March 2012 - sssd-devel - Fedora mailing-lists

[PATCH] Allow more libldap debugging
by Jakub Hrozek 28 Nov '12

28 Nov '12

This patch should not be pushed to master, but I would like to get it reviewed anyway. It should be used to provide a custom build for users experiencing cases where ldap_search_ext would block (c.f. https://bugzilla.redhat.com/show_bug.cgi?id=728343) For example: export SSSD_DEBUG_LDAP_SEARCH="0xffff" would set LDAP_DEBUG_ANY The attached patch applies cleanly on the RHEL6.1 branch. I also have a version that applies on master/1.5 if needed.

4 7

[PATCH][PRELIMINARY] sudo: send username and uid while requesting default options
by Pavel Březina 24 Jul '12

24 Jul '12

https://fedorahosted.org/sssd/ticket/1239 [PATCH 1/2] Finally removes EOK constant from sudo api header. It is not used in the SUDO code so it does not require their changes. [PATCH 2/2] This does what is requested in the ticket. It seems to be very huge but in fact it is mainly changing the variable. Basically I tried to get rid of domain ctx where possible, leave it only in initgroups part and use command ctx elsewhere. The in-memory cache is not yet implemented, I want to discuss the possible ways of doing it. The basic problem is that we need to get the domain during the request for default options. How will we do it? I think there are two options: 1. always try to perform the initgroups - find the domain and the check the in-memory cache (which may be slow if the user is in the last domain, but that will be probably handled as part of https://fedorahosted.org/sssd/ticket/1126 2. store uid:username = domain in the in-memory cache (same cache as results or a new one?) This patch contains a modified version of sysdb_get_sudo_user_info() where the uid is not mandatory. I want to replace this function with sysdb_sudo_get_user_groups() (or make it generic and place it in sysdb_ops?) because the groupnames are the only thing we don't know. However this requires a modification of the data provider protocol as well so I'm keeping it for later.

4 32

Support for subdomains - stage 1
by Jan Zelený 24 Apr '12

24 Apr '12

Hi guys, it took me and Sumit some time but we finally have completed the first stage of support for subdomains. I'm sending all patches in attachment. This stage has basic support for subdomains but some pieces like PAC support are left out. We agreed that those can wait for the second stage which depends on some server side changes that are not ready yet. We'll keep you posted. Please note that patches depend on Sumit's previous idmap library patch. I'll get that reviewed either today or tomorrow. #0001 All sysdby routines that are used in later patches #0002 Responder routines for asking provider for a list of supported subdomains #0003 The routine responder_get_domain is modified to look for subdomains as well when looking for the correct domain descriptor #0004 If a request for fully qualified entity (user/group) comes to the responder and its domain has not been found, it updates its list of domains and supported subdomains in each domain. To update the list, a get_domains call is sent to each provider. #0005 Create a list of all domains and subdomains when the first request after start comes in. To create the list, a get_domains call is sent to each provider. #0006 Check sub-domains in nss_cmd_get{pwuid|grgid}_search() #0007 Basic infrastructure for handling get_subdomains requests in providers. #0008 Add the infrastructure in IPA provider which fetches a list of handled subdomains from server and stores in in sysdb. #0009 Currently the connections to the data provider use the same name as the domain. With sub-domains the name of the sub-domain cannot be used to find the right data provider connection, hence we store the name of the connection in a new member. #0010 Support for subdomain name given to provider when calling get_account_info #0011 New ID-related config options for subdomains, these have to be present because IPA provider doesn't provide these values and defaults need to be implemented. Having defaults on the responder level didn't seem right since the policy might differ for each domain. #0012 The routine expand_homedir_template is now used on more place, therefore it was convenient to move it to util code. #0013 s2n extended LDAP operation - this is used to ask IPA server for entities from supported subdomains #0014 Extend IPA ID provider toi support fetching information for entities within subdomains #0015 Support for routing PAM request from reponder to the right provider. Similar case as patches #3-#6 in NSS responder but much more simple. #0016 Basic support (or rather un-support) for subdomains in auth providers. Basically it's designed to acknowledge that the request is not for the main domain but for subdomain and in that case it supports only SSS_PAM_ACCT_MGMT and returns error otherwise. Note that similar thing as the IPA backend change in last hunk is probably not necessary for krb5 backend since when using it, there will be no subdomains for that domain. #0017 Support providing sysdb context and domain info per request, not per backend context. This is necessary for the next patches. #0018 Accept be_req instead of be_ctx in access providers. Together with the previous patch, this is needed for the next one. #0019 Detect if the authorization request came for a user in subdomain and if yes, replace the original backend-wide sysdb context and domain info with their subdomain specific replacements. #0020 Use request-wide sysdb context and domain info instead of their backend-wide counterparts in HBAC. That's all folks, have fun reviewing :) Thanks and bye, Jan and Sumit

5 37

[PATCH] Canonicalize user aliases in the proxy provider
by Jakub Hrozek 20 Apr '12

20 Apr '12

https://fedorahosted.org/sssd/ticket/1249 The patch also reduces code duplication between several error handling switch/case statements and fixes a bug in get_initgr where we would try to cancel a transaction immediately after committing it. Do we also want to canonicalize group names in a similar fashion? To be honest, downloading the whole group twice just for the sake of determining the correct group name seems a little too much to me..

2 6

[PATCH] Two manual pages fixes
by Marco Pizzoli 20 Apr '12

20 Apr '12

As I reported on the mailing list: - sssd.conf man page does not include "autofs" and "ssh" as supported services. https://fedorahosted.org/sssd/ticket/1183 - sssd-ldap.conf man page should have "not set" instead of "none" as a default for the directive ldap_sasl_mech. https://fedorahosted.org/sssd/ticket/1180 Considered these are my first patches, I ask you to report to me everything I made wrong or possibly-doable-better so I can improve for future patches :-) Thanks Marco

5 13

[PATCH] Install all docs
by Pavel Březina 20 Apr '12

20 Apr '12

I've noticed that hbac_doc and libsss_sudo_doc is created during 'make docs' but not installed nor cleaned afterwards. This patch fixes it. It will treat every directory in SSSD_DOCS as a documentation and automatically (un)install it.

2 7

[PATCH] sudo api: return only errno in sss_sudo_make_request()
by Pavel Březina 18 Apr '12

18 Apr '12

https://fedorahosted.org/sssd/ticket/1233 As Jakub suggested, I changed sss_sudo_make_request() to return only errno code, instead of errno and sss_status. I hope this will make the Coverity happy.

3 7

pick up "EXTERNAL MECH" identity to log in
by Olivier 11 Apr '12

11 Apr '12

Hello there Not sure that this is feasable nor that this is the right place to submit this question but I think it is. I use sssd to deal with authentication on my linux boxes : OK I also know how to use external SASL_MECH to bind my ldap server : I have produced and install a certificate with an appropriate subject and signed it by a CA that is known by my ldap server. Like this, I can bind the server over TLS with my identity and without providing any passwd. $ ldapsearch -ZZ uid=olivier SASL/EXTERNAL authentication started SASL username: 0.9.2342.19200300.100.1.1=guillard,ou=staff,dc=example,dc=fr SASL SSF: 0 ...response... Right : nothing new. I was now wondering if there would have any way to annonce my certificate using the "external SASL_MECH" mechanism over a login process to a linux box (let say using ssh), so that pam would not ask me to type a "login" and a "password" to log in ? Don't hesitate to fire if my question is stupid. Thanks, --- Olivier PS, to rephrase that : I'm looking for a way to use a personnal key to login without having to provide a password. ssh keys are not the right solution because I would need to install the public key in every authorized_key on my network ( I would like a centralized solution ). I also found this : http://code.google.com/p/openssh-lpk/ But I don't want to patch ssh if possible since I highly prefere to use standard tools provided as much as possible I'm on RedHat6

3 3

[PATCH] Catch cases where D-Bus connection is NULL
by Jakub Hrozek 05 Apr '12

05 Apr '12

https://fedorahosted.org/sssd/ticket/1270 Is there a better way to proactively detect that there is no D-Bus connection when a request comes in? The attached patch is more of a band-aid for cases where the back end is not running at all but a request comes in anyway.

3 2

[PATCH] Use the correct options counter
by Jakub Hrozek 05 Apr '12

05 Apr '12

https://fedorahosted.org/sssd/ticket/1282 This patch applies on top of the 1.8 branch only. The same bug was already fixed in master in an unrelated commit.

3 2

[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal 05 Apr '12

05 Apr '12

Please see the attached patches. I tried to split the patches logically into manageable sets. Unfortunately I made a minor mistake and I am afraid I will do something wrong to fix it. I merged two wrong patches. Fortunately it was three liner with 1 liner so it is not a big of the deal but I am really scared that I will do something wrong and loose the work I have done. So I hope it is Ok to send it as is. 0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted earlier that I merged by mistake. I was supposed to merge it with patch 25 but picked the wrong one instead. Patch 25 addresses the real issue found by Coverity as mentioned in Stephen's review mail but it did not apply cleanly since it relies on some code from the patches in the middle. 0002--INI-Adding-missing-function-declararion.patch <- this is the patch that was rejected from the second set sent earlier. Fixed according to review comment. 0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing per component The following set of patches introduces the merging of sections during the reading of the file: 0004--INI-New-error-codes-and-messages.patch 0005--INI-New-merge-flags.patch 0006--INI-Add-new-vars-to-parse-structure.patch 0007--INI-Add-save_error-function.patch 0008--INI-Change-parse_error-to-use-save_error.patch 0009--INI-Preparing-for-merging-sections.patch 0010--INI-Enhance-value-processing.patch 0011--INI-Use-section-line-number.patch 0012--INI-Refactor-section-processing.patch 0013--INI-Return-error-in-DETECT-mode.patch 0014--INI-New-test-files-for-section-merge.patch 0015--INI-Test-DETECT-mode-and-use-new-file.patch 0016--INI-Test-for-all-section-merge-modes.patch Patches related porting of the meta data from old way of doing things to the new way of doing things: 0017--INI-Separate-close-and-destroy.patch 0018--INI-Function-to-reopen-file.patch 0019--INI-Metadata-collection-is-gone.patch 0020--INI-Check-access-function.patch 0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check) 0022--INI-Function-to-check-for-changes.patch 0023--INI-Tests-for-access-and-changes.patch 0024--INI-Rename-error-print-function.patch <- rename error printing function for consistency with new interface 0025--INI-Initialize-variables-in-loops.patch <- Coverity issue addressed. Related to patch 0001. 0026--INI-Exposing-functions.patch <- Make some internal functions reusable There is also patch 27. It is a piece of new functionality. It is a preview. Please see the comment before reviewing it. Do I need to split it into multiple patches or it is Ok as is? It is pretty big but all changes are in one file and logically related. The UNIT test is missing so I am not claiming it actually works as expected. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 30

[PATCH] Fix off-by-one error in principal selection
by Jakub Hrozek 05 Apr '12

05 Apr '12

Just a one-liner but was not exactly easy to find.. https://fedorahosted.org/sssd/ticket/1269

2 4

[PATCH] Return correct resolv_status on resolver timeout
by Jakub Hrozek 05 Apr '12

05 Apr '12

We have used the error status from c-ares to decide whether to mark the request as failed or not. This is wrong, but mostly worked fine because we have been getting some error code from c-ares in all situations until we added the per-request timeouts. We should use the errno code and only use the c-ares return code to print extended debugging information. https://fedorahosted.org/sssd/ticket/1274

2 2

[PATCH] Service lookup fixes
by Jakub Hrozek 05 Apr '12

05 Apr '12

Attached are patches that fix some issues with service lookups and case sensitivity. [PATCH 1/3] Add sss_get_cased_name_list utility function This pattern would repeat in later patches [PATCH 2/3] LDAP services: Save lowercased protocol names in case-insensitive domains https://fedorahosted.org/sssd/ticket/1260 [PATCH 3/3] Proxy services: Save lowercased protocol names and aliases in case-insensitive domains I'm not sure if anyone is ever going to use case insensitive service lookups in the proxy domain, but I think we should implement it for completeness' sake.

2 2

[PATCHES] Four small assorted patches on top of the previous set
by Dmitri Pal 02 Apr '12

02 Apr '12

-- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 1

[PATCH] Silence Coverity warning in the autofs test tool
by Jakub Hrozek 28 Mar '12

28 Mar '12

I think Coverity is being too noisy here, because only if _sss_getautomntent_r() succeeds, then key and value are allocated. This fix should hopefully explain the code to Coverity, too :-)

3 4

[PATCH] BUILDSYS: Create common libs for LDAP and KRB5 sources
by Stephen Gallagher 28 Mar '12

28 Mar '12

This will eliminate the need for automake to build these files for each backend that consumes LDAP and KRB5 functionality (currently 'ldap', 'krb5' and 'ipa'; soon to include 'ad') This will speed up builds slightly, since they won't need to compile each of these files three times and it will make maintaining the list of files in Makefile.am simpler, since we won't need to remember to update three different places. Also, if you're wondering, I left the src/util/sss_ldap.c and src/util/sss_krb5.c off the list because they are sometimes included where the rest of the routines are not (such as in the ldap_child and krb5_child processes).

2 2

[PATCH] Always initialize the returned data in sss_krb5_princ_realm()
by Sumit Bose 28 Mar '12

28 Mar '12

Hi, the callers of sss_krb5_princ_realm() expect that realm and len will be initialized. The attached patch tries to make sure that this is the case even if krb5_principal_get_realm() is not available and krb5_princ_realm() returns NULL. bye, Sumit

3 2

[PATCHES] Improve detection of attribute variances in IPA provider
by Stephen Gallagher 28 Mar '12

28 Mar '12

The IPA provider has its own set of dp_option and sdap_attr_map mappings that we need to make sure remain in-sync with the standard LDAP provider. In the past, we've just kept a "magic number" in a header file that we need to remember to bump up every time we add a new option (or down if we were to remove one). With these patches, we will now make the checks much more robust (checking not only for attribute count but also ordering). Patch 0001: Put the attribute maps into their own header files so they can be included by test tools. There is no functional change in this patch. Patch 0002: Add a terminator for the dp_option maps. This will allow us to test them more simply. Patch 0003: Add some better dp_option tests, allowing us to walk through the map and verify that the option count is the same and that they are in the same order. Patch 0004: Similar to patch 0002, but for sdap_attr_map maps. Patch 0005: Similar to patch 0003, but for sdap_attr_map maps. Patch 0006: Remove old code that relied on the magic numbers. This patch also drops the runtime option-count check, since we are always performing the more complete check at build-time (as part of 'make check', which is always run during distribution-builds as well as during code-review).

2 3

[PATCH] LDAP services: Keep the protocol around
by Jakub Hrozek 26 Mar '12

26 Mar '12

We forgot to set the protocol member of a state structure which resulted in a funny behaviour - if a service supported a protocol and another protocol was requested, the sysdb entry for that service was removed.

3 2

[PATCH] AUTOFS: fix copy-and-paste bug in the autofs client
by Jakub Hrozek 26 Mar '12

26 Mar '12

I found this while working on the Coverity bug. This bug could potentially cause a segfault.

3 2

[PATCH] LDAP: Fix memory leaks in synchronous_tls_setup
by Stephen Gallagher 26 Mar '12

26 Mar '12

We were never freeing "result" if it was allocated by ldap_result(). We were also not freeing "errmsg" if it was allocated but ldap_parse_result() returned an error. Also disambiguate error messages from ldap_parse_result() and error messages from sss_ldap_get_diagnostic_msg() since they use differing memory-management functions.

2 2

[PATCH] Add idmap library
by Sumit Bose 26 Mar '12

26 Mar '12

Hi, this patch adds a library to map a Windows SID to a Unix uid or gid. My current plan is to used it for AD trusts on the client and the server side, this is why the interface allows different kind of memory allocators. bye, Sumit

3 10

Problem in sssd and libsss_autofs
by Marco Pizzoli 26 Mar '12

26 Mar '12

Hi guys, I would like to report this packaging(?) problem. As you can see in the following output, there's not a dependency between the rpm libsss_autofs and sssd. I hope to be of help. Marco [root@myhostname ~]# rpm -qa|grep sss libsss_sudo-1.8.0-6.fc16.x86_64 sssd-1.8.0-6.fc16.x86_64 libsss_autofs-1.8.0-6.fc16.x86_64 sssd-client-1.8.0-6.fc16.x86_64 [root@ myhostname ~]# yum update sssd Loaded plugins: langpacks, presto, refresh-packagekit updates/metalink | 24 kB 00:00 updates | 4.5 kB 00:00 updates/primary_db | 5.6 MB 00:11 updates/group_gz | 431 kB 00:00 updates-testing/metalink | 20 kB 00:00 updates-testing | 4.5 kB 00:00 updates-testing/primary_db | 1.1 MB 00:01 updates-testing/group_gz | 431 kB 00:02 Setting up Update Process Resolving Dependencies --> Running transaction check ---> Package sssd.x86_64 0:1.8.0-6.fc16 will be updated ---> Package sssd.x86_64 0:1.8.1-8.fc16 will be an update --> Processing Dependency: sssd-client(x86-64) = 1.8.1-8.fc16 for package: sssd-1.8.1-8.fc16.x86_64 --> Processing Dependency: libipa_hbac(x86-64) = 1.8.1-8.fc16 for package: sssd-1.8.1-8.fc16.x86_64 --> Running transaction check ---> Package libipa_hbac.x86_64 0:1.8.0-6.fc16 will be updated --> Processing Dependency: libipa_hbac = 1.8.0-6.fc16 for package: libipa_hbac-python-1.8.0-6.fc16.x86_64 ---> Package libipa_hbac.x86_64 0:1.8.1-8.fc16 will be an update ---> Package sssd-client.x86_64 0:1.8.0-6.fc16 will be updated ---> Package sssd-client.x86_64 0:1.8.1-8.fc16 will be an update --> Running transaction check ---> Package libipa_hbac-python.x86_64 0:1.8.0-6.fc16 will be updated ---> Package libipa_hbac-python.x86_64 0:1.8.1-8.fc16 will be an update --> Finished Dependency Resolution Dependencies Resolved ============================================================================================================================================== Package Arch Version Repository Size ============================================================================================================================================== Updating: sssd x86_64 1.8.1-8.fc16 updates-testing 1.8 M Updating for dependencies: libipa_hbac x86_64 1.8.1-8.fc16 updates-testing 45 k libipa_hbac-python x86_64 1.8.1-8.fc16 updates-testing 40 k sssd-client x86_64 1.8.1-8.fc16 updates-testing 75 k Transaction Summary ============================================================================================================================================== Upgrade 4 Packages Total download size: 1.9 M Is this ok [y/N]: y Downloading Packages: Setting up and reading Presto delta metadata updates-testing/prestodelta | 176 kB 00:01 Processing delta metadata Package(s) data still to download: 1.9 M (1/4): libipa_hbac-1.8.1-8.fc16.x86_64.rpm | 45 kB 00:00 (2/4): libipa_hbac-python-1.8.1-8.fc16.x86_64.rpm | 40 kB 00:00 (3/4): sssd-1.8.1-8.fc16.x86_64.rpm | 1.8 MB 00:06 (4/4): sssd-client-1.8.1-8.fc16.x86_64.rpm | 75 kB 00:00 ---------------------------------------------------------------------------------------------------------------------------------------------- Total 180 kB/s | 1.9 MB 00:11 Running Transaction Check Running Transaction Test *Transaction Check Error:* * file /usr/lib64/sssd/modules/libsss_autofs.so from install of sssd-1.8.1-8.fc16.x86_64 conflicts with file from package libsss_autofs-1.8.0-6.fc16.x86_64* Error Summary ------------- [root@ myhostname ~]# yum update sssd libsss_autofs Loaded plugins: langpacks, presto, refresh-packagekit Setting up Update Process Resolving Dependencies --> Running transaction check ---> Package libsss_autofs.x86_64 0:1.8.0-6.fc16 will be updated ---> Package libsss_autofs.x86_64 0:1.8.1-8.fc16 will be an update ---> Package sssd.x86_64 0:1.8.0-6.fc16 will be updated ---> Package sssd.x86_64 0:1.8.1-8.fc16 will be an update --> Processing Dependency: sssd-client(x86-64) = 1.8.1-8.fc16 for package: sssd-1.8.1-8.fc16.x86_64 --> Processing Dependency: libipa_hbac(x86-64) = 1.8.1-8.fc16 for package: sssd-1.8.1-8.fc16.x86_64 --> Running transaction check ---> Package libipa_hbac.x86_64 0:1.8.0-6.fc16 will be updated --> Processing Dependency: libipa_hbac = 1.8.0-6.fc16 for package: libipa_hbac-python-1.8.0-6.fc16.x86_64 ---> Package libipa_hbac.x86_64 0:1.8.1-8.fc16 will be an update ---> Package sssd-client.x86_64 0:1.8.0-6.fc16 will be updated ---> Package sssd-client.x86_64 0:1.8.1-8.fc16 will be an update --> Running transaction check ---> Package libipa_hbac-python.x86_64 0:1.8.0-6.fc16 will be updated ---> Package libipa_hbac-python.x86_64 0:1.8.1-8.fc16 will be an update --> Finished Dependency Resolution Dependencies Resolved ============================================================================================================================================== Package Arch Version Repository Size ============================================================================================================================================== Updating: libsss_autofs x86_64 1.8.1-8.fc16 updates-testing 48 k sssd x86_64 1.8.1-8.fc16 updates-testing 1.8 M Updating for dependencies: libipa_hbac x86_64 1.8.1-8.fc16 updates-testing 45 k libipa_hbac-python x86_64 1.8.1-8.fc16 updates-testing 40 k sssd-client x86_64 1.8.1-8.fc16 updates-testing 75 k Transaction Summary ============================================================================================================================================== Upgrade 5 Packages Total size: 2.0 M Total download size: 48 k Is this ok [y/N]: y Downloading Packages: Setting up and reading Presto delta metadata libsss_autofs-1.8.1-8.fc16.x86_64.rpm | 48 kB 00:00 Running Transaction Check Running Transaction Test Transaction Test Succeeded Running Transaction Updating : libipa_hbac-1.8.1-8.fc16.x86_64 1/10 Updating : sssd-client-1.8.1-8.fc16.x86_64 2/10 Updating : sssd-1.8.1-8.fc16.x86_64 3/10 Updating : libipa_hbac-python-1.8.1-8.fc16.x86_64 4/10 Updating : libsss_autofs-1.8.1-8.fc16.x86_64 5/10 Cleanup : sssd-1.8.0-6.fc16.x86_64 6/10 Cleanup : libipa_hbac-python-1.8.0-6.fc16.x86_64 7/10 Cleanup : libipa_hbac-1.8.0-6.fc16.x86_64 8/10 Cleanup : sssd-client-1.8.0-6.fc16.x86_64 9/10 Cleanup : libsss_autofs-1.8.0-6.fc16.x86_64 10/10 Updated: libsss_autofs.x86_64 0:1.8.1-8.fc16 sssd.x86_64 0:1.8.1-8.fc16 Dependency Updated: libipa_hbac.x86_64 0:1.8.1-8.fc16 libipa_hbac-python.x86_64 0:1.8.1-8.fc16 sssd-client.x86_64 0:1.8.1-8.fc16 Complete!

2 2

Active Directory integration issues
by Rolf Loudon 22 Mar '12

22 Mar '12

Hello I've installed sssd 1.5 on an ubuntu 11.10 server. I've followed the howto at https://fedorahosted.org/sssd/wiki/Configuring%20sssd%20to%20authenticate%2… I wish to use SASL as the authentication to the AD KDC. I add the computer account to the domain and test it as described with kinit -k -t /etc/krb5.keytab host/myhostname.domain.name(a)REALM.NAME then ldapsearch -h ad.kdc -b "dc=domainpart1,dc=domainpart2,dc=domainpart3" -Y GSSAPI cn=someuser and that all works fine. When I use this setup within sssd there are a two main issues. Firstly the logs tell me that the principal is not found in the KDC database. But when I inspect it using ADSI Edit I see the SPN and UPN values that I expect to see and that match the principal it says it cannot find. Likewise these principals can be seen from klist -kte /etc/krb5/keytab (though it doesn't complain about not finding anything in the key tab) I can get round that issue temporarily by specifying the principal name using ldap_sasl_authid. I'd still like to know what is wrong in that instance. Secondly the ldap_search_base strangely affects the authentication and the user lookup. I don't know if the searching is subtree or not. I can't see a parameter to make this explicit. If I set ldap_search_base (or ldap_user_search_base) to dc=domainpart1,dc=domainpart2,dc=domainpart3 then I get errors about ldap_sasl_interactive_bind_s failing. however if I set the ldap_search_base to cn=users,dc=domainpart1,dc=domainpart2,dc=domainpart3 then those errors go away and the lookup is done. The problem is that the users do not live in cn=users,dc=domainpart1,dc=domainpart2,dc=domainpart3 they are in an OU elsewhere. They can be found via a subtree search (as per the ldapsearch example above) if the search base is set to higher up the tree at just the domain components specification. But if I set the search base that way, then the sasl bind fails. Using both ldap_search_base and ldap_user_search_base makes no difference. Is there are way to separately define where the ldap_sasl_bind looks (unless I misunderstand it needs to look for the computer account, which is in cn=computers,dc=... which is also not within cn=users,dc=... so its still confusing me) so that the search base can be set so the user lookup will work. I can successfully lookup the user if I use a simple bind with ldap_default_bind_dn and ldap_default_authtok rather than sasl. And can show that the ldap_search_base affects this lookup in the above way. Really appreciate any pointers to these two problems. many thanks r.

3 8

socket.docx (sssd-devel@lists.fedorahosted.org)
by arun scaria (Google Docs) 22 Mar '12

22 Mar '12

I've shared an item with you: socket.docx https://docs.google.com/document/d/1x-vu_9ycbvVkY7Z3b9mkA5z_SY2jtxbDgGbBQ11… It's not an attachment -- it's stored online at Google Docs. To open this document, just click the link above.

1 0

[PATCH] Save alias of the service primary name, too
by Jakub Hrozek 21 Mar '12

21 Mar '12

After the recent changes to sysdb_attrs_get_aliases() we stopped saving the lowercased alias of the primary name. Services are a different beast than the rest of the entries, because with everything else the nss responder only uses the alias to match the entry. With services, we also need to print the aliases. The attached patch changes the behaviour so that all aliases are saved lowercased in an insensitive domain, including the primary name, but when returning the service, the alias that matches the primary name is filtered out. Because all aliases are lowercased now, I also removed the sss_get_cased_name() call, it is no longer needed.

3 2

PATCH] NSS: Look for services with correct case when cache is updated
by Jakub Hrozek 21 Mar '12

21 Mar '12

https://fedorahosted.org/sssd/ticket/1259

3 4

[PATCH] LDAP: Add better error logging when ldap_result() fails
by Stephen Gallagher 21 Mar '12

21 Mar '12

This should help us diagnose issues with ldap_result() returning -1. The only catch is that it relies on the openldap libraries setting the error code properly, which they do not always do.* * As part of my tests, I reverted the openldap libraries to the 2.4.29 release that was broken with SSSD, causing ldap_result to return -1 all the time. The LDAP_OPT_RESULT_CODE in that case was LDAP_SUCCESS.

2 2

[PATCH] Start SSSD earlier and stop it later (SYSV)
by Stephen Gallagher 21 Mar '12

21 Mar '12

SSSD needs to be started before NFS-related processes or they will mount with the username 'nobody' if they would have otherwise used LDAP accounts. Fixes https://fedorahosted.org/sssd/ticket/1273

2 3

SSSD Crypto Support
by Stephen Gallagher 21 Mar '12

21 Mar '12

SSSD is designed to have support for multiple cryptography libraries. Originally we build in support for both Mozilla NSS and libcrypto. However, over the last several releases, libcrypto support has fallen by the wayside and there is now a notable feature disparity between versions of SSSD built against Mozilla NSS and versions built against libcrypto. The basic functionality still works (we have support for caching credentials using a SHA512 algorithm provided by either library), but some of the more advanced features do not. For example: 1. Support for obfuscated passwords in the sssd.conf requires Mozilla NSS(*) 2. Support for centrally-managed SSH public keys requires a BASE64 encode/decode routine and in 1.8.2 wil add a SHA1 hash routine. There is no equivalent available in libcrypto at this time. Going forward, the core upstream for SSSD (all of whom run on Fedora and RHEL systems which have been consolidated on Mozilla NSS for some time) is planning to formally drop support for libcrypto. However, we're certainly willing to continue supporting it if someone else is willing to own the maintenance on it. Thus, I am CCing the maintainers of SSSD in non-Fedora/RHEL distributions that I know of. If anyone here is relying on libcrypto support and is willing to take over its maintenance, please speak up. (*) I consider this a misfeature imposed upon us by incompetent auditors, but it's still a checkbox on someone's list.

2 1

[PATCH] SSH: Fix infinite loop in sss_ssh_knownhostsproxy
by Jan Cholasta 20 Mar '12

20 Mar '12

Hi, this patch fixes infinite loop in sss_ssh_knownhostsproxy. https://fedorahosted.org/sssd/ticket/1268 Honza -- Jan Cholasta

2 1

[PATCH] NSS: Fix debug message
by Stephen Gallagher 20 Mar '12

20 Mar '12

Coverity Bug 12608 Pushed to master under the one-liner rule.

1 0

sssd.conf include feature
by Greg Lehmann 19 Mar '12

19 Mar '12

Wondering about whether this feature exists or is planned to exist? It is for use in a shared administration environment. We have central administration and local administrators. It would allow a central configuration for sssd with local changes. Puppet could manage the central main file and include a user managed portion. We handle sudoers in a similar way. I guess the main use of this might be to allow local admins to control who can login to a server. sssd.conf could include something like this: access_provider = simple simple_allow_groups = central_admins and the included locally managed file could have simple_allow_users = user01, user03, user42 I know we can do this in other ways with puppet, but this would be simpler and it seems to me an include feature might have other uses.

4 4

[PATCH 0/4]: Actual memory cache implementation
by Simo Sorce 19 Mar '12

19 Mar '12

>From [PATCH 0/0] A shared memory cache to perform better: 0/4: Actual memory cache implementation These is the bulk of the work, these patches are still a bit rough at the edges, grep for FIXMEs and TODOs and you'll see some plumbing (for example configure options in sssd to set expiration time and cache sizes are missing and are still harcoded). Simo. -- Simo Sorce * Red Hat, Inc * New York

4 21

Fwd: [Bug 743133] Performance regression with Kerberos authentication against AD
by Dmitri Pal 19 Mar '12

19 Mar '12

Should we make it a default option? It seems like in most cases it helps a lot. ---------------------------------------------------------------------------------------------- --- Comment #41 from Bojan Smojver <bojan(a)rexursive.com> 2012-03-18 00:50:01 EDT --- (In reply to comment #38) > One thing you might try is setting 'ldap_referrals = false'. Bingo! 1.6 secs with cache blown away, 0.16 secs with cache. Only about two orders of magnitude faster. :-) Thank you. Much appreciated!

3 3

[PATCH] SYSDB: Save only lowercased aliases in case-insensitive domains
by Stephen Gallagher 16 Mar '12

16 Mar '12

Fixes https://fedorahosted.org/sssd/ticket/1253 Previously, we were saving both the lower-cased alias names as well as the original capitalization. This was done in order to allow switching case-sensitive/insensitive modes safely, but it had the negative effect of producing duplicate alias entries (differing only by case) on maps like 'services' which have an 'aliases' field. Jakub and I discussed it and we agreed that switching case-sensitivity should always warrant a cache-purge, as it's a fundamental change to the cache contents.

3 4

[PATCH] Free entry from negative cache
by Jakub Hrozek 16 Mar '12

16 Mar '12

I found this (well, valgrind did..) when debugging #1251. I haven't found any TDB specific free function, so I just used free..

3 5

[PATCH] Fix uninitialized variable
by Jakub Hrozek 16 Mar '12

16 Mar '12

This resulted in using uninitialized variables with missing attributes unless the caller explicitly assigned NULL prior to calling list_missing_attrs.

3 2

[PATCH] IPA: Allow service lookups
by Stephen Gallagher 16 Mar '12

16 Mar '12

IPA doesn't natively support services, but if a user is extending their schema manually, we should still allow performing the lookup.

2 2

[PATCH] LDAP: Errors retrieving the RootDSE should not be fatal
by Stephen Gallagher 16 Mar '12

16 Mar '12

If we can't reach the RootDSE, let's just proceed as if it's unavailable with reasonable defaults. If we fail later on, that's fine. Fixes https://fedorahosted.org/sssd/ticket/1257

2 2

[PATCHES] SSH: Do reverse DNS lookup of host addresses
by Jan Cholasta 15 Mar '12

15 Mar '12

Hi, the attached patches fix <https://fedorahosted.org/sssd/ticket/1245> and also do some refactoring: [PATCH 1/2] SSH: Allow clients to explicitly specify host alias This change removes the need to canonicalize host names on the responder side - the relevant code was removed. [PATCH 2/2] SSH: Canonicalize host name and do reverse DNS lookup in sss_ssh_knownhostsproxy Honza -- Jan Cholasta

2 1

user and group precedence issue
by Olivier 15 Mar '12

15 Mar '12

> (without the n :-) Ooops :) > sssd cares only about what exists in ldap to date. Ooops again > If you look at the ldap tree on its own you see an > "unknown" user name as member of a group. Ok, I see the logic now ( although I'm not completely convinced from a practical point of view to be honnest : a user name could be defined somewhere else, in a referal ldap for example. In that case, should it be an overall group consistency problem if a memberuid was uknown because a referal server is not accessible ? ). Anyway, thank you so much for your responses Simo and Stephen : I'll adapt my view to what is possible then :-) Kindest, --- Olivier 2012/3/14 Simo Sorce <simo(a)redhat.com>: > On Wed, 2012-03-14 at 19:51 +0100, Olivier wrote: >> Simon, > > (without the n :-) > >> that's where I don't catch ( sorry) : >> >> > You are asking it to know about "unknown" users >> >> If you say in nsswitch.conf : >> >> passwd: local sss >> group: sss local >> >> Then sss should know about users that are in local >> /etc/passwd and may retrieve their groups in ldap ? > > No, sssd is blissfully unaware of what you have in /etc/passwd > or /etc/group, sssd cares only about what exists in ldap to date. > >> Why would that be inconsistent not to insert users >> entries in ldap in that situation ? > > Because in the ldap server there is no corresponding user. If you look > at the ldap tree on its own you see an "unknown" user name as member of > a group. > >> BTW, I don' think that ldap requires that an entry exists >> for a posixgroup memberuid ? > > No the rfc2307 schema does not mandate consistency (the rfc2307bis > schema does mandate it due to use of DNs instead of simple names). > > Simo. > > -- > Simo Sorce * Red Hat, Inc * New York > > _______________________________________________ > sssd-devel mailing list > sssd-devel(a)lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/sssd-devel

4 5

user and group precedence issue
by Olivier 14 Mar '12

14 Mar '12

Hello, I have configure redhat (6 and 5) boxes to authenticate users over an openldap server via sssd. I have implemented a policy so that "Systems" accounts ( uid > 500 ) are not in ldap but authentified over local password db. My ldap directory also contains posixgroups that I use to tune some accesses ( using /etc/security/access.conf ). I have added this in my nsswitch.conf : passwd: files sss shadow: files sss group: sss files I have configured sss as a primary source of information for groups, because I would like pam to take into account both groups that are declared in ldap and those that are locally configured (even for system accounts that don't have any entry in ldap). The problem I'm facing is that ldap groups for a user are only considered if the user has itself an entry in ldap ( except if th user is declared as having an ldap group as primary in /etc/passwd ). Here is an example : If I have this in /etc/passwd : ntp:x:38:38::/etc/ntp:/sbin/sh This in /etc/groups ntp:x:38: And this group in ldap : dn: cn=sysgrp,ou=group,dc=example,dc=fr cn: sysgrp gidnumber: 18010 memberuid: ntp memberuid: wheel memberuid: ldap objectclass: posixGroup Then a "su - ntp -c groups" returns only "ntp" group not "sysgrp" : $ su - ntp -c groups ntp If I create a user entry for "ntp" in ldap directory, then it works : # Entry : dn: uid=ntp,ou=sysaccounts,ou=people,dc=example,dc=fr cn: ntp gidnumber: 18010 objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson objectclass: posixAccount uid: ntp uidnumber: 38 ... I have then what I want on the client machine : $ su - ntp -c groups ntp sysgrp I don't want to maintain a DIT in ldap to list system accounts, I would only like to maintain a posix group entry that lists system accounts ( and match if the system account exist on the client ). Is there any way to do that ? May be someone could help me or indicate a documentation or a mailing list that I could try to consult to deal with that problem ? Thanks, --- Olivier

4 10

[PATCH] LDAP: Add AD 2008r2 schema
by Stephen Gallagher 14 Mar '12

14 Mar '12

Fixes https://fedorahosted.org/sssd/ticket/1031 This patch creates a set of schema defaults that corresponds to Active Directory 2008r2. It can be set up simply by specifying ldap_schema = AD Operationally, it behaves like any other RFC2307bis server at this time. This patch does not remove the requirement for SFU/SUA support in Active Directory. More enhancements will follow to add support for AD-specific features.

2 4

Announcing SSSD 1.8.1
by Stephen Gallagher 12 Mar '12

12 Mar '12

The SSSD team is proud to announce the bugfix release of the System Security Services Daemon version 1.8.1 As usual, the source can be downloaded at https://fedorahosted.org/sssd Packages for Fedora will be built later today and should appear in updates-testing within two days. == Highlights == * Resolve issue where we could enter an infinite loop trying to connect to an auth server * Fix serious issue with complex (3+ levels) nested groups * Fix netgroup support for case-insensitivity and aliases * Fix serious issue with lookup bundling resulting in requests never completing * IPA provider will now check the value of nsAccountLock during pam_acct_mgmt in addition to pam_authenticate * Fix several regressions in the proxy provider == Detailed Changelog == Jakub Hrozek (12): * Use proper errno code * Only do one cycle when resolving a server * krb5_child: set debugging sooner * Search netgroups by alias, too * Detect cycle in the fail over on subsequent resolve requests only * Autofs: operate on contents of double-pointer, not address * Only free returned values on success * Save original name into the in-memory cache * Handle errors from lookup_netgr_step gracefully * Fix nested groups processing * Fix netgroup error handling * Handle empty elements in proxy netgroups: Jan Cholasta (1): * Include missing source files to the list of source files which contain translatable strings Jan Zeleny (5): * Fix the script path * Fixed uninitialized pointer in SSH known host proxy * Fixed uninitialized pointer in SSH authorized keys client * Add umask before mkstemp() call in SSH responder * Fixed resource leak in ssh client code Pavel Březina (6): * Hide --debug option in sss_debuglevel * Two memory leaks in sss_sudo_get_values * Missing debug message if sdap_sudo_refresh_set_timer fails * Use of unininitialized value in sudosrv_cache_set_entry and sudosrv_cache_lookup_internal * Use of unininitialized value in sss_sudo_parse_response * Potential NULL-dereference in sudosrv_cmd_get_sudorules Simo Sorce (1): * Use the correct hash table for pending requests Stephen Gallagher (20): * Bump version to 1.8.1 * Fix typo in autofs option description * Include the debug_level upgrade tool in the tarball * Include new manpages in translations * Updating translations for SSSD 1.8.1 * Fix typo in script name * Handle cases where UID is -1 * IPA: Set the DNS discovery domain to match ipa_domain * IPA: Fix segfault with srchost functionality enabled * DP: Reorganize memory hierarchy of requests * Prune python provides correctly * Make RPM spec more explicit * Build experimental features by default in RPMs * Properly terminate GIT_CHECKOUT * LDAP: Make sdap_access_send/recv public * IPA: Check nsAccountLock during PAM_ACCT_MGMT * PROXY: Create fake user entries for group lookups * SSH: Fix missing semicolon * IPA: Initialize hbac_ctx to NULL * i18n: Remove empty translations Yuri Chornoivan (1): * fix typos in manual

1 0

[PATCH] Fix validation errors in translations
by Stephen Gallagher 12 Mar '12

12 Mar '12

This patch corrects some validation errors resulting in translation files not being output (the build system would just detect the error and scrap the translation for these languages).

1 1

building ssd-1.8.0 on RHEL6
by Moritz Baumann 12 Mar '12

12 Mar '12

Hi there, ist it safe to pick the rawhide sssd-1.8.0-6.fc18.src.rpm, change ldb_version to %global ldb_version 0.9.10 and fix the RPM build errors: File must begin with "/": %{_unitdir}/sssd.service Or do I have to build the newer ldb version (1.1.4)? We are running in timeout problems with sssd lookups and would like to test the new sssd version to see if this improoves things. Or is there somewhere an official sssd-1.8.0 in some fasttrack channel? Best, Moritz Baumann

2 1

[PATCH] IPA: Initialize hbac_ctx to NULL
by Stephen Gallagher 12 Mar '12

12 Mar '12

Pushed to master and sssd-1-8 under the one-liner rule.

1 0

[PATCH] Two proxy netgroups fixes
by Jakub Hrozek 09 Mar '12

09 Mar '12

Hi, attached are two patches for issues I found in the proxy netgroups code. [PATCH 1/2] Fix netgroup error handling https://fedorahosted.org/sssd/ticket/1242 The patch improves error handling, and, most importanly, deletes any netgroup that might be in the cache if the search did not yield any results. There's one catch, though. During my testing with nss-pam-ldapd, all the NSS operations returned NSS_STATUS_SUCCESS and an empty "struct __netgrent" structure for cases when the netgroup existed and when the netgroup existed but had no nisNetgroupTriple attributes. This may be a nss-pam-ldapd bug, though..is there any other back end that could be used to test? I'd like to avoid setting up NIS :-) [PATCH 2/2] Handle empty elements in proxy netgroups The make_netgroup_attr() function did not check for NULL elements of netgroup triples and could print literal "(null)" into the triple element in the nice case and crash in the worse case.

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2012