November 2011 - sssd-devel - Fedora mailing-lists

[PATCH] Allow using AD objectSid as uid source
by Marko Myllynen 25 Nov '11

25 Nov '11

Hi, this simple patch allows using AD objectSid as uid source making it possible to use SSSD against AD instances which do not have Identity Management for Unix Role Service enabled. The mapping matches winbind's idmap_rid(8) behaviour. If ldap_user_uid_number is not objectSid then nothing changes. https://fedorahosted.org/sssd/ticket/996 Cheers, -- Marko Myllynen

3 5

[PATCHES][PRELIMINARY] ldap_*_search_base doesn't fully limit the group / netgroup
by Pavel Březina 25 Nov '11

25 Nov '11

https://fedorahosted.org/sssd/ticket/960 I'm sending the fix for groups first because I want this to be ACKed before I start working on netgroups. Current behaviour is that if any of the search bases contain filter, than dereference will be turned off and single step approach will be used. Algorithm for determining the search base: 1. output_filter = "" 1. String compare of memberdn and basedn (calculates with scope as well) 2. If compare is true and filter != "", append filter to output_filter (|) 3. return true and output_filter if it is possible that memberdn belongs to basedn The output_filter is then appended (&) in the actual filter. There is probably one bug, when you have several search bases when one is a generalization of the other but with more restrictive filter. For example (LDIF attached): ldap_group_search_base = cn=QA,ou=Groups,dc=brq,dc=redhat,dc=com?sub?? cn=DEV,ou=Groups,dc=brq,dc=redhat,dc=com?sub? ldap_user_search_base = cn=NewHires,ou=People,dc=brq,dc=redhat,dc=com?sub?? (A) ou=People,dc=brq,dc=redhat,dc=com?sub?(&(uid=u1)(uid=u5)) (B) GroupA (direct or indirect) members in LDIF are: u1, u3 (from B), u4 (from A) Expected result might be u4 (it is currently the actual result). However, B is a contradiction and the filter contains this contradiction*) so the actual result should be empty membership. But the result is: getent group groupA groupA:*:10002:u4 * calling ldap_search_ext with [(&(|(&(uid=u1)(uid=u3)))(objectclass=posixAccount))][cn=u4,cn=NewHires,ou=People,dc=brq,dc=redhat,dc=com] Does anyone know what am I missing? Thank you, Pavel. [PATCH 1/3] Function that compares dn to base dn (thanks Jan) [PATCH 2/3] Fixes some bugs in previous function and changes it's behaviour to follow my needs [PATCH 3/3] Fixes the group processing

2 3

sssd nscd and oracle services
by Aziz Sasmaz 23 Nov '11

23 Nov '11

Hi, We have two oracle cluster nodes running in a rac environment (active/passive). Crs and oracle services are running and these two nodes has SAN disks presented to them We are using sssd perfectly on these two nodes. Nscd is also disabled on primary active node and everything is perfect with sssd there. But If i disable the nscd service on the failover node2, oracle services does not work on the failover node. Failover nodes can't call oracle services if nscd is stopped in an sssd configured environment. Is there any resolution on this or any known bugs? It might be oracle related i know but any help or clue you can give will be greatly appreciated. I am using nscd and sssd at the same time for now, but i am not comfortable :) Thanks, AS

2 2

[PATCH] Add Winbind provider.
by Pavel Zuna 23 Nov '11

23 Nov '11

This patch adds the whole Winbind provider. We agreed with Summit, that it would be better to submit as a single patch as splitting it wouldn't make review any easier. It has the ID and AUTH providers. ID can do user, groups, initgroups and enumeration of them. AUTH can do authentication and password change operation. To build the provider, you need to use the --enable-experimental-winbind-provider configure flag. samba-winbind-devel package is required. SSSD configuration option for the Winbind provider can be found in /etc/sssd/sssd.api.d/sssd-winbind.conf. The correspond pretty much to Winbind options normally found in smb.conf. Both NT and AD domains have to be joined first using samba net utility: net ads join -S server -U user ... A man page (man sssd-winbind) is coming soon. Big thanks to Summit for helping me out with testing this a reviewing commit in my private repo periodically. Thanks! Pavel

4 5

[PATCH] Better confinment of keyrings
by Simo Sorce 22 Nov '11

22 Nov '11

After a quick discussion with David Howells (maintainer of keutils/keyrings) I created this patch for SSSD. It should make the keyrings used to store user passwords not as easy to access even for root by confining them to the sssd process and it's children. I haven't really tested it yet, but I guess we want to discuss if this approach is ok first anyway. Simo. -- Simo Sorce * Red Hat, Inc * New York

3 4

[PATCH] Providers cleanup: Remove unused parameters
by Jakub Hrozek 22 Nov '11

22 Nov '11

During the nested initgroups processing review, Jan requested removing unused "dom" parameter from the code. Instead of doing it on that one place, I compiled SSSD with -Wunused and cleaned up unused parameters in the providers code. It's mostly sss_domain_info no longer needed because of the sysdb refactoring. The patch brings no functional change, it's just cleanup.

2 5

[PATCH] Fixed unchecked value of setenv() in check_and_export_options()
by Jan Zelený 22 Nov '11

22 Nov '11

https://fedorahosted.org/sssd/ticket/1080 Thanks Jan

2 2

[PATCH] SYSDB: Make ENOENT log messages less threatening
by Stephen Gallagher 22 Nov '11

22 Nov '11

Previously, they were reported with the prefix "Error:" which caused confusion among end-users while debugging.

2 2

LDAPS Connection error
by sssd help 22 Nov '11

22 Nov '11

Hi List, Any help here would be appreciated. We've been using SSSD (1.2) on RHEL6 for a while without issue. We are trying to make the move to RHEL6.1 and newer packages of SSSD (1.5.1) and we are running into some problems. For some reason the client doesnt seem to want to connect to our ldap server using LDAPS. See the following log output: (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_id_op_connect_step] (9): beginning to connect (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [fo_resolve_service_send] (4): Trying to resolve service 'LDAP' (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [get_server_status] (7): Status of server 'ldap.example.com' is 'name not resolved' (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [get_server_status] (4): Hostname resolution expired, reseting the server status of 'ldap.example.com ' (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [set_server_common_status] (4): Marking server 'ldap.example.com' as 'name not resolved' (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [get_port_status] (7): Port status of port 636 for server 'ldap.example.com' is 'neutral' (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [get_server_status] (7): Status of server 'ldap.example.com' is 'name not resolved' (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [resolv_gethostbyname_send] (4): Trying to resolve A record of 'ldap.example.com' (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [schedule_timeout_watcher] (9): Scheduling DNS timeout watcher (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [set_server_common_status] (4): Marking server 'ldap.example.com' as 'resolving name' (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [unschedule_timeout_watcher] (9): Unscheduling DNS timeout watcher (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [set_server_common_status] (4): Marking server 'ldap.example.com' as 'name resolved' (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [be_resolve_server_done] (4): Found address for server ldap.example.com: [10.17.8.103] (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_uri_callback] (6): Constructed uri 'ldaps://ldap.example.com/' (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_rootdse_send] (9): Getting rootdse (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(objectclass=*)][]. (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (7): Requesting attrs: [*] (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (7): Requesting attrs: [altServer] (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (7): Requesting attrs: [namingContexts] (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (7): Requesting attrs: [supportedControl] (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (7): Requesting attrs: [supportedExtension] (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (7): Requesting attrs: [supportedFeatures] (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (7): Requesting attrs: [supportedLDAPVersion] (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (7): Requesting attrs: [supportedSASLMechanisms] (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (7): Requesting attrs: [defaultNamingContext] (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (7): Requesting attrs: [lastUSN] (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (7): Requesting attrs: [highestCommittedUSN] (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_ldap_connect_callback_add] (9): New LDAP connection to [ldaps:// ldap.example.com:636] with fd [25]. (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (3): ldap_search_ext failed: Can't contact LDAP server (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [sdap_get_generic_send] (3): Connection error: (null) (Mon Nov 21 17:07:58 2011) [sssd[be[default]]] [fo_set_port_status] (4): Marking port 636 of server 'ldap.example.com' as 'not working' Please also see the following sssd.conf: [sssd] config_file_version = 2 reconnection_retries = 3 sbus_timeout = 30 services = nss, pam #services = pam domains = default [nss] filter_groups = root filter_users = root reconnection_retries = 3 [pam] reconnection_retries = 3 [domain/default] ldap_tls_reqcert = never auth_provider = ldap ldap_id_use_start_tls = False chpass_provider = ldap enumerate = True cache_credentials = True ldap_group_search_base = ou=posixGroups,dc=example,dc=com ldap_user_search_base = ou=People,dc=example,dc=com ldap_default_authtok_type = password ldap_search_base = dc=example,dc=com debug_level = 20 id_provider = ldap ldap_default_bind_dn = uid=binduser,ou=Special Users,dc=example,dc=com ldap_user_gecos = cn ldap_uri = ldaps://ldap.example.com/ ldap_default_authtok = password ldap_tls_cacertdir = /etc/ssl/certs This is the very same config we use on RHEL6 with sssd 1.2. I also tried porting the older sssd build onto this machine and got the same results. Please note that TLS is not an option in our case because we are performing an ssl offload on a hardware load balancer that cannot handle TLS. This mailing list has been extremely helpful in the past and i hope it is so again. Thank you Brandon

4 4

SSSD (another) wish-list
by Ondrej Valousek 22 Nov '11

22 Nov '11

Hi list, Currently, we are using Centrify for Linux&AD integration so I was thinking we could soon save some $$$ and use sssd for the same purpose. There is still one thing (among others to which a RFEs have already been submitted) I am missing: Would it be possible for sssd to maintain the OperatingSystem attribute in AD updated? I know that IPA uses quite minimalistic LDAP schema so it is pity that it does not have any such an attribute, but if it had (comments needed), the same code could be used for IPA and AD domains. I am asking for auditing purposes - currently with Centrify it is easy to query AD just for OperatingSystem attribute and one can immediately see which OSes have been installed in the company. Many thanks, Ondrej

6 23

[PATCH] Fix FTBFS related to -Werror=format-security
by Stephen Gallagher 21 Nov '11

21 Nov '11

Patch provided by Krzysztof Klimonda <kklimonda(a)ubuntu.com> Fixes https://fedorahosted.org/sssd/ticket/1094 Ack and pushed to master, sssd-1-6 and sssd-1-5.

1 0

[PATCH] Prevent printing NULL in several places of LDAP provider
by Jakub Hrozek 18 Nov '11

18 Nov '11

I've seen several "(null)"s being printed when I was testing the IPA password migrations. The attached patch sanitizes them.

2 2

[PATCH] RESPONDER: Ensure that all input strings are valid UTF-8
by Stephen Gallagher 18 Nov '11

18 Nov '11

Fixes https://fedorahosted.org/sssd/ticket/1088

3 8

[PATCH] Add ipa_hbac_support_srchost option to IPA provider
by Jan Zelený 18 Nov '11

18 Nov '11

don't fetch all host groups if this option is false https://fedorahosted.org/sssd/ticket/1078 I was also thinking of reducing the number of host groups, but that seemed to be redundant, since the number of host groups is usually not that high and the complexity of fetching only relevant groups doesn't seem worth it. Jan

2 2

sssd can't get shadow information from ldap
by Aziz Sasmaz 18 Nov '11

18 Nov '11

Hi, sssd can't get shadow info from ldap. When I type getent passwd it shows pass section as * not as "x" As passwd (5) ; If the encrypted password is set to an asterisk, the user will be unable to login using login. Can sssd get shadow information from ldap. Is it possible to cache authentication when we use ldap/shadow ? nlastname1:*:1094:1004:Name Lastname:/home/user1:/bin/bash nlastname2:*:1025:501:otemli:/home/user2:/bin/sh nlastname3:*:1040:1009:Name Lastname:/home/user3:/bin/bash splunk:*:1116:1025:Splunk Server:/opt/splunkforwarder:/bin/bash my sssd.conf file: [sssd] config_file_version = 2 reconnection_retries = 3 sbus_timeout = 30 services = nss, pam domains = ldap.jazzythemartian.com [nss] filter_groups = root filter_users = root reconnection_retries = 3 [pam] [domain/ldap.jazzythemartian.com] id_provider = ldap auth_provider = ldap chpass_provider = ldap access_provider = ldap ldap_schema = rfc2307 ldap_uri = ldaps://ldaptest.jazzythemartian.com ldap_search_base = dc=jazzythemartian,dc=com ldap_tls_reqcert = allow cache_credentials = true enumerate = true entry_cache_timeout = 5400 ldap_pwd_policy = shadow ldap_user_gecos = uid My system-auth file: auth required pam_env.so auth sufficient pam_sss.so use_first_pass auth sufficient pam_ldap.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so account [default=bad success=ok user_unknown=ignore] pam_sss.so account sufficient pam_ldap.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so #password requisite pam_cracklib.so try_first_pass retry=3 password required pam_passwdqc.so enforce=users min=disabled,16,12,8,6 password sufficient pam_sss.so use_authtok password sufficient pam_ldap.so use_authtok password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password required pam_deny.so session optional pam_mkhomedir.so skel=/etc/skel/ umask=0022 session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session sufficient pam_sss.so session required pam_unix.so session sufficient pam_ldap.so Thanks, AS

4 9

[COLLECTION] Fixing NULL dereferencing
by Dmitri Pal 17 Nov '11

17 Nov '11

https://fedorahosted.org/sssd/ticket/1074 Note: the original issue produces a crash only when optimization is off. This means that the issue is concealed by the optimization and it is probably a bug in gcc-4.4.5-6.el6.x86_64. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 2

[PATCHES] SUDO integration - first iteration
by Pavel Březina 15 Nov '11

15 Nov '11

https://fedorahosted.org/sssd/ticket/623 Helpful links: - SUDO plugin API http://www.gratisoft.us/sudo/man/1.8.1/sudo_plugin.man.html What does it do currently? 1. sudo plugin sends input data to responder 2. responder sends back to plugin that user is allowed to run the command What does it not do? - Doesn't require any PAM authentication - Doesn't read anything from LDAP - Doesn't set any environment variables (and reset current environment) This actually can cause some troubles to applications, so far I've encountered an error message in VIM (no $HOME specified) How to test it? 1. Install SUDO version 1.8 or greater I am running 1.8.2 built from source: ftp://ftp.sudo.ws/pub/sudo/sudo-1.8.2.tar.gz 2. Enable SUDO plugin in /etc/sudo.conf Plugin sss_sudo_policy /usr/lib/sudo/libsss_sudoplugin.so Unfortunately, SUDO doesn't allow to have more than one policy plugin activated, so comment out standard sudoers plugin. 3. Enable it in sssd.conf ;-) services += sudo 4. Run sssd 5. Run sudo I left there some debug messages, so don't worry when you see: CMD Return code: 0 errnop: 0 Command exited with status 0 in the output. But tell me if there is anything else than 0 :-) [PATCH 1/5] Adds a client function that allows client to send data to responder. And set sudo responder protocol version. [PATCH 2/5] SUDO plugin. [PATCH 3/5] SUDO responder. [PATCH 4/5] Configure and Makefile updates so we can build plugin and responder. [PATCH 5/5] Just a little update that adds sudo responder to known services of monitor.

2 5

sssd caching
by Thomas Jagt 15 Nov '11

15 Nov '11

Hi, We have authentication running against the AD. We configured the cache_credentials option to be sure that login works if the AD fails. But when we disable an account in the AD, sssd is not updating his cache. When there is a connection between sssd and the AD, the user is still able to login. Is there an option to enable synchronization between the sssd cache and the AD? Thanx and Regards

2 2

[PATCH] Squash transactions in sdap_initgr_common_store
by Jakub Hrozek 11 Nov '11

11 Nov '11

https://fedorahosted.org/sssd/ticket/1053

2 2

[PATCH] Use one transaction instead of two during RFC2307bis group processing
by Jakub Hrozek 11 Nov '11

11 Nov '11

https://fedorahosted.org/sssd/ticket/1054

2 2

Design Discussion: LDAP Referral Chasing
by Stephen Gallagher 11 Nov '11

11 Nov '11

I've created the following wiki page with my thoughts on the design of the LDAP referral chasing: https://fedorahosted.org/sssd/wiki/DesignDocs/LDAPReferrals Please review it and provide feedback in this email thread. Pavel, please review this as well, as one section of the proposal may affect your ticket #960 (though it's possible that your approach already accounts for this).

2 3

[PATCH] SBUS: Fix DEBUG log matching
by Stephen Gallagher 10 Nov '11

10 Nov '11

This log message should only be displayed at the most verbose of log levels. Since it didn't match, it was resulting in a Coverity error warning of the printing of an uninitialized value (fd).

2 2

[PATCH] Typo fixes
by Marko Myllynen 10 Nov '11

10 Nov '11

Hi, Fix few trivial typos reported by Yuri. Cheers, -- Marko Myllynen

3 2

[PATCH] Fix typos in manual pages
by Jakub Hrozek 10 Nov '11

10 Nov '11

https://bugzilla.redhat.com/show_bug.cgi?id=750988 git-formatted patch is attached on behalf of Yuri.

3 2

[PATCH] configAPI: Fix removing in old domain when saving a new domain
by Jakub Hrozek 10 Nov '11

10 Nov '11

https://bugzilla.redhat.com/show_bug.cgi?id=752495

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel November 2011