Re: [SSSD] [PATCH] proxy: Do not try to store same alias twice

2014-11-12 Thread Pavel Reichl
On 11/06/2014 07:48 PM, Michal Židek wrote: 0001-proxy-Do-not-try-to-store-same-alias-twice.patch From f6c84c306cf921344ad2b23040588040ac407186 Mon Sep 17 00:00:00 2001 From: Michal Zidek Date: Fri, 31 Oct 2014 16:39:25 +0100 Subject: [PATCH 1/2] proxy: Do not try to store same alias twice L

Re: [SSSD] [PATCH] Move ccache operations to krb5_child, allow the krb5_auth code to run unprivileged

2014-11-12 Thread Lukas Slebodnik
On (11/11/14 22:37), Jakub Hrozek wrote: >On Tue, Nov 11, 2014 at 09:11:45PM +0100, Jakub Hrozek wrote: >> On Tue, Nov 11, 2014 at 06:23:24PM +0100, Lukas Slebodnik wrote: >> > On (11/11/14 13:45), Jakub Hrozek wrote: >> > >On Tue, Nov 11, 2014 at 11:15:30AM +0100, Jakub Hrozek wrote: >> > >> Can y

[SSSD] Problems with SSSD RPM subpackage ordering

2014-11-12 Thread Jakub Hrozek
Hi, a downstream installation test was failing with our recent packaging changes that involve creatig the sssd user. It turns out that sssd-krb5-common (which contains krb5_child, owned by the sssd user) got installed by yum before sssd-common, which creates the sssd user during the %pre scriptlet

Re: [SSSD] Problems with SSSD RPM subpackage ordering

2014-11-12 Thread Alexander Bokovoy
On Wed, 12 Nov 2014, Jakub Hrozek wrote: Hi, a downstream installation test was failing with our recent packaging changes that involve creatig the sssd user. It turns out that sssd-krb5-common (which contains krb5_child, owned by the sssd user) got installed by yum before sssd-common, which crea

Re: [SSSD] Problems with SSSD RPM subpackage ordering

2014-11-12 Thread Jan Pazdziora
On Wed, Nov 12, 2014 at 03:37:42PM +0200, Alexander Bokovoy wrote: > > > >Also, does anyone spot an issue with our Requires? I couldn't see any, > >but maybe I just overlooked it.. > > If you are requiring a package to be installed before this one is > installed, it should be in PreReq:, not in Req

Re: [SSSD] [PATCH] proxy: Do not try to store same alias twice

2014-11-12 Thread Michal Židek
On 11/11/2014 01:37 PM, Jakub Hrozek wrote: On Thu, Nov 06, 2014 at 07:48:20PM +0100, Michal Židek wrote: On 11/06/2014 07:43 PM, Michal Židek wrote: On 11/05/2014 04:53 PM, Michal Židek wrote: I found this bug while working on https://fedorahosted.org/sssd/ticket/2461 It turned out that not

Re: [SSSD] Problems with SSSD RPM subpackage ordering

2014-11-12 Thread Jakub Hrozek
On Wed, Nov 12, 2014 at 02:48:28PM +0100, Jan Pazdziora wrote: > On Wed, Nov 12, 2014 at 03:37:42PM +0200, Alexander Bokovoy wrote: > > > > > >Also, does anyone spot an issue with our Requires? I couldn't see any, > > >but maybe I just overlooked it.. > > > > If you are requiring a package to be in

[SSSD] [PATCH] sss_client: Return a different error when sssd is not running

2014-11-12 Thread Lukas Slebodnik
ehlo, The sss nss plugin is present in nsswitch by default due to glibc caching and problem with long living applications (e.g. GNOME). The SSSD nss plugin should behave as if it was functioning but had no data even thought sssd is not running. The errors have to be passed from nss plugin up to th

Re: [SSSD] [PATCH] LDAP: Disable token groups by default

2014-11-12 Thread Michal Židek
On 11/11/2014 01:26 PM, Lukas Slebodnik wrote: On (07/11/14 20:02), Michal Židek wrote: On 11/07/2014 02:03 PM, Lukas Slebodnik wrote: Active Directory Server 2008 and later. -Default:

Re: [SSSD] [PATCH] MAN: Clarify usage of groups search base with tokengroups

2014-11-12 Thread Lukas Slebodnik
On (11/11/14 16:05), Dan Lavu wrote: >I think this explains the feature better. > >From 0504e88c570f1f5a3957008041940c2be43a Mon Sep 17 00:00:00 2001 >From: Dan Lavu >Date: Tue, 11 Nov 2014 15:46:51 -0500 >Subject: [PATCH] Man page edit for ldap_use_tokengroups > https://fedorahosted.org/sssd/

Re: [SSSD] Problems with SSSD RPM subpackage ordering

2014-11-12 Thread Jan Pazdziora
On Wed, Nov 12, 2014 at 03:02:43PM +0100, Jakub Hrozek wrote: > On Wed, Nov 12, 2014 at 02:48:28PM +0100, Jan Pazdziora wrote: > > > > I think Requires(pre) is the recommended syntax these days. It helps > > people remember that they can also use it for other scriptlet times if > > they need to. >

Re: [SSSD] Problems with SSSD RPM subpackage ordering

2014-11-12 Thread Jakub Hrozek
On Wed, Nov 12, 2014 at 03:35:43PM +0100, Jan Pazdziora wrote: > On Wed, Nov 12, 2014 at 03:02:43PM +0100, Jakub Hrozek wrote: > > On Wed, Nov 12, 2014 at 02:48:28PM +0100, Jan Pazdziora wrote: > > > > > > I think Requires(pre) is the recommended syntax these days. It helps > > > people remember t

Re: [SSSD] [PATCH] Move ccache operations to krb5_child, allow the krb5_auth code to run unprivileged

2014-11-12 Thread Jakub Hrozek
On Wed, Nov 12, 2014 at 01:45:26PM +0100, Lukas Slebodnik wrote: > On (11/11/14 22:37), Jakub Hrozek wrote: > >On Tue, Nov 11, 2014 at 09:11:45PM +0100, Jakub Hrozek wrote: > >> On Tue, Nov 11, 2014 at 06:23:24PM +0100, Lukas Slebodnik wrote: > >> > On (11/11/14 13:45), Jakub Hrozek wrote: > >> > >

Re: [SSSD] Problems with SSSD RPM subpackage ordering

2014-11-12 Thread Lukas Slebodnik
On (12/11/14 15:42), Jakub Hrozek wrote: >On Wed, Nov 12, 2014 at 03:35:43PM +0100, Jan Pazdziora wrote: >> On Wed, Nov 12, 2014 at 03:02:43PM +0100, Jakub Hrozek wrote: >> > On Wed, Nov 12, 2014 at 02:48:28PM +0100, Jan Pazdziora wrote: >> > > >> > > I think Requires(pre) is the recommended synta

Re: [SSSD] [PATCH] sss_client: Return a different error when sssd is not running

2014-11-12 Thread Simo Sorce
I would create a helper function to be called on return that transforms the error accordingly. This will allow to write the code _and_ the comment once. The comment should be changed to something like this in either case: /* When sssd is stopped return a safe error code as if sss was not configur

[SSSD] [PATCH] MAN: Update case_sensitive=Preserving in man pages.

2014-11-12 Thread Michal Židek
Hello, some man page fixes. https://fedorahosted.org/sssd/ticket/2462 Michal >From 77a40c49602cab00d3179bf266a01eddaf1f60de Mon Sep 17 00:00:00 2001 From: Michal Zidek Date: Wed, 12 Nov 2014 15:47:11 +0100 Subject: [PATCH] MAN: Update case_sensitive=Preserving in man pages. https://fedorahost

Re: [SSSD] Problems with SSSD RPM subpackage ordering

2014-11-12 Thread Jakub Hrozek
On Wed, Nov 12, 2014 at 03:02:43PM +0100, Jakub Hrozek wrote: > But thank you both! Sumit also found out that there might be a loop between > /usr/lib/sssd/libsss_ldap_common.so and > /usr/lib/sssd/libsss_krb5_common.so ... btw this was introdued in cc1c033c34b5f816b633d27a21aefbf811a7cf72, I test

Re: [SSSD] [PATCH] sss_client: Return a different error when sssd is not running

2014-11-12 Thread Lukas Slebodnik
On (12/11/14 10:00), Simo Sorce wrote: >I would create a helper function to be called on return that transforms the >error >accordingly. This will allow to write the code _and_ the comment once. > In this case, Stephan's patch is better https://bugzilla.redhat.com/attachment.cgi?id=788567 >The co

[SSSD] RFC: A template for design documents

2014-11-12 Thread Jakub Hrozek
Hi, I created a proposed template for our design documents: https://fedorahosted.org/sssd/wiki/PageTemplates/FeatureDesign For your convenience, I'll also paste the full page text at the bottom of the e-mail. As you can probably notice, the template is very similar to design text Sumit started s

Re: [SSSD] [PATCH] Move ccache operations to krb5_child, allow the krb5_auth code to run unprivileged

2014-11-12 Thread Lukas Slebodnik
On (12/11/14 15:44), Jakub Hrozek wrote: >On Wed, Nov 12, 2014 at 01:45:26PM +0100, Lukas Slebodnik wrote: >> On (11/11/14 22:37), Jakub Hrozek wrote: >> >On Tue, Nov 11, 2014 at 09:11:45PM +0100, Jakub Hrozek wrote: >> >> On Tue, Nov 11, 2014 at 06:23:24PM +0100, Lukas Slebodnik wrote: >> >> > On

Re: [SSSD] [PATCH] LDAP: Disable token groups by default

2014-11-12 Thread Jakub Hrozek
On Wed, Nov 12, 2014 at 03:26:38PM +0100, Michal Židek wrote: > On 11/11/2014 01:26 PM, Lukas Slebodnik wrote: > >On (07/11/14 20:02), Michal Židek wrote: > >>On 11/07/2014 02:03 PM, Lukas Slebodnik wrote: > >>>Active Directory Server 2008 and later. > >>>

[SSSD] Removing uidNumberfrom SSSD Search Filter

2014-11-12 Thread Nathan Robbins
I am running into an interesting problem with our LDAP server. It’s an old system that has been in place for a long time we cannot change the schema. Basically I can’t change the LDAP server configuration. We do no make use of the uidNumber and gidNumber fields in our configuration. I am try

Re: [SSSD] Removing uidNumberfrom SSSD Search Filter

2014-11-12 Thread Lukas Slebodnik
On (12/11/14 18:02), Nathan Robbins wrote: > >I am running into an interesting problem with our LDAP server. It’s an old >system that has been in place for a long time we cannot change the schema. >Basically I can’t change the LDAP server configuration. > >We do no make use of the uidNumber and

Re: [SSSD] Removing uidNumberfrom SSSD Search Filter

2014-11-12 Thread Nathan Robbins
Ideally, yes, we would have the uidNumber present and populated. In our situation we don’t. That could change in the future. Basically, I was using pam_ldap and it worked for ssh logins, but would not work with samba. I built the user account on the local machine, and set a random password. W

Re: [SSSD] [PATCHES] IPA: check overrrides for IPA users as well

2014-11-12 Thread Sumit Bose
On Mon, Nov 10, 2014 at 03:17:04PM +0100, Sumit Bose wrote: > Hi, > > this patch-set should solve https://fedorahosted.org/sssd/ticket/2481 > "ID Views implementation does not support IPA user&group overrides". It > depends on the already commit patches which bring back ldap_user_uuid > and ldap_g

Re: [SSSD] [PATCH] sss_client: Return a different error when sssd is not running

2014-11-12 Thread Simo Sorce
On Wed, 12 Nov 2014 16:36:00 +0100 Lukas Slebodnik wrote: > On (12/11/14 10:00), Simo Sorce wrote: > >I would create a helper function to be called on return that > >transforms the error accordingly. This will allow to write the code > >_and_ the comment once. > > > In this case, Stephan's patch