Announcing SSSD 1.9.0 beta 6
by Jakub Hrozek
The SSSD team is proud to announce the last preview release of version
1.9 of the System Security Services Daemon.
After this beta, no new features will be added to SSSD 1.9.0 and we will
focus on stability and our backlog of bugfixes until the final release
around September 1st. We might be releasing a release candidate prior to
that date, but we haven't scheduled one for a particular date yet.
Because this is the last beta before the feature freeze, we have also
entered the string freeze for the 1.9.0 release.
As always, you can download the latest sources at
https://fedorahosted.org/sssd/
== Highlights ==
* A new option, override_shell was added. If this option is set, all
users managed by SSSD will have their shell set to its value.
* Many fixes for the support for setting default SELinux user context
from FreeIPA. Most notably, the SELinux mappings can now link to HBAC
rules as the source of users and hosts they apply to.
* Fixed a regression introduced in beta 5 that prevented LDAP SASL binds
from working unless the value of ldap_sasl_minssf was explicitly specified.
* The SSSD supports the concept of a Primary Server and a Back Up
Server. Certain servers in the fail over list can be marked as back up
only. If the SSSD switches to a back up server because a primary server
is not available, it would later try to re-establish a connection to the
primary server. This feature would mainly benefit users who configure
fail over servers from different data centers or geographies.
* A new command-line tool sss_seed is available. This tool is able to
prime the internal cache with a user record and a cached password to
support the scenario when a user needs to log in to the client before
the network connection to the centralized identity source is established,
such as the first log in to a new machine.
* In scenarios, where the SSSD is acting as an IPA client, it is able to
discover and save the DNS domain-Kerberos realm mappings between an IPA
server and a trusted Active Directory server.
== Packaging Changes ==
* a new binary, called sss_seed is available. The binary is installed to
/usr/sbin/sss_seed by default and includes its own manual page.
* The SSSD uses a new directory to store the DNS domain - Kerberos realm
mappings. The default location is /var/lib/sss/pubconf/krb5.include.d
== Tickets Fixed ==
https://fedorahosted.org/sssd/ticket/904
Create tool to seed a user for first-boot
https://fedorahosted.org/sssd/ticket/1087
RFE: Allow Forcing User Shell
https://fedorahosted.org/sssd/ticket/1128
Introduce the concept of a Primary Server in SSSD
https://fedorahosted.org/sssd/ticket/1185
[Feature] AD Extensions
https://fedorahosted.org/sssd/ticket/1318
RFE: make the NSS memory cache timeout configurable
https://fedorahosted.org/sssd/ticket/1368
Missing hostid and subdomains sections in sssd-ipa.conf
https://fedorahosted.org/sssd/ticket/1380
domain_realm mappings manipulation by sssd
https://fedorahosted.org/sssd/ticket/1418
document how sudo works with sssd
https://fedorahosted.org/sssd/ticket/1420
sudo: provide automatic configuration of machine hostnames
https://fedorahosted.org/sssd/ticket/1427
Don't refersh HBAC rules when looking up SELinux rules
https://fedorahosted.org/sssd/ticket/1429
IPA session code returns error when SELinux mapping rule links to an HBAC rule
https://fedorahosted.org/sssd/ticket/1432
Mention AD Provider in manpage of sssd.conf
https://fedorahosted.org/sssd/ticket/1433
Suggested additions to manpage of sssd-ad
https://fedorahosted.org/sssd/ticket/1435
SELinux specifity does not work with HBAC rules
https://fedorahosted.org/sssd/ticket/1439
sss_pam needs to write out SELinux login file during the account phase
https://fedorahosted.org/sssd/ticket/1445
The SELinux login file needs to be created by the responder, not PAM module
== Detailed Changelog ==
Jakub Hrozek (6):
* Bumping version to 1.9.0 beta 6
* Fix sysdb_search_selinux_usermap_by_username return value
* Fix SSSDConfigTest
* Fix bad check
* Create a domain-realm mapping for krb5.conf to be included
* Update translations for 1.9.0 beta 6 release
Jan Zeleny (25):
* Added some DEBUG statements into SELinux related code
* Extend category support in SELinux user maps
* Remove ipa_selinux_map_merge()
* Fix linking of HBAC rules and SELinux user maps
* Provide counter of possible matches in SELinux IPA provider
* Always free request in data provider PAM callback
* Renamed session provider to selinux provider
* Move SELinux processing from session to account PAM stack
* Remove unused member of be_req
* Write SELinux config files in responder instead of PAM module
* Modify hbac_get_cached_rules() so it can be used outside of HBAC code
* Support fetching of HBAC rules from sysdb in SELinux code
* Support fetching of host from sysdb in SELinux code
* Primary server support: introduce concept of reconnection
* Primary server support: basic support in failover code
* Primary server support: support for "disconnecting" connections in LDAP
* Primary server support: IPA adaptation
* Primary server support: krb5 adaptation
* Primary server support: LDAP adaptation
* Primary server support: AD adaptation
* Primary server support: man page, failover section
* Primary server support: new option in ldap provider
* Primary server support: new options in krb5 provider
* Primary server support: new option in IPA provider
* Primary server support: new option in AD provider
Michal Zidek (1):
* Added unit test for sysdb_ssh.c
Nick Guay (1):
* First-boot sss_seed tool
Pavel Březina (7):
* sdap_sudo.c: add missing end of line in few debug messages
* add hostid and subdomains sections in sssd-ipa.conf
* manpage: seealso - include ssh conditionally
* tests: allow changing cwd in all tests
* manpage: sssd-sudo - documents how sudo works with sssd
* sudo ldap provider: support autoconfiguration of hostnames
* Unbreak SASL
Simo Sorce (16):
* Change subdomain_info
* tests: Remove useless consts
* 80 columns police
* Fix double semi-colons
* Fix wrong elements used in comparison
* Use ldb_msg_add_string with bare strings
* Fix return error and debug message
* Make structure initializer more readable
* 80 col and style fixes
* Use a more tractable name for subdomain request
* Add realm paramter to subdomain list
* Expose an initializer function from subdomain
* Change refreshing of subdomains
* Limit refreshes keeping track of last refresh time
* Add online callback to enumerate subdomains
* Add automatic periodic retrieval of subdomains
Stephen Gallagher (4):
* MAN: List all available backends for provider options
* MAN: Improvements to the AD provider manpage
* NSS: Add override_shell option
* SYSDB: Add log message for unexpected LDB errors
Ville Skyttä (1):
* Require and call ldconfig from subpackages if appropriate
11 years, 9 months
[PATCH][SET] Cleanups and subdomain refactoring
by Simo Sorce
As aprt of the work for ticket #1380 I have created a long patchset that
cleans up and refactors some of the ipa subdomain work.
This is in order to be able to refresh subdomains on a periodic basis
and not just when the nss service pings in and also to provide a place
where to trigger an update of the krb5.conf file only when necessary.
The patchset is long (16 patches) but each patch should be small enough
to be easy to review.
The patches have been partially tested, the internal sysdb tests pass,
and I did test on a setup environment, but the setup env was not up to
date, so the test was not complete.
However I am confident that they should work (last famous word) and I am
posting them so that Jakub can take over the second part of the work and
add the code that actually saves the domain_realm info in a file.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
11 years, 9 months
[PATCH] Create a domain-realm mapping for krb5.conf to be included
by Jakub Hrozek
When new subdomains are discovered, the SSSD creates a file that
includes the domain-realm mappings. This file can in turn be included in
the krb5.conf using the includedir directive, such as:
includedir /var/lib/sss/pubconf/realm_mappings
The other part of the work is changing ipa-client such that the above
line is added to krb5.conf when the client is installed.
11 years, 9 months
[PATCH] First Boot Seed Tool
by Nick Guay
This tool is used to seed the cache with user information and a
temporary password if the system does not have direct connectivity to a
IPA/AD/LDAP provider at first boot. It requires a username and domain to
be specified, and the corresponding domain must be configured in sssd.conf.
https://fedorahosted.org/sssd/ticket/904
11 years, 9 months
Re: [SSSD] [PATCH] Added unit test for sysdb_ssh.c
by Jan Zelený
Adding sssd-devel list back to CC
Dne čtvrtek 26 července 2012 18:14:40, Michal Zidek napsal(a):
> On 07/26/2012 02:25 PM, Jan Zelený wrote:
> > Dne středa 25 července 2012 13:21:01, Michal Zidek napsal(a):
> >> Unit test for src/db/sysdb_ssh.c
> >
> > Nack,
> > you are cleaning the directory TESTS_PATH but what if the directory
> > existed
> > (and maybe wasn't empty) before? The least you should do is to exclude the
> > return code from ret variable.
>
> The TESTS_PATH directory is created only for this unit test needs (it is
> actually tests_sysdb_ssh
> directory). If this directory existed before (unlikely, but possible)
> and contains files other than
> tests_conf.ldb and sssd.ldb, then those will remain untouched (rmdir
> syscall only removes empty
> directories). However, if the file existed before and contained files
> with the same names, then these
> will be overwritten, but I don't think this is a big problem because
> such files are probably only garbage
> from previous unfinished tests where the clean_up function was not
> called (because of segfault or
> something). And unlink and rmdir only returns 0 or -1, so I think it is
> OK to test them the way I did (it
> saves some lines of code).
Ok, I have no big problem with this.
> > Please use the SSSD_MAIN_OPTS macro in the variable long_options instead
> > defining the debug-level manually there?
> >
> > An important code-style comment: please declare all variables at the
> > beginning of functions. There are only a handful exceptions of this rule
> > in the code.
> >
> > Nitpick: you are missing space before SYSDB_OBJECTCLASS in
> > store_one_host_test()
> >
> > Consider checking results of all functions (for example function like
> > talloc_strdup(), talloc_zero(), sysdb_attrs_add_string(), ...) or at least
> > those on which something else is depending (like allocation of structures)
> > so we don't get segfaults. I'm not stating this as a hard requirement
> > sice we don't have it in most of places in sysdb test suite, but it would
> > be nice to make the coding style a little bit more defensive.
> >
> > In delete_nonexisting_host_test():
> > nonexisting -> nonexistent
> > Deleting -> Deletion
> >
> >
> > Other than that the patch is ok.
> >
> > Thanks
> > Jan
>
> Thanks. New patch attached.
Just two more minor things:
src/tests/sysdb_ssh-tests.c: In function ‘main’:
src/tests/sysdb_ssh-tests.c:409:9: warning: unused variable ‘debug’ [-Wunused-
variable]
Bad indentation level on line 285 of the patch.
Thanks
Jan
11 years, 9 months
[PRELIMINARY][PATCHES] Primary server support in SSSD
by Jan Zelený
Hi everybody,
I'm sending some patches which implement the primary server support as I see
it. It it based on comment #6 in the related ticket
https://fedorahosted.org/sssd/ticket/1128
Patch #0001 basically adds the necessary support in failover code
Patches #0002 - #0004 extend this support in each provider
Patch #0005 documents the new concept in failover section in man pages
Patches #0006 - #0008 add new options for each provider which utilize this
concept.
Just briefly about the approach. When adding a new server to the list of
servers related to a service, each server can be marked either as primary or
secondary.
When selecting new server from failover list, the algorithm iterates over the
list twice - first it tries to look for primary server and if none is found, it
tries also secondary server.
If a server is returned from failover, and it is not primary server, a timeout
is set (currently hard-coded for 30 seconds) for primary server lookup. This
timeout is rescheduled until a primary server is found. If a primary server
(either working or neutral) is found after this timeout, status of the backend
is reset, i.e. first all offline and then all online callbacks are called. This
is done to interrupt connection to the secondary server in favor of new
connection to a primary server.
I have just couple concerns about things which I have yet to inspect. First of
all when connection to the old server is interrupted, what if an operation is
currently in progress on this connection? I know ticket #1027 induces similar
scenario. Maybe to kill two birds with one stone I could design an extension
to immediately invoke callbacks of all operations running on existing
connection. What do you think about that?
My second concern is about port status timeout. After some time a port is
marked as neutral if originally marked as not-working. That effectively leads
to second attempt to primary server reconnection being successful even though
the server is still not running. As a result, an unnecessary reconnection to
secondary server is performed once some data are needed from the server.
Thank you very much for your opinions on this
Jan
11 years, 9 months
