June 2012 - sssd-devel - Fedora mailing-lists

[PATCH] Allow more libldap debugging
by Jakub Hrozek 28 Nov '12

28 Nov '12

This patch should not be pushed to master, but I would like to get it reviewed anyway. It should be used to provide a custom build for users experiencing cases where ldap_search_ext would block (c.f. https://bugzilla.redhat.com/show_bug.cgi?id=728343) For example: export SSSD_DEBUG_LDAP_SEARCH="0xffff" would set LDAP_DEBUG_ANY The attached patch applies cleanly on the RHEL6.1 branch. I also have a version that applies on master/1.5 if needed.

4 7

[PATCH] - SIGUSR2 should force SSSD to reread resolv.conf as well
by Ariel Barria 05 Sep '12

05 Sep '12

https://fedorahosted.org/sssd/ticket/1045

5 7

[PRELIMINARY][PATCHES] Primary server support in SSSD
by Jan Zelený 01 Aug '12

01 Aug '12

Hi everybody, I'm sending some patches which implement the primary server support as I see it. It it based on comment #6 in the related ticket https://fedorahosted.org/sssd/ticket/1128 Patch #0001 basically adds the necessary support in failover code Patches #0002 - #0004 extend this support in each provider Patch #0005 documents the new concept in failover section in man pages Patches #0006 - #0008 add new options for each provider which utilize this concept. Just briefly about the approach. When adding a new server to the list of servers related to a service, each server can be marked either as primary or secondary. When selecting new server from failover list, the algorithm iterates over the list twice - first it tries to look for primary server and if none is found, it tries also secondary server. If a server is returned from failover, and it is not primary server, a timeout is set (currently hard-coded for 30 seconds) for primary server lookup. This timeout is rescheduled until a primary server is found. If a primary server (either working or neutral) is found after this timeout, status of the backend is reset, i.e. first all offline and then all online callbacks are called. This is done to interrupt connection to the secondary server in favor of new connection to a primary server. I have just couple concerns about things which I have yet to inspect. First of all when connection to the old server is interrupted, what if an operation is currently in progress on this connection? I know ticket #1027 induces similar scenario. Maybe to kill two birds with one stone I could design an extension to immediately invoke callbacks of all operations running on existing connection. What do you think about that? My second concern is about port status timeout. After some time a port is marked as neutral if originally marked as not-working. That effectively leads to second attempt to primary server reconnection being successful even though the server is still not running. As a result, an unnecessary reconnection to secondary server is performed once some data are needed from the server. Thank you very much for your opinions on this Jan

4 14

[PATCH][PRELIMINARY] sudo: send username and uid while requesting default options
by Pavel Březina 24 Jul '12

24 Jul '12

https://fedorahosted.org/sssd/ticket/1239 [PATCH 1/2] Finally removes EOK constant from sudo api header. It is not used in the SUDO code so it does not require their changes. [PATCH 2/2] This does what is requested in the ticket. It seems to be very huge but in fact it is mainly changing the variable. Basically I tried to get rid of domain ctx where possible, leave it only in initgroups part and use command ctx elsewhere. The in-memory cache is not yet implemented, I want to discuss the possible ways of doing it. The basic problem is that we need to get the domain during the request for default options. How will we do it? I think there are two options: 1. always try to perform the initgroups - find the domain and the check the in-memory cache (which may be slow if the user is in the last domain, but that will be probably handled as part of https://fedorahosted.org/sssd/ticket/1126 2. store uid:username = domain in the in-memory cache (same cache as results or a new one?) This patch contains a modified version of sysdb_get_sudo_user_info() where the uid is not mandatory. I want to replace this function with sysdb_sudo_get_user_groups() (or make it generic and place it in sysdb_ops?) because the groupnames are the only thing we don't know. However this requires a modification of the data provider protocol as well so I'm keeping it for later.

4 32

[PATCH] ding-libs spec file update
by Jan Zelený 24 Jul '12

24 Jul '12

Attached patch contains some changes that I'd like to propose. All modifications are based on spec file for Fedora rawhide. Thanks Jan

3 2

[PATCHES] Add Active Directory identity, auth and chpass providers to SSSD
by Stephen Gallagher 06 Jul '12

06 Jul '12

These patches add a new provider to SSSD: the AD provider. This provider is designed to simplify communication with Active Directory 2008 R2 and later. It may work with earlier versions of Active Directory, but we're not planning to test or support them. This set of patches adds the identity, auth and chpass providers. I will be providing an access provider as well, but it's not ready and I wanted to land these patches sooner rather than later. I also have not added any manpages or the SSSDConfig API entries for the new options yet. Those are also still forthcoming. This provider can be configured for testing as follows: {{{ [domain/AD.DOMAIN] id_provider = ad auth_provider = ad chpass_provider = ad ad_server = dc1.example.com, dc2.example.com, _srv_ ad_domain = AD.DOMAIN case_sensitive = False }}} That should be all the configuration needed. The ad_server line can be ommitted if SRV records for AD domain controllers exist in DNS. I'm working on a way to eliminate the need for 'case_sensitive = False' as well, but that's trickier than it sounds because it needs to be set in the NSS responder, not just the back-end. Patches 0001-0005 are minor enhancements to utility. Patch 0001: Some logging enhancements for krb5_child Patch 0002: KRB5_LOCATOR: Print the filename that couldn't be opened Patch 0003: Drop memctx parameter of krb5_try_kdcip and fix a small memory leak in the process. Patch 0004: Converge the assorted IPA and KRB5 routines for setting up the online/offline handlers into a common function that can also be reused for the AD provider. Patch 0005: Just change the name of the "AD-compatible" schema map for the pure LDAP provider so it won't conflict with the one I'm adding to the AD provider. The following two patches add the "meat" of the new functionality. Sorry for the size of the patches, but I couldn't find a sensible way to break them up any further. Patch 0006: Add AD identity provider Patch 0007: Add AD auth and chpass providers

4 10

Mixing passwd accounts with LDAP groups issue
by Jan Engelhardt 05 Jul '12

05 Jul '12

Hi, I have my user account listed in both /etc/passwd, /etc/shadow and the LDAP tree. However, only the LDAP tree has the supplementary group list info. In sssd-1.8.3 and earlier, issuing `getent passwd jengelh` would return me all the (primary and) secondary groups I am a mamber of. Something like uid=25121(jengelh) gid=100(users) groups=100(users),399(abuild),56485(friends), 27072(netitwork),31327(rdesktop) In sssd-1.8.93, this is no longer the case, and instead I get: uid=25121(jengelh) gid=100(users) groups=100(users),33(video) `getent group 31327` has to say: rdesktop:*:31327:fz,mm,mk `ldapsearch -x cn=rdesktop`: dn: cn=rdesktop,ou=groups,o=borg objectClass: posixGroup objectClass: top objectClass: groupOfNames objectClass: sambaGroupMapping objectClass: zarafa-group cn: rdesktop description: Remote Desktop Users member: uid=jengelh,ou=users,o=company member: uid=fz,ou=users,o=company member: uid=mm,ou=users,o=company member: uid=mk,ou=users,o=company sambaGroupType: 2 displayName: Remote Desktop gidNumber: 31327 zarafaHidden: 1 sambaSID: S-1-5-21-2434340325-2384729352-2357823451-12387 If I comment about my entry in /etc/passwd, I do receive the groups from LDAP again, but naturally I am missing out on the local groups: uid=25121(jengelh) gid=27072(netitwork) groups=27072(netitwork),33(video),56485(friends), 31327(rdesktop),399(abuild) It seems like if the user entry is satisfiable from /etc/passwd, group lookup is also only limited to passwd. This breaks with behavior of all previously seen implementations (pam_ldap,..) which strictly separated user and group lookups like NSS's design set forth a handful of decades ago. Side-note supplement: And then there is the cache coming into play, which provided for a handful of surprises on its own. Removing the comment hash mark # from my entry in /etc/passwd again after the previous lookup, I then get *all* memberships from both local and LDAP: uid=25121(jengelh) gid=100(users) groups=100(users),33(video),56485(friends),31327(rdesktop), 27072(netitwork),399(abuild) so the look-in-passwd-only "misfeature" is not even consistent :)

2 5

My solution to keep an update cache of all LDAP entries. Is there a better way?
by Mark London 03 Jul '12

03 Jul '12

Here is my solution to have a persistant uptodate local cache of all ldap entries, so as to avoid very long delays when a user issues a command that causes a large number of LDAP lookups, i.e. by doing a "ls -l /home": enumerate = true enum_cache_timeout = 86400 ldap_purge_cache_timeout = 0 ldap_enumeration_refresh_timeout = 300 I set the cache timeout to be 24 hours, and do an enumerate every 5 minutes. What I would like to know, is why such long delays (i.e. minutes) occurs when doing an "ls -l /home". Is it because it has to write out each entry into the local database? Just curious. :) Thanks. Mark London

3 2

No negative cache with sssd_nss
by Jan Engelhardt 03 Jul '12

03 Jul '12

Hi, it seems that sssd does not cache negative responses from the shadow/NSS backend. This is particularly observable when repeatedly querying for groups that do not exist in /etc/group, but do exist in LDAP. sssd is configured to search local db, plus another server's LDAP tree. If the group "clients" is in LDAP, the following testcase below runs in about ~8.5 sec on the reference machine. However, if I add the "clients" group to the end of /etc/group, it completes in like 1.3 sec. When only in LDAP, tcpdump shows no activity on port 389, so at least the positive caching does work. However, the negative response from NSS increases the execution time significantly, which leads me to believe that part is not cached. ---8<--- #include <stdio.h> #include <stdlib.h> #include <pwd.h> #include <grp.h> int main(void) { unsigned int i; struct group *g; for (i = 0; i < 50000; ++i) { g = getgrnam("clients"); } return EXIT_SUCCESS; }

3 12

[PATCH] LDAP: Print extended failure message for SASL bind
by Stephen Gallagher 02 Jul '12

02 Jul '12

Adds a useful DEBUG message if SASL binds fail. This was helpful in tracking down issues while working on the Active Directory ID provider.

3 4

[PATCH] fix ipa provider (already pushed)
by Simo Sorce 02 Jul '12

02 Jul '12

After recent changes the ipa provider was broken. The problem is in the code the looks at the rootdse, it assumed the sudorule_map to be always available and unconditionally referenced that. That map is configured only if sudo_provider = ldap is configure in the ldap case, however it is never configured in the ipa case as a sudo_provider = ipa has not been made available. This may not be the ultimate way to fix the issue however because there is no sudo provider for ipa there is no other workaround to avoid sssd_be crashing so I pushed this patch under the onliner and unbreak the ipa provider rule (yes I made that last one up :-D but I use it daily so it is important to never completely break it for me). Simo. -- Simo Sorce * Red Hat, Inc * New York

2 1

[PATCH] TESTS: Print messages when LDAP options do not match
by Stephen Gallagher 29 Jun '12

29 Jun '12

In addition to failing when option maps differ, we should also print what we got versus what was expected. This patch has made it easier to keep my WIP branches in sync with master.

2 2

[PATCH] KRB5: Initialize the credential cache type properly
by Stephen Gallagher 29 Jun '12

29 Jun '12

We weren't guaranteeing that the cctype-specific callbacks were initialized before using them. This bug only presented itself for users who were logging in without a ccacheFile attribute in the LDB (for example, first-time logins). I missed this in review because I was testing with users that were already in the cache.

2 2

[PATCH] DEBUG: Log to syslog if we are unable to open a debug fd
by Stephen Gallagher 29 Jun '12

29 Jun '12

If for some reason we are unable to open the debug file from a child process (as was the case during some of my testing on the AD provider), we should log a message to the syslog to alert the admin that logs are being dropped.

2 2

[PATCHES][PRELIMINARY] sudo - new design
by Pavel Březina 29 Jun '12

29 Jun '12

Hello everybody, here is the first set of patches for the new sudo clothes. [1] As it does not touch the responder, I believe it does not require the patches from the other preliminary sudo thread (already acked). However it was written atop them. [2/10] This is the main change for the async processing of the sudo rules. It make sdap_sudo_refresh_send() more generic by adding there two filters: ldap_filter - used for search in the LDAP sysdb_filter - used for a deletion of the rules from sysdb This way we can have many different refresh styles without touching this fundamental function. From this patch further the provider will return an error to the responder making it unusable. [...] The rest of the patches has a self-describing subject. Don't be afraid of the count, these patches are very small :-) The next set of patches is where the fun begin, so be patient :-) [1] https://fedorahosted.org/sssd/wiki/DesignDocs/SUDOCachingRules

5 26

[PATCH] SELinux user maps: pick just one map
by Jan Zelený 29 Jun '12

29 Jun '12

This patch modifies behavior of SSSD when putting together content of user config file for pam_selinux. SSSD will now pick only the first user map in the priority list which matches to the user logging in. Other maps are ignored. https://fedorahosted.org/sssd/ticket/1360 Rob, please confirm that this is the right and expected behavior. Thanks Jan

6 18

Re: [SSSD] Very slow listing of files owned by many different, users. Any solution?
by Mark London 28 Jun '12

28 Jun '12

sgallagh(a)redhat.com wrote: > On Wed, 2012-06-27 at 13:18 -0400, Mark London wrote: >> Hi - We are running SSSD with LDAP at our site, where we have several >> hundred users. LDAP is being served by our Windows domain server. >> >> With entry_cache_timeout set to a short value, when someone does an >> operation that requires information for multiple users, i.e. listing the >> owners of all of the user's home directories via the command "ls -l >> /home", this will take many many minutes to complete. Of course, this >> happens, because an LDAP request has to be issued for each user, and >> then stored in the database. Further similar operations will complete >> quickly, during the entry_cache_timeout period. But such operations do >> not occur that frequent enough for the data to be kept in the cache. >> >> The only solution seems to be sto imply increase entry_cache_timeout to >> a very large value. Of course, this is not ideal, because changes to >> the ldap entries will not be seen for a long time. A kludge workaround, >> would be to keep a low timeout, and have a cron job that runs the >> command "ls -l /home" every 5 minutes, on each workstation. >> >> Is there a more elegant way to solve this problem? Thanks. - Mark > > If this action is a very common one (listing all of /home), then in your > particular environment you will probably want to set 'enumerate = True' > in the [domain/DOMAINNAME] section of sssd.conf. > > What this does is instruct SSSD to poll for cache updates on a regular > basis and store cached information about all users and groups at alltimes. Hi - We have enumerate turned on and it works great when SSSD is started, as "ls -l /home" returns immediately. However, that's not the case, no matter what I set ldap_enumeration_refresh_timeout. I.e. After I received your email, I thought maybe that the enumeration data was being cleared out of the cache somehow. So I tried setting the ldap_enumeration_refresh_timeout to much less than entry_cache_timeout. Should that prevent the cached entries from ever timing out? In any event, it doesn't appear to work. "ls - /home" still takes a long time and triggers requests. (Thu Jun 28 08:04:06 2012) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'hereiam' matched without domain, user is hereiam (Thu Jun 28 08:04:06 2012) [sssd[nss]] [nss_cmd_getpwnam_cb] (0x0400): Requesting info for [hereiam] from [<ALL>] (Thu Jun 28 08:04:06 2012) [sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/USER/PSFC/hereiam] (Thu Jun 28 08:04:06 2012) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting info for [hereiam@PSFC] Here's our sssd.conf. Thanks for any help. - Mark [sssd] config_file_version = 2 # Number of times services should attempt to reconnect in the # event of a crash or restart before they give up reconnection_retries = 3 # If a back end is particularly slow you can raise this timeout here sbus_timeout = 30 services = nss, pam # SSSD will not start if you do not configure any domains. # Add new domain configurations as [domain/<NAME>] sections, and # then add the list of domains (in the order you want them to be # queried) to the "domains" attribute below and uncomment it. ; domains = LOCAL,LDAP domains = PSFC [nss] # The following prevents SSSD from searching for the root user/group in # all domains (you can add here a comma-separated list of system accounts that # are always going to be /etc/passwd users, or that you want to filter out). filter_groups = root filter_users = root reconnection_retries = 3 debug_level = 0 # The entry_cache_timeout indicates the number of seconds to retain an # entry in cache before it is considered stale and must block to refresh. # The entry_cache_nowait_timeout indicates the number of seconds to # wait before updating the cache out-of-band. (NSS requests will still # be returned from cache until the full entry_cache_timeout). Setting this # value to 0 turns this feature off (default). ; entry_cache_timeout = 600 ; entry_cache_nowait_timeout = 300 [pam] reconnection_retries = 3 debug_level = 0 [domain/PSFC] description = LDAP domain with AD server enumerate = true min_id = 501 cache_credentials = true entry_cache_timeout = 600 debug_level = 0 ldap_enumeration_refresh_timeout = 120 id_provider = ldap chpass_provider = none auth_provider = ldap ldap_uri = _srv_,ldaps://198.125.180.133 ldap_tls_cacertdir = /etc/openldap/cacerts #ldap_tls_cacert = /etc/openldap/cacerts/test.cer ldap_schema = rfc2307bis ldap_search_base = dc=psfc,dc=mit,dc=edu ldap_user_search_base = dc=psfc,dc=mit,dc=edu ldap_group_search_base = dc=psfc,dc=mit,dc=edu ldap_default_bind_dn = CN=ADldapreadonly,OU=Computer Group,OU=PSFC Users,DC=psfc,DC=mit,DC=edu ldap_default_authtok_type = password ldap_default_authtok = ldapread #ldap_pwd_policy = none ldap_user_object_class = person ldap_user_name = sAMAccountName ldap_user_uid_number = msSFU30UidNumber ldap_user_gid_number = msSFU30GidNumber ldap_user_home_directory = msSFU30HomeDirectory ldap_user_shell = msSFU30LoginShell ldap_user_principal = userPrincipalName ldap_group_object_class = group ldap_group_member = msSFU30PosixMember ldap_user_member_of = msSFU30PosixMemberOf ldap_group_name = name ldap_group_gid_number = msSFU30GidNumber ldap_force_upper_case_realm = True

1 0

Unspecified error loading config db
by Jan Engelhardt 28 Jun '12

28 Jun '12

Installed sssd-1.8.3 on a fresh openSUSE_Factory, where it happens to not work. Unfortunately, I just can't make anything out from these error message. What's "unavailable" supposed to mean? v-sfac:/var/log # sssd -d 99 -i ldb: module version mismatch in src/ldb_modules/memberof.c : ldb_version=1.1.6 module_version=1.0.2 ldb: failed to initialise module /usr/lib64/ldb/memberof.so : Unavailable (Wed Jun 27 17:50:01:328016 2012) [sssd] [load_configuration] (0x0010): The confdb initialization failed (Wed Jun 27 17:50:01:328127 2012) [sssd] [main] (0x0020): Error loading configuration database: [5]: Input/output error v-sfac:/var/lib/sss # ls -l /usr/lib64/ldb/memberof.so -rwxr-xr-x 1 root root 52328 May 14 11:39 /usr/lib64/ldb/memberof.so libldb-1.1.6 is installed. Wrong kind of version?

2 3

Online detection issues going forward
by Stephen Gallagher 28 Jun '12

28 Jun '12

Right now, SSSD has two mechanisms for detecting a shift in network state in order to determine if it should attempt to go online immediately. This is done to ensure that cached entries get updated as quickly as possible and so that if the provider offers online callbacks (such as the deferred kinit feature of the krb5 provider) they will fire immediately. 1) We register with libnl (a library providing access to kernel netlink APIs) to be notified whenever a network interface comes up or goes down on the system. 2) We set an inotify watch on /etc/resolv.conf to be notified if the DNS information changes. In the current default configuration of Fedora, we actually end up relying more often on 2) than 1) in the case of VPNs. The reason for this is that when we join a VPN, we are notified that the network has changed, but in many cases we still cannot connect to the servers until NetworkManager has also updated /etc/resolv.conf. This is because in the common VPN case, the DNS entry for the identity and authentication servers are also located inside the VPN. So in this situation, our current behavior is to actually try twice to connect to the servers; the first time when we notice the network change and the second for when resolv.conf is modified. In situations where DNS for the identity and auth servers are inside the VPN, it's always this second attempt that succeeds. However, this behavior makes one very basic assumption: When a VPN or other connection is established to a new network, /etc/resolv.conf will be updated with new data. This is the current default for NetworkManager on Fedora and RHEL systems, but this will not be the case soon. Currently, it is possible to set up NetworkManager to use dnsmasq for DNS caching by adding dns=dnsmasq to NetworkManager.conf. The effect of this is that NetworkManager will update dnsmasq configuration instead of /etc/resolv.conf. /etc/resolv.conf will then remain static and always pointed at 127.0.0.1. This means that our inotify backup above becomes useless. This becomes more urgent because a similar approach is currently planned to become the default in Fedora 18. This approach will use 'unbound' instead of 'dnsmasq' in order to facilitate the use of DNSSEC on all Fedora clients, but the effect will be the same. /etc/resolv.conf will remain static and configuration changes will occur in 'unbound' instead. So we need to come up with a new way to deal with the "DNS servers behind a VPN" use-case that will play nicer with these two solutions (or better still, work generically). As a final note, we are not *completely* broken in these situations. We will still eventually go on once a full minute has passed *and* a request that cannot be answered by the cache occurs. But for those users relying on the deferred kinit feature as part of their workflow will see a definite regression in behavior under this scenario.

3 3

Very slow listing of files owned by many different users. Any solution?
by Mark London 27 Jun '12

27 Jun '12

Hi - We are running SSSD with LDAP at our site, where we have several hundred users. LDAP is being served by our Windows domain server. With entry_cache_timeout set to a short value, when someone does an operation that requires information for multiple users, i.e. listing the owners of all of the user's home directories via the command "ls -l /home", this will take many many minutes to complete. Of course, this happens, because an LDAP request has to be issued for each user, and then stored in the database. Further similar operations will complete quickly, during the entry_cache_timeout period. But such operations do not occur that frequent enough for the data to be kept in the cache. The only solution seems to be sto imply increase entry_cache_timeout to a very large value. Of course, this is not ideal, because changes to the ldap entries will not be seen for a long time. A kludge workaround, would be to keep a low timeout, and have a cron job that runs the command "ls -l /home" every 5 minutes, on each workstation. Is there a more elegant way to solve this problem? Thanks. - Mark

2 1

[PATCH] libcrypto fully implemented
by George McCollister 26 Jun '12

26 Jun '12

I implemented missing libcrypto functionality. Regards, George McCollister

2 3

Announcing SSSD 1.9.0 beta 3
by Stephen Gallagher 25 Jun '12

25 Jun '12

The SSSD is proud to announce the third of five preview releases of version 1.9 of the System Security Services Daemon. Beta 4 will be released on July 10th and include a new AD provider (wrapping the intricacies of setting up AD, configuring LDAP attributes and Kerberos realm into a simpler set of configuration options) Beta 5 will be released on July 31st and will contain a new tool for "seeding" accounts with a temporary password for sending machines to remotees as well as introducing a concept of primary vs. secondary servers. After Beta 5, no new features will be added to SSSD 1.9.0 and we will focus on stability and our backlog of bugfixes until the final release around September 1st. We will most likely issue a series of release candidate builds prior to that, but these have not yet been scheduled. As always, you can download the latest sources at https://fedorahosted.org/sssd/ == Highlights == * Add a new PAC responder for dealing with cross-realm Kerberos trusts * Terminate idle connections to the NSS and PAM responders * Switch from libunistring to glib2 for unicode support == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1163 [Feature] SSSD AD Integration Feature (Cross Realm Kerberos Trusts) https://fedorahosted.org/sssd/ticket/1354 Add support for terminating idle connections in sssd_nss https://fedorahosted.org/sssd/ticket/1383 sssd_nss segfaults performing netgroup lookups without a specified domain == Detailed Changelog == Jan Zeleny (5): * Fix possible segfault in sdap_save_group() * PAC responder: add some utility functions * PAC responder: test suite * Fix re_expression matching with subdomains * SELinux user maps: pick just one map Shantanu Goel (4): * Set return errno to the value prior to calling close(). * Log message if close() fails in destructor. * Do not send SIGPIPE on disconnection * Add support for terminating idle connections Simo Sorce (2): * Do not leak file descriptors in client libs. * Add close on exec support for old platforms Stef Walter (1): * Move some debug lines to new debug log levels Stephen Gallagher (6): * Bumping version to 1.9.0 beta 3 * Fix typo breaking DIR cache detection * Make the client idle timeout configurable * UTILS: Fix segfault due to sss_parse_name_for_domains * BUILD: Change default unicode library to glib2 * Update translations for 1.9.0 beta 3 release Sumit Bose (11): * PAC responder: add basic infrastructure * PAC responder: add the core functionality * PAC responder: support in spec file * PAC client: add basic support in common client code * PAC client: add krb5 authdata plugin * Add support for ID ranges * Add range support to PAC responder * Try to build PAC responder only if all dependencies are available * Build pac responder tests only if pac responder is build * Add man page section for the PAC responder * Set default for subdomain_homedir

1 0

[PATCH] Set default for subdomain_homedir
by Sumit Bose 25 Jun '12

25 Jun '12

Hi, to make sub-domain configuration easier this patch adds a default value for the subdomain_homedir parameter. bye, Sumit

2 1

BUILD: Change default unicode library to glib2
by Stephen Gallagher 25 Jun '12

25 Jun '12

There is no longer any real advantage to building against libunistring by default. This patch switches SSSD's build to use glib2 instead, which will exist already on all platforms that SSSD is known to compile on. This will eliminate an extra dependency on libunistring and save space on capacity-limited systems.

2 4

[PATCH] update build dependency list in BUILD.txt
by Pavel Březina 25 Jun '12

25 Jun '12

2 2

[PATCH] Build pac responder tests only if pac responder is build
by Sumit Bose 25 Jun '12

25 Jun '12

Hi, the unit tests of the pac responder basically have the same dependencies as the pac responder and should be build only if the pac responder is build as well. bye, Sumit

3 2

[PATCH] Add man page section for the PAC responder
by Sumit Bose 25 Jun '12

25 Jun '12

Hi, the following patch will add a description about the pac responder to the sssd.conf man page. bye, Sumit

2 1

[PATCH] Fix re_expression matching with subdomains
by Jan Zelený 22 Jun '12

22 Jun '12

This patch fixes an issue which resulted in a need to initialize responder with data from local domain, otherwise it would not correctly detect requests for subdomains. Similar situation can occur if new subdomain is added at runtime. The solution is to ask for a list of subdomains in case there is a candidate domain identified in the process of matching re_expressions with given name. Thanks Jan

3 6

[PATCH] UTILS: Fix segfault due to sss_parse_name_for_domains
by Stephen Gallagher 22 Jun '12

22 Jun '12

The recent fixes for per-domain parsing can cause a segfault in the netgroup processing if the domain isn't set to NULL when it's parsed as "any domain". Fixes https://fedorahosted.org/sssd/ticket/1383

2 2

[PATCH] Try to build PAC responder only if all dependencies are available
by Sumit Bose 22 Jun '12

22 Jun '12

Hi, as Stephen found out the provided spec file cannot be used to build sssd with the PAC responder on RHEL5, because samba4 is not available here. This patch takes care that samba4 is not required on RHEL5 and the PAC responder only builds if all dependencies are met, even with --enable-all-experimental-features or similar set. bye, Sumit

2 1

[PATCHES] PAC responder and client
by Jan Zelený 21 Jun '12

21 Jun '12

Sumit sent me his set of patches last Friday. I've done some merges, filled commit messages and other cosmetic adjustments. I've also done initial review and I'm sending my comments: get_rid() doesn't need to be in the header file, it can be static in the module Defining idmap_talloc() and idmap_free() twice, please remove one of them. The condition if (pac_ctx->idmap_ctx == NULL) in domsid_rid_to_uid() will be always false, won't it? If it was NULL, the entire responder would fail way earlier. Missing debug_level initialization in main() in PAC responder pac_save_memberships_next() is missing static in its definition (declaration is ok) pac_save_memberships_recv() is missing static you are not assigning the result to *_pwd in get_pwd_from_pac() Is the TODO in save_pac_user() valid and important? Do we need to address this before pushing the patch set? Nitpick: please use initialization instead of "g = 0;" in get_gids_from_pac() Typo: Remote users are members ... (comment in pac_save_memberships_send()) Please remove the sysdb_search_group_by_gid() call in pac_save_memberships_next(), it is redundant there and can be replaced by checking the return code after calling pac_store_memberships(). You are not freeing pr_ctx in some error cases. The only place pr_ctx is free'd is pac_save_memberships_done(), i.e. only when everything went ok. Please add some talloc_free() calls where necessary. My first guess is that pac_get_domains_done() and pac_add_pac_user() are the only two places where it is necessary. In function local_sid_to_id(): I think another check should be in place: if (rid-remote_min+local_min > local_max) return ERANGE; Sumit, please contact me if you need help with anything. Thanks Jan

4 7

[PATCH][RFC] Fix lack of O_CLOEXEC in open()
by Simo Sorce 21 Jun '12

21 Jun '12

Old platforms like RHEL5 do not have this feature, this is a RFC about the way I propose handling it. Although I generally do not like ifdefs in code and we could alwys use the fctnl method, I would like to avoid the fcntl when the platfroms suport the open options as this will remove 2 system calls. This is because this code is in the client and the cache is a fast path for us, so the less syscalls the faster. It also makes it very easy to remove the code later once we will drop support for things like RHEL5 ... eventually :) Simo. NB. it compiles on F17 but had not way to test it on an actual RHEL5, can someone do that please ? -- Simo Sorce * Red Hat, Inc * New York

2 1

[PATCH] Prevent file descriptor leak in client libs
by Simo Sorce 21 Jun '12

21 Jun '12

It's a one-liner but I sitll would like an ack before pushing. Simo. -- Simo Sorce * Red Hat, Inc * New York

2 1

[PATCH]-Quiet down the startup of sssd
by Ariel Barria 20 Jun '12

20 Jun '12

https://fedorahosted.org/sssd/ticket/1294

4 6

[PATCH] Fix possible segfault in sdap_save_group()
by Jan Zelený 20 Jun '12

20 Jun '12

Discovered by Marko, no ticket filed Thanks Jan

3 2

sssd just 'Aborts' on RHEL5.
by Steve Traylen 20 Jun '12

20 Jun '12

sssd does not want to start for me on RHEL5. # rpm -q sssd sssd-1.5.1-49.el5_8.1 on both RHEL5 and SLC5 results in # /usr/sbin/sssd -i -d 8 Aborted This is both with our sssd.conf which is working fine over on RHEL6 but also for the default sssd.conf that comes with the package. The end of an strace is here: http://pastie.org/4114307 , if I delete the 'var/lib/sss/db/config.ldb file then it is created again before the 'Aborted' happens. Nothing is logged to syslog or sssd.log. Any ideas. Steve.

2 8

[PATCH]-Bad debug message when adding services without explicit dns_discovery_domain
by Ariel Barria 19 Jun '12

19 Jun '12

https://fedorahosted.org/sssd/ticket/920

5 9

[PATCH] Add support for terminating idle connections in sssd_nss
by Stephen Gallagher 18 Jun '12

18 Jun '12

This patch was submitted by Shantanu Goel in a Trac ticket. Sending to the list for review. I haven't yet had a chance to dig into it myself yet, but the concept as described in https://fedorahosted.org/sssd/ticket/1354 is sound, so I'd like to see this get cleaned up and included.

4 13

Announcing SSSD 1.9.0 beta 2
by Stephen Gallagher 18 Jun '12

18 Jun '12

The SSSD team is proud to announce the second beta of our upcoming 1.9.0 release. We have revised our beta plan and will be having five betas instead of three as originally communicated. Originally, the plan was to have our next beta be the final one, at the end of July. We now have the following schedule: Beta 3 will be released next Friday (Jun 22nd) or the following Monday and contain enhancements necessary to support Kerberos cross-realm trusts with FreeIPA, a server-side piece of which will be released a few days after. Beta 4 will be released on July 10th and include a new AD provider (wrapping the intricacies of setting up AD, configuring LDAP attributes and Kerberos realm into a simpler set of configuration options) Beta 5 will be released on July 31st and will contain a new tool for "seeding" accounts with a temporary password for sending machines to remotees as well as introducing a concept of primary vs. secondary servers. After Beta 5, no new features will be added to SSSD 1.9.0 and we will focus on stability and our backlog of bugfixes until the final release around September 1st. We will most likely issue a series of release candidate builds prior to that, but these have not yet been scheduled. As always, you can download the latest sources at https://fedorahosted.org/sssd/ == Highlights == * Add support for the Kerberos DIR cache for storing multiple TGTs automatically * Major performance enhancement when storing large groups in the cache * Major performance enhancement when performing initgroups() against Active Directory * SSSDConfig data file default locations can now be set during configure for easier packaging == Tickets Fixed == https://fedorahosted.org/sssd/ticket/974 [RFE] Support DIR: credential caches for multiple TGT support https://fedorahosted.org/sssd/ticket/984 RFE: sssd should support Netscape LDAP password expiration controls https://fedorahosted.org/sssd/ticket/1213 Warn to syslog when dereference requests fail https://fedorahosted.org/sssd/ticket/1240 sudo: contact data provider only once https://fedorahosted.org/sssd/ticket/1255 RFE: change the way we deal with fake users https://fedorahosted.org/sssd/ticket/1256 Document the expectations about ghost users showing in the lookups https://fedorahosted.org/sssd/ticket/1330 Potential NULL dereference in sss_krb5_read_etypes_for_keytab https://fedorahosted.org/sssd/ticket/1336 Please only use named parameters in translatable strings https://fedorahosted.org/sssd/ticket/1337 Minor typos in SSSD messages and man pages https://fedorahosted.org/sssd/ticket/1346 in-memory cache causes nss to segfault if it cannot be initialized properly https://fedorahosted.org/sssd/ticket/1367 Optimize AD memberOf lookups with LDAP_MATCHING_RULE_IN_CHAIN == Detailed Changelog == Ariel Barria (3): * Potential NULL dereference in proxy provider * Warn to syslog when dereference requests fail * Clarify how comments work in sssd.conf Jakub Hrozek (20): * NSS: keep a pointer to body after body is reallocated * Use sized_string correctly in FQDN domains * Use the sysdb attribute name, not LDAP attribute name * LDAP nested groups: Do not process callback with _post deep in the nested structure * Send 16bit protocol numbers from the sss_client * Revert the client packet length, too, after reverting the packet protocol * Fix the default sssd.conf path * Fix the 0.11 sysdb upgrade * sss_names_init: Report correct error code if allocation failed * Two small krb5_child fixes * Provide more debugging in krb5_child and ldap_child * Allow redefining the KRB5_CHILD path * Split parse_krb5_child_response so it can be reused * Add a krb5_child test tool * Residual util functions * Handle trailing slash in the ccname template * Add a credential cache back end structure * Add support for storing credential caches in the DIR: back end * Use Kerberos context in KRB5_DEBUG * Make krb5_ccname_template and krb5_ccachedir configurable Jan Cholasta (3): * SSH: Update sss_ssh_knownhostsproxy manual page * SSH: Supress error message output in sss_ssh_knownhostsproxy * SSH: Don't abort connection in sss_ssh_knownhostsproxy when DNS records are missing Jan Zeleny (20): * Fixed two minor memory leaks * Fixed issue in SELinux user maps * Ghost members - add the ghost attribute to sysdb * Ghost members - support in LDAP provider * Ghost members - support in proxy provider * Ghost members - modifications in sysdb * Ghost members - modifications in memberof plugin * Ghost members - sysdb upgrade routine * Ghost members - NSS responder changes * Ghost members - removed sdap_check_aliases() * Ghost members - modified sss_groupshow * Ghost members - various small changes * Add support for filtering atributes * Utilize attribute exclusion in LDAP initgroups * Fixed setting of debug level in test suite * IPA subdomains - ask for information about master domain * Allow fast memcache timeout to be configurable * Fix an issue in ghost users * Provide "service filter" for SELinux context * Fixed debug message in sdap_save_group() Joshua Roys (1): * Simple implementation of Netscape password warning expiration control Nick Guay (1): * added DEBUG messages to krb5_child and ldap_child Stef Walter (1): * Make re_expression and full_name_format per domain options Stephen Gallagher (27): * Bumping version ton 1.8.92 for beta 2 development * RPM: Allow running 'make rpms' on RHEL 5 machines * NSS: Expire in-memory netgroup cache before the nowait timeout * Always use positional arguments in translatable strings * KRB5: Avoid NULL-dereference with empty keytab * Update translation sources * NSS: Fix segfault when mmap cache cannot be initialized * NSS: Restore original protocol for getservbyport * SSSDConfig: Make SSSDConfig a package * SSSDConfig: Make default config and schema file locations configurable * PAM: Better pam_reply message * SYSDB: Reduce noise level of debug messages in lookups * LDAP: Remove redundant check * LDAP: Fix incorrect switch statement in sdap_get_initgr_done() * LDAP: Add helper function to get list of a user's groups from sysdb * LDAP: Make sdap_initgr_common_store() non-static * LDAP: Add ldap_*_use_matching_rule_in_chain options * LDAP: Add support for AD chain matching extension in group lookups * LDAP: Add support for AD chain matching extension in initgroups * LDAP: Auto-detect support for the ldap match rule * LDAP: Fix missing variable in debug message * SSS_CLIENT: Fix uninitialized value error * Fix compilation on older little-endian systems * KRB5: Update DEBUG macros for create_ccache_dir and find_ccdir_parent_data * KRB5: Auto-detect DIR cache support in configure * KRB5: Avoid shadowing dirname * Updating translations for 1.9.0 beta 2 release Sumit Bose (4): * Rename struct dom_sid to struct sss_dom_sid * Fix libsss_hbac library version * sss_idmap: add support for samba struct dom_sid * sss_idmap: fix typo which prevents sub auth larger then 2^31 Yuri Chornoivan (1): * Fix typos in message and man pages.

1 1

[PATCH] Conditionalize support for DIR cache in the Kerberos provider
by Stephen Gallagher 15 Jun '12

15 Jun '12

We only support the DIR cache on Kerberos 1.10 and higher. We need to make sure we still build and run on older systems. Patch 0001: Minor fix for building on little-endian RHEL 5 systems. (Building for ppc was broken) Patch 0002: Conditionalize DIR cache

2 7

[PATCH] SSS_CLIENT: Fix uninitialized value error
by Stephen Gallagher 15 Jun '12

15 Jun '12

This would cause a crash if we jump to the done: label before it has been allocated. Pushed to master under the one-liner rule. This same issue was also addressed by Jan's patch "Provide service filter for SELinux context", but only in the 1.8.x branch by mistake.

1 0

[PATCH] LDAP: Fix missing variable in debug message
by Stephen Gallagher 15 Jun '12

15 Jun '12

Pushed to master under the one-liner rule.

1 0

[PATCH] Fixed debug message in sdap_save_group()
by Jan Zelený 15 Jun '12

15 Jun '12

Pushed to master under oneliner rule Jan

1 0

[PATCH] Provide service filter for SELinux context
by Jan Zelený 14 Jun '12

14 Jun '12

At this moment we will support only asterisk, designating "all services". https://fedorahosted.org/sssd/ticket/1360 Thanks Jan

3 6

[PATCH] Support DIR: credential caches
by Jakub Hrozek 14 Jun '12

14 Jun '12

[PATCH 01/11] Two small krb5_child fixes ssia [PATCH 02/11] Provide more debugging in krb5_child and ldap_child I started this patch before Nick did, maybe it would still be useful, at least the parts that get rid of level-9 DEBUG messages. [PATCH 03/11] Allow redefining the KRB5_CHILD path The krb5-child-test will want to run the child from the build directory. [PATCH 04/11] Split parse_krb5_child_response so it can be reused krb5-child-test will be another consumer. It also makes the code more readable by splitting a huge function. [PATCH 05/11] Add a krb5_child test tool https://fedorahosted.org/sssd/ticket/1127 [PATCH 06/11] Residual util functions Kerberos credential caches can be specified by TYPE:RESIDUAL. This pa tch adds a couple of utilities to support parsing if ccache locations, checking types etc. [PATCH 07/11] Handle trailing slash in the ccname template With the DIR cache support, it's perfectly legal to specify a ccname directory that ends with a slash. The create_dir function did not han dle that situation correctly. The unit test is included in the DIR: cache patch, because it uses the cc_dir_create() function. [PATCH 08/11] Add a credential cache back end structure To be able to add support for new credential cache types easily, this patch creates a new structure sss_krb5_cc_be that defines common with a credential cache, such as create, check if used or remove. [PATCH 09/11] Add support for storing credential caches in the DIR: back end https://fedorahosted.org/sssd/ticket/974 Please note that only the TGTs acquired by the krb5_child have changed, the ldap_child still puts its ccache into /var/lib/sss/db. The cc_dir_remove() function is a little odd, I tried to use the krb5 API directly, but I think I found a bug in libkrb5. For a subsidiary cache that does not exist (DIR::/no/such/path), the following code would segfault: krb5_cc_resolve(context, location, &ccache); // returns EOK krberr = krb5_cc_destroy(context, ccache); // KRB5_FCC_NOFILE if (krberr) { if (ccache) krb5_cc_close(context, ccache); // SIGSEGV } [PATCH 10/11] Use Kerberos context in KRB5_DEBUG Passing Kerberos context to sss_krb5_get_error_message will allow us to get better error messages. This patch technically belong earlier, but rebasing would be hard at this point. [PATCH 11/11] Switch Kerberos cache default to DIR Just switches the defaults.

3 12

[PATCH] Fixed subdomain-related issue in re_expression matching
by Jan Zelený 14 Jun '12

14 Jun '12

One part of the matching was to check whether domain part of fully qualified name is a name of a domain or any of its subdomains. The problem is that at the time of first request we don't yet have lists of subdomains. One solution would be to issue a request to data provider, asking for a list of subdomains but mixing subdomain logic with re_expression matching doesn't seem right. Therefore this patch deletes the check for specific domain name, leaving only check for a specific format. Thanks Jan

2 4

[PATCH] Fix an issue in ghost users
by Jan Zelený 13 Jun '12

13 Jun '12

There was an issue with ghost members in nested groups. Consider a scenario with two groups A and B, B being member of A and having some ghost members. In such case SSSD stored both groups, then added membership between them and then added ghost members to the group B. The problem was that adding ghost members to group B didn't propagate these ghost members to group A. This functionality could have been solved by memberof plugin but the logic is far more complicated that changes this patch introduces. The change is simple: add ghost members at the same time as the group is created, even if groups are supposed to be stored in two passes. That way ghost members will be present at the time A -> B membership is created and they will be propagated as expected. I've tested this with plain RFC2307bis and IPA schema, more tests are welcomed. Thanks Jan

2 3

[PATCH] sss_names_init: Report correct error code if allocation failed
by Jakub Hrozek 13 Jun '12

13 Jun '12

I found this when checking my DIR: cache patches with clang.

2 2

[PATCHES][PRELIMINARY] Add support for AD's chain matching filter
by Stephen Gallagher 13 Jun '12

13 Jun '12

This is the second set of patches. These aren't quite ready for a complete review. They are functional, but they need some discussion. These patches attempt to implement https://fedorahosted.org/sssd/ticket/1367. For details on the "magic" filters, see http://msdn.microsoft.com/en-us/library/windows/desktop/aa746475% 28v=vs.85%29.aspx (http://goo.gl/Czjlf if that doesn't come through email well). Patch 0001: Add new option "ldap_use_matching_rule_in_chain". This patch is very incomplete. It only adds the new option. It is missing SSSDConfig API entries and manpages. It is included because it's necessary to test the other two patches. Patch 0002: Add support for the chain matching filter when performing group lookups. This is the contentious patch. It works, but it does not have the performance gain I might have expected. I need to do some re-testing on beefier hardware, but this approach has two major performance downsides compared to the existing approach. 1) The existing approach takes advantage of the ASQ lookup, which (by accident or design on Microsoft's part) ignores the limits on page size per lookup. As a result, we can do a single lookup for all of the users at a particular nesting level. With the match filter, we have to use the paging control and request additional pages (meaning additional round-trips). Net result is that the existing approach is faster for the common case (only one or two nestings). 2) This is the bigger issue, though it may be a flawed test (I'll explain in a moment). In addition to multiple round-trips to the server, each round-trip in my tests was taking between 2x and 3x the time to return. I suspect that this may be due in part to the fact that my target server was a fairly wimpy CPU-and-memory VM, but it does reveal that lookups using this filter against very large groups causes a significantly increased strain on the AD server. With both of those downsides in mind, I'm considering scrapping this portion of the solution. Additional input is welcome. Patch 0003: Add support for the chain matching filter when performing initgroups lookups. This patch is much more performant (due in large part to the fact that in the average case, the set of groups a user belongs to will almost always fall within a single paged search). With this patch, I consistently see 'time id -G <username>' reduced by 50%. That makes this patch a clear performance victory in my mind.

3 21

[PATCHES] Some assorted bugfixes and helpers
by Stephen Gallagher 13 Jun '12

13 Jun '12

Sending patches in two parts. These first five are (I believe) ready for a complete review. I will send three more in a [PRELIMINARY] thread as well, since they require some discussion. Patch 0001: Fix the debug levels for some sysdb user and group lookups. Success was too noisy and failure was not noisy enough. Patch 0002: Remove block of code that appears twice in the same function. Looks like a copy-paste error. Patch 0003: Fix incorrect switch statement in sdap_get_initgr_done() SDAP_SCHEMA_AD needs to be calling sdap_initgr_rfc2307bis_recv(), not sdap_initgr_nested_recv(). By coincidence both recv functions happened to be identical, but if one or the other changed, this would break unexpectedly. Patch 0004: Add helper function to get list of a user's groups from sysdb This is being made into a function so it can be reused in one of the AD patches I'll be sending shortly. Patch 0005: Make sdap_initgr_common_store() non-static Move it to a private header so it can be reused by other initgroups C files. This is being made public so it can be reused in my AD patches.

3 7

[PATCH]-Clarify how comments work in sssd.conf
by Ariel Barria 13 Jun '12

13 Jun '12

https://fedorahosted.org/sssd/ticket/1117

2 2

[PATCH] Per-domain re_expression and full_name_format
by Stef Walter 13 Jun '12

13 Jun '12

In order to support the AD Domain\User style and the more usual kerberos user@realm style, sssd needs per domain re_expression and full_name_format options. Attached is a rough patch implementing per domain qualified user names. When discussing it on IRC we came up with the following plan: In order to prevent conflicts between the regular expressions for different domains, we parse with a domains regular expression and then check that the resulting domain matches that domain's name. It's not clear that we should support 'null-domains' in these regular expressions and sss_parse_name_for_domains(). There's a TODO in the patch to sort this out. It may be that we choose to have callers of sss_parse_name_for_domains() which can accept unqualified user domains use the full input string when parsing into a qualified name fails. In other words, sss_parse_name_for_domains() would not support returning a NULL *domain. The global re_expression and full_name_format options remain as defaults for the domains. This patch is especially important for Samba integration. Samba only allows Domain\User format, with the exception that the slash can be replaced with another character. Cheers, Stef

4 9

Re: [SSSD] Ticket 1374
by Stephen Gallagher 12 Jun '12

12 Jun '12

On Mon, 2012-06-11 at 23:54 -0500, Ariel Barria wrote: > Hi. > Apology, I wanted to ask about ticket 1374. > > What is required is to look for debug so > For Example: > DEBUG(9, ("Checking for DNS timeouts\n")); > and change it so > DEBUG(SSSDBG_TRACE_ALL, ("Checking for DNS timeouts\n")); > > Thanks for you time. > CCing the sssd-devel list so others can chime in if they want to. That's only a small piece of the work. We DO need to replace all of the numeric values with the macro versions. However, the bigger part of this job is going through and verifying that the new macro levels actually make sense. For example, the one you cite above doesn't really belong at SSSDBG_TRACE_ALL. That's probably better at SSSDBG_TRACE_LIBS, unless it's very noisy (would show up in the logs very often). In which case it belongs at SSSDBG_TRACE_INTERNAL. SSSDBG_TRACE_ALL should be reserved for things that are really only used for very specific reasons. Things like the pointer address of an SBUS connection, or similar.

1 0

[PATCH][1.5.x backport] DP: Reorganize memory hierarchy of requests
by Stephen Gallagher 10 Jun '12

10 Jun '12

Backporting this fix to the 1.5.x LTM series. This function alters the memory hierarchy of the be_req to ensure memory safety during shutdown. It creates a spy on the be_cli object so that it will free the be_req if the client is freed. It is generally allocated atop the private data context for the appropriate back-end against which it is being filed. https://fedorahosted.org/sssd/ticket/1226

2 2

[PATCH] Allow fast memcache timeout to be configurable
by Jan Zelený 10 Jun '12

10 Jun '12

https://fedorahosted.org/sssd/ticket/1318 Tested with getent, works fine. Thanks Jan

4 7

[PATCH] IPA subdomains - ask for information about master domain
by Jan Zelený 10 Jun '12

10 Jun '12

This functionality will be utilized by PAC responder once it lands in the master branch. One round of review already done by Sumit. Also the patch has been tested together with the PAC responder. The query is performed only if there is missing information in the cache. That means this should be done only once after restart when cache doesn't exist. All subsequent requests for subdomains won't include the request for master domain. This is done to save time since it is not possible to change this information once IPA server is installed. https://fedorahosted.org/sssd/ticket/1351 Thanks Jan

3 6

[PATCH] PAM: Better pam_reply message
by Stephen Gallagher 10 Jun '12

10 Jun '12

One-liner to make debugging PAM issues easier. It allows us to easily see what result we got back from the provider.

3 4

[PATCH] Fix the 0.11 sysdb upgrade
by Jakub Hrozek 08 Jun '12

08 Jun '12

The block that upgraded the version was at a wrong indentation level, so it never ran if there were no fake users to convert.

2 2

[PATCH] sss_idmap: fix typo which prevents sub auth larger then 2^31
by Sumit Bose 08 Jun '12

08 Jun '12

Hi, I found a missing 'u' in the idmap code. This patch fixes the typo and adds a test. bye, Sumit

3 4

[PATCH] sss_idmap: add support for samba struct dom_sid
by Sumit Bose 08 Jun '12

08 Jun '12

Hi, this patch allows us besides other conversions to convert the dom_sid structure used by samba to strings and back. This structure is used by various samba libraries, but there are no public inferfaces for the conversion. I've seen Simo adding code to the IPA kdb plugin doing these conversions and I need them for the PAC responder as well. So I thought it might be useful to put it in a library. bye, Sumit

3 9

[PATCH] Fix the default sssd.conf path
by Jakub Hrozek 05 Jun '12

05 Jun '12

Sorry, I didn't notice during the review, only when I was triaging Rob's #1363.

2 1

Two factor auth using SSSD
by Erinn Looney-Triggs 04 Jun '12

04 Jun '12

I have for a while had an interest in integrating Google's two factor auth (https://code.google.com/p/google-authenticator/) into my environment. However, the code Google gives is close but not there for a centralized auth setup. Now there are other projects to deal with this like totp-cgi (https://github.com/mricon/totp-cgi) which relies on another PAM module (pam_url). However, it seems to me that SSSD might be an appropriate place for something like this, so I wanted to gather some thoughts on the feasibility of integrating two factor auth into SSSD. Let me lay out my idea here, and open it up to criticism. Essentially Google authenticator uses a shared secret that is held both on the authenticating system and on the device (your cell phone). This shared secret then has a bit of magic run on it (https://tools.ietf.org/html/rfc6238) and if what the user enters and what is computed match, you are good to go. It seems to me that it would be very easy to centrally store this shared secret (as well as some emergency codes that are generated in case you lose your phone) in LDAP then retrieve it using SSSD (thus allowing offline caching). The problem is that the shared secret is, well plain text, and sensitive, I don't know if there are ways to mitigate this or not. Is there a secure storage for something like this? Second question is, would SSSD be an appropriate use of this, and if so, is it easy to work into the PAM stack to have this as a second prompt, e.g. Password: TOTP: Let me know your thoughts, concerns, etc. -Erinn

2 5

[PATCH] Try all KDCs when getting TGT for LDAP (a sssd-1.5 backport)
by Jakub Hrozek 04 Jun '12

04 Jun '12

Attached are patches that backport the fix for #1324 to the sssd-1.5 branch. Patches 1-4 are a dependency - I needed to backport the feature to only resolve a single service once (upstream #1214). The fix for #1324 depends on it both contextually and also users who are hit by #1324 will most likely be hit by #1214, too.

2 2

[PATCH] Fixed setting of debug level in test suite
by Jan Zelený 04 Jun '12

04 Jun '12

No ticket attached, I just found this when trying to track down another issue. Thanks Jan

3 2

sssd 1.8.4 on Debian -- fails with "ldap_result error: [Success]"
by Mantas M. 04 Jun '12

04 Jun '12

I'm trying to configure sssd 1.8.4 on a Debian Sid server to use a LDAP+Kerberos domain, and I'm getting this error in sssd debug log: > [sdap_process_result] (0x0040): ldap_result error: [Success] More context: > [sssd[be[nullroute]]] [set_server_common_status] (0x0100): Marking server 'radian.cluenet.org' as 'name resolved' > [sssd[be[nullroute]]] [be_resolve_server_done] (0x1000): Saving the first resolved server > [sssd[be[nullroute]]] [be_resolve_server_done] (0x0200): Found address for server radian.cluenet.org: [70.85.16.91] TTL 10467 > [sssd[be[nullroute]]] [sdap_uri_callback] (0x0400): Constructed uri 'ldap://radian.cluenet.org' > [sssd[be[nullroute]]] [sss_ldap_init_send] (0x0400): Setting 6 seconds timeout for connecting > [sssd[be[nullroute]]] [sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to [ldap://radian.cluenet.org:389/??base] with fd [19]. > [sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][]. > [sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [*] > [sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [altServer] > [sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [namingContexts] > [sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedControl] > [sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedExtension] > [sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedFeatures] > [sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedLDAPVersion] > [sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [supportedSASLMechanisms] > [sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [defaultNamingContext] > [sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [lastUSN] > [sssd[be[nullroute]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [highestCommittedUSN] > [sssd[be[nullroute]]] [sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set > [sssd[be[nullroute]]] [sdap_get_server_opts_from_rootdse] (0x0200): No known USN scheme is supported by this server! > [sssd[be[nullroute]]] [sdap_get_server_opts_from_rootdse] (0x0200): Will use modification timestamp as usn! > [sssd[be[nullroute]]] [simple_bind_send] (0x0100): Executing simple bind as: (null) > [sssd[be[nullroute]]] [sdap_process_result] (0x0040): ldap_result error: [Success] > [sssd[be[nullroute]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'radian.cluenet.org' as 'not working' > [sssd[be[nullroute]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP' > [sssd[be[nullroute]]] [get_server_status] (0x1000): Status of server 'radian.cluenet.org' is 'name resolved' > [sssd[be[nullroute]]] [get_port_status] (0x1000): Port status of port 389 for server 'radian.cluenet.org' is 'not working' > [sssd[be[nullroute]]] [fo_resolve_service_send] (0x0020): No available servers for service 'LDAP' > [sssd[be[nullroute]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5 > [sssd[be[nullroute]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error]) In other words, it seems to be able to connect, but considers "Success" to be an error... The configuration for the domain is simple, and works on Arch Linux: > [domain/nullroute] > enumerate = false > dns_discovery_domain = nullroute.eu.org > id_provider = ldap > auth_provider = krb5 > ldap_uri = _srv_, ldap://radian.cluenet.org > ldap_search_base = dc=nullroute,dc=eu,dc=org > krb5_realm = NULLROUTE.EU.ORG I'd appreciate any help. -- Mantas Mikulėnas

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel June 2012