Re: [SSSD] [PATCHES] Run PAC responder and subdomains provider for IPA domains

2012-11-14 Thread Jakub Hrozek
On Tue, Nov 13, 2012 at 10:04:25PM +0100, Sumit Bose wrote: On Tue, Nov 13, 2012 at 05:23:13PM +0100, Jakub Hrozek wrote: On Tue, Nov 13, 2012 at 01:43:25PM +0100, Sumit Bose wrote: Hi, the following two patches fix https://fedorahosted.org/sssd/ticket/1613 by running the PAC

Re: [SSSD] [PATCHES] sudo failing for ad trusted user in IPA environment

2012-11-14 Thread Sumit Bose
On Tue, Nov 13, 2012 at 03:53:43PM +0100, Pavel Březina wrote: On 11/12/2012 02:33 PM, Pavel Březina wrote: On 11/09/2012 03:18 PM, Simo Sorce wrote: On Fri, 2012-11-09 at 14:28 +0100, Pavel Březina wrote: From 724ebcafa2d4e54df048ca2a578b03281fb7fe6f Mon Sep 17 00:00:00 2001 From:

Re: [SSSD] [PATCH] Display more information on DB version crash

2012-11-14 Thread Jan Cholasta
On 13.11.2012 15:41, Ondrej Kos wrote: On 11/12/2012 01:14 PM, Jan Cholasta wrote: On 9.11.2012 13:24, Ondrej Kos wrote: On 11/08/2012 07:01 PM, Jan Cholasta wrote: Hi, On 8.11.2012 15:05, Ondrej Kos wrote: https://fedorahosted.org/sssd/ticket/1589 patch is attached O. 1) I think

Re: [SSSD] [PATCH] Display more information on DB version crash

2012-11-14 Thread Ondrej Kos
On 11/14/2012 11:53 AM, Jan Cholasta wrote: On 13.11.2012 15:41, Ondrej Kos wrote: On 11/12/2012 01:14 PM, Jan Cholasta wrote: On 9.11.2012 13:24, Ondrej Kos wrote: On 11/08/2012 07:01 PM, Jan Cholasta wrote: Hi, On 8.11.2012 15:05, Ondrej Kos wrote:

Re: [SSSD] [PATCHES] sudo failing for ad trusted user in IPA environment

2012-11-14 Thread Jakub Hrozek
On Wed, Nov 14, 2012 at 11:02:14AM +0100, Sumit Bose wrote: On Tue, Nov 13, 2012 at 03:53:43PM +0100, Pavel Březina wrote: On 11/12/2012 02:33 PM, Pavel Březina wrote: On 11/09/2012 03:18 PM, Simo Sorce wrote: On Fri, 2012-11-09 at 14:28 +0100, Pavel Březina wrote: From

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-14 Thread Stephen Gallagher
On Wed 14 Nov 2012 01:24:15 AM EST, Paul B. Henson wrote: On Nov 13, 2012, at 9:06 PM, Simo Sorce s...@redhat.com wrote: Well my concern is allowing people to get the perf. benefit you need, as you may not be the only one who needs it, w/o causing issues for those apps that will use

[SSSD] [PATCH 2/3] Avoid duplicating macros

2012-11-14 Thread Simo Sorce
This macro is already available in util/util.h which is expicitly included in this file. --- src/ldb_modules/memberof.c |4 1 files changed, 0 insertions(+), 4 deletions(-) diff --git a/src/ldb_modules/memberof.c b/src/ldb_modules/memberof.c index

[SSSD] [PATCH 0/3] cleanups for talloc_zfree

2012-11-14 Thread Simo Sorce
While coding my latest patch I found an annoying const warning when freeing strings we allocate with talloc but then assign to a variable of type const char *. This made me investigate our talloc_zfree macro and I found a weird patch, made back in the times that really doesn't make much sense. I

[SSSD] [PATCH 3/3] Avoid const warnings when deallocating memory

2012-11-14 Thread Simo Sorce
In some case we allocate and assign data to a const pointer. When we then try to free it we would get a const warning because talloc_free accepts a void, not a const void pointer. Use discard_const to avoid the warning, it is safe in this case. --- src/util/util.h |2 +- 1 files changed, 1

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-14 Thread Simo Sorce
On Wed, 2012-11-14 at 08:48 -0500, Stephen Gallagher wrote: On Wed 14 Nov 2012 01:24:15 AM EST, Paul B. Henson wrote: On Nov 13, 2012, at 9:06 PM, Simo Sorce s...@redhat.com wrote: Well my concern is allowing people to get the perf. benefit you need, as you may not be the only one who

Re: [SSSD] [PATCH] Display more information on DB version crash

2012-11-14 Thread Jan Cholasta
On 14.11.2012 14:03, Ondrej Kos wrote: On 11/14/2012 11:53 AM, Jan Cholasta wrote: On 13.11.2012 15:41, Ondrej Kos wrote: On 11/12/2012 01:14 PM, Jan Cholasta wrote: On 9.11.2012 13:24, Ondrej Kos wrote: On 11/08/2012 07:01 PM, Jan Cholasta wrote: Hi, On 8.11.2012 15:05, Ondrej Kos wrote:

[SSSD] [PATCH 0/1] Simplify writing update functions

2012-11-14 Thread Simo Sorce
While approaching the problem of updating the DB after a patch I am working on I noticed that we do have a lot of biolerplate code in there that could very simply be tucked into 2 helper functions, simplifying writing upgrade functions and making it less likely a typo or copypaste error will

[SSSD] [PATCH 1/1] Simplify writing db update functions

2012-11-14 Thread Simo Sorce
Add functions to automate setting versions numbers in the db, also decrease chances of error in copying and pasting code, by setting the version number only once when we commence the upgrade. --- src/db/sysdb_upgrade.c | 621 +++- 1 files changed, 196

Re: [SSSD] [PATCH] Display more information on DB version crash

2012-11-14 Thread Simo Sorce
On Wed, 2012-11-14 at 15:18 +0100, Jan Cholasta wrote: Just one more nitpick: SSS_DB_CHECK_PTS and sss_db_version_check are used only in sysdb.c, so there is no reason to have them defined publicly in util.h+util.c. Move them both to sysdb.c please (you might also want to rename them to

Re: [SSSD] [PATCH] Display more information on DB version crash

2012-11-14 Thread Ondrej Kos
On 11/14/2012 03:38 PM, Simo Sorce wrote: On Wed, 2012-11-14 at 15:18 +0100, Jan Cholasta wrote: Just one more nitpick: SSS_DB_CHECK_PTS and sss_db_version_check are used only in sysdb.c, so there is no reason to have them defined publicly in util.h+util.c. Move them both to sysdb.c please

Re: [SSSD] [PATCH 1/3] Revert Avoid accessing half-deallocated memory when using talloc_zfree macro.

2012-11-14 Thread Pavel Březina
On 11/14/2012 03:01 PM, Simo Sorce wrote: This reverts commit ff57c6aeb80a52b1f52bd1dac9308a69dc7a4774. This commit doesn't really make sense, we are never accessing freed memory as all we are dealing with is a pointer which is never itsef part of the memory we are freeing (if it were, it would

Re: [SSSD] [PATCH 1/3] Revert Avoid accessing half-deallocated memory when using talloc_zfree macro.

2012-11-14 Thread Jakub Hrozek
On Wed, Nov 14, 2012 at 05:01:34PM +0100, Pavel Březina wrote: On 11/14/2012 03:01 PM, Simo Sorce wrote: This reverts commit ff57c6aeb80a52b1f52bd1dac9308a69dc7a4774. This commit doesn't really make sense, we are never accessing freed memory as all we are dealing with is a pointer which is

Re: [SSSD] [PATCHES] sudo failing for ad trusted user in IPA environment

2012-11-14 Thread Jakub Hrozek
On Wed, Nov 14, 2012 at 02:37:01PM +0100, Jakub Hrozek wrote: On Wed, Nov 14, 2012 at 11:02:14AM +0100, Sumit Bose wrote: On Tue, Nov 13, 2012 at 03:53:43PM +0100, Pavel Březina wrote: On 11/12/2012 02:33 PM, Pavel Březina wrote: On 11/09/2012 03:18 PM, Simo Sorce wrote: On Fri,

[SSSD] [PATCHES] Fix password change for trusted AD users

2012-11-14 Thread Sumit Bose
Hi, the following three patches make password changes for trusted AD users work and fix https://fedorahosted.org/sssd/ticket/1615 . The most important fix, disabling canonicalization for the AS-REQ for the change password ticket, is in the third patch. The other two fixes issues I came across

Re: [SSSD] [PATCH 3/3] Avoid const warnings when deallocating memory

2012-11-14 Thread Sumit Bose
On Wed, Nov 14, 2012 at 09:01:15AM -0500, Simo Sorce wrote: In some case we allocate and assign data to a const pointer. When we then try to free it we would get a const warning because talloc_free accepts a void, not a const void pointer. Use discard_const to avoid the warning, it is safe in

Re: [SSSD] [PATCH 1/3] Revert Avoid accessing half-deallocated memory when using talloc_zfree macro.

2012-11-14 Thread Simo Sorce
On Wed, 2012-11-14 at 17:06 +0100, Jakub Hrozek wrote: On Wed, Nov 14, 2012 at 05:01:34PM +0100, Pavel Březina wrote: On 11/14/2012 03:01 PM, Simo Sorce wrote: This reverts commit ff57c6aeb80a52b1f52bd1dac9308a69dc7a4774. This commit doesn't really make sense, we are never accessing

Re: [SSSD] [PATCH 3/3] Avoid const warnings when deallocating memory

2012-11-14 Thread Simo Sorce
On Wed, 2012-11-14 at 17:16 +0100, Sumit Bose wrote: On Wed, Nov 14, 2012 at 09:01:15AM -0500, Simo Sorce wrote: In some case we allocate and assign data to a const pointer. When we then try to free it we would get a const warning because talloc_free accepts a void, not a const void

Re: [SSSD] [PATCHES] Fix password change for trusted AD users

2012-11-14 Thread Simo Sorce
On Wed, 2012-11-14 at 17:27 +0100, Sumit Bose wrote: Hi, the following three patches make password changes for trusted AD users work and fix https://fedorahosted.org/sssd/ticket/1615 . The most important fix, disabling canonicalization for the AS-REQ for the change password ticket, is in

Re: [SSSD] [PATCHES] Fix password change for trusted AD users

2012-11-14 Thread Simo Sorce
On Wed, 2012-11-14 at 17:27 +0100, Sumit Bose wrote: -#define SSSD_KRB5_CHANGEPW_PRINCIPAL kadmin/changepw +/* SSSD_KRB5_CHANGEPW_PRINCIPAL is used as the 8th argument (in_tkt_service) + * of krb5_get_init_creds_password() which is declared as 'char *' in MIT + * Kerberos 1.10 or lower. It

[SSSD] [PATCH 1/3] Refactor the way subdomain accounts are saved

2012-11-14 Thread Simo Sorce
The original sysdb code had a strong assumption that only users from one domain are saved in the databse, with the subdomain feature, we have changed reality, but have not adjusted all the code arund the sysdb calls to not rely on the original assumption. One of the side effects of this

Re: [SSSD] [PATCHES] Fix password change for trusted AD users

2012-11-14 Thread Sumit Bose
On Wed, Nov 14, 2012 at 12:03:14PM -0500, Simo Sorce wrote: On Wed, 2012-11-14 at 17:27 +0100, Sumit Bose wrote: Hi, the following three patches make password changes for trusted AD users work and fix https://fedorahosted.org/sssd/ticket/1615 . The most important fix, disabling

[SSSD] [PATCH 3/3] Handle conversion to fully qualified usernames

2012-11-14 Thread Simo Sorce
In subdomains we have to use fully qualified usernames. Unfortunately we have no other good option than simply removing caches for users of subdomains. This is because the memberof plugin does not support the rename operation. --- src/db/sysdb.c |7 src/db/sysdb_private.h |4

[SSSD] [PATCH 2/3] Do not save HBAC rules in subdomain subtree

2012-11-14 Thread Simo Sorce
From: Sumit Bose sb...@redhat.com Currently the sysdb context is pointed to the subdomain subtree containing user the user to be checked at the beginning of a HBAC request. As a result all HBAC rules and related data is save in the subdomain tree as well. But since the HBAC rules of the

[SSSD] [PATCH 0/3] Fix group memberships for subdomain users

2012-11-14 Thread Simo Sorce
This patch changes the way subdomain users are stored in the database. The reason for changing the way we do it is that the sysdb code, before the subdomain patches were added assumed a single domain per cache file. This assumption beled in many other interfaces including the way users are read

Re: [SSSD] [PATCH 1/3] Revert Avoid accessing half-deallocated memory when using talloc_zfree macro.

2012-11-14 Thread Dmitri Pal
On 11/14/2012 11:06 AM, Jakub Hrozek wrote: On Wed, Nov 14, 2012 at 05:01:34PM +0100, Pavel Březina wrote: On 11/14/2012 03:01 PM, Simo Sorce wrote: This reverts commit ff57c6aeb80a52b1f52bd1dac9308a69dc7a4774. This commit doesn't really make sense, we are never accessing freed memory as all

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-14 Thread Simo Sorce
On Wed, 2012-11-14 at 10:59 -0800, Paul B. Henson wrote: On Wed, Nov 14, 2012 at 09:04:24AM -0500, Simo Sorce wrote: Ok, put down this way it tips my opinion toward the currently proposed patch. Cool. Is there anything else I need to do to move this forward? No we just need someone to

Re: [SSSD] [PATCH 1/3] Revert Avoid accessing half-deallocated memory when using talloc_zfree macro.

2012-11-14 Thread Stephen Gallagher
On Wed 14 Nov 2012 01:35:21 PM EST, Dmitri Pal wrote: On 11/14/2012 11:06 AM, Jakub Hrozek wrote: On Wed, Nov 14, 2012 at 05:01:34PM +0100, Pavel Březina wrote: On 11/14/2012 03:01 PM, Simo Sorce wrote: This reverts commit ff57c6aeb80a52b1f52bd1dac9308a69dc7a4774. This commit doesn't really

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-14 Thread Stephen Gallagher
On Wed 14 Nov 2012 02:28:07 PM EST, Simo Sorce wrote: On Wed, 2012-11-14 at 10:59 -0800, Paul B. Henson wrote: On Wed, Nov 14, 2012 at 09:04:24AM -0500, Simo Sorce wrote: Ok, put down this way it tips my opinion toward the currently proposed patch. Cool. Is there anything else I need to do

Re: [SSSD] Ticket #1376 -- Add support for suppressing group members

2012-11-14 Thread Paul B. Henson
On 11/14/2012 1:41 PM, Stephen Gallagher wrote: Minor: Please use the new SSSDBG macros in confdb_get_domain_internal(). You don't need to update the existing code, but all new code should use the macros. See util.h for a listing of them. Done. ../src/providers/ldap/sdap.h:481:5: note:

[SSSD] [PATCH] SUDO: Fix compilation warning

2012-11-14 Thread Jakub Hrozek
I'm sorry, I overlooked the compilation warning in the recent sudo patches as I was testing on a VM that didn't have the silent rules enabled. A patch is attached. From ceec408542627a21e9e08acebe9488d5f11e7147 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek jhro...@redhat.com Date: Thu, 15 Nov 2012