August 2009 - sssd-devel - Fedora mailing-lists

Announcing the release of SSSD 0.5.0
by Stephen Gallagher 24 Aug '09

24 Aug '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The SSSD Development team is proud to announce the immediate release of SSSD 0.5.0. It can be found at https://fedorahosted.org/sssd/ The list of changes include (but are not limited to) * The addition of the Kerberos 5 authentication provider * The addition of the native LDAP identity provider * Support for building on Debian and Ubuntu * Improved caching mechanism to reduce server load * Includes the fix released for CVE-2009-2410 in SSSD 0.4.1 and many other bugfixes. - -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkqS3bAACgkQeiVVYja6o6NSiACgirHdUpkJqun2ugkrjDYTfAhz vWsAoKlioTE9q/7XEZwuf15RGnbsCnDL =SJUo -----END PGP SIGNATURE-----

1 0

[PATCHES] fix various minor issues
by Simo Sorce 24 Aug '09

24 Aug '09

Series of patches I made up while working toward elimination of the legacy options this summer. 0001 - Catch a bad buffer sent by glibc. I reproduced this a couple of times. It was almost certainly due to bad input sent from the server, but I wasn't able to pinpoint the main cause. Meanwhile catch the bad buffer so at least we do not segfault apps. 0002 - Add debug statements. Found the need to instrument sysdb with some more debug statements to catch some bugs I was working on. 0003 - Relax memberof constraints. Instead of completely failing an operation if a member does not actually exists, simply skip it. This makes the code "lossy" but allows for a much simpler 2 pass storage technique then having to find a way to track down dependencies and try to store groups according to them (impossible for circular dependencies anyway). 0004 - Do not fail enums If a single store failed for any reason, then the enumeration would stop completely. Reworked the code to simply skip the bad element and keep going. Simo. -- Simo Sorce * Red Hat, Inc * New York

2 3

[PATCH] use stored upn if available
by Sumit Bose 24 Aug '09

24 Aug '09

Hi, this is the last patch in the series to add the basic support for AD as a server. With this patch the kerberos backend will use the user principal name provided by the server to get the TGT. To make the client side kerberos libraries happy the realm part is always made upper case. bye, Sumit

3 8

[PATCH] extended the documentation of LDAP backend
by Sumit Bose 24 Aug '09

24 Aug '09

Hi, this patch extends the man page of the LDAP backend and added a configuration example for AD. bye, Sumit

3 5

[PATCH] Disallow all legacy operations outside domains
by Jakub Hrozek 21 Aug '09

21 Aug '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 One of my previous patches disallowed adding users and groups outside known domains but I forgot disallowing modifying, deleting, etc. Fixes: ticket #114 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkqOZ7QACgkQHsardTLnvCWAyACePh6G5RKsvhlIVSKwRfeASHw3 rGAAn0XX6gphj2xLgPOvRb1NS9JboqWZ =J7zs -----END PGP SIGNATURE-----

3 4

[PATCH] store additional LDAP attributes
by Sumit Bose 21 Aug '09

21 Aug '09

Hi, with this patch the LDAP backend can store two additional attributes to the sysdb if available. The original DN is used by the authentication part of the LDAP backend to bind to the LDAP server. The user principle name (UPN) can be used by the kerberos backend to get the TGT. Both are necessary if the DN or UPN cannot be generated from the unix user name, which is often the case if you are using AD. bye, Sumit

2 2

[PATCH] fix handling of filtersUsers in groups
by Sumit Bose 21 Aug '09

21 Aug '09

Hi, this patch fixes https://fedorahosted.org/sssd/ticket/108 . I couldn't make up my mind if the output should contain the filtered user or not (wheel:x:10:root,sgallagh or wheel:x:10:sgallagh), because I think the handling of root is different from other user. With provider=files root should be member of groups like wheel even if the root user is filtered. In other configurations where certain user, e.g. Administrator if your server is AD, shall be filtered, I think it is expected that this user does not appear in a group. So I added a new boolean parameter filterUsersInGroups and fixed the original problem in fill_grent. I also removed some very old tab indents. bye, Sumit

2 2

[PATCH] ELAPI Shortening names
by Dmitri Pal 21 Aug '09

21 Aug '09

Ticket #118 See patch comment. -- Thank you, Dmitri Pal Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

3 3

[PATCH] Fix sysdb tests
by Jakub Hrozek 21 Aug '09

21 Aug '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Couple of changes to sysdb tests to reflect latest changes: * we're always in MPG domains, so don't set GID, let sysdb choose it automatically * we're always in MPG domains, so GIDs and UIDs cannot overlap * test the difference between sysdb_add_user and sysdb_store_user - store allows setting attributes for existing users (function test_sysdb_store_user_existing()) Fixes #129 Jakub -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkqOoPMACgkQHsardTLnvCVMhgCgsM5KU3z21no1NOXBcRPVRLR3 AOgAn1Hq7BLUQWEtHbXrIZiR9WTP3zu3 =J3Iy -----END PGP SIGNATURE-----

2 2

[PATCH] COMMON Fixes to return values, errno, leaks
by Dmitri Pal 21 Aug '09

21 Aug '09

Started looking at the ticket #107 related to traverse functions. Realized that the return values are not consistent. That overlapped with the work that I wanted to do for ticket #103 - errno cleanup. So I (across collection, INI and ELAPI): * Made the return codes consistent (where found) * Removed errno where it is not needed While was testing used valgrind and found a nasty problem when the value was added to collection with overwriting duplicates the count was decreased improperly. Fixing collection.c to not decrease count made valgrind happy. While I was debugging this I also spotted several build warnings in trace statements when the " exp ? v1 : v2 " was used. Fixed those. In ini_config.c there was a trace statement that used variable after it was freed. Removed trace statement. -- Thank you, Dmitri Pal Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 7

[PATCH] ELAPI Adding concept of the targets
by Dmitri Pal 20 Aug '09

20 Aug '09

See the patch comment. The wiki page will be really helpful during review: https://fedorahosted.org/sssd/wiki/WikiPage/ELAPIInterface -- Thank you, Dmitri Pal Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 7

[PATCH] Ensure nextID doesn't reuse an existing local UID or GID
by Stephen Gallagher 20 Aug '09

20 Aug '09

If there was no maxID set for a domain, the search filter to check whether the UID was available would always return empty (because no UIDs can be <= 0) This patch changes the search filter if the maxID is unset so that it has no upper limit This resolves https://fedorahosted.org/sssd/ticket/119 -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 2

[PATCH] Make the LOCAL provider always use MagicPrivateGroups
by Stephen Gallagher 20 Aug '09

20 Aug '09

This patch will resolve https://fedorahosted.org/sssd/ticket/95 by making MPG=false an impossible configuration for the LOCAL provider. -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 5

[PATCH] Fix usage of $(builddir) in SSSD
by Stephen Gallagher 20 Aug '09

20 Aug '09

There are some old versions of automake that do not define $(builddir) correctly. Since $(builddir) is "Rigorously equal to ‘.’", we'll set it at the top of the Makefile.am files. -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 8

[PATCH] Eliminate the --with-tests configure flag
by Stephen Gallagher 19 Aug '09

19 Aug '09

This patch resolves https://fedorahosted.org/sssd/ticket/116 --with-tests was confusing. Since we now build our tests only with 'make check', it doesn't make sense for this to be a configure- time option. We will detect during configure whether the 'check' package is available and we will use them if so. Otherwise, we will only build and execute any test suites that do not rely on the 'check' framework. Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 4

[PATCH] enable usage of defaultBindDn
by Sumit Bose 19 Aug '09

19 Aug '09

Hi, this patch addresses https://fedorahosted.org/sssd/ticket/109. It should now be possbile to get users with 'UNIX attributes' set from AD. For me the following config options worked: ... provider = ldap ldapUri = ldap://your.ldap.server userSearchBase = cn=users,dc=example,dc=com groupSearchBase = cn=groups,dc=example,dc=com defaultBindDn = cn=Administrator,cn=Users,dc=example,dc=com defaultAuthtokType = password defaultAuthtok = YOUR_PASSWORD userObjectClass = person userName = msSFU30Name userUidNumber = msSFU30UidNumber userGidNumber = msSFU30GidNumber userHomeDirectory = msSFU30HomeDirectory userShell = msSFU30LoginShell tls_reqcert = never ... I'm currently trying to get authentication against AD working, too. I will include a sample configuration and more man page option with a following patch. bye, Sumit

2 2

Unused dependencies
by Mathias Gug 19 Aug '09

19 Aug '09

Hi, While building sssd on Karmic, the following warnings are generated during the build [1]: dpkg-shlibdeps: warning: dependency on libcom_err.so.2 could be avoided if "debian/sssd/usr/lib/sssd/libsss_krb5.so.1.0.0" were not uselessly linked against it (they use none of its symbols). dpkg-shlibdeps: warning: dependency on libssl3.so could be avoided if "debian/sssd/usr/sbin/sss_groupdel debian/sssd/usr/lib/sssd/sssd/sssd_nss debian/sssd/usr/sbin/sssd debian/sssd/usr/sbin/sss_userdel debian/sssd/usr/lib/sssd/sssd/sssd_be debian/sssd/usr/lib/sssd/sssd/sssd_pam debian/sssd/usr/lib/sssd/sssd/sssd_dp debian/sssd/usr/sbin/sss_useradd debian/sssd/usr/sbin/sss_groupmod debian/sssd/usr/sbin/sss_groupadd debian/sssd/usr/sbin/sss_usermod" were not uselessly linked against it (they use none of its symbols). dpkg-shlibdeps: warning: dependency on librt.so.1 could be avoided if "debian/sssd/usr/sbin/sss_groupdel debian/sssd/usr/lib/sssd/libsss_ldap.so.1.0.0 debian/sssd/usr/lib/sssd/libsss_proxy.so.1.0.0 debian/sssd/usr/lib/sssd/sssd/sssd_nss debian/sssd/usr/sbin/sssd debian/sssd/usr/sbin/sss_userdel debian/sssd/usr/lib/sssd/sssd/sssd_be debian/sssd/usr/lib/sssd/sssd/sssd_pam debian/sssd/usr/lib/sssd/sssd/sssd_dp debian/sssd/usr/sbin/sss_useradd debian/sssd/usr/lib/ldb/memberof.so debian/sssd/usr/lib/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so debian/sssd/usr/sbin/sss_groupmod debian/sssd/usr/sbin/sss_groupadd debian/sssd/usr/sbin/sss_usermod debian/sssd/usr/lib/sssd/libsss_krb5.so.1.0.0" were not uselessly linked against it (they use none of its symbols). dpkg-shlibdeps: warning: dependency on libplc4.so could be avoided if "debian/sssd/usr/sbin/sss_groupdel debian/sssd/usr/lib/sssd/sssd/sssd_nss debian/sssd/usr/sbin/sssd debian/sssd/usr/sbin/sss_userdel debian/sssd/usr/lib/sssd/sssd/sssd_be debian/sssd/usr/lib/sssd/sssd/sssd_pam debian/sssd/usr/lib/sssd/sssd/sssd_dp debian/sssd/usr/sbin/sss_useradd debian/sssd/usr/sbin/sss_groupmod debian/sssd/usr/sbin/sss_groupadd debian/sssd/usr/sbin/sss_usermod" were not uselessly linked against it (they use none of its symbols). dpkg-shlibdeps: warning: dependency on libplds4.so could be avoided if "debian/sssd/usr/sbin/sss_groupdel debian/sssd/usr/lib/sssd/sssd/sssd_nss debian/sssd/usr/sbin/sssd debian/sssd/usr/sbin/sss_userdel debian/sssd/usr/lib/sssd/sssd/sssd_be debian/sssd/usr/lib/sssd/sssd/sssd_pam debian/sssd/usr/lib/sssd/sssd/sssd_dp debian/sssd/usr/sbin/sss_useradd debian/sssd/usr/sbin/sss_groupmod debian/sssd/usr/sbin/sss_groupadd debian/sssd/usr/sbin/sss_usermod" were not uselessly linked against it (they use none of its symbols). dpkg-shlibdeps: warning: dependency on libnssutil3.so could be avoided if "debian/sssd/usr/sbin/sss_groupdel debian/sssd/usr/lib/sssd/sssd/sssd_nss debian/sssd/usr/sbin/sssd debian/sssd/usr/sbin/sss_userdel debian/sssd/usr/lib/sssd/sssd/sssd_be debian/sssd/usr/lib/sssd/sssd/sssd_pam debian/sssd/usr/lib/sssd/sssd/sssd_dp debian/sssd/usr/sbin/sss_useradd debian/sssd/usr/sbin/sss_groupmod debian/sssd/usr/sbin/sss_groupadd debian/sssd/usr/sbin/sss_usermod" were not uselessly linked against it (they use none of its symbols). dpkg-shlibdeps: warning: dependency on libsmime3.so could be avoided if "debian/sssd/usr/sbin/sss_groupdel debian/sssd/usr/lib/sssd/sssd/sssd_nss debian/sssd/usr/sbin/sssd debian/sssd/usr/sbin/sss_userdel debian/sssd/usr/lib/sssd/sssd/sssd_be debian/sssd/usr/lib/sssd/sssd/sssd_pam debian/sssd/usr/lib/sssd/sssd/sssd_dp debian/sssd/usr/sbin/sss_useradd debian/sssd/usr/sbin/sss_groupmod debian/sssd/usr/sbin/sss_groupadd debian/sssd/usr/sbin/sss_usermod" were not uselessly linked against it (they use none of its symbols). dpkg-shlibdeps: warning: dependency on libk5crypto.so.3 could be avoided if "debian/sssd/usr/lib/sssd/libsss_krb5.so.1.0.0" were not uselessly linked against it (they use none of its symbols). [1]: http://launchpadlibrarian.net/30425717/buildlog_ubuntu-karmic-i386.sssd_0.5… Could these be avoided somehow? -- Mathias Gug Ubuntu Developer http://www.ubuntu.com

2 1

[PATCH] added missing hash_create which was remove by a previous patch
by Sumit Bose 18 Aug '09

18 Aug '09

Hi, commit c0f3393d4ab923e2eedab0fad88a864e2aae9fc9 removed a needed hash_create. This patch adds it again. bye, Sumit

2 2

[PATCH] fix return value of confdb_get_domains
by Sumit Bose 18 Aug '09

18 Aug '09

Hi, while testing Stephen's 'only one local domain' patch I found that if the last configured domain is broken sssd terminates even if there valid domains available. The following patch will fix this. bye, Sumit

3 2

[PATCH] Ensure that only one local domain is configured
by Stephen Gallagher 18 Aug '09

18 Aug '09

This patch resolves https://fedorahosted.org/sssd/ticket/97 -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 2

[PATCH] Remove unneeded binary objects from the replace directory
by Stephen Gallagher 18 Aug '09

18 Aug '09

These were unintentionally committed binary files. They were used by the Samba project during cross-compilation, but they serve no purpose for us. -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 2

[RFC] Legacy user support and minimum domain requirements in the SSSD
by Stephen Gallagher 17 Aug '09

17 Aug '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Recently there has been a lot of activity in Trac surrounding our support for invoking the legacy shadow-utils tools for managing legacy files-based domains. This has raised some questions over the utility of this feature. First of all, there is an unreasonable amount of code implemented to handle the logic of determining into which domain we're attempting to add a user. Secondly, the legacy local users (provider=files) is the only non-native backend that we're providing any special handling for. I'm not sure I see the utility in exerting so much effort supporting a configuration we hope to be phasing out. So my proposal is to have the sss_* tools support only the native local domain in the SSSD (provider=local). By extension, I also propose that we mandate that a valid config must have exactly one provider=local domain (it can hold whatever name the administrator desires, but it should always be there). There should never be more than one, as that doesn't really make sense and would similarly introduce the complexity of adding users to the domains. In summary, I feel that the sssd commandline user and group tools should manipulate only the SSSD native local users and groups, and all configurations of the SSSD need to ensure that a native local domain is present. Please raise questions and comments in reply to this message. - -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkqJpmEACgkQeiVVYja6o6OvHwCgpc6NLUlgj+jFHWTWbpMOj4e4 ilwAn3xDugbXQv71sH14WcSK0PwCUEh2 =6L5u -----END PGP SIGNATURE-----

3 2

Ubuntu packages available from freeipa PPA
by Mathias Gug 17 Aug '09

17 Aug '09

Hi, I've just uploaded an SSSD package to the FreeIPA team PPA [1] to be tested on Ubuntu Karmic. It builds a snapshot from the git master tree (via the bzr import of master [2]). The specific Debian packaging is available from another bzr branch [3]. [1]: https://launchpad.net/~freeipa/+archive/ppa [2]: https://code.launchpad.net/~vcs-imports/sssd/trunk [3]: https://code.launchpad.net/~mathiaz/sssd/ubuntu-pkg My plan is still to try to get 0.5.0 in Karmic. The deadline (FeatureFreeze) is Thu, August 27th. I'll try to do an upload on a daily basis to make sure master keeps building on Karmic. And I think that the Debian packaging is ready. Next step is to get more testing done on the sssd packages available from the FreeIPA PPA. -- Mathias Gug Ubuntu Developer http://www.ubuntu.com

2 4

[PATCH] Fix broken build
by Stephen Gallagher 17 Aug '09

17 Aug '09

In the code review of the DP reconnection patch, I noticed a build-breaking bug which I fixed in-tree and then failed to push to the upstream tree. This one-liner fixes the broken build. (Pushed to master under the one-liner and urgency rules) -- Stephen Gallagher RHCE 804006346421761 Looking to carve out IT costs? www.redhat.com/carveoutcosts/

1 0

[RFC] removal of 'legacy' option
by Simo Sorce 17 Aug '09

17 Aug '09

I am working on removing the 'legacy' option. The idea is to always save data in our cache using the member/memberof schema and let backends manage how to process incoming data without forcing all internal code to conform to differences imposed by backends. I have pushed 7 patches to my personal tree. Here: http://fedorapeople.org/gitweb?p=simo/public_git/sssd.git;a=summary So far it works with my limited testing against the native ldap driver. Once I have at least briefly tested other backends I'll propose these patches for inclusion. Note that this patch set may also fix some existing bugs in the group enumeration code. Simo.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2009