sssd-devel September 2010

sssd-devel@lists.fedorahosted.org

13 participants
48 discussions

Improving GNOME's ldap resiliency
by Jeff Schroeder 26 Sep '10

26 Sep '10

As we move to evolve the GNOME infrastructure, it has came to my attention that: 1.) Our ldap services sometimes go haywire and services we provide go with it. 2.) Our ldap master, label.gnome.org, does not have an ldap client configured due to the chicken/egg problem. 3.) The ldap slave in our backup (Canonical) datacenter is flaky causing issues with services hosted there such as damned lies[1]. The sssd[2] is this nifty project written by mostly redhatters which does the job of pam_ldap plus a lot more. Most important to us, it does offline ldap information caching. Since we don't enable password-based logins to our servers, it won't cache shadow attributes but it will store group/passwd info. The package is already in EPEL and will be the default ldap client in RHEL6. It has been in Fedora since Fedora 11[3] and is going to be shipping with RHEL5.6. Integrating this should be a piece of cake. Setting up sssd on our servers fixes several existing issues: 1.) When label goes down, users can no longer commit to gnome git. This would have been a much bigger issue in the svn days. Yay for dvcs! 2.) Other services on the ldap master won't have problems if their init script runs before ldap comes up. Example: Starting httpd: httpd: bad group name bugzilla [FAILED] 3.) Home directories are mounted over NFS on all servers in our primary (redhat) datacenter. NFS with downed ldap can get ugly unless that info was cached locally. 4.) ldap will no longer be perceived as a hindrance towards rebooting label for a new kernel or some major update. Speaking as someone who has deployed ldap + sssd in an environment many order of magnitudes bigger than GNOME's, I highly recommend it. In the future, sssd will support caching ssh keys (from ldap) locally in it's own ldb cache. Do we want to explore this avenue or do we want to continue using the the create-auth scripts? If we want to entertain this, we should work together with upstream to integrate with our custom ssh key ldap schema. The developers expressed they will work by default with the openssh-lpk schema which we sadly do not use. This email is an introduction of us to the sssd team and vice versa. If no one voices a strong opinion against, I'm going to work on deploying sssd over the next week or so. [1] http://l10n.gnome.org/ [2] https://fedorahosted.org/sssd/ [3] http://fedoraproject.org/wiki/Features/SSSD [4] http://git.gnome.org/browse/sysadmin-bin/tree/create-auth -- Jeff Schroeder Don't drink and derive, alcohol and analysis don't mix. http://www.digitalprognosis.com

2 1

[PATCH] Use new MIT krb5 API for better password expiration warnings
by Sumit Bose 23 Sep '10

23 Sep '10

Hi, currently we can only present a warning message which in generated inside the MIT Kerberos library to the user if the password is about to expire. But the developers of MIT Kerberos were so nice to add a new API to retrieve the original timestamps (http://k5wiki.kerberos.org/wiki/Projects/Password_expiration_API) It is currently available in the daily development snapshots of MIT Kerberos and should find its way into the 1.9 release. The attached patch checks if the new API is available and adds a callback to read the password expiration timestamp. As mentioned on the web page there is a small chance that this patch will not display the time when the password expires, but the time when the account expires. I think we can neglect this case. bye, Sumit

2 2

[PATCH] Save all data to sysdb in one transaction
by Sumit Bose 23 Sep '10

23 Sep '10

Hi, this patch for master saves all IPA HBAC data in one transaction and proceeds if the sysdb transaction fails. It addresses a review comment from the "Use new schema for HBAC service checks" patch. The first patch changes the handling of the host data to be compatible with the other data. The second removes the individual transactions and introduces a common sysdb transaction. Do we want/need a similar patch for master, too? bye, Sumit

3 9

[PATCH] Request all group attributes during initgroups processing (sssd-1-2)
by Stephen Gallagher 23 Sep '10

23 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We tried to be too clever and only requested the name of the group, but we require the objectClass to validate the results. https://fedorahosted.org/sssd/ticket/622 This is rebased from the patches in the thread "Fix two serious issues with initgroups". The other two patches are unnecessary in sssd-1-2 (bug 620 does not exist there) - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyPkKQACgkQeiVVYja6o6Oz7QCdGqpJk4DdXhY98yQG+yyUDbeG /+QAnijrjOrBOHoBJra/ETAg2nhdjxPN =QCGD -----END PGP SIGNATURE-----

2 2

[PATCH] Assorted patches for initgroups processing (sssd-1.2)
by Jakub Hrozek 23 Sep '10

23 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is just a rebased version of the same patches that went into master. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyaG1oACgkQHsardTLnvCW74gCgpgoE8SqGV74eLwbffRAYAv6R 16kAoILN6C0rnXfrVrdBRUkYvjW989MA =uSnr -----END PGP SIGNATURE-----

2 1

[PATCH] Fix version handling of the libraries
by Sumit Bose 23 Sep '10

23 Sep '10

Hi, patch 0002 mainly fixes the version numbers in the *.pc files. The first patch removes the unneeded --disable-rpath configure option from the spec file example. bye, Sumit

2 2

[PATCH] Two minor fixes for ding-libs
by Sumit Bose 23 Sep '10

23 Sep '10

Hi, I've found two minor issues in ding-libs which are fixed by the attacked patches. bye, Sumit

2 2

[PATCHES] Sysdb interface for netgroups
by Stephen Gallagher 22 Sep '10

22 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is a first pass at the cache storage and retrieval for netgroups information. Part of these patches were written by Jakub, part by me. I'd prefer it if Jan, Simo or Sumit did the review for this. I'm going to try to submit patches for review on a rolling basis for the netgroups code, in order to avoid a too-large review when the work is complete. Patch 0001: New sysdb interfaces for netgroups. Add and delete support for netgroups entries, tuples and nested netgroups. Patch 0002: Unit tests for the above interfaces. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyQ5KoACgkQeiVVYja6o6OM3gCgkv7AwjDGN6A97uM7URMDPAn0 tr8AnidKAUkbpjr2F9lhdH3gbIx/or3G =ndx4 -----END PGP SIGNATURE-----

4 16

[PATCH][ding-libs] Build all of the ding-libs from the root
by Stephen Gallagher 22 Sep '10

22 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We rethought how we're going to build the ding-libs. They will now all be built from a single tarball (and a single SRPM, by extension) and produce independent shared libraries (which will produce an assortment of binary subpackages in RPM) The attached (large) patch makes this change by moving all of the ding-libs into a common Makefile.am/configure.ac pair at the root of the source tree. Dmitri, I have rebased my FedoraPeople repo branch with these changes, so developing from that as a base should work for you. http://fedorapeople.org/gitweb?p=sgallagh/public_git/ding-libs.git;a=shortl… Let me know if you have trouble. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkyZKFkACgkQeiVVYja6o6P74QCfYFcDT5V61rMN9WHCsBOim3O0 hAMAn1i620mra4wzGNGl6EGmFa/BFLNB =C+OV -----END PGP SIGNATURE-----

3 6

[PATCH] Assorted patches for initgroups processing
by Jakub Hrozek 22 Sep '10

22 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I found these issues while testing Stephen's initgroup patches: [PATCH 1/3] Fix sysdb_group_dn_name We copied the RDN attribute name, not its value. Also includes a unit test. [PATCH 2/3] Fix sysdb_attrs_to_list We didn't cycle through all the attributes. [PATCH 3/3] Request the correct attribute name The attributes we got from sdap_get_generic_recv() are already mapped to sysdb attributes, so when we asked for "cn", it was not found as the attributes already included "name". They apply to master only, I can resend the 1.2 version when/if these are deemed OK. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkySO9YACgkQHsardTLnvCUjWwCeJvPq/UU09wmPY80o6vbrSxAH 61QAoNrAaIh/ZixsVcImODbdegLKjPMW =xQ4R -----END PGP SIGNATURE-----

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2010