sssd / sssd-ci-containers

Setup containerized environment for testing and developing SSSD.

SSSD - System Security Services Daemon

Introduction

SSSD provides a set of daemons to manage access to remote directories and authentication mechanisms such as LDAP, Kerberos or FreeIPA. It provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources.

More information about SSSD can be found on its project page - https://github.com/SSSD/sssd.

Downloading SSSD

SSSD is shipped as a binary package by most Linux distributions. If you want to obtain the latest source files, please navigate to the Releases folder on GitHub.

We sign release tarballs with our gpg key (id C13CD07FFB2DB1408E457A3CD3D21B2910CF6759) since April 2022. For convenience, the key is also uploaded to keys.openpgp.org keyserver. You can import the key using:

$ curl -o sssd.asc https://raw.githubusercontent.com/SSSD/sssd/master/contrib/pubkey.asc
$ gpg2 --import sssd.asc

or

$ gpg2 --keyserver keys.openpgp.org --recv-keys C13CD07FFB2DB1408E457A3CD3D21B2910CF6759

And verify the signature with:

$ version=x.y.z
$ curl -o sssd-$version.tar.gz https://github.com/SSSD/sssd/releases/download/$version/sssd-$version.tar.gz
$ curl -o sssd-$version.tar.gz.asc https://github.com/SSSD/sssd/releases/download/$version/sssd-$version.tar.gz.asc
$ gpg2 --verify sssd-$version.tar.gz.asc sssd-$version.tar.gz

Releases

SSSD maintains two release streams - stable and LTM. Releases designated as LTM are long-term maintenance releases and will see bugfixes and security patches for a longer time than other releases.

The list of all releases is maintained together with SSSD documentation.

Building and installation from source

Please see the our developer documentation.

Documentation

The most up-to-date documentation can be found at https://sssd.io.

Its source code is hosted at https://github.com/SSSD/sssd.io.

Submitting bugs

Please file an issue in the SSSD github instance. Make sure to follow the guide on reporting SSSD bugs.

Licensing

Please see the file called COPYING.

Contacts

There are several ways to contact us:

• the sssd-devel mailing list: Development of the System Security Services Daemon
• the sssd-users mailing list: End-user discussions about the System Security Services Daemon
• the #sssd and #freeipa IRC channels on libera.chat:
  • irc://irc.libera.chat/sssd
  • irc://irc.libera.chat/freeipa

sssd-ci-containers's Issues

IPA container recreated

I had not used any CI container commands for a few days, I ran git fetch origin and git rebase origin/master which pulled in a few new commits. I wasn't sure if my containers were all running so I ran this:

[justin@fedora sssd-ci-containers]$ sudo make up                                                                       
[sudo] password for justin:                                                                                                                                                                                                                   
docker-compose up --detach                                                                                                                                                                                                                    
nfs is up-to-date                                                                                                                                                                                                                             
kdc is up-to-date                                                                                                                                                                                                                             
ldap is up-to-date                                                                                                                                                                                                                            
client is up-to-date                                                                                                                                                                                                                          
samba is up-to-date                                                                                                                                                                                                                           
Recreating ipa ...                                                                                                                                                                                                                            
Recreating ipa ... done           

And it wiped my IPA container which I had setup for testing.

I found this in the docker compose documentation

If there are existing containers for a service, and the service’s configuration or image was changed after the container’s creation, docker compose up picks up the changes by stopping and recreating the containers (preserving mounted volumes). To prevent Compose from picking up changes, use the --no-recreate flag.

What is the best way to prevent this issue going forward?

AD playbook retries on setting user password as permanent

The AD setup where password for users Administrator (and vagrant) is set as permanent is somehow flaky and is retrying.

Remove mandatory build dependecies for passkey

Passkey feature pulled in build dependencies on ipa server and on client.
We want to have an option to have the client machine as clean as possible - without *-devel packages and the whole gcc build environment.

We, QE, want the passskey pieces that needs to be build either prebuilt elsewhere and published as a repository or configurable to be enable on demand just for passkey feature tests.