August 2013 - sssd-devel - Fedora mailing-lists

[PATCH] nested groups unit test
by Pavel Březina 18 Feb '14

18 Feb '14

Hi, this is the first unit test for nested groups. It covers only the most basic situation when we are trying to resolve one group with no members. Even though it is only one test, the patch set is quite big. This is because it creates the possibility to mock providers related modules. Most of the patches are just a preparation for unit testing providers. Patches 1-5 Moves the code around to reduce number of dependencies. (E.g. you do not want to load fail over when you are testing nested groups.) Patch 6 Mocks basic SDAP interface. Patch 7 Mocks sysdb objects - currently user and rfc2307bis group. You can decide what set of attributes the object should posses. For example, creating a user requires only basedn and name parameter, to construct originalDN and name attributes. The rest is provided by (attrname, value) pairs via variadic function. E.g.: mock_sysdb_user(mem_ctx, basedn, name, SYSDB_UIDNUM, uid, ...) get_attr_type() translates the sysdb attribute name to proper data type. This should be extended as needed. Patch 8 Adds provider tests related common object files and cflags in makefile Patch 9 New macro sss_will_return_always(fn, value). This can be used to mock function data in such way that any call of mock() will return the value. It was just pushed also to cmocka upstream as will_return_always(). Patch 10-11 Unit test. Patch 12 Removes a noisy debug message. I would like to get this reviewed before I continue with more test cases, so the framework is tuned enough. Off topic: I also created new macro called fail_msg, which will make the test fail printing a message. I didn't use this macro in the end, but it made its way to cmocka upstream.

3 10

[PATCH] PROXY: Handle empty GECOS
by Jakub Hrozek 20 Nov '13

20 Nov '13

I found this bug while triaging a customer case with Chris Hudson who ran into the same issue Simo fixed recently in the proxy provider.

2 3

Fix proxy backend initgroups_dyn code
by Simo Sorce 20 Nov '13

20 Nov '13

Tested fix for #2051 and seem to work. However it just occurred to me we may always want to check if pwd.pw_gid is listed in the gids returned and add it if not ? Simo. -- Simo Sorce * Red Hat, Inc * New York

3 5

[PATCH] Add ldap_autofs_map_master_name option
by C. S. 12 Nov '13

12 Nov '13

Add ldap_autofs_map_master_name option so that the auto master map name change be changed from the default auto.master.

3 17

planning the 1.9.6 release
by Jakub Hrozek 18 Sep '13

18 Sep '13

Hi, I've pushed quite a couple of patches to the sssd-1-9 branch lately as part of work on RHEL-6.5. I think it would be nice to use that as basis of 1.9.6 upstream release. Is there anything that the users or developers would like to include in the 1.9.6 ? There are some mmap patches on the list that need pushing to 1.9 but apart from them, I think this is pretty much it. Here is a list of tickets 1.9.6 would fix in the 1.9 branch: * Enabling enumeration causes sssd_be process to utilize 100% of the CPU https://fedorahosted.org/sssd/ticket/1893 * SSSD doesn't display warning for last grace login. https://fedorahosted.org/sssd/ticket/1890 * [RFE] support autoconfiguring SUDO with ipa provider and compat tree https://fedorahosted.org/sssd/ticket/1733 * SUDO is not working for users from trusted AD domain https://fedorahosted.org/sssd/ticket/1912 * getgrnam / getgrgid for large user groups is too slow due to range retrieval functionality https://fedorahosted.org/sssd/ticket/1823 * [RFE] Add support for suppressing group members https://fedorahosted.org/sssd/ticket/1376 * If previous SRV query failed, the next try might not be retried in some cases https://fedorahosted.org/sssd/ticket/1886 * [abrt] sssd-1.10.0-4.fc19.beta1: get_server_status: Process /usr/libexec/sssd/sssd_be was killed by signal 11 (SIGSEGV) https://fedorahosted.org/sssd/ticket/1947 * sssd_be goes to 99% CPU and causes significant login delays when client is under load https://fedorahosted.org/sssd/ticket/1806 * sudoHost mismatch response is incorrect sometimes https://fedorahosted.org/sssd/ticket/1693 * sssd fails to resolve hosts/services once the network is up https://fedorahosted.org/sssd/ticket/1933 * cyclic group memberships may not work depending on order of operations https://fedorahosted.org/sssd/ticket/1846 * sssd fails instead of skipping when a sudo ldap filter returns entries with multiple CNs https://fedorahosted.org/sssd/ticket/2031 * sssd_be crashing with nested ldap groups contain a dangling member https://fedorahosted.org/sssd/ticket/1932 * sss_cache -N/-n should invalidate the hash table in sssd_nss https://fedorahosted.org/sssd/ticket/1759 * SSSD filter out ldap user/group if uid/gid is zero https://fedorahosted.org/sssd/ticket/2005 * SSSD service randomly dies https://fedorahosted.org/sssd/ticket/1980 * SYSV init script should use @sbindir@ https://fedorahosted.org/sssd/ticket/1986 * Enhance sssd init script so that it would source a configuration https://fedorahosted.org/sssd/ticket/1959 * SSSD failover doesn't work if the first DNS server in resolv.conf is unavailable https://fedorahosted.org/sssd/ticket/1966 * resolv-tests failing with memory leak https://fedorahosted.org/sssd/ticket/1899 * sssd_nss terminated with segmentation fault https://fedorahosted.org/sssd/ticket/2018 * unite periodic refresh API https://fedorahosted.org/sssd/ticket/1891 * [RFE] Add a task to the SSSD to periodically refresh cached entries https://fedorahosted.org/sssd/ticket/1713 * passwd returns "Authentication token manipulation error" when entering wrong current password https://fedorahosted.org/sssd/ticket/2029 * Cannot change expired password of an AD user https://fedorahosted.org/sssd/ticket/1827 And here is a complete log of what's currently planned for 1.9.6 (git log --oneline sssd-1_9_5..sssd-1-9): 658e275 print hint about password complexity when new password is rejected f4f0a4c ldap, krb5: More descriptive msg on chpass failure. 261bc18 providers: refresh expired netgroups edbafc2 back end: add refresh expired records periodic task f47934c back end: periodical refresh of expired records API 651ab87 back end: periodic task API 4fda997 mmap_cache: Check if slot and name_ptr are not invalid. 560e2b4 resolv-tests failing with memory leak 8d4485d Set default DNS resolution timeout to 6 seconds. 1e50573 Lower timeout to contact DNS server 7a45875 Add a commit template 230e4e4 init script: source /etc/sysconfig/sssd 60d3b25 Configure SYSV init scripts properly 4a3ad2f Handle too many results from getnetgr. 67771f6 Do not call sss_cmd_done in function check_cache. 5d762a9 MAN: Clarify the min_id/max_id limits further 3678074 NSS: Clear cached netgroups if a request comes in from the sss_cache 845deed NSS: allow removing entries from netgroup hash table f081ea9 LDAP: Fix crash when processing nested groups c487f42 sudo: print better debug message when a rule has multiple cn values a810814 sudo: skip rule on error instead of failing completely e4c8fd0 Every time use permissive control in function memberof_mod. 26df163 Always set port status to neutral when resetting service. ec7fbcd sudo responder: use different callback for oob refresh e7769aa IPA: Do not download or store the member attribute of host groups ab4c050 failover: if expanded server is marked as neutral, invoke srv collapse 5ecdadb collapse_srv_lookup may free the server, make it clear from the API 5e0f0c4 failover: set state->out when meta server remains in SRV_RESOLVE_ERROR 868bf88 Add ignore_group_members option. c13eb93 Adding option to disable retrieving large AD groups. 200d054 Removing unused functions. 2aaa41c sudo responder: use fully qualified name for subdomain users 96db69c SUDO: IPA provider ac77faa Display the last grace warning, too 3896c82 Only try to relink ghost users if we're not enumerating

2 2

[PATCHES] Fix warnings
by Lukas Slebodnik 16 Sep '13

16 Sep '13

ehlo, I tested some patches with old distro and I spotted warnings. -- uninitialized variable (gcc 4.4.7) -- macro AM_PROG_AR not found in library (automake 1.11.1) I checked them and all warnings should be harmless, but anyway we don't like warnings. Two patches are attached. LS

2 7

[PATCHES] KRB: Remove unused function parameters
by Lukas Slebodnik 12 Sep '13

12 Sep '13

ehlo, There are some unused function parameters. I split change to three patches for easier review, but I can squash them to only one patch. LS

3 6

[PATCHES] Enable printf format string checking
by Lukas Slebodnik 11 Sep '13

11 Sep '13

ehlo, It would be great to have enabled printf format string checking in RHEL7. Therefore I decided to send pateches for ticket https://fedorahosted.org/sssd/ticket/1945 Patch 0001 -- Even if this patch is first, it should be applied in upstream as last. Patch 0002 - 0006 -- trivial Patch 0007 -- ssize_t is not defined in ANSI c99, IIRC it is defined in posix as a signed type, therefore format should be used "zd" Patch 0008 -- size_t is defined in ANSI c99 as unzigned type -> "zu" Patch 0009 -- wrapper for inttypes.h and for future format macros. Patch 0012 -- formating types defined in stdint.h uint_32_t ... -- there are used macros defined in inttypes.h Patches 0010 - 0015 fix formating for special variables (key_serial_t, rlim_t...) and for some types I created macros in sss_format.h Patch 0010 -- key_serial_t is typedef of int32_t, but it could be defined differently in another (platforms/ implemantations of kerberos) Patch 0011 -- it seems that rlim_t us the same as uint64_t, but it was defined using conditional build an not a typedef of std types. Patch 0013 -- time_t is defined as "long int" sizeof_i386(time_t) != sizeof_x86_64(time_t) Patch 0014 -- ber_int and ber_tag are typedef for int and unsigned long Patch 0015 -- gid_t and uid_t are typedef as unsigned (I checked linux 32 bit, linu 64_bit and freebsd 64 bit) Patch 0016 -- trivial LS

4 12

[PATCH] DB: Add user/group lookup by SID
by Ondrej Kos 10 Sep '13

10 Sep '13

Hi, Attached patch adds sysdb routine to search users/groups by their SID, which will be needed for ticket 1568. I'm sending it now, because one of the patches I have in this working branch (store group SID) was already written and posted on the list by Sumit, so not to waste time again :) -- Ondrej Kos Associate Software Engineer Identity Management - SSSD Red Hat Czech

2 10

[PATCHES] Remove requests when AD subdomain goes away
by Ondrej Kos 05 Sep '13

05 Sep '13

Hi, Attached are three patches, [PATCH 1/3] Make subdomain refresh period configurable * Adds the ad_subdomain_refresh_period and ipa_subdomain_refresh_period configuration options. This isn't needed to be pushed, but I think it can be beneficial. Also, I needed to write this anyway to work with the refresh. [PATCH 2/3] DP: Store list of back-end tevent requests * Adds every created request to list, and removes every terminated. This is to enable iteration through active requests, to fix the issue addressed in https://fedorahosted.org/sssd/ticket/1968 [PATCH 3/3] Clean list of domain requests * fixes https://fedorahosted.org/sssd/ticket/1968 * Goes through the list of tevent requests introduced in previous patch an those, which match the vanished domain are terminated. Ondra -- Ondrej Kos Associate Software Engineer Identity Management - SSSD Red Hat Czech

2 7

[PATCHES] ad srv: prefer servers that are in the same domain as client
by Pavel Březina 05 Sep '13

05 Sep '13

https://fedorahosted.org/sssd/ticket/2001 There is a bug in underlying resolv_sort_srv_reply(). It sometimes returns less servers than there is on the input. This seems to be related to configuration when two servers has the same priority and weight (0). I haven't found the root cause yet, I'll investigate more.

4 17

[PATCH] Rename SAFEALIGN macros
by Michal Židek 05 Sep '13

05 Sep '13

Hi, about 3 months ago I renamed the SAFEALIGN macros (and added aliases for backward compatibility) from SAFEALIGN_COPY_<type> SAFEALIGN_SET_<type> to SAFEALIGN_BUF2VAR_<type> SAFEALIGN_VAR2BUF_<type> according to request in ticket https://fedorahosted.org/sssd/ticket/1772 But, now I think I used wrong new names for these macros, because the SAFEALIGN_BUF2VAR_<type> is not meant to only copy value from buffer to variable, it can be used the other way around as well (it is basically just memcpy with bytes counting). So the original SAFEALIGN_COPY_<> was IMO much better name for the macro. The second macro SAFEALIGN_VAR2BUF_<type> is used to SET the buffer at given address with specified value. This can be used if the value we copy to buffer is just expression (like 3 + 5), #DEFINEd constant or literal (so we can not get its address with &, so SAFEALIGN_COPY_<type> can not be used). The original name of this macro was SAFEALIGN_SET_<type> which was better than the new one. I wrongly interpreted the macros when creating the new names and realized it now when I wanted to use them. The reason why the name change was requested is most likely because SAFEALIGN_SET_UINT32 might look like it should be used when setting uint32_t variable to a specific value taken from buffer. The parameter 'value' is expression of type uint32_t and not address to some uint32_t value in buffer. Another reason why people might have been confused with the old names was that it was not clear that with SAFEALIGN_SET the 'value' is not a pointer to value but the value itself. I think this was the reason why the ticket was created. So, I would prefer to change the names once again (the new ones are not used anywhere so far) to the original ones with one little difference. The SAFEALIGN_SET_<type> will be SAFEALIGN_SETMEM_<type>. It makes more clear that we want to change memory at given address (and not set some variable of type <type>). With additional comments showing the expected types of all arguments, this should be clear enough and hopefully nobody will be confused in the future. Patch is attached. Thanks Michal

3 11

Question about pam_auth_req and crash from BZ972699
by Lukas Slebodnik 04 Sep '13

04 Sep '13

ehlo, I have a question about struct pam_auth_req and crash from BZ972699 I thought It is a duplicate of upstream ticket https://fedorahosted.org/sssd/ticket/2018 (use after free) But I anlysed the core dump and it doe not look like use after free. I also checked talloc_magic for struct "pam_auth_req" and it is ok. Here is the definition of structure. (gdb) ptype preq type = struct pam_auth_req { struct cli_ctx *cctx; struct sss_domain_info *domain; struct pam_data *pd; pam_dp_callback_t *callback; struct ldb_result *res; _Bool check_provider; void *data; } * And here is output from gdb (gdb) p *preq $1 = {cctx = 0x9f90a0, domain = 0x9a3740, pd = 0xa178f0, callback = 0, res = 0x0, check_provider = false, data = 0x0} #0 0x0000000000000000 in ?? () #1 0x00000000004110d1 in pam_dp_process_reply (pending=0x9d3c00, ptr=<value optimized out>) at src/responder/pam/pamsrv_dp.c:79 #2 0x00007f1aeb0a661a in complete_pending_call_and_unlock ( connection=0xa1e3a0, pending=0x9d3c00, message=<value optimized out>) at dbus-connection.c:2234 #3 0x00007f1aeb0a886f in dbus_connection_dispatch (connection=0xa1e3a0) at dbus-connection.c:4397 #4 0x000000000045425e in sbus_dispatch (ev=0x99d380, te=<value optimized out>, tv=..., data=<value optimized out>) at src/sbus/sssd_dbus_connection.c:104 #5 0x00007f1aeb920bd9 in tevent_common_loop_timer_delay (ev=0x99d380) at ../tevent_timed.c:254 77 dbus_pending_call_unref(pending); 78 dbus_message_unref(msg); 79 preq->callback(preq); <<<<<<< CHASH HERE 80 } 81 sssd_pam crashed because preq->callback was NULL. I would like to describe struct pam_auth_req more deeply. struct pam_auth_req is created in function pam_forwarder form file "src/responder/pam/pamsrv_cmd.c". Most of structure members are initialized in this function, but *calback* is initialized in function pam_dom_forwarder. 1173 if (!NEED_CHECK_PROVIDER(preq->domain->provider)) { 1174 preq->callback = pam_reply; <<<<HERE 1175 ret = LOCAL_pam_handler(preq); 1176 } 1177 else { 1178 preq->callback = pam_reply; <<<<< OR HERE 1179 ret = pam_dp_send_req(preq, SSS_CLI_SOCKET_TIMEOUT/2); 1180 DEBUG(4, ("pam_dp_send_req returned %d\n", ret)); 1181 } 1182 There are 3 places where is pam_dom_forwarder called and it is called only in some condition (pam_check_user_search returned EOK) Mostly it looks like following lines: 852 ret = pam_check_user_search(preq); 853 if (ret == EOK) { 854 pam_dom_forwarder(preq); 855 } And my question are: 1. Do we need to initialize pam_auth_req->callback only in function pam_dom_forwarder? 2. Should we check preq->callback for NULL? 3. Do you have any idea how to reproduce it? I really don't know what is right solution. Thank you very much for any ideas. LS

3 5

[PATCH] Make IPA SELinux provider aware of subdomain users
by Jakub Hrozek 03 Sep '13

03 Sep '13

Hi, attached is a 1.9 version of a fix for https://fedorahosted.org/sssd/ticket/1892. It's not the best looking code but unfortunately in 1.9 there is still the old sysdb API before Simo's refactoring where we need to pass the right sysdb context.

2 3

FreeIPA on Debian
by Dmitri Pal 02 Sep '13

02 Sep '13

Hello, Sorry for cross posting to 4 different lists but it seems that this is the best way to include most of people who might be interested in this discussion. The question of "When FreeIPA will be available on Debian?" has been coming up periodically on the list(s) without any resolution. However it is clear that it would be beneficial for the community and the project. May be it is time to try again? Let us see why it yet has not happened? 1) Some components need to be ported to Debian especially Dogtag and a slew of its new RESTEasy dependencies. This requires time and quite an effort from someone familiar with the domain. 2) The code needs to be changed in installer and potentially in other places as it might have had some Fedorizms blended in 3) Someone needs to own packages in Debian and maintain them, someone with good knowledge of the distro and time to take ownership of about 50 packages. Can we pull it off together this time? Say we plan for some Dogtag and IPA domain experts to work on the port during Nov 13 - Feb 14 and address 1) and 2). Would there be any interest to join forces with them? Would there be anyone to take on item 3) from the list above? -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

5 7

[PATCH] 1.9 backport: SIGCHLD handler: do not call callback when pvt data was freed
by Pavel Březina 30 Aug '13

30 Aug '13

https://fedorahosted.org/sssd/ticket/1992

2 2

override_homedir exception
by Jean-Baptiste Denis 29 Aug '13

29 Aug '13

Hello everydbody, I'm in a situation where I already have an override_homedir statement in my sssd configuration (using ldap) but I'd like to honor the homeDirectory ldap attribute for a (group of eventually) specific user. I can't find any way to achieve that in the ssd version I'm using (1.9.2). Did I miss something ? If not, does it look like a reasonabme RFE ? Regards, Jean-Baptiste

8 27

Announcing SSSD 1.11.0
by Jakub Hrozek 29 Aug '13

29 Aug '13

=== SSSD 1.11.0 === The SSSD team is proud to announce the final release of version 1.11 of the System Security Services Daemon. This release focuses on changes not visible to the end-user. The aim is to support new features used by the forthcoming version 3.3 of FreeIPA and targets supporting legacy (non-SSSD) clients in a setup where the FreeIPA server established a trust relationship with an Active Directory Forest. As always, the source is available from https://fedorahosted.org/sssd. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * This release focuses on changes not visible to the end-user. The aim is to support new features used by the forthcoming version 3.3 of FreeIPA and targets supporting legacy (non-SSSD) clients in a setup where the FreeIPA server established a trust relationship with an Active Directory Forest. - The handling of ID ranges in the providers has been changed to use a plugin interface where each provider can use a different plugin - The libsss_idmap library has been enhanced in several ways such as handling "external mappings" or supporting base RIDs other than 0 - The assumption that subdomain users always have a primary user-private-group (UPG) has been removed - When SSSD is running on the IPA server, it is able to perform lookups for trusted users directly against the AD server using the AD provider lookups including enumeration and site location * The sudo integration was made more robust. SSSD is now able to gracefully handle situations where it is not able to resolve the client host name or sudo rules have multiple name attributes * Several nested group membership bugs were fixed * The PAC responder was made more robust and efficient, modifying existing cache entries instead of always recreating them. * The Kerberos provider now supports the new KEYRING ccache type. This feature depends on yet unreleased libkrb5 and kernel patches. == Packaging changes == * The sssd_pac binary was moved to the IPA and AD provider subpackages from the krb5-common subpackage == Tickets fixed == https://fedorahosted.org/sssd/ticket/1938 [RFE] Add a new call to libsss_idmap to add a new mapping where the first RID is not 0 https://fedorahosted.org/sssd/ticket/1960 [RFE] Add range type for ID mapping in AD to libsss_idmap https://fedorahosted.org/sssd/ticket/1961 [RFE] Add plugin to LDAP provider to find new ranges https://fedorahosted.org/sssd/ticket/1962 [RFE] Integrate AD provider lookup code into IPA subdomain user lookup https://fedorahosted.org/sssd/ticket/1979 [RFE] Add an optional unique range identifier https://fedorahosted.org/sssd/ticket/1993 [RFE] Add a new option to denote server mode https://fedorahosted.org/sssd/ticket/1965 man: document that the default access provider in AD provider is "permit" https://fedorahosted.org/sssd/ticket/1988 [RFE] sss_cache has no option to clear all cached entries of all types https://fedorahosted.org/sssd/ticket/1997 When resolving a SID, search for groups first, then users https://fedorahosted.org/sssd/ticket/1998 sssd-ad man page states that ad_server can be an IP address even though SSSD doesn't support that https://fedorahosted.org/sssd/ticket/2005 SSSD filter out ldap user/group if uid/gid is zero https://fedorahosted.org/sssd/ticket/2009 Disallow or warn if full_name_format is set to a non-default value when IPA server mode is on https://fedorahosted.org/sssd/ticket/2023 AD provider in server mode follows referrals https://fedorahosted.org/sssd/ticket/2025 pysss module linking is broken https://fedorahosted.org/sssd/ticket/1408 It should be possible to use uid/gid defined in AD instead of SIDs https://fedorahosted.org/sssd/ticket/1821 Allow using UIDs and GIDs from AD in trust case https://fedorahosted.org/sssd/ticket/1881 Determine how to map SID to UID/GID based on IdM server configuration https://fedorahosted.org/sssd/ticket/1942 convert enumeration timer to be_ptask https://fedorahosted.org/sssd/ticket/1963 [RFE] Implement or Improve enumeration https://fedorahosted.org/sssd/ticket/1964 [RFE] Enhance IPA SRV plugin to do AD site lookups as well https://fedorahosted.org/sssd/ticket/1996 PAC responder: update cached user object instead of deleting and recreating them https://fedorahosted.org/sssd/ticket/2027 Domain Users memberships removed in subsequent lookups in server_mode https://fedorahosted.org/sssd/ticket/2032 sssd sees gid as 0 for AD trust posix users causing lookup failures https://fedorahosted.org/sssd/ticket/2035 amend the docs of sss_nss_getnamebysid to make it clear it only works for id_provider=ad https://fedorahosted.org/sssd/ticket/2044 Update sssd-ad manpage to reflect "trust between domains in single forest are supported" == Detailed changelog == Alexander Bokovoy (3): * build: fix dependencies for pysss module * pysss: add pysss.getgrouplist(username) * pysss: prevent crashing when group is unresolvable Jakub Hrozek (58): * Updating the version for the 1.10.1 release * Bump version to track 1.11 development * IPA: Add a server mode option * LDAP: Add utility function sdap_copy_map * AD: decouple ad_id_ctx initialization * AD: initialize failover with custom realm, domain and failover service * IPA: Initialize server mode ctx if server mode is on * AD: Move storing sdap_domain for subdomain to generic LDAP code * IPA: Create and remove AD id_ctx for subdomains discovered in server mode * IPA: Look up AD users directly if IPA server mode is on * Updating translations for the 1.11 beta1 release * Bumping the version for the 1.11 beta2 release * RPM: Move sssd_pac to the krb5-common subpackage * DB: sysdb_search_user_by_name: search by both name and alias * LDAP: When resolving a SID, search for groups first, then users * RPM: Require libsss_idmap from sssd-common * MAN: clarify the default access provider for AD * MAN: IP addresss does not work when used for ad_server * MAN: Clarify the min_id/max_id limits further * Remove unused be_ctx->sigchld_ctx * IPA: warn if full_name_format is customized in server mode * AD: Set the bool value same as default value in opts * Fix the default FQDN format * SUDO: realloc with sizeof(uint32_t) when adding uint32_t * KRB5: Do not send PAC in server mode * LDAP: Use domain-specific name where appropriate * Updating translations for the 1.11 beta2 release * Bumping the version for the 1.11 beta3 release * Use GID if subdomain is not MPG * PAM: Check negcache when searching for fully qualified users, too * PAM: Set negcache if user is not found after provider check * Use the correct resolv timeout * Remove unused constant * AD: Use the correct include guard * UTIL: Remove obsolete compat macros * KRB5: Formatting changes * KRB5: Do not log to syslog on each login * MAN: AD provider only supports trusted domains from the same forest * PAC: Skip SIDs that cannot be resolved to domain * IPA: Enable AD sites when in server mode * DB: Update sss_domain_info with new updated data * DB: remove unused realm parameter from sysdb_master_domain_add_info * LDAP: Add enum_{users,groups}_recv to follow the tevent_req style * LDAP: Remove unused constant * LDAP: Move the ldap enum request to its own reusable module * LDAP: Convert enumeration to the ptask API * LDAP: Make cleanup synchronous * LDAP: Make the cleanup task reusable for subdomains * LDAP: Make sdap_id_setup_tasks reusable for subdomains * SYSDB: Store enumerate flag for subdomain * Read enumerate state for subdomains from cache * Add a new option to control subdomain enumeration * IPA: enable enumeration if parent domain enumerates in server mode * NSS: Descend into subdomains if enumerate=true * IPA: Add forgotten declaration * DP: Use the correct type for DBus boolean * Updating translations for the 1.11.0 release * Updating the version for the 1.11.0 release Jim Collins (1): * ldap: only update shadowLastChange when password change is successful Lukas Slebodnik (35): * BUILD: Use pkg-config to detect cmocka * Return right directory name for dircache * Use conditional build for retrieving ccache. * Remove unused function parameter * Every time use permissive control in function memberof_mod. * Fix clang format string warning. * Use functionm ldb_dn_get_linearized to format struct ldb_dn * Add mising argument required by format string * Remove unused memory context from function unpack_authtok * Fix warnings: uninitialized variable * Fix autotols warnings: macro xyz not found in library * Fix possible dereference of a NULL pointer. * Every time release allocated memory in function py_sss_getgrouplist * Prevent using uninitialized "group_name" in done section. * Remove unused memory context * SSH: Ensure that cmd_ctx->name will not be NULL. * Add script make_srpm.sh to dist tarball. * NSS: allow removing entries from netgroup hash table * NSS: Clear cached netgroups if a request comes in from the sss_cache * Enable removing nonexisting dn in sdap_handle_account_info * proxy: Alocate auth tokens in struct authtok_conv * Check whether servername is not empty string. * Remove include recursion * Remove include recursion * Use brackets around macros. * Fix memory leak insss_krb5_get_error_message * mmap_cache: Skip records which doesn't have same hash * mmap_cache: Use stricter check for hash keys. * UTIL: Create new wraper header file sss_endian.h * CLIENT: Fix non gnu sss_strnlen implementation * MONITOR: Move function declaration out of conditional build * UTIL: Explicitly include header file sys/socket.h * MEMBEROF: Remove temporary workaround * IPA_HBAC: Explicitelly include header file time.h * CONFIGURE: Get rid of bashism Michal Zidek (16): * sss_cache: Add option to invalidate all entries * Always set port status to neutral when resetting service. * Missing space in debug message * Remove unused constant. * Set default DNS resolution timeout to 6 seconds. * Lower timeout to contact DNS server * resolv-tests failing with memory leak * ldap, krb5: More descriptive msg on chpass failure. * mmap_cache: Check if slot and name_ptr are not invalid. * mmap_cache: Check data->name value in client code * mmap_cache: Remove triple checks in client code. * mmap_cache: Off by one error. * mmap_cache: Use better checks for corrupted mc in responder * mmap_cache: Store corrupted mmap cache before reset * mmap_cache: Use sss_atomic_write_s instead of write. * pam: Bad debug message format and parameter. Ondrej Kos (9): * Do not copy special files when creating homedir * KRB5_CHILD: Fix handling of get_password return code * Do not try to set password when authtok_length is zero * KRB: Handle empty password gracefully * KRB: Replace multiple calls with variable * TOOLS: Update all services with sss_debuglevel * Clarify that getnamebysid currently works only with ipa/ad id_provider * AD: Cast SASL callbacks to propper type * DP: Notify propperly when removing PAC responder Pavel Březina (13): * remove unused variable * print hint about password complexity when new password is rejected * dyndns timeout test: catch SIGCHLD handler events * SIGCHLD handler: do not call callback when pvt data where freed * Fix netgroup lookup when using fully qualified name * sudo: skip rule on error instead of failing completely * sudo: print better debug message when a rule has multiple cn values * simple access provider: allow fully qualified names * add simple access provider init test * sudo: continue if we are unable to resolve fqdn * sudo: do not fail to store the rule if we can't read usn * sudo: do not strdup usn on ENOENT * sss_packet_grow: correctly pad packet length to 512B Simo Sorce (5): * Add a commit template * sssd_ad: Add hackish workaround for sasl ad_compat * proxy: Allow initgroup to return NOTFOUND * krb5_common: Refactor to use a talloc temp context * BUILD: Remove unnecessary patch and configure opts Stephen Gallagher (14): * Move pre and post scripts to sssd-common * Remove sysv->systemd upgrade routines * Move sssd_pac binary to the IPA and AD providers * Netgroups should ignore the 'use_fully_qualified_names' setting * BUILD: Fix contrib build macros to display warnings * gitignore: Add Eclipse project files to ignore list * KRB5: Add new #define for collection cache types * KRB5: Refactor cc_*_check_existing * KRB5: Only set active and valid on success * KRB5: Add low-level debugging to sss_get_ccache_name_for_principal * KRB5: Remove unnecessary call to become_user() * KRB5: Add support for KEYRING cache type * BUILD: Ignore translations when building RPMs * krb5: Fetch ccname template from krb5.conf Sumit Bose (36): * idmap: allow first RID to be set * idmap: add optional unique range id * idmap: add option to indicate external_mapping * idmap: allow NULL domain sid for external mappings * idmap: add calls to check if ID mapping conforms to ranges * idmap: add sss_idmap_domain_has_algorithmic_mapping * Add cmocka based tests for libsss_idmap * Add now options ldap_min_id and ldap_max_id * SDAP IDMAP: Add configured domain to idmap context * Allow different methods to find new domains for idmapping * Add sdap_idmap_domain_has_algorithmic_mapping() * Replace SDAP_ID_MAPPING checks with sdap_idmap_domain_has_algorithmic_mapping * Add ipa_idmap_init() * Add support for new ipaRangeType attribute * Replace new_subdomain() with find_subdomain_by_name() * IPA: read ranges before subdomains * Save mpg state for subdomains * Read mpg state for subdomains from cache * Fix memory context for a state member * Fix memory context for hash entries * ipa_s2n_get_user_done: free group_attrs as well * ipa_s2n_get_user_done: make sure ALIAS name is lower case * sdap_get_initgr_done: use the right SID to get a GID * sdap_save_user: save original primary GID of subdomain users * fill_initgr: add original primary GID if available * sdap_add_incomplete_groups: use fully qualified name if needed * save_rfc2307bis_user_memberships: use fq names for subdomains * sysdb_add_incomplete_group: store SID string is available * check_cc_validity: make sure _valid is always set * PAC: if user entry already exists keep it * PAC: do not create users with missing GID * PAC: handle non-POSIX groups in cache * PAC: read user DN instead of constructing it * PAC: do not fail if a single group cannot be added/removed * PAC: use SID instead of GID to search for groups * ipa-server-mode: add IPA group memberships to AD users Yuri Chornoivan (1): * Fix two minor typos

3 3

[PATCH] DP: Use the correct type for DBus boolean
by Jakub Hrozek 28 Aug '13

28 Aug '13

An engineer from the BaseOS QE team found out that the SSSD does not work at all on big endian architectures..

3 4

[PATCHES] Improve portability of sssd
by Lukas Slebodnik 28 Aug '13

28 Aug '13

ehlo, Patches are self describing. LS

3 8

[PATCH] IPA: Add forgotten declaration
by Jakub Hrozek 28 Aug '13

28 Aug '13

Pushed as a one-liner. Sorry, I managed to resolve a conflict between mine and Sumit's patch wrong.

2 1

[PATCHES] Enable enumeration and cleanup tasks for subdomains
by Jakub Hrozek 28 Aug '13

28 Aug '13

Hi, the attached patch implements enumeration and cleanup for the IPA server mode and also makes it possible to support enumeration and cleanup for other subdomains in general (we already have a request from one of our users to enumerate trusted AD domains). Some of the changes can also be leveraged to special-case enumeration requests in AD or IPA providers to e.g. download the master domain data before enumerating the domain for the first time. I hope the patches are split well to make it possible to review them easily. The bigger patches usually just move code around.

2 7

[PATCH] DB: Update sss_domain_info with new updated data
by Jakub Hrozek 28 Aug '13

28 Aug '13

There seems to be a logic bug in sysdb_master_domain_add_info(). We first update the domain data with sysdb search results and then update sysdb. I think it should be the other way around.

3 7

[PATCH] ipa-server-mode: add IPA group memberships to AD users
by Sumit Bose 28 Aug '13

28 Aug '13

Hi, currently in ipa-server-mode only the AD groups memberships are available. This patch adds the IPA group memberships to trusted AD users. This patch is missing some unit tests for some of the helper functions. I will send them later, but I didn't want to delay the next release. bye, Sumit

3 15

[PATCHES] mmap_cache: Skip records which doesn't have same hash
by Lukas Slebodnik 28 Aug '13

28 Aug '13

ehlo, detail description in attached patches. LS

4 12

[PATCH] sss_packet_grow: correctly pad packet length to 512B
by Pavel Březina 28 Aug '13

28 Aug '13

https://fedorahosted.org/sssd/ticket/2059

4 4

[PATCH] IPA: Enable AD sites when in server mode
by Jakub Hrozek 28 Aug '13

28 Aug '13

https://fedorahosted.org/sssd/ticket/1964 Currently the AD sites are enabled unconditionally

2 6

[PATCH] 1.5 backport: SIGCHLD handler: do not call callback when pvt data where freed
by Pavel Březina 28 Aug '13

28 Aug '13

https://fedorahosted.org/sssd/ticket/1992

2 4

[PATCH] Removing unused parameter type from sudosrv_get_sudorules_query_cache()
by Lukas Slebodnik 28 Aug '13

28 Aug '13

Hi, this patch should solve ticket https://fedorahosted.org/sssd/ticket/1825 LS

3 5

[PATCH] USe rkb5.conf default for ccache template
by Simo Sorce 28 Aug '13

28 Aug '13

These patches make use of the krb5.conf for setting the default ccache template instead of relying on a pre-configured default set a package build time. The build time parameter is still used as a fallback default if krb5.conf and libkrb5 profile library returns no value. Tested on my machine and works just fine (requires restart of sssd if you change krb5.conf). Simo. -- Simo Sorce * Red Hat, Inc * New York

3 7

[PATCH] BUILD: Ignore translations when building RPMs
by Stephen Gallagher 28 Aug '13

28 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When we're running 'make rpms' for development purposes, the nested call to 'make distdir' ends up forcing an update of the translation pot files. With this patch, we'll automatically ignore them during (S)RPM actions. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlIcwZYACgkQeiVVYja6o6MO0gCcCn9RxJasvLRSpLqg7TaoZWGS vcIAnjOkMMclWiZ3ITywIfUUjIA9AnfS =rZ2/ -----END PGP SIGNATURE-----

3 3

[PATCHES] KRB5: Add support for KEYRING:persistent
by Stephen Gallagher 27 Aug '13

27 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patch 0001: Adds a couple debug messages I found useful to figure out if a bug was in SSSD or libkrb5. Feel free to skip its inclusion if you feel it's unnecessary (it's at log level 9) Patch 0002: KRB5: Remove unnecessary call to become_user() By the time that the create_ccache_in_dir() routine is called, we are already guaranteed to have dropped privileges. This has either happened because we dropped them before the exec() in the normal operation case or because we dropped them explicitly after we completed the TGT validation step if that or FAST is configured. This code is actually completely harmless, since it checks internally to see if we've already dropped privileges before it does so, but it's unnecessary. Patch 0003: KRB5: Add support for KEYRING cache type This is the Big One. This adds support for KEYRING types but notes in sssd-krb5(5) that we only support KEYRING:persistent (this is because the other keyring types may break if validation or FAST are used). Other than that, this patch should be reasonably straightforward. I have tested this code against Simo's preliminary Kerberos patches along with David Howells' kernel patch for persistent keyrings. We hit (and fixed) a couple bugs in krb5. This patch should be safe to put into the upstream master immediately; it does not change any behavior with the existing FILE or DIR cache types. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlIXq/sACgkQeiVVYja6o6NbpQCgr7VL8rYn4pBM6evONUIFLn5m fYwAn3vZg2/Bn8R2RsExD7biknyHidvp =6n94 -----END PGP SIGNATURE-----

2 5

[PATCH] sudo: do not fail to store the rule if we can't read usn
by Pavel Březina 26 Aug '13

26 Aug '13

https://fedorahosted.org/sssd/ticket/2052

2 4

[PATCH] PAC: Skip SIDs that cannot be resolved to domain
by Jakub Hrozek 26 Aug '13

26 Aug '13

Hi, attached is a small patch I prepared when testing the PAC responder patches. In my case, the user was a member of a well-known SID S-1-18-1 which didn't resolve into a domain and all his groups were skipped. I think we should just skip the offending SID and carry on.

2 3

[PATCHES] PAC responder improvements
by Sumit Bose 26 Aug '13

26 Aug '13

Hi, this series of patches contains improvements for the PAC responder related to the support of UIDs and GIDs managed by AD. The first patch is a fix for https://fedorahosted.org/sssd/ticket/1996. The original idea in the ticket was to modify an existing user entry instead of deleting and recreating it. But since the PAC does not contain any useful information which would improve the entry I decided to not touch existing user entries at all and only update the group memberships. Please find details about the other patches in the commit messages. bye, Sumit

2 4

[PATCH] DP: Notify propperly when removing PAC responder
by Ondrej Kos 24 Aug '13

24 Aug '13

Hi, During testing, I noticed, that all responders are logged propperly when being shut down: [sssd[be[DOM]]] [be_client_destructor] (0x0400): Removed PAM client [sssd[be[DOM]]] [be_client_destructor] (0x0400): Removed NSS client But not PAC: [sssd[be[DOM]]] [be_client_destructor] (0x0020): Unknown client removed ... Attached patch adds pac_cli pointer, to fix this behavior. Ondra -- Ondrej Kos Associate Software Engineer Identity Management - SSSD Red Hat Czech

3 6

[PATCH] check_cc_validity: make sure _valid is always set
by Sumit Bose 24 Aug '13

24 Aug '13

Hi, this patch fixes a compiler warning in the latest master. bye, Sumit

3 4

[PATCH] MAN: AD provider only supports trusted domains from the same forest
by Jakub Hrozek 24 Aug '13

24 Aug '13

https://fedorahosted.org/sssd/ticket/2044

2 2

[PATCH] pam: Bad debug message format and parameter.
by Michal Židek 22 Aug '13

22 Aug '13

Simple patch attached. Thanks Michal PS: We should really push the patches that Lukas wrote to prevent this kind of errors. It is in thread: [SSSD] [PATCHES] Enable printf format string checking With them, we will get warning if do the same mistake in the future.

3 3

[PATCHES] Fix warnings generated by static analysers
by Lukas Slebodnik 22 Aug '13

22 Aug '13

ehlo, Patches are attached. Comment to patch 0001 dp_refresh.h and dp_ptask contain comment "/* solve circular dependency */" and forward declaration of some structures was after this comment. But circular dependency was there. LS

2 2

[PATCH] mmap_cache: Store corrupted mmap cache before reset
by Michal Židek 22 Aug '13

22 Aug '13

Hello, I think it could be useful to store the corrupted memory cache before reset. We have very little info about what was really wrong in the cache when it was in inconsistent state. This way we could ask users to send us copy of the corrupted cache if they hit this issue. It could provide some more answers. Patch is attached. It stores the corrupted cache in /var/lib/sss/mc/<cache_name>_corrupted. Thanks Michal

4 18

[PATCHES] Minor buildsystem patches
by Stephen Gallagher 22 Aug '13

22 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patch 0001: Add Eclipse project files to the .gitignore Some of us use Eclipse as a code editor and would prefer not to see the project files in 'git status' Patch 0002: Fix contrib build macros to display warnings There was an inconsistency with how the warnings were specified and how they were consumed by the macros. The result was that warnings were hidden. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlIWHWgACgkQeiVVYja6o6M3SwCfXSKUgaT0H5huoWYAUWM+lkDn 680An2FoKu5kxFD5PoL8nnOMU5IcSMhE =T734 -----END PGP SIGNATURE-----

2 2

[PATCH] KRB5: Add new #define for collection cache types
by Stephen Gallagher 22 Aug '13

22 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Kerberos now supports multiple types of collection caches, not just DIR: caches. We should add a macro for generic collection behavior and use that where appropriate. Since the execution path is the same for all collection types, it made sense to convert the existing usages of HAVE_KRB5_DIRCACHE to HAVE_KRB5_CC_COLLECTION instead. This patch applies atop the two patches in the thread "[PATCH] KRB5: Refactor cc_*_check_existing" and is a precursor to upcoming patches for supporting the KEYRING cache type. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlIWHjQACgkQeiVVYja6o6Mq9wCfXwRjbw35m2HXnP++OegleJoH 2+AAoJukrkpRk2PJ/90EyfYcxu2Fima6 =XAYG -----END PGP SIGNATURE-----

2 2

[PATCH] KRB5: Refactor cc_*_check_existing
by Stephen Gallagher 22 Aug '13

22 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 There was duplicated code in cc_file_check_existing() and in cc_dir_check_existing(). I pulled them into the same function. There are two changes made to the original code here: 1) Fixes a use-after-free bug in cc_file_check_existing(). In the original code, we called krb5_free_context() and then used that context immediately after that in krb5_cc_close(). This patch corrects the ordering 2) The krb5_cc_resolve() call handles KRB5_FCC_NOFILE for all cache types. Previously, this was only handled for DIR caches. This second part I need someone with Kerberos knowledge to verify. Is there a risk of receiving this error for the FILE or KEYRING types, and if so is this handling still acceptable or should they be special-cased? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlIM+LYACgkQeiVVYja6o6MNjACfSxhKZIq3nr9YSG3lro9kKQ2A zIIAni3Px6SSQ9CU/x3ltMW2VTJ1Scan =pTjc -----END PGP SIGNATURE-----

4 6

[PATCH] Use conditional build for retrieving ccache.
by Lukas Slebodnik 22 Aug '13

22 Aug '13

ehlo, Sumit wrote me yesterday, that some krb5 functions in get_ccache_name_by_principal needn't be available in older version of libkrb5. We noticed that this function is very similar to another function get_ccache_for_princ and there was used conditional build. Refactoring patch is attached. LS

2 5

[PATCH] mmap_cache: Use prime muber for size of hash table.
by Lukas Slebodnik 20 Aug '13

20 Aug '13

ehlo, yet another patch to improve mmap_cache. LS

3 3

[PATCHES] Fixes and improvements for ipa_server_mode
by Sumit Bose 19 Aug '13

19 Aug '13

Hi, I wrote the following patches while testig the ipa_server_mode. While the first three are needed fixes the fourth patch is an improvement which might help to avoid an additional request to the LDAP server. bye, Sumit

2 3

[PATCH] sudo: continue if we are unable to resolve fqdn
by Pavel Březina 19 Aug '13

19 Aug '13

https://fedorahosted.org/sssd/ticket/2043

3 2

Re: [SSSD] [PATCH] mmap_cache: Check data->name value in client code
by Simo Sorce 19 Aug '13

19 Aug '13

On Tue, 2013-08-13 at 19:42 +0200, Michal Židek wrote: > Thanks for the review Simo. > > On 08/12/2013 11:07 PM, Simo Sorce wrote: > > What you need to check is somehing like: > > if (data->name > offsetof(struct sss_mc_pwd_data, strs) + > > data->strs_len) { return ENOENT; } > > > > ... except you should probably not trust strs_len entirely at this point > > if you are trying to catch malformed data and you should also check that > > data + strs_len is within the mmaped memory region. > > > > Ok. The new check tests if data + strs_len is in the data_table > (if it is somewhere else in the mmaped region it is already corrupted). Sure. > > Also at this point it may make sense to do a strlen(name) upfront and > > check that strs_len > name and return immediately if not. > > > > I added this one check too... I think it is not bad to have another > line of defense. Thanks. > Btw. I think we have off-by-one error in cases where we use pattern: > if (slot > MC_SIZE_TO_SLOTS(data_table_size) { > return something (ENOENT/NULL); > } > > If the slots are numbered from 0 and MC_SIZE_TO_SLOTS returns > number of slots needed to store some amount of data, there should > be '>=' no '>'. Please check my thinking. If I am correct then the > second patch should fix it. Let's look at MC_SIZE_TO_SLOTS() definition: We always add (MC_SLOT_SIZE -1) to the requested size. This means if you ask 1 byte you get 1 slot, if you ask for MC_SLOT_SIZE + 1 you get 2 slots. Ie you get the right number of slots required for the size when you call that macro. So yeah good catch! However I think I'd like to see this fixed in a different way, by using a macro as we use this check elsewhere. Something like: #define MC_SLOT_WITHIN_BOUNDS(slot, size) \ (slot <= (size / MC_SLOT_SIZE)) and change the check to: if (!MC_SLOT_WITHIN_BOUNDS(slot, mcc->dt_size)) { ... This would be more error proof if someone should add code in future to check bounds. > I also removed the triple check at Lukas's request in the second > patch, since it modifies the same parts already). I would prefer this to be done in a separate patch please. Simo. -- Simo Sorce * Red Hat, Inc * New York

4 15

ssh client correctly denied access but sees "connection closed by IP"
by Sophit4 19 Aug '13

19 Aug '13

SSH Server is running on a RHEL 6.4 system with version sssd-1.9.2-82.7.el6_4.x86_64. I'm using access_provider = ldap in sssd.conf and ldap_access_filter = memberOf=cn=GoodUsers,ou=x,ou=y,o=z This is working as intended but remote ssh users not in group GoodUsers are simply disconnected with no error message after successfully authenticating via authorized_keys or LDAP password. Is there a way to better inform the end user the general reason for the disconnect? Current behavior: [usr1@test-client Desktop]$ ssh test-server *Connection closed by* 192.168.1.22 [root@test-server ~]# tail -1 /var/log/secure Aug 15 11:40:20 test-server sshd[5562]: *fatal*: Access denied for user usr1 by PAM account configuration Thanks in advance.

4 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2013