sssd-users April 2013

sssd-users@lists.fedorahosted.org

20 participants
20 discussions

SSSD, Linux Mint 14 and Samba 4 AD Server
by Rowland Penny 11 Apr '13

11 Apr '13

Hello, I am trying to use sssd instead of winbind against a samba 4 AD server. After looking around the internet, I have got to the point where I can get a domain users info with 'getent passwd <domainuser>' and 'id <domainuser>'. I can also create a directory and chmod it <domainuser>:users, what I cannot do is login into the computer through ssh or the login GUI on the computer. This is on Linux Mint 14 using sssd 1.9.1. Does anybody have any idea why sssd seems to work but fails in a very important way. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

5 29

sss_ssh_authorizedkeys returns "Error looking up public keys"
by Mathieu Lemoine 11 Apr '13

11 Apr '13

Hello, I have sssd 1.9.4 (from https://launchpad.net/~nicholas-hatch/+archive/auth/+packages) configured on an OpenLDAP server. getent passwd, getent group, authentication and cache is working great. My issue now lies with the SSH public key. My user has the ldapPublicKey objectClass, and the key is in the sshPublicKey attribute. sss_ssh_authorizedkeys is still returning "Error looking up public keys". An inquiry on the #sssd chan directed me to this mailing-list and more precisely to jcholast, I tried to check out the commits, but nothing seems to get out of it... If any of you had informations regarding that, it'd be greatly appreciated., Mathieu.

8 22

Offline log in
by Sutton, Harry (GSSE) 11 Apr '13

11 Apr '13

After getting sssd logins working yesterday (thanks again, Sumit), I was pleasantly surprised to find I was able to login this morning with my domain credentials from home /before/ I had established my VPN connection to the office. (I know I shouldn't have necessarily been surprised, that's the expected behavior, but I've been fiddling with this for weeks and only yesterday finally got things working as 'expected'.) Before I made my VPN connection, I did a klist to see the cached credentials, and did a double-take when I saw the TGT: At first I thought I was back in the U.S. Navy boot camp (which is where I was on December 31, 1969) but then I decided this timestamp might have been chosen intentionally to pre-date UNIX epoch time. But why go to all that trouble rather than just use the valid TGT I had received yesterday when I made a live, valid connection? Wasn't that cached, along with my authentication credentials? Once I established my tunnel connection, I checked again, saw the same (old) TGT, so I logged out of the session (without dropping the tunnel connection) and when I logged back in I had a TGT dated today. I'm guessing (something I can test easily enough) that if I had waiting long enough before logging out and back in again, the TGT would have been re-issued correctly. -- *Harry Sutton* Global Solutions Support Engineering (GSSE) GSD Customer Solution Center Technology Services, Enterprise Group

3 4

AD authentication failure
by Sutton, Harry (GSSE) 10 Apr '13

10 Apr '13

Okay, I'm seeing something in my logs that points to why I'm not authenticating with pam_sss.so, and it may be unique to our environment here at HP, although I suspect others will eventually have the same situation. The issue, I think, is that we use email addresses as part of our uid (and dn) attributes, and the '@' sign is getting interpreted as part of a Kerberos realm identifier. In /var/log/secure, for example, I'm seeing " login: pam_sss(login:auth): system info: [Cannot resolve servers for KDC in realm "HP.COM"] ", while in /var/log/sssd/krb5_child.log for the same timestamp there's "[[sssd[krb5_child[16801]]]] [get_and_save_tgt] (0x0020): 977: [-1765328164][Cannot resolve servers for KDC in realm "HP.COM"]", while /var/log/sssd/ldap_child.log shows the correct realm, "[[sssd[ldap_child[16791]]]] [unpack_buffer] (0x1000): got realm_str: AMERICAS.CPQCORP.NET" from the /etc/krb5.keytab file. So: is there something in pam_sss.so that needs to be 'fixed' to get around this problem? -- *Harry Sutton* Global Solutions Support Engineering (GSSE) GSD Customer Solution Center Technology Services, Enterprise Group

3 6

Marking port 636 of server 'realmname' as 'not working'
by Chris Gray 08 Apr '13

08 Apr '13

Sorry in advance for the most likely repeated question. After searching for a week, and still being stuck, it was time to ask the mailing list. I have a CentOS 6.4 machine that I'm trying to use SSSD/LDAP/KRB5 to authenticate with active directory. I can do ldapsearch commands with ldap, or ldaps (the ldap only works due to the machine account, using GSSAPI, otherwise, my domain doesn't support anonymous binding). I can kinit my username, and klist shows the host/hostname entries. OpenSSL doesn't complain about my certs. My only problem seems to be SSSD saying my ports are down. I get the same message for 389 and 636. Once it's marked as not working, the authentication clearly fails (first login, no cache to fall back on). I can telnet to the ports from the centos machine. I can telnet (well, kitty in telnet mode) to them from my windows workstation. Any ideas? Installed versions: sssd-1.9.2-82.4.el6_4.x86_64 sssd-client-1.9.2-82.4.el6_4.x86_64 openldap-2.4.23-32.el6_4.x86_64 openldap-clients-2.4.23-32.el6_4.x86_64 nss-3.14.0.0-12.el6.x86_64 krb5-workstation-1.10.3-10.el6_4.1.x86_64 pam-1.1.1-13.el6.x86_64 kstart-4.1-2.el6.x86_64 msktutil-0.4.2-1.el6.x86_64 My ldapsearch commands, ldapsearch -H ldaps://server.fqdn:636/ -Y GSSAPI -N -b "dc=example,dc=corp" "(&(objectClass=user)(sAMAccountName=username))" ldapsearch -H ldaps://server.fqdn:636/ -x -b '' -s base supportedSASLMechanisms Both of those work, and can work over non-tls ldap. openssl s_client -connect server.fqdn:636 -CAfile /etc/openldap/certs/adpubkeycerts.pem That command works fine. (Fri Apr 5 20:43:49 2013) [[sssd[ldap_child[1532]]]] [sss_child_krb5_trace_cb] (0x4000): [1532] 1365219829.627008: Received error from KDC: -1765328378/Client not found in Kerberos database (Fri Apr 5 20:43:49 2013) [sssd[be[domain.corp]]] [sdap_get_tgt_recv] (0x0400): Child responded: 14 [Client not found in Kerberos database], expired on [0] (Fri Apr 5 20:43:49 2013) [sssd[be[domain.corp]]] [sdap_kinit_done] (0x0100): Could not get TGT: 14 [Bad address] (Fri Apr 5 20:43:49 2013) [sssd[be[domain.corp]]] [sdap_cli_kinit_done] (0x0400): Cannot get a TGT: ret [5] result [4] I'm assuming those log entries are my problem. Or not, I fixed those by adding this to sssd.conf, which doesn't seem like it should be needed, as I would think it'd pick it up from /etc/krb5.keytab: ldap_sasl_authid = server$@fqdn Well, at least that's progress, still can't login though with an AD account. Hopefully that's just a matter of fixing these: (Fri Apr 5 22:11:34 2013) [sssd[be[domain.corp]]] [krb5_auth_send] (0x0100): No ccache file for user [ADUser] found. (Fri Apr 5 22:11:34 2013) [sssd[be[domain.corp]]] [krb5_auth_send] (0x4000): Ccache_file is [not set] and is not active and TGT is not valid. Any help would be appreciated, Thanks, Chris

3 2

Odd behavior
by Sutton, Harry (GSSE) 08 Apr '13

08 Apr '13

Okay, so I have sssd-ad pretty much working on a Fedora 18 laptop, but I'm not having much luck getting it going on RHEL 6.4, at least not for GDM logins. If I have the sssd daemon running, I get an authentication failure using my domain username / password, and my local account login takes orders of magnitude longer to complete than if sssd is shut off. This is after I've manually (and successfully) completed 'kinit <domain-username>' and 'net ads join -k', so I have a TGT and two application principals (cifs and ldap) attached to my domain user principal. There is also a valid krb5.keytab file in /etc/. Now from my Fedora laptop, where I'm logged in with my domain credentials (the same ones, obviously, as I'm trying to use from my RHEL 6.4 workstation): if the sssd daemon is not running on the RHEL 6.4 workstation, an attempt to ssh from the laptop fails with an authentication error. Once I start sssd on the workstation, my ssh connection from the laptop succeeds without any password or passphrase challenges - presumably because the kerberos credentials are in force. The files /etc/krb5.conf, /etc/samba/smb.conf, and /etc/sssd/sssd.conf are identical on both systems, but obviously the applications and libraries are different versions between Fedora 18 and RHEL 6.4. Has anyone here gotten everything working (with Microsoft Active Directory) using sssd on RHEL 6.4? Regards, -- *Harry Sutton* Global Solutions Support Engineering (GSSE) GSD Customer Solution Center Technology Services, Enterprise Group

4 6

Marking port 636 of server 'realmname' as 'not working'
by Chris Gray 06 Apr '13

06 Apr '13

> Or not, I fixed those by adding this to sssd.conf, which doesn't seem > like it should be needed, as I would think it'd pick it up from > /etc/krb5.keytab: > ldap_sasl_authid = server$@fqdn DNS is working fine, can ping the shortname and fqdn from everywhere. It also gets the ad server ip from dns using the srv records. Adding the ldap_sasl_authid made the name error go away, so if it's dns, is it attempting fqdn$(a)realm.corp, or just hostname$(a)realm.corp, the later would be correct from what I've read. Chris

1 0

sssd and apparmor on ubuntu 12.04
by Rowland Penny 05 Apr '13

05 Apr '13

Hi, There appears to be a problem with sssd 1.9.4 on Ubuntu 12.04 server. if apparmor is installed it takes a very long time to install via apt-get and then will not start correctly, it hangs forever and if you stop it with ctrl-c, it then claims to have started but hasn't. It does not matter if you put apparmor into complain mode, it still will not start, or if you try to stop or restart sssd it just hangs. The only cure seems to be to totally remove apparmor with 'apt-get purge apparmor', sssd then works correctly. I got sssd from here: deb http://ppa.launchpad.net/sssd/updates/ubuntu precise main deb-src http://ppa.launchpad.net/sssd/updates/ubuntu precise main Rowland -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 2

Caching not working?
by Sutton, Harry (GSSE) 05 Apr '13

05 Apr '13

Okay, I have AD sign-on working on my Fedora 18 laptop, but when I disconnect from the network and attempt to login, I get an authentication failure. In krb5_child, I can see that it recognizes my attempt as offline ("validate [true] offline [true]"); ldap_child appears identical between the failed attempt and a subsequent successful one (network re-connected.) In /var/log/sssd/sssd_<DOMAIN>, I see this "[krb5_auth_send] (0x0100): Home directory for user [SuttonH] not known." A Google search suggests this was a problem in the past, perhaps fixed now? But I wonder if it's related to my earlier issue about the home directory not getting created correctly until I inserted a fallback_homedir stanza into my sssd.conf file. (The home directory does exist.) Am I the only one seeing this? /Harry

2 13

Announcing SSSD 1.10.0 Alpha 1
by Jakub Hrozek 02 Apr '13

02 Apr '13

=== SSSD 1.10 Alpha 1 === The SSSD team is proud to announce the alpha release of version 1.10 of the System Security Services Daemon. This alpha release includes all the features developed since the sssd-1-9 branched off as well as refactoring of several internal interfaces, making the code more readable and maintanable in the long term. As always, the source is available from https://fedorahosted.org/sssd. RPM packages will be made available for Fedora 19 and rawhide shortly. The SSSD 1.10 Beta release is scheduled for April 25th and will contain all the planned features. We will most likely issue another pre-release build prior to the Beta, but that has not been firmly scheduled yet. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * Includes a fix for CVE-2013-0287: A simple access provider flaw prevents intended ACL use when SSSD is configured as an Active Directory client * Many internal interfaces were refactored, making the code more readable and maintanable in the long term. This refactoring includes the subdomains code, the sysdb interface as a whole, internal error code reporting, SELinux login context processing and processing of nested LDAP groups. * A new option ipa_dyndns_ttl was added, allowing the client to set a custom TTL on IPA dynamic DNS updates * A new ignore_group_members option was added. This option can be used to suppress downloading group members on group lookups, making the group lookups much faster for environments that do not need to know the group members. * A new option ldap_rfc2307_fallback_to_local_users was added. If this option is set to true, SSSD is be able to resolve local group members of LDAP groups. * Added support for krb5 1.11's responder callback. * Support for libnl version 3 was added. * Fixed an indexing bug that prevented the contents of autofs maps from being returned to the automounter deamon in case the map contained a large number of entries * Fixed spurious password expiration warning that was printed on login with the Kerberos back end * Fixed a regression when saving binary attributes to the cache * Fixed a file descriptor leak when sss_cache was executed == Packaging Changes == * The shared components of the SSSD are now built as a shared library to reduce amount of duplicated code being linked into multiple SSSD binaries and lower the disk usage of SSSD installation. * The check that ensured that SSSD is running with the same ldb version it was built against was made optional, defaulting to false. You can enable the strict check again by selecting --enable-ldb-version-check during configure == Tickets Fixed == https://fedorahosted.org/sssd/ticket/812 Support libnl 3.x https://fedorahosted.org/sssd/ticket/1033 [RFE] implement a script/tool joining to the Active Directory domain https://fedorahosted.org/sssd/ticket/1287 compilation warnings with -O2 https://fedorahosted.org/sssd/ticket/1327 When multiple values are assigned, sss_debuglevel should display a usage message https://fedorahosted.org/sssd/ticket/1371 Missing resolv.conf should be non-fatal https://fedorahosted.org/sssd/ticket/1376 [RFE] Add support for suppressing group members https://fedorahosted.org/sssd/ticket/1405 [RFE] Kerberos canonicalization should be skipped on password-changes in AD provider https://fedorahosted.org/sssd/ticket/1476 SSSD has a much longer TTL when updating a DNS record than IPA client install placed in the beginning https://fedorahosted.org/sssd/ticket/1481 Move sss_cache to the main subpackage https://fedorahosted.org/sssd/ticket/1484 failover should protect against empty host names https://fedorahosted.org/sssd/ticket/1495 include talloc log in our debug facility https://fedorahosted.org/sssd/ticket/1575 Change responder contexts hierarchy https://fedorahosted.org/sssd/ticket/1586 Make authtoken opaque objects https://fedorahosted.org/sssd/ticket/1603 [RFE] Send user principal together with the PAC to the pac responder https://fedorahosted.org/sssd/ticket/1643 [RFE] refactor sysdb interface https://fedorahosted.org/sssd/ticket/1660 LDAP_CONTROL_X_DEREF: sssd should fallback if server returns LDAP_UNAVAILABLE_CRITICAL_EXTENSION error https://fedorahosted.org/sssd/ticket/1712 sudoNotBefore/sudoNotAfter not supported by sssd sudoers plugin https://fedorahosted.org/sssd/ticket/1738 Decrease the krb5_auth_timeout default value of 15 https://fedorahosted.org/sssd/ticket/1743 selinux: move all logic to responder, provider should only update db https://fedorahosted.org/sssd/ticket/1744 selinux: reuse IPA_HBAC_REFRESH or provide an alternative https://fedorahosted.org/sssd/ticket/1745 Unnecessary output is seen when invalid option is passed to sss_cache https://fedorahosted.org/sssd/ticket/1746 sss_* tools with use_fully_qualified_names should require fqdn https://fedorahosted.org/sssd/ticket/1747 Refactor subdomain interfaces https://fedorahosted.org/sssd/ticket/1756 append new line to error string from poptStrerror() https://fedorahosted.org/sssd/ticket/1763 check the return values of sysdb_transaction_commit in sysdb tests https://fedorahosted.org/sssd/ticket/1765 remove the alt_db_path parameter of sysdb_init https://fedorahosted.org/sssd/ticket/1766 use an explanatory macro for checking if a domain is a subdomain https://fedorahosted.org/sssd/ticket/1771 Negative cache messages are displayed at too low of a DEBUG level https://fedorahosted.org/sssd/ticket/1790 Possible null derefence in ipa_subdomains.c https://fedorahosted.org/sssd/ticket/1794 reuse open_cloexec elsewhere in the code https://fedorahosted.org/sssd/ticket/1803 SSSD returns System Error if the ccachedir is not writable https://fedorahosted.org/sssd/ticket/1804 Filter out inappropriate multicast and subnet broadcast addresses from IPA dynamic DNS update https://fedorahosted.org/sssd/ticket/1805 RFE: Add a new override_homedir expansion for the "original value" https://fedorahosted.org/sssd/ticket/1810 Uninitialized scalar variable in responder_get_domain https://fedorahosted.org/sssd/ticket/1811 Unchecked return value in tests https://fedorahosted.org/sssd/ticket/1812 make the get_next_domain() function a little more readable https://fedorahosted.org/sssd/ticket/1813 make the ldb check configurable https://fedorahosted.org/sssd/ticket/1819 Refresh doxygen template files https://fedorahosted.org/sssd/ticket/1820 sysdb unit tests uses system memberof https://fedorahosted.org/sssd/ticket/1825 Invalid assignment to enum https://fedorahosted.org/sssd/ticket/1833 segmentation fault in cmocka unit tests with raised optization level https://fedorahosted.org/sssd/ticket/1834 Support for libini 1.0 https://fedorahosted.org/sssd/ticket/1838 nss and pam clients broken in master https://fedorahosted.org/sssd/ticket/1840 Add --with-test-dir=/dev/shm to DISTCHECK_CONFIGURE_FLAGS == Detailed Changelog == Abhishek Singh (1): * filename in comment is corrected Ariel Barria (1): * Improve syslog message when configuration cannot be loaded Jakub Hrozek (44): * Bump version to 1.10dev * Require ar in configure.ac * TESTS: Fix a couple of debug-level setters * SYSDB: Remove unused macros * LDAP: Remove double break * Indentation fix * Bump the version and reset release back to 0 * tests: add a unit test for sysdb_netgroup_base_dn * tests: unit test for test_sysdb_search_users * tests: adda a unit test for test_sysdb_search_groups * tests: test sysdb_initgroups * tests: add unit test for sysdb_get_new_id * tests: unit test for sysdb_remove_attrs * TOOLS: set domain in check_group_names * Fix code style * Don't use srcdir with tests * krb5: include backwards compatible declaration of krb5_trace_info * LDAP: Check for authtok validity * Filter out multicast addresses from IPA DNS updates * Lower the DEBUG level if an entry cannot be deleted from memcache * Fix the krb5 password expiration warning * Remove enumerate=true from man sssd-ldap * Do not process success case in an else * Revert "Add debug message to autofs client" * Don't treat 0 as default for pam_pwd_expiration warning * Remove unused functions * Use the correct memory context in be_req_create * Check the return value of sysdb_search_services * Detect the presence of libcmocka during configure * Add utility functions for tests that use sysdb or tevent. * Move sss_cmd_execute from client to responder code. * CMocka based test for the NSS responder * Retry the correct service on krb5 child timeout * Remove duplicate remake from bashrc_sssd * Provide a be_get_account_info_send function * Add unit tests for simple access test by groups * Do not compile main() in DP if UNIT_TESTING is defined * Resolve GIDs in the simple access provider * Return error code from ipa_subdom_store * Move signal.m4 from src/util to external * Document what does access_provider=ad do * Include config.h to build io.c on RHEL5 * selinux: Remove unused parameter * Updating the translations for the 1.10 alpha release James Hogarth (1): * Make TTL configurable for dynamic dns updates Jan Cholasta (1): * LDAP: If deref search fails, try again without deref Jan Engelhardt (1): * sysdb: try dealing with binary-content attributes John Hodrien (1): * Correct sss_ssh_knowhostsproxy typo in man pages Kamil Dudka (1): * sssd-1.8.0: work around a bug in cov-build from Coverity Lukas Slebodnik (12): * Improved readability of get_next_domain() * Fixed typo in debug message. * Removing unused parameter type from sudosrv_get_sudorules_query_cache() * Reuse sss_open_cloexec at other places in code. * More generalized function open_debug_file_ex() * Removing unused header file providers.h * Fix sss_client breakage. * Removing unused declaration of functions and variable. * Making the ldb check configurable * Fixing duplicate const * Reusing create_pam_data() on the other places. * Making the authtok structure really opaque. Michal Zidek (15): * sss_debuglevel: Multiple arguments are treated as error. * Include talloc log in our debug facility * failover: Protect against empty host names * sss_cache: Call DEBUG_INIT sooner * tools: Respect use_fully_qualified_names * Possible null derefence in ipa_subdomains.c. * Unchecked return value in files.c * Use the same dbg level for all ncache hits. * Remove the alt_db_path parameter of sysdb_init * File descriptor leak in nss responder. * Debug message in sss_mc_create_file. * Move SELinux processing to provider. * Reuse cached SELinux mappings. * Make the SELinux refresh time configurable. * tests: Print warning if LDB_MODULES_PATH is not set Milan Cejnar (1): * tools: append new line to string from poptStrerror() Nathaniel McCallum (1): * Add support for krb5 1.11's responder callback. Ondrej Kos (13): * MAN: quotation fix * Display more information on DB version mismatch * SYSDB: split sysdb_add_user * TESTS: Fix coverity issues 13126, 13127 * TESTS: include error message on fail * Fix uninitialized time_t var in responder * krb5_child: fix value type and initialization * Fix initialization of multiple variables * Fix coverity issue 13136 * Decrease krb5_auth_timeout default * Update README file * LDAP: Fix value initialization * Provide libnl3 support Paul B. Henson (1): * Add ignore_group_members option. Pavel Březina (25): * sudo: do not hardcode protocol version * fix -O3 variable may be uninitialized warnings * sudo: print message if old protocol is used * sudo manpage: clarify that sudoHost may contain wildcards and not regular expression * use talloc_zfree when freeing rhostent in resolver * set ret to EOK after for loop in sdap_sudo_purge_sudoers * Fix LDAP authentication - invalid password length * set struct bet_info->bet_type * krb: recreate ccache if it was deleted * dp: check whether hostid backend is configured before filing be request * get_next_domain() test dom->parent->next for NULL * subdomains: replace invalid characters with underscore in krb5 mapping file name * if selinux is disabled, ignore that selogin dir is missing * sdap_fill_memberships: continue if a member is not foud in sysdb * Add debug message to autofs client * autofs: fix invalid header 'number of entries' in packet * build: require libcmocka on fedora 18+ * fix segfault in nss responder unit test * krb5-utils-tests: remove invalid condition * correct order in error_to_str table * do not leak memory on failure in *_process_init() * change responder contexts hierarchy * coding style fix * refactor nested group processing: add new code * refactor nested group processing: replace old code Simo Sorce (131): * Add helpers to set common mc record fields * Save errno before it might be modified. * Revert "Avoid accessing half-deallocated memory when using talloc_zfree macro." * Avoid duplicating macros * Avoid const warnings when deallocating memory * Fix tevent_req style for krb5_auth * Fix ipa_subdomain_id names and tevent_req style * Fix tevent_req style for get_netgroup in ipa_id * Streamline ipa_account_info handler * Use an entry type mask macro to filter entry types * Fix comment on wrong line * Remove redundant definition. * Fix tevent_req style for sdap_async_sudo. * Remove unhelpful vtable from sss_cache * Remove dead netgroup functions * Revert "Add a default section to a switch-statement" * Add sysdb_search_service() helper function * Use sysdb_search_service() for all svc queries * Fix sdap reinit. * Code can only check for cached passwords * Add function to safely wipe memory. * Add authtok utility functions. * Change pam data auth tokens. * Use new sysdb_search_service() in sss_cache * The Big sysdb/domain split-up! * Refactor sysdb initialization * Refactor single domain initialization * Remove the sysdb_ctx_get_domain() function. * Make sysdb_user_dn() require a domain explictly. * Make sysdb_group_dn() require a domain explictly. * Make sysdb_netgroup_dn() require a domain explictly. * Make sysdb_netgroup_base_dn() require a domain. * Make sysdb_domain_dn() require a domain. * Make sysdb_custom_dn() require a domain. * Make sysdb_custom_subtree_dn() require a domain. * Move range objects into their own top-level tree. * Upgrade DB and move ranges into top level object * Pass domain to sysdb_get<pw/gr>nam() functions * Pass domain to sysdb_get<pwu/grg><id() functions * Pass domain to sysdb_enum<pw/gr>ebt() functions * Add domain option to sysdb_get/netgr/attrs() fns * Add domain argument to sysdb_initgroups() * Add domain argument to sysdb_get_user_attr() * Add domain to sysdb_search_user_by_name() * Add domain to sysdb_search_user_by_uid() * Add domain to sysdb_search_group_by_name() * Add domain to sysdb_search_group_by_gid() * Add domain arg to sysdb_search_netgroup_by_name() * Add domain argument to sysdb_set_user_attr() * Add domain argument to sysdb_set_group_attr() * Add domain argument to sysdb_set_netgroup_attr() * Add domain argument to sysdb_get_new_id() * Add domain argument to sysdb_add_basic_user() * Add domain argument to sysdb_add_user() * Add domain arguments to sysdb_add_group functions. * Add domain arguments to sysdb_add_inetgroup fns. * Add domain argument to sysdb_store_user() * Add domain argument to sysdb_store_group() * Add domain arg to sysdb group member functions * Add domain argument to sysdb_cache_password() * Add domain argument to sysdb_cache_auth() * Add domain argument to sysdb_store_custom() * Add domain argument to sysdb_search_custom() * Add domain to sysdb_delete_custom * Add domain arg to sysdb_search_users() * Add domain argument to sysdb_delete_user() * Add domain argument to sysdb_search_groups() * Add domain argument to sysdb_delete_group() * Add domain arg to sysdb_search/delete_netgroup() * Add domain argument to sysdb_has/set_enumerated() * Add domain argument to sysdb_remove_attrs() * Add domain argument to sysdb_idmap_ funcitons * Add domain arguemnt to sysdb_get_real_name() * Add domain argument to sysdb autofs functions * Add domain argument to sysdb selinux functions * Add domain arguments to sysdb services functions * Add domain arguments to sysdb ssh functions * Add domain arguments to sysdb sudo functions * Add domain to some subdomain functions * Pass the domain to upgrade functions * Move mpg flag to the domain where it belongs * Kill sysdb->domain * Stop creating fake sysdb contexts * Tidy up BASE dn macros * Remove outdated code. * Move ldap provider access functions * Remove sysdb as a be context structure member * Remove sysdb as a be request structure member * Remove sysdb argument from ipa_host_info_send() * Remove unused structure * Remove sysdb argument from hbac_user_attrs_to_rule() * Remove sysdb arg from hbac_service_attrs_to_rule() * Remove sysdb arg from hbac_*host_attrs_to_rule() * Remove sysdb arg from ipa_hbac_service_info_send() * Remove sysdb arg from [ipa_]hbac_sysdb_save() * Remove sysdb argument from hbac_get_cached_rules() * Remove hbac_ctx_sysdb() * Remove hbac_ctx_be() * Remove hbac_ctx_ev() * Remove hbac_ctx_sdap_id_[ctx|op]() * Move hbac_ctx_is_offline() * Do not pass NULL to ipa_subdomain_retrieve() * Split simple_access_check function out * Pass domain not be_req to access check functions * Remove domain from be_req structure * Introduce be_req_terminate() helper * Add be_req_create() helper * Add be_req_get_be_ctx() helper. * Add be_req_get_data() helper funciton. * Make struct be_req opaque * Add realm info to sss_domain_info * Avoid sysdb_subdom in sysdb_get_subdomains() * Update main domain info in place * Refactor sysdb_master_domain_add_info() * Add sysdb_subdomain_store() function * Remove sysdb_subdom completely * Add function get_next_domain() * Add ability to disable domains * Change the way domains are linked. * Parent and subdomains use the same sysdb * Introduce IS_SUBDOMAIN() macro * krb5_child style fix * Refactor krb5 child * Add SSSD specific error codes and definitions * Use SSSD specific errors for offline auth * Return ERR_INTERNAL instead of EIO * Cleanup error message handling for krb5 child * Improve IS_SSSD_ERROR() macro * Use common error facility instead of sdap_result * Convert sdap_access to new error codes * ldap: Fallback option for rfc2307 schema Stephen Gallagher (10): * LDAP: Better debug logging when saving groups * Correct format security for talloc_named of auth tokens * Fix minor grammar error in log * NSS: Add original homedir to home directory template options * BUILD: Build shared components as an internal shared library * BUILD: Add contributed macros and aliases to simplify building * BUILD: Include build aliases in the tarball * BUILD: Fix cmocka detection * BUILD: Fix up whitespace in Makefile.am * BUILD: Always run distcheck and RPM tests in /dev/shm Sumit Bose (1): * Add a default section to a switch-statement Thorsten Scherf (1): * Updated Doxygen configuration to 1.8.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users April 2013