sssd-devel November 2012

sssd-devel@lists.fedorahosted.org

15 participants
101 discussions

[PATCH] SSSD fails to store users if any of the requested attribute is empty.
by Michal Židek 21 Feb '13

21 Feb '13

https://fedorahosted.org/sssd/ticket/1440 Looks like some LDAP servers are able to store empty attribute values. For some servers it results in syntax error, so it is probably a rare case (if not an error) to have such values. LDB seems to be unable to handle such values too, so in this patch we skip empty values and do not store them to local cache. Patch is attached. Thanks Michal

2 3

[PATCH] Include the auth_utils.h header in the distribution
by Jakub Hrozek 29 Jan '13

29 Jan '13

Reported by Sumit.

2 3

[PATCH] LDAP: Handle empty namingContexts values safely
by Stephen Gallagher 29 Jan '13

29 Jan '13

Certain LDAP servers can return an empty string as the value of namingContexts. We need to treat these as NULL so that we can fail gracefully. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=854619 (Regression)

3 3

[PATCH] LDAP: Check validity of naming_context
by Jakub Hrozek 29 Jan '13

29 Jan '13

https://fedorahosted.org/sssd/ticket/1581 If the namingContext attribute had no values or multiple values, then our code would dereference a NULL pointer.

3 5

[PATCH] Do not grow sssd_nss memory footprint
by Jakub Hrozek 29 Jan '13

29 Jan '13

Hi, the attached patch might seem simple, but it touches a delicate and low-level part of the SSSD, so I'd like to request a detailed review. I was notified by Bruce Aiesi of the Red Hat QE team that the sssd_nss process grew its memory footprint when stress-tested by logging in many users in parallel. I ran a couple of tests and then found out that the responder context grew because we never freed the internal Data Provider request. Attached is a patch that simple frees the "side request" after all the callbacks have been invoked. I didn't see the memory growth anymore during my testing and I didn't see any other issues, either during my tests or with valgrind. I hope I didn't miss any detail and the patch is OK.

2 4

[PATCH] Do not always return PAM_SYSTEM_ERR when offline krb5 fails
by Jakub Hrozek 29 Jan '13

29 Jan '13

I noticed that if offline auth failed for any reason including mistyped password, we would always print System Error. This makes auditing the logs hard as it sounds like an internal error occured. I don't like the header with a single inline function myself, but I didn't want to clutter util.h with that function either. And we don't have any shared header for that purpose at the moment..suggestions are welcome.

4 8

[PATCH 0/4] Create and use an auth token object
by Simo Sorce 10 Jan '13

10 Jan '13

The current way we handle with auth token is manual and very error prone. The semanthics are also confusing and do not make clear how tokens are stored such that manipulating them is difficult. For example it was unclar in the code whether password tokens where 0 terminated and whether the length would incliude the null termination byte or not. This code creates a standard structure called sss_auth_token that has a full set of getters and setters. Simo. Note: I wanted to make this structure completely opaque but it would have required a lot more allocations and pointers, and made the patchset larger. Fixes: https://fedorahosted.org/sssd/ticket/1586 Simo Sorce (4): Code can only check for cached passwords Add function to safely wipe memory. Add authtok utility functions. Change pam data auth tokens. Makefile.am | 4 + src/db/sysdb.h | 3 +- src/db/sysdb_ops.c | 13 +- src/providers/data_provider.h | 9 +- src/providers/dp_auth_util.c | 77 ++++++---- src/providers/dp_pam_data_util.c | 113 ++++++++------- src/providers/ipa/ipa_auth.c | 6 +- src/providers/krb5/krb5_auth.c | 45 +++--- src/providers/krb5/krb5_child.c | 148 ++++++++++--------- src/providers/krb5/krb5_child_handler.c | 59 ++++++-- .../krb5/krb5_delayed_online_authentication.c | 50 ++++--- src/providers/krb5/krb5_renew_tgt.c | 18 +-- src/providers/ldap/ldap_auth.c | 90 +++++------- src/providers/ldap/sdap_async.c | 4 +- src/providers/ldap/sdap_async.h | 7 +- src/providers/ldap/sdap_async_connection.c | 85 ++++++----- src/providers/proxy/proxy.h | 7 +- src/providers/proxy/proxy_auth.c | 14 +- src/providers/proxy/proxy_child.c | 51 ++++--- src/responder/pam/pam_LOCAL_domain.c | 52 +++---- src/responder/pam/pamsrv_cmd.c | 159 ++++++++++++--------- src/tests/krb5_child-test.c | 13 +- src/tests/sysdb-tests.c | 6 +- src/util/authtok.c | 146 +++++++++++++++++++ src/util/authtok.h | 137 ++++++++++++++++++ src/util/util.c | 9 ++ src/util/util.h | 10 ++ 27 files changed, 856 insertions(+), 479 deletions(-) create mode 100644 src/util/authtok.c create mode 100644 src/util/authtok.h -- 1.7.11.4

2 46

[PATCH] sss_cache: fqdn not accepted
by Michal Židek 04 Jan '13

04 Jan '13

sss_cache did not accept fully quaified domain names. https://fedorahosted.org/sssd/ticket/1620 Patch is in attachment. Thanks Michal

3 6

[PATCH] failover: Protect against empty host names
by Michal Židek 02 Jan '13

02 Jan '13

Added new parameter to split_on_separator that allows to skip empty values. https://fedorahosted.org/sssd/ticket/1484 Patch is in attachment. Michal

7 23

A test repository with SSSD 1.9 for RHEL-6.3
by Jakub Hrozek 21 Dec '12

21 Dec '12

Hi, even though RHEL-6.4 is still brewing, I think there might be some interest in trying out the 1.9.x series of the SSSD on RHEL-6.3. So I went ahead and built the SSSD 1.9.2 in a RHEL-6.3 buildroot: http://repos.fedorapeople.org/repos/jhrozek/sssd/epel-6/ The NVR of these test packages will be lower than those in 6.4 to keep the upgrade path clean. The only missing functionality is the PAC responder, which means this SSSD version won't be able to work with an AD domain that is in a trust relationship with an IPA 3.x domain. I had to disable the PAC responder as it requires Kerberos 1.10. Because some new functionality required tweaking the SELinux policy, you will encounter AVC denials when the new fast cache is accessed. That said, my quick smoke testing went fine and we will be glad to hear test results or bug reports. Using the repository comes with a warning - this is NOT an official Red Hat supported repository. The packages have NOT gone through formal QA. If it breaks your RHEL-6.3 installation, you get to keep the pieces. This is the repo configuration I used: -------------------------- [sssd-1.9-RHEL6.3] name=SSSD 1.9.x built for latest stable RHEL baseurl=http://repos.fedorapeople.org/repos/jhrozek/sssd/epel-6/$basearch/ enabled=1 skip_if_unavailable=1 gpgcheck=0 [sssd-1.9-RHEL6.3-source] name=SSSD 1.9.x built for latest stable RHEL - Source baseurl=http://repos.fedorapeople.org/repos/jhrozek/sssd/epel-6/SRPMS enabled=0 skip_if_unavailable=1 gpgcheck=0 -------------------------- Happy testing!

2 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel November 2012