain-realm mappings

On Thu, Jun 27, 2013 at 09:53:42AM +0200, Sumit Bose wrote: > > +static errno_t > > +ipa_write_subdom_mappings(struct sss_domain_info *domain) > > +{ > > +errno_t ret; > > + > > +ret = sss_write_domain_mappings(domain); > > +if (ret) { > > +DEBUG(SSSDBG_OP_FAILURE, ("couldn't wr

Re: [SSSD] [PATCH] sudo responder: use different callback for oob refresh

On Thu, Jun 27, 2013 at 01:04:48PM +0200, Lukas Slebodnik wrote: > On (27/06/13 10:20), Pavel Březina wrote: > >On 06/26/2013 05:32 PM, Lukas Slebodnik wrote: > >>On (26/06/13 10:49), Pavel Březina wrote: > >>>https://fedorahosted.org/sssd/ticket/1693 > >>> > >>>The reason why sudo show different m

Re: [SSSD] ldap shadowLastChange update patch

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 06/26/2013 10:02 PM, j...@collins-fam.com wrote: > > > Thanks, > > Jim Collins > Patch looks good to me by inspection, except that it violates our style guidelines. Please reflow the IF statement so that it will fit in 79 characters. -BEGI

Re: [SSSD] [PATCH] Do not copy special files when creating homedir

On 06/27/2013 01:09 PM, Ondrej Kos wrote: On 06/27/2013 12:48 PM, Pavel Březina wrote: On 06/26/2013 03:16 PM, Ondrej Kos wrote: Hi, Attached find a patch addressing sssd trac issue https://fedorahosted.org/sssd/ticket/1778 Ondra The patch works as expected, I have just a comment to debug m

Re: [SSSD] [PATCH] Do not try to set password when authtok_length is zero

On 06/27/2013 01:39 PM, Sumit Bose wrote: On Thu, Jun 27, 2013 at 01:32:59PM +0200, Ondrej Kos wrote: On 06/27/2013 01:17 PM, Pavel Březina wrote: On 06/25/2013 02:55 PM, Lukas Slebodnik wrote: On (24/06/13 17:04), Ondrej Kos wrote: The problem here wasn't in returned error code, but in fault

Re: [SSSD] [PATCH] KRB5: guess UPN for subdomain users

On Thu, 2013-06-27 at 13:27 +0200, Jakub Hrozek wrote: > Hi, > > during testing I found out that we mishandle UPNs for subdomain users > when using Kerberos authentication. > > If there is no userPrincipal attribute we guess based on username@REALM. > But for subdomain users the username is alrea

Re: [SSSD] [PATCH] AD: Write out domain-realm mappings

On Thu, Jun 27, 2013 at 01:44:41PM +0200, Jakub Hrozek wrote: > On Thu, Jun 27, 2013 at 09:53:42AM +0200, Sumit Bose wrote: > > > +static errno_t > > > +ipa_write_subdom_mappings(struct sss_domain_info *domain) > > > +{ > > > +errno_t ret; > > > + > > > +ret = sss_write_domain_mappings(doma

Re: [SSSD] [PATCH] KRB5: guess UPN for subdomain users

On Thu, Jun 27, 2013 at 08:58:19AM -0400, Simo Sorce wrote: > On Thu, 2013-06-27 at 13:27 +0200, Jakub Hrozek wrote: > > Hi, > > > > during testing I found out that we mishandle UPNs for subdomain users > > when using Kerberos authentication. > > > > If there is no userPrincipal attribute we gues

Re: [SSSD] [PATCH] KRB5: guess UPN for subdomain users

On Thu, Jun 27, 2013 at 01:27:28PM +0200, Jakub Hrozek wrote: > Hi, > > during testing I found out that we mishandle UPNs for subdomain users > when using Kerberos authentication. > > If there is no userPrincipal attribute we guess based on username@REALM. > But for subdomain users the username i

Re: [SSSD] [PATCH] KRB5: guess UPN for subdomain users

On Thu, Jun 27, 2013 at 04:00:28PM +0200, Sumit Bose wrote: > On Thu, Jun 27, 2013 at 01:27:28PM +0200, Jakub Hrozek wrote: > > Hi, > > > > during testing I found out that we mishandle UPNs for subdomain users > > when using Kerberos authentication. > > > > If there is no userPrincipal attribute

Re: [SSSD] [PATCH] IPA: Do not download or store the member attribute of host groups

On Tue, Jun 25, 2013 at 08:38:21AM -0400, Stephen Gallagher wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > On 06/25/2013 04:41 AM, Jakub Hrozek wrote: > > On Sun, Jun 23, 2013 at 09:12:01PM +0200, Jakub Hrozek wrote: > >> The attached patch applies on both master and sssd-1-9 and > >

Re: [SSSD] [PATCH] KRB5: guess UPN for subdomain users

On Thu, Jun 27, 2013 at 04:37:09PM +0200, Jakub Hrozek wrote: > On Thu, Jun 27, 2013 at 04:00:28PM +0200, Sumit Bose wrote: > > On Thu, Jun 27, 2013 at 01:27:28PM +0200, Jakub Hrozek wrote: > > > Hi, > > > > > > during testing I found out that we mishandle UPNs for subdomain users > > > when using

Re: [SSSD] [PATCH] KRB5: guess UPN for subdomain users

On Thu, Jun 27, 2013 at 05:09:52PM +0200, Sumit Bose wrote: > On Thu, Jun 27, 2013 at 04:37:09PM +0200, Jakub Hrozek wrote: > > On Thu, Jun 27, 2013 at 04:00:28PM +0200, Sumit Bose wrote: > > > On Thu, Jun 27, 2013 at 01:27:28PM +0200, Jakub Hrozek wrote: > > > > Hi, > > > > > > > > during testing

Re: [SSSD] [PATCH] KRB5: guess UPN for subdomain users

On Thu, Jun 27, 2013 at 05:23:58PM +0200, Sumit Bose wrote: > On Thu, Jun 27, 2013 at 05:09:52PM +0200, Sumit Bose wrote: > > On Thu, Jun 27, 2013 at 04:37:09PM +0200, Jakub Hrozek wrote: > > > On Thu, Jun 27, 2013 at 04:00:28PM +0200, Sumit Bose wrote: > > > > On Thu, Jun 27, 2013 at 01:27:28PM +0

Re: [SSSD] [PATCH] KRB5: guess UPN for subdomain users

On Thu, Jun 27, 2013 at 06:23:22PM +0200, Jakub Hrozek wrote: > On Thu, Jun 27, 2013 at 05:23:58PM +0200, Sumit Bose wrote: > > On Thu, Jun 27, 2013 at 05:09:52PM +0200, Sumit Bose wrote: > > > On Thu, Jun 27, 2013 at 04:37:09PM +0200, Jakub Hrozek wrote: > > > > On Thu, Jun 27, 2013 at 04:00:28PM

Re: [SSSD] [PATCH] KRB5: guess UPN for subdomain users

On Thu, Jun 27, 2013 at 06:38:02PM +0200, Sumit Bose wrote: > On Thu, Jun 27, 2013 at 06:23:22PM +0200, Jakub Hrozek wrote: > > On Thu, Jun 27, 2013 at 05:23:58PM +0200, Sumit Bose wrote: > > > On Thu, Jun 27, 2013 at 05:09:52PM +0200, Sumit Bose wrote: > > > > On Thu, Jun 27, 2013 at 04:37:09PM +0

Re: [SSSD] [PATCH] AD: Write out domain-realm mappings

On Thu, Jun 27, 2013 at 03:03:51PM +0200, Sumit Bose wrote: > On Thu, Jun 27, 2013 at 01:44:41PM +0200, Jakub Hrozek wrote: > > On Thu, Jun 27, 2013 at 09:53:42AM +0200, Sumit Bose wrote: > > > > +static errno_t > > > > +ipa_write_subdom_mappings(struct sss_domain_info *domain) > > > > +{ > > > > +

[SSSD] [PATCH] Fix compilation warning

Sorry, one of my patches introduced a compilation warning: CC src/providers/krb5/krb5_child_handler.lo /home/remote/jhrozek/devel/sssd/src/providers/krb5/krb5_common.c:928:14: warning: assigning to 'char *' from 'const char *' discards qualifiers [-Wincompatible-pointer-types-discard

Re: [SSSD] [PATCH] Do not copy special files when creating homedir

On Thu, Jun 27, 2013 at 02:02:44PM +0200, Pavel Březina wrote: > On 06/27/2013 01:09 PM, Ondrej Kos wrote: > >On 06/27/2013 12:48 PM, Pavel Březina wrote: > >>On 06/26/2013 03:16 PM, Ondrej Kos wrote: > >>>Hi, > >>> > >>>Attached find a patch addressing sssd trac issue > >>>https://fedorahosted.org

Re: [SSSD] [PATCH] Add missing argument to DEBUG message.

On Thu, Jun 27, 2013 at 11:48:56AM +0200, Pavel Březina wrote: > On 06/27/2013 10:49 AM, Lukas Slebodnik wrote: > >ehlo, > > > >Simple patch is attached. > > > >LS > > Obvious ack. Rebased on top of the current master and pushed to master. ___ sssd-deve

Re: [SSSD] [PATCHES] SSH: When host is removed from LDAP remove it from the, cache as well

On Thu, Jun 27, 2013 at 10:24:31AM +0200, Pavel Březina wrote: > On 06/18/2013 05:07 PM, Jan Cholasta wrote: > >On 12.6.2013 11:46, Pavel Březina wrote: > >>>+if (state->count != 1) { > >>>+ret = sysdb_delete_ssh_host(state->domain->sysdb, > >>>state->domain, > >>>+

Re: [SSSD] [PATCH] KRB5: guess UPN for subdomain users

On Thu, Jun 27, 2013 at 01:27:28PM +0200, Jakub Hrozek wrote: > I really > don't like the result because parsing out is inherently fragile. I think > we should store the plain username in an additional sysdb attribute, > too. https://fedorahosted.org/sssd/ticket/2006 __

Re: [SSSD] [PATCHES] Do not call sss_cmd_done in function check_cache

On Wed, Jun 26, 2013 at 10:42:01AM +0200, Lukas Slebodnik wrote: > On (25/06/13 15:16), Jakub Hrozek wrote: > >On Tue, Jun 25, 2013 at 10:36:14AM +0200, Lukas Slebodnik wrote: > >> ehlo, > >> > >> Attached patches should fix https://fedorahosted.org/sssd/ticket/1980 > >> > >> The first patch adds

Re: [SSSD] [PATCHES] Do not call sss_cmd_done in function check_cache

On Thu, Jun 27, 2013 at 08:00:02PM +0200, Jakub Hrozek wrote: > On Wed, Jun 26, 2013 at 10:42:01AM +0200, Lukas Slebodnik wrote: > > On (25/06/13 15:16), Jakub Hrozek wrote: > > >On Tue, Jun 25, 2013 at 10:36:14AM +0200, Lukas Slebodnik wrote: > > >> ehlo, > > >> > > >> Attached patches should fix

Re: [SSSD] Access denied by pam_sss(sshd:account)

I have two more questions for my own knowledge and maybe those of others : * 1st question : If 2 users, a local user called "aminata" and a domain user "aminata@domain" exist, how does sssd choose who we are when we ssh in the system with a username of "aminata" and the re_expressions is set to: