[SSSD] Re: [PATCHES] Support starting SSSD from a default configuration

2016-05-11 Thread Lukas Slebodnik
On (10/05/16 17:06), Jakub Hrozek wrote: >On Tue, May 10, 2016 at 09:51:18AM -0400, Stephen Gallagher wrote: >> On 05/10/2016 09:45 AM, Jakub Hrozek wrote: >> > On Tue, Apr 19, 2016 at 02:09:14PM -0400, Stephen Gallagher wrote: >> >> These patches provide support for shipping a default configuratio

[SSSD] [PATCH] TOOLS: Fix warning maybe-uninitialized

2016-05-11 Thread Lukas Slebodnik
ehlo, simple patch is attached. LS >From 7397a9d4498716c32721c0baa466d4e2eaaf3aee Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik Date: Wed, 11 May 2016 15:03:42 +0200 Subject: [PATCH] TOOLS: Fix warning maybe-uninitialized MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfe

[SSSD] Re: [PATCH] IPA: Handle requests for netgroups from trusted domains gracefully

2016-05-11 Thread Jakub Hrozek
On Wed, May 11, 2016 at 01:57:53PM +0200, Pavel Březina wrote: > On 05/06/2016 03:04 PM, Jakub Hrozek wrote: > > To reproduce, just run: > > getent netgroup some_name@trusted.domain > > > > Please see the commit message for explanation. The other solution would > > be the other way around, ie

[SSSD] Re: [PATCH] IPA: Handle requests for netgroups from trusted domains gracefully

2016-05-11 Thread Pavel Březina
On 05/06/2016 03:04 PM, Jakub Hrozek wrote: To reproduce, just run: getent netgroup some_name@trusted.domain Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the

[SSSD] Re: [PATCH 1/6] RESPONDERS: Negcache in resp_ctx

2016-05-11 Thread Lukas Slebodnik
On (11/05/16 10:34), Pavel Březina wrote: >On 05/10/2016 01:32 PM, Pavel Březina wrote: >> On 05/05/2016 04:40 PM, Petr Cech wrote: >> > On 05/05/2016 12:08 PM, Petr Cech wrote: >> > > Hello, >> > > >> > > this patch set moves negative cache from particular context of given >> > > responder to com

[SSSD] Re: [PATCH SET] Make the negcache timeout part of nc_ctx

2016-05-11 Thread Jakub Hrozek
On Wed, May 11, 2016 at 10:34:47AM +0200, Pavel Březina wrote: > On 05/10/2016 01:31 PM, Pavel Březina wrote: > > On 05/02/2016 03:02 PM, Petr Cech wrote: > > > On 04/28/2016 01:39 PM, Pavel Březina wrote: > > > > Hi, just few nitpicks: > > > > > > > > Patch 1 NEGCACHE: Adding timeout to struct ss

[SSSD] Re: [PATCH] Failover to next server if authentication fails

2016-05-11 Thread Jakub Hrozek
On Wed, May 11, 2016 at 11:42:40AM +0200, Jakub Hrozek wrote: > On Wed, May 11, 2016 at 10:24:10AM +0200, Pavel Březina wrote: > > On 05/10/2016 04:00 PM, Jakub Hrozek wrote: > > > On Thu, Apr 21, 2016 at 02:54:21PM +0200, Pavel Březina wrote: > > > > We can fail in sasl_bind_send() with ERR_AUTH_F

[SSSD] Re: [PATCHES] Support starting SSSD from a default configuration

2016-05-11 Thread Jakub Hrozek
On Tue, May 10, 2016 at 05:06:41PM +0200, Jakub Hrozek wrote: > OK, for posterity, attached are the patches (RB: me) that I would like > to commit. > > CI passed as well: > http://sssd-ci.duckdns.org/logs/job/43/08/summary.html > (The failure on debian is in dyndns-tests, which is unrelated) mast

[SSSD] Re: [PATCH] RESPONDERS: Negative caching of local users

2016-05-11 Thread Petr Cech
On 05/11/2016 11:21 AM, Pavel Březina wrote: On 05/11/2016 11:14 AM, Pavel Březina wrote: On 05/10/2016 02:02 PM, Petr Cech wrote: On 05/10/2016 11:57 AM, Pavel Březina wrote: Hi, Hello Pavel, patches works as expected. I would like you to rename few things though... "locals" refers more t

[SSSD] Re: [PATCH] IPA: Handle requests for netgroups from trusted domains gracefully

2016-05-11 Thread Jakub Hrozek
On Fri, May 06, 2016 at 03:04:42PM +0200, Jakub Hrozek wrote: > To reproduce, just run: > getent netgroup some_name@trusted.domain > > Please see the commit message for explanation. The other solution would > be the other way around, ie always go to the code that handles lookups > for trusted

[SSSD] [PATCH] LDAP: Try also the AD access control for IPA users

2016-05-11 Thread Jakub Hrozek
Hi, the attached patch implements Sumit's idea to solve https://fedorahosted.org/sssd/ticket/2927 The user who reported the bug confirmed that the patch works. As an additional improvement, they requested that these results should not be considered when the cache expires, but immediatelly. But ho

[SSSD] Re: [PATCH] Failover to next server if authentication fails

2016-05-11 Thread Jakub Hrozek
On Wed, May 11, 2016 at 10:24:10AM +0200, Pavel Březina wrote: > On 05/10/2016 04:00 PM, Jakub Hrozek wrote: > > On Thu, Apr 21, 2016 at 02:54:21PM +0200, Pavel Březina wrote: > > > We can fail in sasl_bind_send() with ERR_AUTH_FAILED for basically > > > unspecified reason but we do not failover to

[SSSD] Re: [PATCH] RESPONDERS: Negative caching of local users

2016-05-11 Thread Pavel Březina
On 05/11/2016 11:14 AM, Pavel Březina wrote: On 05/10/2016 02:02 PM, Petr Cech wrote: On 05/10/2016 11:57 AM, Pavel Březina wrote: Hi, Hello Pavel, patches works as expected. I would like you to rename few things though... "locals" refers more to a resident and it is not being used in the m

[SSSD] Re: [PATCH] RESPONDERS: Negative caching of local users

2016-05-11 Thread Pavel Březina
On 05/10/2016 02:02 PM, Petr Cech wrote: On 05/10/2016 11:57 AM, Pavel Březina wrote: Hi, Hello Pavel, patches works as expected. I would like you to rename few things though... "locals" refers more to a resident and it is not being used in the meaning of local users and groups. I'd rather u

[SSSD] Re: [PATCH SET] Make the negcache timeout part of nc_ctx

2016-05-11 Thread Pavel Březina
On 05/10/2016 01:31 PM, Pavel Březina wrote: On 05/02/2016 03:02 PM, Petr Cech wrote: On 04/28/2016 01:39 PM, Pavel Březina wrote: Hi, just few nitpicks: Patch 1 NEGCACHE: Adding timeout to struct sss_nc_ctx +int responder_get_neg_timeout_from_confdb(struct confdb_ctx *cdb, +

[SSSD] Re: [PATCH 1/6] RESPONDERS: Negcache in resp_ctx

2016-05-11 Thread Pavel Březina
On 05/10/2016 01:32 PM, Pavel Březina wrote: On 05/05/2016 04:40 PM, Petr Cech wrote: On 05/05/2016 12:08 PM, Petr Cech wrote: Hello, this patch set moves negative cache from particular context of given responder to common context resp_ctx. It is reaction on Fix taloc context for negative cac

[SSSD] Re: [PATCH] Do not crash if GetUserAttrs cannot be parsed

2016-05-11 Thread Jakub Hrozek
On Wed, May 11, 2016 at 10:28:16AM +0200, Jakub Hrozek wrote: > On Tue, May 10, 2016 at 12:53:08PM +0200, Pavel Březina wrote: > > On 05/10/2016 12:34 PM, Jakub Hrozek wrote: > > > On Tue, May 10, 2016 at 12:06:39PM +0200, Pavel Březina wrote: > > > > On 05/05/2016 11:38 AM, Jakub Hrozek wrote: > >

[SSSD] Re: [PATCH] Do not crash if GetUserAttrs cannot be parsed

2016-05-11 Thread Jakub Hrozek
On Tue, May 10, 2016 at 12:53:08PM +0200, Pavel Březina wrote: > On 05/10/2016 12:34 PM, Jakub Hrozek wrote: > > On Tue, May 10, 2016 at 12:06:39PM +0200, Pavel Březina wrote: > > > On 05/05/2016 11:38 AM, Jakub Hrozek wrote: > > > > On Wed, Apr 27, 2016 at 11:47:50AM +0200, Pavel Březina wrote: >

[SSSD] Re: [PATCH] Failover to next server if authentication fails

2016-05-11 Thread Pavel Březina
On 05/10/2016 04:00 PM, Jakub Hrozek wrote: On Thu, Apr 21, 2016 at 02:54:21PM +0200, Pavel Březina wrote: We can fail in sasl_bind_send() with ERR_AUTH_FAILED for basically unspecified reason but we do not failover to next server. This patch should fix it. As said on the meeting, I didn't repr