October 2010 - sssd-devel - Fedora mailing-lists

Config problem or bug(?) with sssd and Windows AD 2008
by Patrick Grieshaber 02 Feb '11

02 Feb '11

Hello folks, first let me say that the sssd project is great and I am lucky that this project is available for CentOS/Redhat through the EPEL repo :-). I've installed version sssd-1.2.1-27.el5.x86_64 and I want to be able to fetch user infos plus enable login through AD 2008 - but I fail.. sssd.conf: [domain/example.com] enumerate = false id_provider = ldap chpass_provider = krb5 ldap_uri = ldap://dc1.example.com, ldap://dc2.example.com ldap_search_base = dc=example,dc=com tls_reqcert = demand ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt ldap_tls_cacertdir = /etc/pki/tls/certs ldap_default_bind_dn = CN=serviceuser,DC=example,DC=com ldap_default_authtok_type = password ldap_default_authtok = serviceuserpassword ldap_user_name = sAMAccountName ldap_search_base = OU=IT,DC=example,DC=com ldap_pwd_policy = none ldap_user_object_class = person ldap_schema = rfc2307bis ldap_user_principal = userPrincipalName ldap_user_uid_number = sAMAccountName ldap_user_gid_number = sAMAccountName ldap_user_uuid = sAMAccountName ldap_user_fullname = displayName # kerberos config auth_provider = krb5 krb5_kdcip = dc1.example.com krb5_realm = EXAMPLE.COM krb5_changepw_principle = kadmin/changepw krb5_ccachedir = /tmp krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX krb5_auth_timeout = 15 For debugging reasons I run: sssd -d9 Here the output if I attempt: su - myuser(a)example.com ...snip... (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(&(sAMAccountName=myuser)(objectclass=person))][OU=IT,DC=example,DC=com]. ...snip... (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_parse_entry] (9): OriginalDN: [CN=my,OU=IT,DC=example,DC=com]. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_generic_done] (6): Search result: Success(0), (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_users_process] (6): Search for users, returned 1 results. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[(nil)], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [ldb] (9): start ldb transaction (nesting: 0) (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_user_send] (9): Save user (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_user_send] (1): no uid provided for [myuser] in domain [example.com] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_users_process] (2): Failed to store user 0. Ignoring. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [ldb] (9): commit ldb transaction (nesting: 0) (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_users_done] (9): Saving 1 Users - Done (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success And su outputs: su: user myuser(a)example.com does not exist What is wrong? I do the mapping of a uid/gid... any help is appreciated! Thank you, pat -- Patrick Grieshaber Mobile: +41 (0)79 215 63 79 Xing: xing.com/profile/Patrick_Grieshaber Skype: patrickgrieshaber GPG Key Fingerprint 0252 0C05 410E C345 1AC7 7530 98ED B18E 62CB CF04

4 11

[PATCH] Introduce pam_verbosity config option
by Sumit Bose 15 Nov '10

15 Nov '10

Hi, this patch should fix ticket #604, but maybe we want to add some more levels to pam_verbosity and also handle other messages with this patch. Currently I have two questions. First, is more granularity needed for pam_verbosity or is it enough to switch between only important and all messages? Second, if offline_credentials_expiration is set, the 'Authenticated with cached credentials' messages is always display. Is this acceptable or shall we introduce a threshold parameter here? bye, Sumit

2 5

[PATCHES] Sanitize search filters in the sysdb
by Stephen Gallagher 15 Nov '10

15 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is the first part of a fix for https://fedorahosted.org/sssd/ticket/639 These patches address the various search filters we're using in the sysdb. Patches for LDAP search filters will be coming later. I wanted to get these reviewed first. Patch 0001: Adds a utility function to sanitize search filters using the method described in RFC 4515. Includes a unit test. Patch 0002: Sanitize search filters internal to the public sysdb APIs. Includes unit tests. Patch 0003: Sanitize sysdb search filters in the IPA provider used with sysdb_search_custom() Patch 0004: Sanitize sysdb search filters used when processing nested groups. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzKGl0ACgkQeiVVYja6o6OSLQCeI9d1ITiVS4JcrZesZTXsyTyG zS0AoIQeKBsatVL4Ed51D2nGwxaT7PVh =qbgv -----END PGP SIGNATURE-----

2 7

[PATCHES] Create krb5 access provider
by Sumit Bose 05 Nov '10

05 Nov '10

Hi, this series of patches implements an access target for the Kerberos provider based on the krb5_kuserok() call which checks $HOME/.k5login. This patch should fix ticket #618. bye, Sumit

2 2

[PATCH] Store krb5 auth context for other targets
by Sumit Bose 04 Nov '10

04 Nov '10

Hi, this patch should fix ticket #628. It was reported the in the case of a timeout the KDC was contacted two times. This happened, because the KDC was added two times (one for the auth target the other for the chpass target). There is already some code which should detect multiple initialisation from different targets, but it didn't worked correctly. This patch should fix it. bye, Sumit

3 3

sdap_async_netgroups.c misused SDAP_SEARCH_BASE?
by Moritz Baumann 01 Nov '10

01 Nov '10

I have filed a bug report at: https://bugzilla.redhat.com/show_bug.cgi?id=648150 ddiff -Nur sssd-1.4.0/src/providers/ldap/sdap_async_netgroups.c sssd-1.4.0.patch/src/providers/ldap/sdap_async_netgroups.c --- sssd-1.4.0/src/providers/ldap/sdap_async_netgroups.c 2010-10-18 20:03:45.000000000 +0200 +++ sssd-1.4.0.patch/src/providers/ldap/sdap_async_netgroups.c 2010-10-31 14:57:51.963194696 +0100 @@ -603,7 +603,7 @@ subreq = sdap_get_generic_send(state, state->ev, state->opts, state->sh, dp_opt_get_string(state->opts->basic, - SDAP_SEARCH_BASE), + SDAP_NETGROUP_SEARCH_BASE), LDAP_SCOPE_SUBTREE, state->filter, state->attrs, state->opts->netgroup_map, I'm not sure if this fixes the issue. Best, Moritz

3 2

[PATCH] Fix incorrect free of req in krb5_auth.c
by Stephen Gallagher 01 Nov '10

01 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Causes a crash in the kerberos provider when we immediately thereafter call into krb5_find_ccache_step(). - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzIgLsACgkQeiVVYja6o6N+TACgoBpq5jbCzej43bnNqbcMCNsB p7QAnAikYC0KWMNtY552FFP16g9mr1Ha =Ozre -----END PGP SIGNATURE-----

2 2

[PATCH] Fix two return value checks
by Sumit Bose 01 Nov '10

01 Nov '10

Hi, this patch fixed two typos in krb5_auth.c. bye, Sumit

2 2

GECOS mapping for 'cn' attribute in SSSD.
by Gowrishankar Rajaiyan 27 Oct '10

27 Oct '10

Hi All, When SSSD is configured for proxy id_provider and a user is enumerated, GECOS field is populated with the ldap server's "cn" attribute. # getent -s sss passwd puser1 puser1:*:1001:1001:Posix User1:/export/puser1:/bin/bash However, if SSSD is configured for ldap id_provider and the same user is enumerated, the GECOS field remains empty. # getent -s sss passwd puser1 puser1:*:1001:1001::/export/puser1:/bin/bash It looks like nss_ldap switched to defaulting to using 'cn' for the gecos mapping. Perhaps SSSD should do the same? Best regards, Shanks

3 2

[PATCH] Mention ding-libs in BUILD.txt
by Sumit Bose 27 Oct '10

27 Oct '10

Hi, this patch add some comments about ding-libs to BUILD.txt and should fix ticket #651. bye, Sumit

2 4

[PATCH] Allow authentication for referrals
by Sumit Bose 27 Oct '10

27 Oct '10

Hi, this patch add a rebind proc which uses the same credentials used for the primary server to authenticate to the second server when doing referral chasing. There are two important things to keep in mind: - as already mentioned we use the same credentials for both connections, i.e. if TLS is used on the first connection, it will be used un the second too. If GSSAPI is use for the first server it will be used for the second server with the same realm/KDC/keytab settings. If we want different credentials and authentication schemes for different server we should address this in a separate patch. - everything is synchronous, let me repeat: synchronous. From 'man ldap_set_rebind_proc': "The rebind function must use a synchronous bind method." I have tested this patch against an OpenLDAP server with GSSAPI and simple bind with and without TLS. This patch should fix ticket #495. bye, Sumit

2 2

[PATCHES] Fixes for nss responder
by Sumit Bose 26 Oct '10

26 Oct '10

Hi, if an nss provider dies during a request the nss responders dies due to a double free error minutes after the request was sent. The responder does not handle the unfinished request and so they stay around and the client has to wait for a response until SSS_CLI_SOCKET_TIMEOUT (5 minutes) is over. During the termination of the request the sss_dp_callback structure is free two times which lead to an abort in the nss responder. The first patch add a handler which removes all open requests after a reconnect. The second one is only marginally related to the described issue but makes sure that cmdctx, the parent or grand-parent memory context of the sss_dp_callback structure, is always allocate with talloc_zero. The third patch removes the explicit talloc_free of the sss_dp_callback structures, because they are already freed because cmdctx was freed during the callback. bye, Sumit

2 2

[PATCH] Always use uint32_t for UID/GID numbers (master)
by Jakub Hrozek 26 Oct '10

26 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 As discovered by QA, we were not consistent across architectures with our handling of UID numbers. This patch converts to strtouint32(), so we use the fixed-width uint32_t everywhere. Attached are patches for both master and 1.2, where the patch also fixes one additional place which was still using strtol(). Jakub -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzFidMACgkQHsardTLnvCWHegCfa7bj/AWnNa6nBjW9qzz3rA+H iykAnRYj/xtrnP3YLI+adJ1vLQc3Obc4 =CpSQ -----END PGP SIGNATURE-----

2 6

[PATCH] Minor improvements to the prerelease S/RPM builds
by Stephen Gallagher 26 Oct '10

26 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm doing some work to get the automated builds working again in the post-ding_libs world. This is just a minor patch to the Makefile to add the current minute to the timestamp. Also changes 'make srpms' to 'make srpm', since we're only creating one. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkzFxtcACgkQeiVVYja6o6O4lwCgoqlVbXCOzADYloNK9keLQs8N SBIAn1oOfIkjE2nPqKmJsfM2iVJhtoXb =n6h/ -----END PGP SIGNATURE-----

2 2

[PATCHES] Netgroups for proxy provider
by Sumit Bose 25 Oct '10

25 Oct '10

Hi, there two patches add netgroups support for the proxy provider as requested in ticket #630. bye, Sumit

2 4

[PATCH] Use unsigned long for conversion to id_t (sssd 1.2 only)
by Jakub Hrozek 22 Oct '10

22 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We used strtol() on a number of places to convert into uid_t or gid_t from a string representation such as LDAP attribute, but on some platforms, unsigned long might be necessary to store big id_t values. This patch converts to using strtoul() instead. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky8nN4ACgkQHsardTLnvCWRzQCcDqc0Wpf+5Dg7NsN6Jf/Bh43G rVMAoMJT5OHxSMgwWFDMMSXXusV9F/3n =hYrP -----END PGP SIGNATURE-----

4 4

[PATCH] Download only enabled IPA HBAC rules
by Sumit Bose 22 Oct '10

22 Oct '10

Hi, with this patch only enabled IPA HABC rules are loaded and saved in sysdb. This fixes ticket #530. bye, Sumit

2 3

[PATCH] Add ldap_deref option
by Sumit Bose 22 Oct '10

22 Oct '10

Hi, as requested by ticket #568 this patch adds the option ldap_deref to sssd.conf. This option controls how aliases are dereferenced. bye, Sumit

3 4

[Transifex] File submitted via email to SSSD | master
by admin＠transifex.net 22 Oct '10

22 Oct '10

Hello sssd, this is Transifex at http://www.transifex.net. The following attached files were submitted to SSSD | master by yurchor <yurchor(a)ukr.net> Please, visit Transifex at http://www.transifex.net/projects/p/sssd/c/master/ in order to see the component page. Thank you, Transifex

2 1

[PATCH] Add some missing ldap_memfree()
by Sumit Bose 22 Oct '10

22 Oct '10

Hi, I've found a few places where we do not free the error message returned by ldap_parse_result(). This patch should fix this. bye, Sumit

3 2

[PATCH] Fix a typo in dhash.h
by Sumit Bose 21 Oct '10

21 Oct '10

Hi, just a typo. bye, Sumit

2 1

[PATCH] Convert krb5_kdcip option to krb5_server
by Jan Zelený 19 Oct '10

19 Oct '10

Based on Jakub's proof-of-concept patch I prepared a patch which handles this option replacement. As it was discussed on the meeting couple weeks back, I didn't modify the update script (I hope I remember this requirement modification right) and in case both krb5_kdcip and krb5_server options are in the config file, the latter one has bigger priority. Jan

2 8

[PATCH] Write log opening failures to the syslog
by Stephen Gallagher 19 Oct '10

19 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 If there is a problem with reopening the logs, it can be an audit trail issue. Make sure we log this in the syslog. Previously we were trying to write this to the debug log that we just proved couldn't be opened :-( - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky98IYACgkQeiVVYja6o6PzYgCfdy38nA9GRohEl6sh+Qk3oY81 2nsAn2y20/Z56zPXo8tMDAx0mBOCeWfX =cdtq -----END PGP SIGNATURE-----

2 2

[Transifex] File submitted via email to SSSD | master
by admin＠transifex.net 19 Oct '10

19 Oct '10

Hello sssd, this is Transifex at http://www.transifex.net. The following attached files were submitted to SSSD | master by raven <piotrdrag(a)gmail.com> Please, visit Transifex at http://www.transifex.net/projects/p/sssd/c/master/ in order to see the component page. Thank you, Transifex

2 1

create_homedir and ldap domain
by Eric Doutreleau 19 Oct '10

19 Oct '10

i m still using sssd 1.3 and in my ldap domain i have put the following statement create_homedir = False but the homedir is still created if it doesn't exist. can i use this directive for an ldap domain?

3 3

Re: [SSSD] [RFC][PATCH] Add new getgrgid2(), getgrnam2() interfaces to glibc
by Stephen Gallagher 19 Oct '10

19 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/18/2010 07:42 PM, Petr Baudis wrote: > This RFC patch adds support for new interfaces: getgrgid2(), > getgrnam2() and their *_r() variants. These interfaces allow > the user to specify whether the group.gr_mem field shall be > filled in. > > The issue we are trying to solve is that needlessly high load is > generated in large deployments with NIS/LDAP user groups with possibly > thousands of members. Even when nscd is used, the information is > requested and transferred frequently even when there never arises > any real use for the huge lists of members at the node at all. > > We have looked at some commonly used applications and e.g. for a normal > desktop, if some basic utilities and file managers would be trivially > modified to use the new interface, the full lists of users in a group > would never have to be downloaded. Right now, even ls will trigger > getting full lists of users in all groups it encounters. Moreover, e.g. > the sssd guys are reportedly trying to solve this problem by evil hacks > like randomly not filling or only partially filling the gr_mem field. > Actually, your information is a little bit incorrect. We recently discovered that we had a few bugs in SSSD that were causing us to only present a subset of the gr_mem field. This was entirely incorrect, and as of SSSD 1.2.4 and 1.4.0 we have rectified this problem. The way we do things in SSSD is, however, designed to significantly reduce the load on LDAP servers. When we perform a group lookup with getgrnam() or getgrgid(), we request ONLY this group from the LDAP server. What we then do on our client-side is to create in our cache mechanism a series of "fake" users in our data store. These users will be reported back to getgrnam(), but they are not separately looked up and populated with their complete user information unless they are directly requested by a getpwnam() or getpwid() request. The net result is that we will report all of the users that belong in a group, but we will not make additional requests to populate those users unless they are directly requested. Yes, for groups that have many thousands of users, we may make a single request that transfers a couple hundred kilobytes, but we do not make subsequent requests for each of those users in turn. RFC2307bis servers require slightly more processing, as we need to make multiple requests to LDAP if there are nested groups in play. But we never make more requests than the configured nesting limit. > Any comments on the API are welcome, including thoughts on how to > make it more elegant. Originally, I wanted to implement it as > gid_t getgidbyname(const char *name) etc., but I would have to redo > some parts of the NSS infrastructure to easily allow returning gid_t > instead of a struct. > > If there is a consensus that this is a good idea and Ulrich gives his > blessing, I will of course extend the patch to be compatible with older > NSS modules and add NIS support and nscd support. > I'm really not sure what the value of this approach is. Realistically, you're talking about creating an interface whose sole purpose is to map GID<->groupname and nothing else? I'm not sure there's sufficient value in this approach, given that it's possible as described above to limit the network requests. I think it makes much more sense to guide the respective name-service providers along the path of handling these requests more efficiently. I'm expanding this mailing to include the sssd-devel list for broader discussion. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky9iTYACgkQeiVVYja6o6PwsACaAsWK6+lv/jsVLqQJhsml00hB z8IAni+cKfv2z9PNWLSe6qKO8Ol/KP53 =PeBB -----END PGP SIGNATURE-----

3 4

Announcing SSSD 1.4.0
by Stephen Gallagher 19 Oct '10

19 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The SSSD team proudly announces the release of the System Security Services Daemon version 1.4.0. As always, SSSD 1.4.0 can be downloaded at https://fedorahosted.org/sssd == Highlights == * Added support for netgroups to the LDAP provider * Performance improvements made to group processing of RFC2307 LDAP servers * Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin * Build-system improvements to support Gentoo * Split out several libraries into the ding-libs tarball * Manpage reviewed and updated == Detailed Changelog == Jakub Hrozek (30): * Fix wrong return value in HBAC time rules evaluation * Package systemd unit file * Move crypto functions into its own subdir * Add safe copy/move macros for uint16_t * Password obfuscation utility functions * Fix pysss linking * Python bindings for obfuscation * sss_obfuscate tool * Deobfuscate password in back ends * Fix assorted minor bugs in sss_ tools * Fix parameter order when initializing decryption * Revert "Make ldap bind asynchronous" * Define objectclass with a constant * Use a different min_id for local domain * Add parameter to skip cleanup in sysdb test * Fix sysdb_group_dn_name * Fix sysdb_attrs_to_list * Request the correct attribute name * Add KDC to the list of LDAP options * Report Kerberos error code from ldap_child_get_tgt_sync * Make ldap_child report kerberos return code to parent * Initialize kerberos service for GSSAPI * Check for GSSAPI before attempting to kinit * Add sysdb_attrs_get_ulong utility function * sysdb interface for adding incomplete groups * Save dummy groups to cache during initgroups * sysdb interface for adding fake users * Save dummy member users during RFC2307 getgr{nam,gid} * Use unsigned long for conversion to id_t * set in_transaction explicitly to false Jan Zeleny (14): * Initialized return value in dp_copy_options() * Fixed potential comparison of undefined variable * Fixed printing of undefined value in sdap_async_accounts.c * Fixed uninialized value in proxy_id provider * Cleaned some dead assignments * Reviewed sssd-ldap man page * Fixed small issue in memory context hierarchy * Dead assignments cleanup in providers code * Dead assignments cleanup in NSS responder * Dead assignments cleanup in memberof module * Dead assignments cleanup in various places in SSSD * Disable events on ldap fd when offline. * Man pages should mention supported providers * Move all references to ldap_<entity>_search_base to "advanced" section Martin Nagy (1): * Make ldap bind asynchronous Maxim (6): * Fix building sssd * Fix configure check for ldb * Add gentoo distrubutions * Add custom pam module dir * Add gentoo-specific init dir * Remove useless /etc/dbus-1/system.d directory from installation Ralf Haferkamp (2): * Shortcut for save_group() to accept sysdb DNs as member attributes * Return all group members from getgr(nam|gid) Simo Sorce (2): * Check if control is supported before using it. * Add option to limit nested groups Stephen Gallagher (36): * Fix chpass operations with LDAP provider * Remove common directory * Rewrite toplevel Makefile * Build SSSD RPMs with external libraries * Remove src/Makefile.am and src/configure.ac * Don't build SSSDConfig API when configured with --without-python-bindings * Treat a zero-length password as a failure * Properly handle errors from a password change operation * Handle multiple simultaneous enumeration requests * Remove generated manpages when performing "make clean" * Request all group attributes during initgroups processing * Fix missing variable substitution in DEBUG message * Initgroups on a non-cached user should go to the data provider * Fix assorted specfile issues * Initialize debug_level to zero in crypto tests * Return offline instead of error * Add common hash table setup * Add utility function sss_strnlen() * Store entry_cache_timeout in sss_domain_info object * Require explicit setting of callback context for check_cache * Netgroups sysdb API * netgroup tests * Rename group.c and passwd.c for clarity * Add support for netgroups to NSS sss_client * Add negative cache features for netgroups * Split out some helper functions for the NSS responder * Add netgroup support to the NSS responder * Rename upgrade_config.py and build it properly * Assorted specfile changes * Make sdap_save_users_send handle zero users gracefully * Handle nested groups in RFC2307bis * Modify sysdb_[add|remove]_group_member to accept users and groups * Add proper nested initgroup support for RFC2307bis servers * Updating translation files for release * Fix 'make distcheck' for XML documentation * Updating version for SSSD 1.4.0 release Sumit Bose (21): * Store rootdse supported features in sdap_handler * Handle host objects like other objects * Save all data to sysdb in one transaction * Use new MIT krb5 API for better password expiration warnings * Suppress some 'may be used uninitialized' warnings * Suppress some 'unchecked return value' warnings * Use POPT_TABLEEND to close option table * Add a missing include file * Rename index to idx * Distribute XML sources instead of man-pages * Remove unused defines * Raise the required version of libdhash * Add missing tevent_req_done() * Return NSS_STATUS_RETURN instead of NSS_STATUS_NOTFOUND * Add handling of nested netgroups to nss client * Do not fail if netgroup exists just update the attributes * Add sysdb_netgroup_base_dn() * Also return member groups to the client * Add infrastructure to LDAP provider for netgroup support * Implement netgroup support for LDAP provider * Avoid a global variable in netgroup client. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky8lt4ACgkQeiVVYja6o6NC+QCfTYv7LhCuNnZQ5coLwqkoQ2/K zn4An3ah9ZOi2eu+E8ETZRgoY8lw0gRk =x48f -----END PGP SIGNATURE-----

2 2

[PATCH] Serialize authentication requests
by Jan Zelený 19 Oct '10

19 Oct '10

I'm sending a patch which is resolving ticket #533 by implementing a hash table into the PAM responder. For testing I followed this approach: 0) Configure sssd to use RH LDAP and KRB 1) Activate shaping on the host computer tc qdisc add dev eth0 root netem delay 2s 2) Run 2 separate shells with non-root user logged in 3) In both shells run su - <login> simultaneously 4) When asked for password, type in your password, but don't hit enter 5) When you have a password typed in both shells, hit enter in the first one, quickly switch to the other one and hit enter there (you should have 2s window to do this) In both shells you should be logged in as <login> and you should have the same ticket cache file. Something about the concept: I took it from NSS responder (or rather the common part, which retrieves information about user) as suggested in the ticket. But as Jakub pointed out to me, it is questionable whether we want to invoke all associated callbacks by scheduling them on the same time. The easier alternative is to call them all one after another in a cycle. I suppose it was implemented this way so it doesn't take long to forward all associated replies and other requests from PAM module can be served. Am I right? Or would it be better to re-write the patch and use the cycle instead? Thanks Jan

2 1

[PATCH] Fix 'make distcheck' for XML documentation
by Stephen Gallagher 18 Oct '10

18 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A missing $(srcdir) variable was preventing 'make distcheck' from working if run from a parallel build directory. Pushed to master under one-liner rule. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky8h60ACgkQeiVVYja6o6PdvQCgkceGP453nkQFctPdV2p3R8Yi yFwAmwffOv4jUQ4WviucoUxnXWA0LC2M =25Tt -----END PGP SIGNATURE-----

1 0

[PATCH] set in_transaction explicitly to false
by Jakub Hrozek 18 Oct '10

18 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I didn't hit this in development as I was running with -O0.. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky4brYACgkQHsardTLnvCXTVQCfcmvQY0Nhk/NqFZAJDSC3buTU IT8An14UJEu8KAEruaj5XFcDlDwA2tqd =YzGW -----END PGP SIGNATURE-----

2 2

[PATCHES] Initgroups support for RFC2307bis nested groups (master)
by Stephen Gallagher 18 Oct '10

18 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patch 0001: Modify sysdb_[add|remove]_group_member to accept users and groups Previously, it assumed that all members were users. This changes the interface so that either a user or a group can be specified. Also, it eliminates the need for a memory context to be passed, since the internal memory should be self-contained. Patch 0002: Add proper nested initgroup support for RFC2307bis servers Both of these patches are forward-ported from SSSD 1.2.4 (adjusting for sysdb changes). - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky7nR0ACgkQeiVVYja6o6Pc0ACfQ8HrRu1jglyMiQb1sNITy9dS g5UAnRbQI8d2cF+ev0KjaJQ73qN/BQLE =T69a -----END PGP SIGNATURE-----

2 4

[PATCH] Documentation update
by Jan Zelený 18 Oct '10

18 Oct '10

I'm sending patch removing all references to ldap_user_search_base, ldap_group_search_base and ldap_netgroup_search_base as discussed on the meeting. The ticket #607 suggests to put them into Advanced config options section, but there is no such section, so I removed them altogether. In the ticket, it is also stated that Fedora deployment guide has been updated accordingly, but I found references to this option: http://docs.fedoraproject.org/en- US/Fedora_Draft_Documentation/0.1/html/Deployment_Guide/chap-SSSD_User_Guide- Configuring_Domains.html http://docs.fedoraproject.org/en- US/Fedora_Draft_Documentation/0.1/html/Deployment_Guide/sect-SSSD_User_Guide- Configuring_Domains-Setting_up_Kerberos_Authentication.html http://docs.fedoraproject.org/en- US/Fedora_Draft_Documentation/0.1/html/Deployment_Guide/sect-SSSD_User_Guide- SSSD_Example_Configuration_Files-SSSD_Configuration_File_Format.html I've already sent an email to David asking him to take care of this. I'll search our wiki for references to these options during the weekend. Jan

4 5

[PATCHES] Handle nested groups in RFC2307bis (master)
by Stephen Gallagher 18 Oct '10

18 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 These patches are forward-ported from the work done in SSSD 1.2.4. Patch 0001: Add options for managing nested group limits. Patch 0002: Shortcut out of sdap_save_users() if there are no users to save, rather than starting a useless LDB transaction. Patch 0003: Handle nested groups in RFC2307bis Like SSSD 1.2.4, these patches only handle the generic case of RFC2307bis and do not perform any of the optimizations available when memberOf support is available. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky4oRUACgkQeiVVYja6o6NUywCeMzJSc7UkUGcmtcltuSltdzU7 S3UAn17UWBN+hn37lG2947ZA8pnyKSmi =30ki -----END PGP SIGNATURE-----

2 7

[PATCH] Use unsigned long for conversion to id_t
by Jakub Hrozek 18 Oct '10

18 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We used strtol() on a number of places to convert into uid_t or gid_t from a string representation such as LDAP attribute, but on some platforms, unsigned long might be necessary to store big id_t values. This patch converts to using strtoul() instead. Fixes: #650 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky8WNMACgkQHsardTLnvCVNcgCdHr2kc89RkJ+KvScequEOcnyE XFYAoKKlUiXcFSYFEiulykIq5gO3Ql/V =ZpLz -----END PGP SIGNATURE-----

2 4

[PATCH] Save dummy groups to cache during initgroups (master)
by Jakub Hrozek 15 Oct '10

15 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [PATCH 1/2] sysdb interface for adding fake groups Adds a sysdb_add_fake_group() call that adds an expired group entry. Also tweaks the NSS code a little so the fake group entries that are invalid are skipped. This is not how we use the fake groups in patch #2 as we also store the gid, but I think it's worth making sure we don't return fake groups now that we have a mechanism to add them. [PATCH 2/2] Save dummy groups to cache during initgroups When performing initgroups/getgrouplist on RFC2307, add fake group entries for those groups that are not cached already. That way, complete group membership is returned without saving complete group objects. These two patches apply to master only but I have a 1.2 counterpart - currently only in my fedorapeople repo - I can resend them when/if these are approved as these read much easily, so I think it makes sense to review them first. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkykhNMACgkQHsardTLnvCVyDgCgqOgmne9qYk9l1uEyB32mJWn5 LQcAnRNErXrbmwHVY49Gx5IANUF946dr =O6nl -----END PGP SIGNATURE-----

2 10

[PATCH 2/2] Save dummy member users during RFC2307 getgr{nam, uid} (master)
by Jakub Hrozek 15 Oct '10

15 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, these two patches add the same functionality we have in the 1.2 branch into master. I think they read much better b/c of the synchronous sysdb interface. Both must be applied on top of Ralf's patches in the "Behaviour of getgrnam/getgrgid" thread. Jakub -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyy+pAACgkQHsardTLnvCXwFACfYqJBydSwz/K7PD1hBu7Nh/OM aokAn0qlwTlezT4DLTFqp/e8fkkIRYUu =rqOw -----END PGP SIGNATURE-----

2 5

[PATCH] Check for GSSAPI before attempting to kinit
by Jakub Hrozek 15 Oct '10

15 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I forgot to squash in one more patch for the kdcinfo patchset..we need to init the GSSAPI service when both SDAP_KRB5_KINIT is true and SDAP_SASL_MECH is set to GSSAPI. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky2La8ACgkQHsardTLnvCVA4QCglsFiP9Gr9ybvrW6plVJBg/BL Ck0AnRDlnPZkpkApFRUKCfVAbLitTDAS =L93b -----END PGP SIGNATURE-----

2 2

[PATCHES] Two build-system fixes
by Stephen Gallagher 13 Oct '10

13 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patch 0001: Rename upgrade_config.py and build it properly Previously, we were just copying the script into the libexec dir during installation. However, this causes problems for packaging multilib on several distributions. https://fedorahosted.org/sssd/ticket/641 Patch 0002: Assorted specfile changes Several problems with the specfile were fixed in the SSSD release in certain RPM-based distributions. This patch pulls them into the example specfile - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky1t+UACgkQeiVVYja6o6NtFgCfZY2phgT0RQ4MLRbWvSynOUuB /8IAoKuaYlMEtQUMc8Ie/ot6HRMklRzg =kupp -----END PGP SIGNATURE-----

2 4

[PATCH] Create kdcinfo files for the LDAP provider
by Jakub Hrozek 13 Oct '10

13 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This series of patches implement creation of kdcinfo files when GSSAPI is used with pure LDAP provider. [PATCH 1/4] Add KDC to the list of LDAP options A simple patch that adds a way to specify the KDC [PATCH 2/4] Report Kerberos error code from ldap_child_get_tgt_sync While looking at the ldap_child code, I noticed that the call to ldap_child_get_tgt_sync should return the Kerberos specific error code rather than errno. [PATCH 3/4] Make ldap_child report kerberos return code to parent The buffer used to communicate between parent and child now contains a new parameter which is the Kerberos error code. An example of use of this is detecting that KDC was unreachable in the following patch. [PATCH 4/4] Initialize kerberos service for GSSAPI I'm not very fond of patch #4 myself - the reason is that as far as I remember, the sdap_ modules were meant to be a rather thin wrapper to provide an "async set of LDAP calls", the provider and backend-specific calls belong one level up, to the ldap_ modules. However, in order to support fail over in during sdap_kinit_, I used the be_resolve_ family functions there, which looks like breaking the abstraction level quite a bit. If there are any suggestions on how to accomplish the kinit w/ fail over better, I'll be glad to hear them. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyGK/UACgkQHsardTLnvCX1eACgvWrKscnQpQaUFMBZg5idClEM lboAmgIdqQDlgenJCkELWL98jPK0yvog =3NiP -----END PGP SIGNATURE-----

3 5

[PATCHES] Netgroup support for LDAP provider
by Sumit Bose 13 Oct '10

13 Oct '10

Hi, this series of patches continue the work Stephen has started in "[PATCHES] Support for netgroups in the NSS client and responder". We decided to try to be as compatible to nss_ldap as possible, i.e. we do not any group unrolling or loop detection inside of sssd, but rely on glibc. To achieve this I added support to return netgroup member groups to the client and glibc. This is mostly done in 0003 and 0006. 0007 and 0008 add the necessary support to the LDAP provider. There is one difference to nss_ldap. If a netgroup member is not specified by a plain name but by a DN nss_ldap just returns the DN string to glibc and then glibc searches for a netgroup where the name is the returned DN. Even nss_ldap cannot find a matching netgroup for this name. If sssd detects a DN in the member list it tries to translate it to the corresponding name of the netgroup. If this fails it will return the full DN. The patches 0001 and 0002 fixes two errors in Stephen's patches. bye, Sumit

2 7

[PATCHES] Support for netgroups in the NSS client and responder
by Stephen Gallagher 13 Oct '10

13 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 These patches were tested on the local domain (by manually editing the sssd.ldb). I also ran them through valgrind. Patch 0001: Add utility function sss_strnlen() This is useful for guaranteeing the size of an input buffer. I'm using this in the nss client portion of the netgroups support. Patch 0002: Store entry_cache_timeout in sss_domain_info object This is useful so that the NSS responder can identify an domain's entry timeout for expiring the memory cache for a lookup such as with netgroups. Patch 0003: Require explicit setting of callback context for check_cache Previously, it was implicitly using the nss_dom_ctx, but there are situations where we would want to send a different private context. Specifically, we need to be able to send a step_ctx for the netgroups support in patch 0010. Patch 0004-0005: Sysdb interfaces for netgroups (and associated tests) These are identical to the last set I sent in the "Sysdb interface for netgroups" thread. I am retiring that thread to use this one for the review. Patch 0006: Rename group.c and passwd.c for clarity Prefixing group.c and passwd.c with "nss_" similar to the way the PAM client sources are prefixed with "pam_". This patch isn't strictly necessary, but I wanted it to be more clear which files were associated with NSS vs. PAM vs. common in the sss_client directory. Patch 0007 will create nss_netgroup.c as well. Patch 0007: Add support for netgroups to NSS sss_client There's one peculiarity about this patch that I have to note. I need to send back a true/false value to the setnetgrent call in order to properly report that there were no entries. This differs from the other set*ent functions because we are processing a specific requested entry rather than enumerating all entries. Without doing this, we actually return a netgroup containing no member triples, which is certainly not what the client app expects. Patch 0008: Add negative cache features for netgroups This patch just updates the negative cache interface to allow including netgroups in the negative cache like other entries. Patch 0009: Split out some helper functions for the NSS responder Create a new private header and make some functions available for other object files. The nsssrv_cmd.c file is getting far too large to be manageable. Patch 0010 will create a separate file (nsssrv_netgroup.c) to hold all of the netgroup-related code, but we need access to this set of functions in both places. Patch 0010: Add netgroup support to the NSS responder This is the big one. It borrows a lot of its design from the recently rewritten enumeration code, but it has a few gotchas (notably that we need to maintain state between setnetgrent and getnetgrent calls to ensure that we are still answering requests for the same requested entry. Remaining work on netgroups will be to add support for the LDAP backend to store the netgroups in the cache appropriately. In the future (https://fedorahosted.org/sssd/ticket/630) we will also add netgroups support to the proxy provider. This proxy support is not planned for 1.4.0. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyakSUACgkQeiVVYja6o6Or5ACgrYx+rlk4ux/MOCjqVQ9Ds8+6 BvQAn1KrVnr7J0HAreUTovg8B03WLp0R =71HE -----END PGP SIGNATURE-----

2 3

Behaviour of getgrnam/getgrgid
by Ralf Haferkamp 13 Oct '10

13 Oct '10

Hi, Is it really the intended behaviour of the sssd LDAP backend (I am running the current code from the master branch) to only return the group members that are already cached in sysdb and to silently ignore everything else? E.g. when I start sssd with empty caches and do a "getent group <random-ldap-group>" I will only get back the group without any members. Somehow I think this can't be intended :) I have started working on a patch to let sssd look up the non-cached users via LDAP (and save them into the cache). Find it attached. Note: That patch is not really complete (e.g. it doesn't handle rfc2307 groups correctly). But before putting more effort into this I like to make sure that I am not trying to fix a "feature" here. -- regards, Ralf

7 42

Man pages should mention supported providers
by Jan Zelený 13 Oct '10

13 Oct '10

Supported providers are mentioned in Description section, because there was already partial description present. Another possibility was to comment it as configuration option (e.g. create access_provider=ldap record there). I like this way more, but I'm not sure whether it is descriptive enough. -- Jan

2 4

[PATCH] Raise the required version of libdhash
by Sumit Bose 13 Oct '10

13 Oct '10

Hi, this patch increase the required version number of libdhash. Older version cannot update hash entries with hash_enter(). I think we currently do not use hash_enter() to update entries (I had a netgroup patch where it was used, but since we let glibc do all the unrolling and loop-detection it is not needed anymore). To avoid surprises we should check for the latest version of libdhash. bye, Sumit

2 2

[PATCH] Remove unused defines
by Sumit Bose 13 Oct '10

13 Oct '10

Hi, by chance I came across these two defines which are not used (anymore). bye, Sumit

3 2

[PATCH] Distribute XML sources instead of man-pages
by Sumit Bose 13 Oct '10

13 Oct '10

Hi, currently we distribute the generated man pages with the released tar balls. This patch replaces them with the XML source files. bye, Sumit

3 2

[PATCHES] Three minor cosmetic fixes
by Sumit Bose 13 Oct '10

13 Oct '10

Hi, the three attached patches fixes some compiler warnings, which might occur with a high warning level like -Wextra. bye, Sumit

3 2

Announcing the release of ding-libs 0.1.2
by Stephen Gallagher 12 Oct '10

12 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sumit discovered and fixed a serious bug in libdhash. Specifically, the hash_enter() function was incapable of updating an existing entry. We are releasing ding-libs 0.1.2 immediately with a fix for this incorrect behavior. ding-libs-0.1.2 is available for source tarball download at https://fedorahosted.org/sssd/wiki/Releases#DING-LIBSReleases - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAky0rN4ACgkQeiVVYja6o6Pd+wCgh7WJJhgoSYsuOACGV8fOpNee Y+cAnRrQVWrD2Ma/CPAYY1MTJ7Hri3Cx =/Pbk -----END PGP SIGNATURE-----

1 0

[PATCH] dhash: Allow hash_enter() to update entries
by Sumit Bose 12 Oct '10

12 Oct '10

Hi, Patch 0003 add update capabilities to hash_enter(). The current behaviour was to keep the old entry and return HASH_SUCCESS. I have added an update test to the unit test. Maybe it make sense to update the version number to make it easier to detect if updates are possible or not. Patch 0001 adds a missing include file and 0002 makes hash_example pass valgrind without errors. bye, Sumit

2 2

login is slow just after reboot
by Eric Doutreleau 12 Oct '10

12 Oct '10

hi we re using sssd 1.3.0 with ldap authentication and as soon as we have populated a lot of groups login just after reboot is very slow ( about 45 seconds ). After the first initial login all the subsequent login are immediate. I know that there were some performance problem with initgroup. Are they solved now? I 'm doing enumeration on my ldap server. Should i upgrade to 1.3.1 version?

2 1

[PATCH] Do not remove man pages in released tar balls
by Sumit Bose 11 Oct '10

11 Oct '10

Hi, make clean removes the generated man pages even in the distributed version where they cannot be recreated because we do not ship the xml sources. This patch checks if src/man/include, which we do not ship either, exists before removing the files. bye, Sumit

2 2

Announcing SSSD 1.2.4
by Stephen Gallagher 09 Oct '10

09 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The SSSD team is proud to announce the immediate release of version 1.2.4 of the System Security Services Daemon. This update fixes several serious bugs in the 1.2.x line of SSSD and is a recommended update for all users. It can be downloaded at https://fedorahosted.org/sssd == Highlights == * Resolves long-standing issues related to group processing with RFC2307bis LDAP servers * Fixed bugs in RFC2307bis group memberships related to initgroups * Fix tight-loop bug on systems with older OpenLDAP client libraries (such as Red Hat Enterprise Linux 5) == Detailed Changelog == Héctor Daniel Cabrera (1): * Updating ES translation Jakub Hrozek (9): * Fix sysdb_group_dn_name * Fix sysdb_attrs_to_list * Request the correct attribute name * End update_members request if there's nothing to do * sysdb interface for adding incomplete group entries * Add fake groups during initgroups * sysdb interface for adding expired user entries * Shortcut for save_group() to accept sysdb DNs as member attributes * Add fake users during saving of RFC2307 group Jan Zeleny (1): * Disable events on ldap fd when offline. Simo Sorce (1): * Add option to limit nested groups Stephen Gallagher (8): * Request all group attributes during initgroups processing * Add common hash table setup * Make sdap_save_users_send handle zero users gracefully * Handle nested groups in RFC2307bis * Make user argument of sysdb_update_members_send a const * Modify sysdb_add_group_member_send to accept users and groups * Add proper nested initgroup support for RFC2307bis servers * Releasing version 1.2.4 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyvrhwACgkQeiVVYja6o6NG/gCgsIiRGlDSipnZJe9fr8wZAxaD osIAoJKRu9XeY5y7BjBf8GMc1WyNHLjq =fo2a -----END PGP SIGNATURE-----

1 0

[PATCHES] Initgroups support for RFC2307bis nested groups (sssd-1-2)
by Stephen Gallagher 09 Oct '10

09 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 These patches must be applied atop my patches in the thread "Handle nested groups in RFC2307bis (sssd-1-2)", which in turn must be applied atop Jakub's patches in the thread "Fix initgroup processing for RFC2307 (sssd-1.2)". These patches rely on the fake group functionality added by Jakub's patches. Patch 0001: Make user argument of sysdb_update_members_send a const This argument should have been const to begin with, as the function should not modify it. This removes a const pointer issue from patch 3 (since it was more sensible to just send a const string than make a useless copy) Patch 0002: Modify sysdb_add_group_member_send to accept users and groups Previously, it assumed that all members were users. This changes the interface so that either a user or a group can be specified. Patch 0003: Add proper nested initgroup support for RFC2307bis servers This patch handles the general case, that of any RFC2307bis server. The memberOf optimizations that we were previously relying on are still available if ldap_schema=IPA is set in the sssd.conf. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyuctsACgkQeiVVYja6o6P6fwCfZnXU1vD7YoUw+pwIo39G8TlA 56gAmwcR7hLw20DTerjis+N/fpeQNv8D =6AP4 -----END PGP SIGNATURE-----

3 7

[PATCHES] Handle nested groups in RFC2307bis (sssd-1-2)
by Stephen Gallagher 09 Oct '10

09 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 These patches apply atop Jakub's "Fix initgroup processing for RFC2307 (sssd-1.2)" patches. Patch 0002: Add option to limit nested groups Patch 0003: Handle nested groups in RFC2307bis This first approach handles the non-optimized "pure" RFC2307bis case. It recursively calls into nested groups until it it has found them all or hits the pre-defined nesting limit. It then saves all member users first, then all groups to the sysdb This patch only handles the general case of RFC2307bis nested groups. It contains no optimizations for memberOf implementations. Given that we have time constraints, this patch should handle all implementations of RFC2307bis correctly (if not high-performance). Support for partial (AD) and complete (IPA) memberOf will be added to the master branch later. Still to do: initgroups for RFC2307bis using Jakub's fake groups. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkysmk8ACgkQeiVVYja6o6MQRACfTOiHz0JwvJ5C1P2iaiMKXz7g eS0An21yo8giW5uVR92mN+zeYwQFU3nK =Qx3A -----END PGP SIGNATURE-----

3 9

[PATCH] Return all user members for RFC2307 groups (sssd-1.2)
by Jakub Hrozek 09 Oct '10

09 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [PATCH 1/3] sysdb interface for adding expired user entries These are added instead of looking up the members. [PATCH 2/3] Shortcut for save_group() to accept sysdb DNs as member attributes This patch is a backport of original written by Ralf Haferkamp. [PATCH 3/3] Add fake users during saving of RFC2307 group Instead of looking up the user entries, we just add dummy expired users that are refreshed when they are requested with getpwnam/getpwuid -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyrXCUACgkQHsardTLnvCWpwACg33dycv5TL1CZsVwvl9SFyJIK W4gAoL+FaNyFUJG155eM63df5C9xq9CT =lvCd -----END PGP SIGNATURE-----

3 10

[PATCH] Fix initgroup processing for RFC2307 (sssd-1.2)
by Jakub Hrozek 09 Oct '10

09 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, these patches supersede those in threads: [PATCH] Save dummy groups to cache during initgroup (sssd-1.2) and: [PATCH] End update_members request if there's nothing to do(sssd-1.2) I am sending them separately so that it's easier to test and apply them. Patch #1 has already been acked, patches #2 and #3 were nacked on IRC for a minor issue, so hopefully should be OK, too. They apply directly on top of origin/sssd-1-2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyskS8ACgkQHsardTLnvCVLNACg6m+nl1rUCUF45JiQJEvhCRCW 7i4An3J5SMfQZzuOOIzrbnW6j7KcKUZ7 =2ZDi -----END PGP SIGNATURE-----

2 5

[PATCH] Add common hash table setup
by Stephen Gallagher 09 Oct '10

09 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 sss_hash_create() produces a dhash table living in the talloc hierarchy. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkysmOoACgkQeiVVYja6o6NhBwCcCbhvJ/df1qtYRIqoGHvW0nIP oFQAnAxd3MNFlg0tkYR91/cwIyEA22N1 =swMP -----END PGP SIGNATURE-----

2 4

[PATCH] Fix log filling with error message
by Jan Zelený 08 Oct '10

08 Oct '10

I'm sending a patch solving ticket #599 for review. After I tried some other solutions, this one seemed to be the most simple one which didn't cause any problems. My only concern was whether monitoring the LDAP socket will be restored once the backend goes online. Looking at the code, it should, because sdap_install_callbacks is called every time sh->connected is set to true. But still I wanted to be sure. From testing performed by Dmitri, it seems that I was right and the backend is correctly restored. Here is a complete test case: 1. Disconnect from the network 2. Try to log in -- the data provider should now go offline 3. Connect to the network 4. Wait for the log filling message to appear in the log -- ! The messsage should appear only once ! 5. If the message doesn't appear, repeat from step 1 6. If the message appeared, try to log in 7. If successful, check that the login was performed online and not from cached credentials 8. Step 7 might need to be repeated a couple times, it takes some time for SSSD to go online again Note: the reproduction of this issue might not be that easy. To achieve the message appearing in the log, you would have to try different scenarios (NB connected using VPN -> suspended -> woke up in the company network -> suspended -> ...) Jan

5 6

Hash table for PAM requests
by Jan Zelený 07 Oct '10

07 Oct '10

Hi, I have a question regarding PAM responder. I'm currently working on implementation of a hash table for PAM requests (ticket #533). I have done a large part, but now I found something which made me curios about the whole concept of my implementation. I'm assuming PAM responder works this way: 1) Receive PAM request 2) Delegate it to all domains 3) If any domain is marked as offline, ask the domain cache for that record I've implemented the hash table to be used for requests going to domain providers, not the local ones (i.e. those which are going to cache). I think in the context of the ticket #533 this is the right approach, because when the domain is offline, I won't get a kerberos ticket anyway, so there is no way that two users simultaneously logging in will get two credential cache files. Or do you think I should implement it for both domain and cache requests in case the domain goes online after the first but before the second request? Thanks for any advice Jan

2 1

Ordering of the group info and initgr patches for 1.2
by Jakub Hrozek 06 Oct '10

06 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, as there are already many patches on the list, here is a simple dependency chain between them: 3) group info fixes: [PATCH 1/3] sysdb interface for adding expired user entries [PATCH 2/3] Shortcut for save_group() to accept sysdb DNs as member attributes [PATCH 3/3] Add fake users during saving of RFC2307 group 2) initgroup fixes: [PATCH 1/2] sysdb interface for adding expired group entries [PATCH 2/2] Add fake groups during initgroups 1) [PATCH] End update_members request if there's nothing to do 0) origin/sssd-1-2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkysfc0ACgkQHsardTLnvCVFIwCgpoovwksxXCQn4x0mDV5+HsVv l68An3BpvSwpnVeL8IHn9YOGNe4EeIyM =WBc3 -----END PGP SIGNATURE-----

1 0

[PATCH] Save dummy groups to cache during initgroups (sssd-1.2)
by Jakub Hrozek 06 Oct '10

06 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [PATCH 1/2] sysdb interface for adding fake groups Adds a sysdb_add_fake_group_send() call that adds an expired group entry. [PATCH 2/2] Save dummy groups to cache during initgroups When performing initgroups/getgrouplist on RFC2307, add fake group entries for those groups that are not cached already. That way, complete group membership is returned without saving complete group objects. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyrXBAACgkQHsardTLnvCXX1ACfSoDJ4xRyBNF88A+6viXwJukG hmoAoLSudyDHOSD4F30HlF0YEeVUGuoW =0xuH -----END PGP SIGNATURE-----

2 9

[PATCH] End update_members request if there's nothing to do (sssd-1.2)
by Jakub Hrozek 05 Oct '10

05 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 If there were no users to add nor delete, sysdb_update_members_step() would mark the request as done but not call post, so the callback would never be called. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyrXAYACgkQHsardTLnvCVCYQCeI3I4GmRWwP+WuCibmVNOQl7n RAAAoKJsmOt0tpUKHs2lRzQOhpTj5XzN =kaPS -----END PGP SIGNATURE-----

2 1

[PATCH] Return offline instead of error
by Stephen Gallagher 04 Oct '10

04 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When the failover code returns that there are no available servers while we are marked offline, we were returning an error to the PAM authentication code. Instead, we should return success with a result value of SDAP_UNAVAIL so that the PAM responder will mark the domain offline and attempt offline authentication. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkymLIIACgkQeiVVYja6o6MNLwCfYs1KNyo/efVWxZXu1sY6jkb2 /YAAnREisr66R1+gWaj9tCkXyCOcZ/2w =eRON -----END PGP SIGNATURE-----

3 4

Handling nested netgroups (looking for recommendations)
by Stephen Gallagher 04 Oct '10

04 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 First, a little overview on netgroups. Netgroups in LDAP can contain two attributes: 1) nistNetgroupTriple - Contains a literal triple of (host, username, domain) 2) memberNisNetgroup - The name (or DN, more on that later) of another netgroup. Returning triples are simple, we just return them as-is. However, returning nested netgroups introduces a bit of additional complexity. Currently, nss_ldap just returns the name of the memberNisNetgroup directly to glibc and allows it to handle it. This means that glibc will make an extra, internal set of setnetgrent(), getnetgrent() endnetgrent() calls to nss_ldap. Or not: the design of glibc means that if the nested netgroup appears in an NSS provider listed in nsswitch.conf before nss_ldap, it will be returned from there, rather than nss_ldap. This means that it is theoretically possible for a local file to override the centralized LDAP for a netgroup. With SSSD, our original plan was that we should always treat the LDAP server as authoritative. We would internally handle recursive lookups for nested netgroups and unravel them ourselves before returning them to glibc. We would only return nested names in this case if the specified member does not exist on the LDAP server (in this case we will assume that it's meant to be handled by another netgroup provider). To illustrate the difference: With nsswitch.conf: netgroup files nss_ldap On LDAP: ldapnetgroup1: (user1, host1, ldapdomain) extranetgroup2 extranetgroup2: (user2, host2, ldapdomain) In local files: extranetgroup2: (localuser, localhost, localdomain) With nss_ldap, making a request for ldapnetgroup1 would return to the calling application (after glibc completed all its internal lookups): ldapnetgroup1: (user1, host1, ldapdomain), (localuser, localhost, localdomain) Whereas with the proposed approach for SSSD: With nssswitch.conf: netgroup files sss We would get back from glibc: ldapnetgroup1: (user1, host1, ldapdomain), (user2, host2, ldapdomain) So the difference in behavior should be clear now. The obvious advantage to this approach is that the central server will always be considered authoritative for its entries. We will assume that the specified member should use the LDAP representation as its first option, and fail over to glibc's lookup for other netgroup providers only if it does not exist in LDAP. This should provide a more stable environment, however it does differ from the current expected behavior as defined by nss_ldap. To enumerate the options we can follow: 1) We can behave exactly as nss_ldap does. If we locate a member netgroup, we can return that directly to glibc and expect to have it look it up as needed. Pros: identical behavior to the current state. Cons: makes additional requests to the SSSD that we could be handling internally without a lot of back-and-forth to glibc. 2) We can assume that member entries in LDAP refer to LDAP entries unless we cannot locate them. In this case, we can internally handle the recursive lookups to LDAP. Any member netgroups that we don't find in LDAP should be returned to glibc to process. Pros: we can control nesting limits this way. The memberOf plugin also does a good job with protecting us against loops. We can parallelize the lookups of multiple member netgroups for performance. Cons: we are changing the behavior as described above. Appendix) There is no formal specification of netgroups. It's possible for the memberNisNetgroup attribute to contain either a simple name or a full LDAP distinguished name. If a full DN is provided, we should assume that this means that it must be in LDAP, and stop processing (and don't return it) if we get a DN that doesn't match. For entries that are not complete DN's, we should choose one of the two aforementioned approaches. Please comment if you have an opinion. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyiMSIACgkQeiVVYja6o6MuxwCghVhG3baFori0Retl6itILvLe NqkAn3Sn5EZkgP5Yoztuvh/KHudWP48S =tcYu -----END PGP SIGNATURE-----

7 17

[PATCH] Save dummy member users during RFC2307 getgr{nam, uid} (master)
by Jakub Hrozek 02 Oct '10

02 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [PATCH 1/2] sysdb interface for adding fake users same as in previous patchset, just adds fake users [PATCH 2/2] Save dummy member users during RFC2307 getgr{nam,uid} When performing getgrnam/getgrgid, instead of looking up the member users, just save expired user entries. These patches apply on top of Ralf's patches. I also changed two very minor things that IMHO make the whole codepath read more easily - I moved struct sdap_process_group_state next to sdap_process_group_send() and renamed sdap_process_group_done() as the name suggested that it is a _done() callback of sdap_process_group_send(). Stephen, how would you like to coordinate backporting this to 1.2 since, as far as I recall, we won't be backporting Ralf's patches? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkykhNsACgkQHsardTLnvCWBnwCgiJVOzgnJnN6riKU3SUrhhf7G kq8AoKYyOhAz68ymJOSL2Pqfqhi2d4Xp =I238 -----END PGP SIGNATURE-----

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel October 2010