sssd-devel November 2011

sssd-devel@lists.fedorahosted.org

24 participants
74 discussions

[PATCHES] Support for multiple LDAP search bases
by Stephen Gallagher 02 Nov '11

02 Nov '11

These patches add support for multiple search bases for users and groups in both direct-lookup and enumeration modes. Addresses https://fedorahosted.org/sssd/ticket/868 Some notes: There is no patch adding multiple search base support for group lookups in RFC2307bis because it's meaningless right now. Since the group memberships are direct DNs, we do all of our searches as base searches, ignoring group_search_base. There is a separate ticket, https://fedorahosted.org/sssd/ticket/960 that will need to address this, taking advantage of the multiple search base features. Also, while working through this, I opened https://fedorahosted.org/sssd/ticket/1006 as I noticed that we are using far too many separate transactions while processing RFC2307bis (which is likely the cause of the extreme slowdown that some of our users were reporting with AD). These patches don't really work separately, but they've been broken up to make review much easier. Patch 0001: Remove some unused options in a struct Patch 0002: Fix size return for split_on_separator() It was returning the size of the array, rather than the number of elements. (The array was NULL-terminated). This argument was only used in one place that was actually working around this odd return value. Patch 0003: Make sdap_get_id_specific_filter() more strict Just makes it take const char * instead of char *. Patch 0004: Add parser for multiple search bases As discussed on the list, this will the ldap_*_search_base options in the form of: search_base[?scope?[filter][?search_base?scope?[filter]]*] This is backwards-compatible (just use a search base) Patch 0005: Add support for multiple search bases for users Patch 0006: Add support for multiple search bases for netgroups Patch 0007: Add support for multiple search bases for RFC2307 groups Patch 0008: Add support for multiple search bases for initgroups (user portion) Patch 0009: Add support for multiple search bases for initgroups (RFC2307 group portion) Patch 0010: Add support for multiple search bases for initgroups (RFC2307 group portion) This patch I'm not 100% sure of. It may need more processing. With RFC2307, it was safe to have duplicate groups in the list, because only the group name is important (and we guarantee that the name list has only unique values before saving it). With RFC2307bis, I'm not sure if it's safe to add two groups that may have the same name. Comments welcome. Patch 0011: Update manpages with multiple search base information Patch 0012: Convert ldap_*_search_filter Instead of making this a global option for all user lookups, make it only used if the search base is passed without an explicit filter. The idea here is to deprecate the old separate ldap_user_search_filter and ldap_group_search_filter options in favor of the new representation (which is closer to the traditional nss_ldap representation). Patch 0013: Add support for multiple search bases for user enumeration Patch 0014: Add support for multiple search bases for group enumeration This changes our behavior slightly with regard to handling direct lookups that return more than one entry. In the old code, we had a bug that would cause SSSD to treat this as an enumeration (instead of a direct lookup). This was a bug and has been fixed incidentally as part of this modification.

2 10

[PATCH] Two deref fixes
by Jakub Hrozek 02 Nov '11

02 Nov '11

Simo was studying the dereference code lately and found two issues. #1 is an important bug, #2 is more of a cosmetic issue. [PATCH 1/2] Use LDAPDerefSpec properly ldap_create_deref_control_value expects an array of LDAPDerefSpec structures with LDAPDerefSpec.derefAttr == NULL as a sentinel. We were passing a single instance of a LDAPDerefSpec structure. https://fedorahosted.org/sssd/ticket/1050 [PATCH 2/2] Remove confusing do-while loop The deref processing would return a single control back. The do-while loop was harmless but confusing.

3 5

Authentication against AD
by Thomas Jagt 01 Nov '11

01 Nov '11

Hi Stephen, We are using sssd to authenticate against AD with using Kerberos and LDAP. The idea is to filter users who are allowed to login based on a LDAP filter. In the AD there are computer objects created with the same name as the hostname of the Linux client. The filter must be something like is; If the computer object is a member of the group where the user is memberOf then allow the user to login. So what we want is to authenticate linux clients based on computer objects in the AD. (We are not using winbind) When using the ldap_access_filter it's not possible to create a LDAP query neither with the ldap_group_search_filter. Is it possible with sssd to meet our requirements? The following ldapsearch gives the right output; ldapsearch -h test.local -s sub -x -b ",ou=Groups,dc=test,dc=local" "(&(member=cn=`hostname`,cn=Computers,dc=test,dc=local))" Thanx and Regards Thomas Jagt

4 6

sss_debuglevel doesn't work for LDAP logs?
by Mark London 01 Nov '11

01 Nov '11

Hi - Is the sss_debuglevel command supposed to work with the sssd_be logs? I'm using LDAP, and while the command change the debugging level for the PAM and NSS logs, it didn't change the debug level for the my sssd_be LDAP log (or at least it couldn't change it from 0). I also tried to specify a different configuration file, that had debugging enabled in the LDAP section, and that didn't seem to work either. Thanks. - Mark

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel November 2011