November 2011 - sssd-devel - Fedora mailing-lists

[PATCH] Allow more libldap debugging
by Jakub Hrozek 28 Nov '12

28 Nov '12

This patch should not be pushed to master, but I would like to get it reviewed anyway. It should be used to provide a custom build for users experiencing cases where ldap_search_ext would block (c.f. https://bugzilla.redhat.com/show_bug.cgi?id=728343) For example: export SSSD_DEBUG_LDAP_SEARCH="0xffff" would set LDAP_DEBUG_ANY The attached patch applies cleanly on the RHEL6.1 branch. I also have a version that applies on master/1.5 if needed.

4 7

[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal 05 Apr '12

05 Apr '12

Please see the attached patches. I tried to split the patches logically into manageable sets. Unfortunately I made a minor mistake and I am afraid I will do something wrong to fix it. I merged two wrong patches. Fortunately it was three liner with 1 liner so it is not a big of the deal but I am really scared that I will do something wrong and loose the work I have done. So I hope it is Ok to send it as is. 0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted earlier that I merged by mistake. I was supposed to merge it with patch 25 but picked the wrong one instead. Patch 25 addresses the real issue found by Coverity as mentioned in Stephen's review mail but it did not apply cleanly since it relies on some code from the patches in the middle. 0002--INI-Adding-missing-function-declararion.patch <- this is the patch that was rejected from the second set sent earlier. Fixed according to review comment. 0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing per component The following set of patches introduces the merging of sections during the reading of the file: 0004--INI-New-error-codes-and-messages.patch 0005--INI-New-merge-flags.patch 0006--INI-Add-new-vars-to-parse-structure.patch 0007--INI-Add-save_error-function.patch 0008--INI-Change-parse_error-to-use-save_error.patch 0009--INI-Preparing-for-merging-sections.patch 0010--INI-Enhance-value-processing.patch 0011--INI-Use-section-line-number.patch 0012--INI-Refactor-section-processing.patch 0013--INI-Return-error-in-DETECT-mode.patch 0014--INI-New-test-files-for-section-merge.patch 0015--INI-Test-DETECT-mode-and-use-new-file.patch 0016--INI-Test-for-all-section-merge-modes.patch Patches related porting of the meta data from old way of doing things to the new way of doing things: 0017--INI-Separate-close-and-destroy.patch 0018--INI-Function-to-reopen-file.patch 0019--INI-Metadata-collection-is-gone.patch 0020--INI-Check-access-function.patch 0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check) 0022--INI-Function-to-check-for-changes.patch 0023--INI-Tests-for-access-and-changes.patch 0024--INI-Rename-error-print-function.patch <- rename error printing function for consistency with new interface 0025--INI-Initialize-variables-in-loops.patch <- Coverity issue addressed. Related to patch 0001. 0026--INI-Exposing-functions.patch <- Make some internal functions reusable There is also patch 27. It is a piece of new functionality. It is a preview. Please see the comment before reviewing it. Do I need to split it into multiple patches or it is Ok as is? It is pretty big but all changes are in one file and logically related. The UNIT test is missing so I am not claiming it actually works as expected. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 30

Announcing SSSD 1.6.2
by Stephen Gallagher 04 Jan '12

04 Jan '12

The SSSD team is proud to announce the version 1.6.2 enhancement and bugfix release of the System Security Services Daemon. As always, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Improved handling of users and groups with multi-valued name attributes (aliases) * Performance enhancements * Initgroups on RFC2307bis/FreeIPA * HBAC rule processing * Improved process-hang detection and restarting * Enabled the midpoint cache refresh by default (fewer cache misses on commonly-used entries) * Cleaned up the example configuration == Detailed Changelog == Jakub Hrozek (23): * Improve error message for LDAP password constraint violation * Keep deref controls until the whole request is finished * Fix uninitialized pointer read in sdap_gssapi_get_default_realm() * IPA access: hostname comparison should be case-insensitive * Add sysdb interface to get name aliases * Add a sysdb_get_direct_parents function * Store name aliases for users, groups * Return users and groups based on alias * Use explicit base 10 for converting strings to integers * Fix typo in sysdb_get_direct_parents * Add option to follow symlinks to check_file() * Append PID to sbus server socket name, let clients use a symlink * Streamline the example config * Do not delete requests inside hash_iterate loop * Check if dp_requests hash table exists before using it * Fix off-by-one error in remove_socket_symlink() * Report on errno, not return code in create_socket_symlink * Add a missing break * Sanitize DN in sysdb_get_direct_parents * gitignore additions * Utility functions for LDAP nested schema initgroups * Use fewer transactions during RFC2307bis initgroups * Use fewer transactions during IPA initgroups Jan Zeleny (2): * man page fix (lists are comma-separated) * Fixed timeout handling in responders Marko Myllynen (3): * Add missing options to sssd.api.conf * Unbreak ./configure * Update sssd-example.conf Pavel Březina (3): * sss_ldap_err2string() - function created * sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string() * Added quiet option to pam_sss Pavel Zuna (1): * Fix small bug where TALLOC_CTX could end up unfreed. Stephen Gallagher (18): * Bumping version to 1.6.2 * Add option to specify the kerberos replay cache dir * Fix typo in %configure * Remove all libtool .la files from RPM * Improve documentation of libipa_hbac * Add libipa_hbac documentation to the -devel package * MONITOR: Correctly detect lack of response from services * Do not build documentation on RHEL 5 * Fix typo in specfile * MAN: Add more information about internal credential storage * Enable the midpoint cache update by default * HBAC: fix typos preventing proper hostgroup evaluation * HBAC: Do not save member/memberOf links * HBAC: Use originalMember for identifying servicegroups * HBAC: Use originalMember for identifying hostgroups * BUILDSYS: Fix --without-manpages * MONITOR: fix timeout conversion * Updating translation files for string freeze Sumit Bose (1): * Do not access memory out of bounds

5 32

Re: [SSSD] Announcing SSSD 1.5.14
by GOLLSCHEWSKY, Tim 20 Dec '11

20 Dec '11

> > I'm not sure if artificially trimming the group list is a good idea. > > It wouldn't work for everyone and I would be wary of breaking access > > control mechanisms. > > Noted. And yes I agree this (non-mandatory) config option wouldn't be useful for everyone, it's just something > that fixes my particular problem (reduces ssh login times from 30 seconds to <5). > > I may have to write my own patch and apply it to the SRPM as each official version of SSSD is released. It won't be > supported by Red Hat obviously but my users won't be complaining about slow login times anymore. So partial win. :) Just thought I'd contribute my results in case this helps with your investigation of the larger problem. I assume there are other organisations with huge AD/LDAP directories that are having similar issues with ssh authentication times. I've finished my local patch and added a config option called: ldap_rfc2307bis_initgroups_filter If not specified, sssd just reverts to normal behaviour (cn=*) during the initgroups run. With no ldap_rfc2307bis_initgroups_filter: # time ssh myhost groups xxxxdm xxxxdef xxxxgmt xxxx002 xxxx003 xxxxp xxxx001 xxxx002 xxxxt xxxxp xxxxange xxxxra xxxxb2 xxxxp xxxxd xxxxt xxxxp xxxxp xxxxp xxxxp xxxxd xxxxd xxxxp xxxxd xxxxd xxxxd xxxxp xxxxp xxxxd xxxxd xxxxp xxxxt xxxxd xxxxlemr xxxxp xxxxd xxxxp xxxxp xxxxd xxxxt xxxxd xxxxp xxxxd xxxxd xxxxt xxxxp xxxxt xxxxp xxxxd xxxxd xxxxt xxxxp xxxxd xxxxu xxxxp xxxxp xxxxp xxxxp xxxxd xxxxp xxxxp xxxxu xxxxp xxxxp xxxxt xxxxp xxxxd xxxxd xxxxt xxxxp xxxxd xxxxt xxxxt xxxxd xxxxt xxxxp xxxxp xxxxi xxxxd xxxxd xxxxp xxxxd xxxxp xxxxp xxxxd xxxxd xxxxp xxxxp xxxxd xxxxp xxxxd xxxxp xxxxd xxxxp xxxxp xxxxp xxxxp xxxxd xxxxd xxxxd xxxxd xxxxp xxxxp xxxxp xxxxd xxxxd xxxxd xxxxd xxxxd xxxxp xxxxp xxxxd xxxxd xxxxd xxxxd xxxxd xxxxd xxxxp xxxxp xxxxd xxxxp xxxxd xxxxd xxxxp xxxxd xxxxd xxxxd xxxxd xxxxd xxxxp xxxxd xxxxd xxxxd xxxxd xxxxd xxxxd xxxxd xxxxp xxxxd xxxxd xxxxp xxxxt xxxxp xxxxd xxxxd xxxxp xxxxd xxxxd xxxxd xxxxp xxxxd xxxxd real 0m48.47s user 0m0.15s sys 0m0.02s With ldap_rfc2307bis_initgroups_filter = (|(cn=xxxrd)(cn=xxxxp)(cn=xxxxd)) # time ssh myhost groups xxxxdm xxxxgmt xxxxd xxxxp xxxxd real 0m5.11s user 0m0.15s sys 0m0.03s This hack will have to do until a better solution is found. I'm hoping the fixes coming in 1.7.0 will do the trick. :) Thanks to everyone who helped me get to this point. Best regards, Tim Gollschewsky. This e-mail is sent by Suncorp Group Limited ABN 66 145 290 124 or one of its related entities "Suncorp". Suncorp may be contacted at Level 18, 36 Wickham Terrace, Brisbane or on 13 11 55 or at suncorp.com.au. The content of this e-mail is the view of the sender or stated author and does not necessarily reflect the view of Suncorp. The content, including attachments, is a confidential communication between Suncorp and the intended recipient. If you are not the intended recipient, any use, interference with, disclosure or copying of this e-mail, including attachments, is unauthorised and expressly prohibited. If you have received this e-mail in error please contact the sender immediately and delete the e-mail and any attachments from your system.

4 5

GSSAPI and Kerberos - understanding question
by Josh Geisser 20 Dec '11

20 Dec '11

Hi list I'm sure I have gabs of understanding of how to use SSSD without using plain binding-user credentials in the configfile. I followed the guide for Win2008 allthough I only have 2003 SFU - would that work? - I see it right that GSSAPI should enable looking up stuff in the LDAP using a machine-account instead of the binding-user/passwd? - Kerberos (which has the machine-auth-ticket) comes into play for LDAP, but this exceeds the basic LDAP authentication (eg. Auth via Kerberos on the LDAP server)? Is this enough to feed nsswitch (e.g. getent) or is an additional valid user/pass still required? The trouble I'm having here is the ktpasswd.exe generated-key is always dated at 01/01/70 01:00:00 which I guess is also the reason why ldapsearch -Y GSSAPI and kinit fail? 2003 behaviour? The krb and ldap configuration works quite fine with bind-dn, just struggeling with SASL/GSSAPI. Cheers Josh -- ---- ASG at hnet

7 28

[PATCH] Add common SIGCHLD handling.
by Pavel Zuna 19 Dec '11

19 Dec '11

Base on the second proposal: https://fedorahosted.org/sssd/wiki/DesignDocs/SigChld There is some old SIGCHLD handling code in src/providers/child_common.[ch], that should probably go away if this gets accepted. There was also a naming conflict with the sss_child_ctx structure. This structure is only used internally by functions defined src/providers/child_common.c. I renamed the original structure to sss_child_ctx_old for now. Pavel

3 18

[PATCHES] ldap_*_search_base doesn't fully limit the group / netgroup
by Pavel Březina 14 Dec '11

14 Dec '11

https://fedorahosted.org/sssd/ticket/960

3 6

[PATCHES] Support native IPA netgroups
by Jan Zelený 09 Dec '11

09 Dec '11

I'm sending couple patches which add support for IPA netgroups: #53 These routines were not static, so I renamed them in order to avoid confusion and possible collision with equivalent routines in IPA provider #54 Some new config options, please focus on this patch, I'm not entirely sure if my approach was the correct one. #55 This new context was necessary so I can pass ipa options to routine determining host search base. #56 This is netgroups support itself #57 IPA id provider which is utilizing previously added support of netgroup fetching Thanks Jan

3 15

[PATCH] Added sssd --version option
by Pavel Březina 08 Dec '11

08 Dec '11

https://fedorahosted.org/sssd/ticket/953

5 11

[PATCH] Add ldap_sasl_minssf option
by Jan Zelený 08 Dec '11

08 Dec '11

https://fedorahosted.org/sssd/ticket/1075 The only thing is that I'm not sure if 72 is the right default minssf value for IPA provider, as default IPA installation works with 56 as the highest possible value for me. In default SSSD installation, this means that communication with IPA server will be rejected with no information about the reason being min SSF. I think this will be very confusing to SSSD users. Can anyone give me a hint how to proceed? Lower the default value in SSSD or do the change in IPA? Thanks Jan

5 12

[PATCH] Use dereference during IPA provider initgroups
by Jakub Hrozek 30 Nov '11

30 Nov '11

https://fedorahosted.org/sssd/ticket/1099

2 1

[PATCH] Add ipa_hbac_support_srchost option to IPA provider
by Jan Zelený 30 Nov '11

30 Nov '11

don't fetch all host groups if this option is set to false https://fedorahosted.org/sssd/ticket/1078 Jan

2 5

IPA migration fixes
by Jakub Hrozek 29 Nov '11

29 Nov '11

https://fedorahosted.org/sssd/ticket/924 started as a segfault ticket but we could never reproduce the crash afterwards. As Sumit noted it might have been caused by setting the O_NONBLOCK flag twice. However, the changes Sumit proposed in the ticket still make sense because they provide much cleaner solution. Attached are two patches: [PATCH 1/2] Provide means of forcing TLS and GSSAPI enabled/disabled for sdap connections This will be used to force TLS on the auth connection only and allow staying on GSSAPI-backed ID connection for the rest of the request. [PATCH 2/2] IPA migration fixes * use the id connection for looking up the migration flag * force TLS on the password based authentication connection

4 12

[PATCH] Remove unused constants
by Jakub Hrozek 29 Nov '11

29 Nov '11

They were harmless but unused and confusing.

2 2

[PATCH] Fix two small bugs in group dereferencing
by Jakub Hrozek 29 Nov '11

29 Nov '11

Noticed this while working on the dereference support in IPA initgroups

2 2

[PATCH] RESPONDER: Refactor DP requests into tevent_req style
by Stephen Gallagher 29 Nov '11

29 Nov '11

This patch addresses a number of code-maintenance issues and one hard-to-spot bug that has been hiding in the responder code for a long time. The code has been changed so that we will now follow the tevent_req style for requesting data from the Data Provider. We will attach tevent_req objects to the DP request object and call tevent_req_[done| error] on them once the processing is complete. For those requests that don't need to wait for a reply (such as midpoint cache refresh), the caller need only talloc_free() the returned tevent_req. The cache update will still continue in the background, but no notification of completion will be sent to this caller. The major bug that this addresses was the present of two timeouts being monitored for the same request: one was set in tevent directly by the NSS responder and the other was created implicitly by the D-BUS communication. Under some hard-to-reproduce situations, these could interact negatively and result in one cancelling the other. It has now been reduced down to using ONLY the D-BUS timeout.

2 4

SSSD Configuration issue
by Nitesh Mehare 29 Nov '11

29 Nov '11

Hello I'm configuring SSSD for the first time.I'm trying to setup the machine to authenticate using ldap server using sssd.The machine configuration is as follows bash-3.2# uname -a Linux bagira.in.ibm.com 2.6.18-238.el5 #1 SMP Sun Dec 19 14:22:44 EST 2010 x86_64 x86_64 x86_64 GNU/Linux bash-3.2# cat /etc/issue Red Hat Enterprise Linux Server release 5.6 (Tikanga) Kernel \r on an \m bash-3.2# bash-3.2# rpm -qa |grep sssd sssd-1.2.1-39.el5 sssd-client-1.2.1-39.el5 bash-3.2# *I have modified sssd.conf file * bash-3.2# cat /etc/sssd/sssd.conf [sssd] config_file_version = 2 # Number of times services should attempt to reconnect in the # event of a crash or restart before they give up reconnection_retries = 3 # If a back end is particularly slow you can raise this timeout here sbus_timeout = 30 services = nss, pam # SSSD will not start if you do not configure any domains. # Add new domain configurations as [domain/<NAME>] sections, and # then add the list of domains (in the order you want them to be # queried) to the "domains" attribute below and uncomment it. domains = LDAP [nss] # The following prevents SSSD from searching for the root user/group in # all domains (you can add here a comma-separated list of system accounts that # are always going to be /etc/passwd users, or that you want to filter out). filter_groups = root filter_users = root reconnection_retries = 3 # The entry_cache_timeout indicates the number of seconds to retain an # entry in cache before it is considered stale and must block to refresh. # The entry_cache_nowait_timeout indicates the number of seconds to # wait before updating the cache out-of-band. (NSS requests will still # be returned from cache until the full entry_cache_timeout). Setting this # value to 0 turns this feature off (default). ; entry_cache_timeout = 600 ; entry_cache_nowait_timeout = 300 [pam] reconnection_retries = 3 # Example domain configurations # Note that enabling enumeration in the following configurations will have a # moderate performance impact while enumerations are actually running, and # may increase the time necessary to detect network disconnection. # Consequently, the default value for enumeration is FALSE. # Refer to the sssd.conf man page for full details. # Example LOCAL domain that stores all users natively in the SSSD internal # directory. These local users and groups are not visible in /etc/passwd; it # now contains only root and system accounts. ; [domain/LOCAL] ; description = LOCAL Users domain ; id_provider = local ; enumerate = true ; min_id = 500 ; max_id = 999 # Example native LDAP domain # ldap_schema can be set to "rfc2307", which uses the "memberuid" attribute # for group membership, or to "rfc2307bis", which uses the "member" attribute # to denote group membership. Changes to this setting affect only how we # determine the groups a user belongs to and will have no negative effect on # data about the user itself. If you do not know this value, ask an # administrator. [domain/LDAP] debug_level = 9 id_provider = ldap auth_provider = ldap ldap_schema = rfc2307 access_provider = ldap ldap_access_filter = memberOf=cn=idsldap,ou=People,o=sample ldap_uri = ldap://lbullet.in.ibm.com ldap_search_base = ou=People,o=sample ldap_tls_reqcert = never cache_credentials = false enumerate = False # Example LDAP domain where the LDAP server is an Active Directory server. ; [domain/AD] ; description = LDAP domain with AD server ; enumerate = false ; min_id = 1000 ; ; id_provider = ldap ; auth_provider = ldap ; ldap_uri = ldap://your.ad.server.com ; ldap_schema = rfc2307bis ; ldap_user_search_base = cn=users,dc=example,dc=com ; ldap_group_search_base = cn=users,dc=example,dc=com ; ldap_default_bind_dn = cn=Administrator,cn=Users,dc=example,dc=com ; ldap_default_authtok_type = password ; ldap_default_authtok = YOUR_PASSWORD ; ldap_user_object_class = person ; ldap_user_name = msSFU30Name ; ldap_user_uid_number = msSFU30UidNumber ; ldap_user_gid_number = msSFU30GidNumber ; ldap_user_home_directory = msSFU30HomeDirectory ; ldap_user_shell = msSFU30LoginShell ; ldap_user_principal = userPrincipalName ; ldap_group_object_class = group ; ldap_group_name = msSFU30Name ; ldap_group_gid_number = msSFU30GidNumber ; ldap_force_upper_case_realm = True bash-3.2# *The system-auth file looks like this* bash-3.2# cat /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient /lib64/security/pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] /lib64/security/pam_sss.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient /lib64/security/pam_sss.so use_authtok password required pam_deny.so session required pam_mkhomedir.so umask=0022 skel=/etc/skel/ session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session sufficient /lib64/security/pam_sss.so session required pam_unix.so bash-3.2# bash-3.2# cat /etc/nsswitch.conf # # /etc/nsswitch.conf # # An example Name Service Switch config file. This file should be # sorted with the most-used services at the beginning. # # The entry '[NOTFOUND=return]' means that the search for an # entry should stop if the search in the previous entry turned # up nothing. Note that if the search failed due to some other reason # (like no NIS server responding) then the search continues with the # next entry. # # Valid entries include: # # nisplus Use NIS+ (NIS version 3) # nis Use NIS (NIS version 2), also called YP # dns Use DNS (Domain Name Service) # files Use the local files # db Use the local database (.db) files # compat Use NIS on compat mode # hesiod Use Hesiod for user lookups # [NOTFOUND=return] Stop searching if not found so far # # To use db, put the "db" in front of "files" for entries you want to be # looked up first in the databases # # Example: #passwd: db files nisplus nis #shadow: db files nisplus nis #group: db files nisplus nis passwd: files sss shadow: files group: files sss #hosts: db files nisplus nis dns hosts: files dns # Example - obey only what nisplus tells us... #services: nisplus [NOTFOUND=return] files #networks: nisplus [NOTFOUND=return] files #protocols: nisplus [NOTFOUND=return] files #rpc: nisplus [NOTFOUND=return] files #ethers: nisplus [NOTFOUND=return] files #netmasks: nisplus [NOTFOUND=return] files bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files rpc: files services: files netgroup: nisplus publickey: nisplus automount: files nisplus aliases: files nisplus bash-3.2# *The firewall and selinux is disabled* I have tried to look into the traces which shows the following *bash-3.2# tail -f /var/log/messages* Nov 11 09:15:58 bagira sssd: Starting up Nov 11 09:15:58 bagira sssd[be[LDAP]]: Starting up Nov 11 09:15:58 bagira sssd[nss]: Starting up Nov 11 09:15:58 bagira sssd[pam]: Starting up (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [be_get_account_info] (4): Got request for [4097][1][name=nitinst] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(&(uid=nitinst)(objectclass=posixAccount))][ou=People,o=sample]. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [objectClass] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [uid] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [userPassword] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [uidNumber] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gidNumber] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gecos] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [homeDirectory] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [loginShell] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbPrincipalName] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [cn] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [modifyTimestamp] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowLastChange] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowMin] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowMax] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowWarning] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowInactive] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowExpire] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowFlag] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbLastPwdChange] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbPasswordExpiration] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [pwdAttribute] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8): ldap_search_ext called, msgid = 1126 (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9): OriginalDN: [uid=nitinst,ou=People,o=sample]. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a14e0], ldap[0x858e9b0] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6): Search result: Success(0), *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_users_process] (6): Search for users, returned 1 results.* (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0] *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!* (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb transaction (nesting: 0) (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): Save user (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): Adding original DN [uid=nitinst,ou=People,o=sample] to attributes of [nitinst]. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): Original memberOf is not available for [nitinst]. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): User principal is not available for [nitinst]. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): Adding [shadowLastChange]=[15288] to user attributes. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (6): Storing info for user nitinst (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_users_process] (9): User 0 processed! (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb transaction (nesting: 0) (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_users_done] (9): Saving 1 Users - Done (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_dispatch] (9): dbus conn: 8589BA0 (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_dispatch] (9): Dispatching. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sbus_message_handler] (9): Received SBUS method [getAccountInfo] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [be_get_account_info] (4): Got request for [4099][1][name=nitinst] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_send] (9): Retrieving info for initgroups call (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(&(uid=nitinst)(objectclass=posixAccount))][ou=People,o=sample]. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [objectClass] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [uid] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [userPassword] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [uidNumber] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gidNumber] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gecos] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [homeDirectory] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [loginShell] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbPrincipalName] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [cn] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [modifyTimestamp] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowLastChange] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowMin] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowMax] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowWarning] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowInactive] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowExpire] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowFlag] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbLastPwdChange] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbPasswordExpiration] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [pwdAttribute] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8): ldap_search_ext called, msgid = 1127 (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9): OriginalDN: [uid=nitinst,ou=People,o=sample]. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0] *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!* (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a8a50], ldap[0x858e9b0] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6): Search result: Success(0), (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_user] (9): Receiving info for the user (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb transaction (nesting: 0) (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_store] (9): Storing the user (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): Save user (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): Adding original DN [uid=nitinst,ou=People,o=sample] to attributes of [nitinst]. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): Original memberOf is not available for [nitinst]. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (7): User principal is not available for [nitinst]. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (9): Adding [shadowLastChange]=[15288] to user attributes. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_save_user_send] (6): Storing info for user nitinst (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_commit] (9): Commit change (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb transaction (nesting: 0) (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_process] (9): Process user's groups (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(&(memberuid=nitinst)(objectclass=posixGroup))][ou=People,o=sample]. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [objectClass] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [cn] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [userPassword] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gidNumber] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [memberuid] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [modifyTimestamp] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_send] (8): ldap_search_ext called, msgid = 1128 (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_parse_entry] (9): OriginalDN: [cn=idsldap,ou=People,o=sample]. (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0] *(Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!* (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[0x85a1770], ldap[0x858e9b0] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_generic_done] (6): Search result: Success(0), (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x858e7f0], connected[1], ops[(nil)], ldap[0x858e9b0] (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): start ldb transaction (nesting: 0) (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [ldb] (9): commit ldb transaction (nesting: 0) (Fri Nov 11 10:20:30 2011) [sssd[be[LDAP]]] [sdap_get_initgr_done] (9): Initgroups done >From the traces what i could figure out is once it returned the search result but still it gave the error * ldap_result found nothing! *even though the entry in present on the ldap server. Could you tell me if i'm missing any configuration step ?? Thanks

5 31

[PATCH] LDAP: Try next failover server on any error
by Stephen Gallagher 29 Nov '11

29 Nov '11

Fixes https://fedorahosted.org/sssd/ticket/1101 Previously, we were only trying the next failover server if we got back ETIMEDOUT (which was a relic of using ldap_initialize()). Now that we're directly connecting to the socket manually, we need to ensure that we handle all possible socket errors. With this fix, we will now just treat ALL errors as requiring us to try the next server.

3 4

[PATCH] Fixed uninitialized pointer read in netgroups processing
by Jan Zelený 28 Nov '11

28 Nov '11

Discovered by coverity, no ticket assigned Jan

2 2

[PATCH] Add -fno-strict-aliasing
by Stephen Gallagher 28 Nov '11

28 Nov '11

There are several places in the code where we rely on type-punned pointers (such as with the sssm_*_id_init() functions). Most modern distros build with -fno-scrict-aliasing by default, so we're safe there. However some older distros (notably RHEL 5) do not have this enabled by default. For safety at -O2, we need to set this explicitly.

1 1

[PATCH] Fixed logically dead code in netgroup processing
by Jan Zelený 28 Nov '11

28 Nov '11

Detected by Coverity, no ticket yet Jan

2 2

[PATCH] function declaration after the header guard in sss_cli.h
by Pavel Březina 28 Nov '11

28 Nov '11

3 3

[PATCH] Fixed a typo in sysdb_upgrade_07() declaration
by Jan Zelený 28 Nov '11

28 Nov '11

Pushed under the one-liner rule Jan

1 0

sssd 1.6.1 LDAP: Marking port 389 as not working
by Sascha Frey 28 Nov '11

28 Nov '11

Hi list, I'm trying to get sssd 1.6.1 working on FreeBSD 9.0 RC2 for some time now. /var/log/sssd/sssd_LDAP.log shows that the connection to the LDAP server fails: (Sat Nov 26 18:54:52 2011) [sssd[be[LDAP]]] [sdap_ldap_connect_callback_add] (7): New LDAP connection to [ldap://rep1.LDAP.techfak.uni-bielefeld.de:389/??base] with fd [15]. (Sat Nov 26 18:54:52 2011) [sssd[be[LDAP]]] [sdap_sys_connect_done] (1): Failed to set LDAP SASL nocanon option to true (Sat Nov 26 18:54:52 2011) [sssd[be[LDAP]]] [fo_set_port_status] (4): Marking port 389 of server 'rep1.LDAP.techfak.uni-bielefeld.de' as 'not working' 'ldapsearch -x -ZZ' with TLS_REQCERT=demand does work. I tried with 'ldap_tls_cacert' in sssd.conf (should not be neccessary because of TLS_CACERT in /usr/local/etc/openldap/ldap.conf). Doesn't seem to be TLS verfication issue, because 'ldap_tls_reqcert = never' doesn't help either. ldap://server.fqdn/ or ldaps://server.fqdn/ makes no difference. The same sssd.conf works with sssd 1.5.1 under RHEL 6.1. Any ideas? Regards, Sascha

2 1

[PATCH] Fix segfault in IPA ID provider
by Jakub Hrozek 25 Nov '11

25 Nov '11

There's a regression in the IPA ID provider that caused all ID operations except for initgroups to segfault.

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel November 2011