sssd-devel September 2014

sssd-devel@lists.fedorahosted.org

23 participants
95 discussions

[PATCH TRIVIAL] CI: Don't say Valgrind is ignored in README.md
by Nikolai Kondrashov 25 Sep '14

25 Sep '14

Hi everyone, I forgot to remove the note about Valgrind being ignored from CI's README.md when enforcing the Valgrind check. The attached patch fixes that. Nick

3 2

[PATCH] IPA: Use GC for group lookups in server mode
by Jakub Hrozek 25 Sep '14

25 Sep '14

Hi, the attached patch enables cross-domain group lookups. Even though AD trusts often work with POSIX attributes which are normally not replicated to GC, our group lookups are smart since commit 008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using the LDAP connection and only use the GC connection to look up the members. I tested the patch with trusts that use ID-mapping, there the cross-domain memberships are resolved fine. For setups that use POSIX mapping, only the members from the domain that the group belongs to is visible -- that is because the AD back end currently tests if POSIX attributes are in use and if they are, GC support is completely disabled. Perhaps this is something to work on in 1.13 when we refactor the group membership, but for now I'd like to keep the patch (and associated risk) minimal.

2 2

[PATCH] TESTS: Add a unit test for matching the secondary objectclass
by Jakub Hrozek 25 Sep '14

25 Sep '14

I promised Michal to write a unit test for the alternative objectclass matching, because friends don't let friends commit a feature without tests.

2 3

[PATCH] UTIL: Do not change SSSD domains in get_domains_head
by Stephen Gallagher 25 Sep '14

25 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When there was more than one SSSD domain configured, actions performed against domains later in the list would be incorrectly told to use the first domain as the base for locating subdomains. This was because we were rewinding the ->prev list on the sss_domain_info object, which is only intended to be used by confdb code. The correct approach was to use only the parent linkage, which would take us up to the top-level domain in this SSSD domain. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQi3YEACgkQeiVVYja6o6PqAACgjb4ISPCELnMMBIoKKHX/tj8r UdgAmQHRTCMC0BQo8oBlFy4ZKNj1gshs =AaTR -----END PGP SIGNATURE-----

3 2

[PATCH] PAM: Add domains= option to pam_sss
by Daniel Gollub 22 Sep '14

22 Sep '14

Fixes: https://fedorahosted.org/sssd/ticket/1021 Signed-off-by: Daniel Gollub <dgollub(a)brocade.com> Reviewed-by: Sven-Thorsten Dietrich <sven(a)brocade.com> --- src/providers/data_provider.h | 1 + src/responder/pam/pamsrv_cmd.c | 44 +++++++++++++++++++++++++++++++++++++++++- src/sss_client/pam_sss.c | 29 ++++++++++++++++++++++++++-- src/sss_client/sss_cli.h | 1 + 4 files changed, 72 insertions(+), 3 deletions(-) diff --git a/src/providers/data_provider.h b/src/providers/data_provider.h index ebb4fad..0abfd0f 100644 --- a/src/providers/data_provider.h +++ b/src/providers/data_provider.h @@ -170,6 +170,7 @@ struct pam_data { char *tty; char *ruser; char *rhost; + char **requested_domains; struct sss_auth_token *authtok; struct sss_auth_token *newauthtok; uint32_t cli_pid; diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c index 140d541..c6539e5 100644 --- a/src/responder/pam/pamsrv_cmd.c +++ b/src/responder/pam/pamsrv_cmd.c @@ -44,6 +44,26 @@ enum pam_verbosity { static void pam_reply(struct pam_auth_req *preq); +static bool is_domain_requested(struct pam_data *pd, const char *domain_name) +{ + int i; + + /* If none specific domains got requested via pam, all domains are allowed. + * Which mimics the default/original behaviour. + */ + if (!pd->requested_domains) + return true; + + for (i = 0; pd->requested_domains[i]; i++) { + if (strcmp(domain_name, pd->requested_domains[i])) + continue; + + return true; + } + + return false; +} + static int extract_authtok_v2(struct sss_auth_token *tok, size_t data_size, uint8_t *body, size_t blen, size_t *c) @@ -146,6 +166,7 @@ static int pam_parse_in_data_v2(struct sss_domain_info *domains, int ret; uint32_t start; uint32_t terminator; + char *requested_domains; if (blen < 4*sizeof(uint32_t)+2) { DEBUG(SSSDBG_CRIT_FAILURE, "Received data is invalid.\n"); @@ -202,6 +223,16 @@ static int pam_parse_in_data_v2(struct sss_domain_info *domains, ret = extract_string(&pd->rhost, size, body, blen, &c); if (ret != EOK) return ret; break; + case SSS_PAM_ITEM_REQUESTED_DOMAINS: + ret = extract_string(&requested_domains, size, body, blen, &c); + if (ret != EOK) return ret; + ret = split_on_separator(pd, requested_domains, ',', true, true, + &pd->requested_domains, NULL); + if (ret != EOK) { + DEBUG(1, ("Failed to parse requested_domains list!\n")); + return ret; + } + break; case SSS_PAM_ITEM_CLI_PID: ret = extract_uint32_t(&pd->cli_pid, size, body, blen, &c); @@ -836,12 +867,22 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd) ret = ENOENT; goto done; } + + /* skip this domain if not requested */ + if (!is_domain_requested(pd, dom->name)) { + ret = ENOENT; + goto done; + } } else { for (dom = preq->cctx->rctx->domains; dom; dom = get_next_domain(dom, false)) { if (dom->fqnames) continue; + /* skip this domain if not requested */ + if (!is_domain_requested(pd, dom->name)) + continue; + ncret = sss_ncache_check_user(pctx->ncache, pctx->neg_timeout, dom, pd->user); if (ncret == ENOENT) { @@ -856,7 +897,8 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd) "User [%s@%s] filtered out (negative cache). " "Trying next domain.\n", pd->user, dom->name); } - if (!dom) { + + if (!dom || !is_domain_requested(pd, dom->name)) { ret = ENOENT; goto done; } diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c index d2502d1..4d76bd2 100644 --- a/src/sss_client/pam_sss.c +++ b/src/sss_client/pam_sss.c @@ -58,6 +58,7 @@ #define PW_RESET_MSG_MAX_SIZE 4096 #define OPT_RETRY_KEY "retry=" +#define OPT_DOMAINS_KEY "domains=" struct pam_items { const char* pam_service; @@ -81,6 +82,8 @@ struct pam_items { pid_t cli_pid; const char *login_name; char *domain_name; + const char *requested_domains; + size_t requested_domains_size; }; #define DEBUG_MGS_LEN 1024 @@ -246,6 +249,9 @@ static int pack_message_v3(struct pam_items *pi, size_t *size, len += pi->pam_newauthtok != NULL ? 3*sizeof(uint32_t) + pi->pam_newauthtok_size : 0; len += 3*sizeof(uint32_t); /* cli_pid */ + len += *pi->requested_domains != '\0' ? + 2*sizeof(uint32_t) + pi->requested_domains_size : 0; + buf = malloc(len); if (buf == NULL) { @@ -271,6 +277,9 @@ static int pack_message_v3(struct pam_items *pi, size_t *size, rp += add_string_item(SSS_PAM_ITEM_RHOST, pi->pam_rhost, pi->pam_rhost_size, &buf[rp]); + rp += add_string_item(SSS_PAM_ITEM_REQUESTED_DOMAINS, pi->requested_domains, pi->requested_domains_size, + &buf[rp]); + rp += add_uint32_t_item(SSS_PAM_ITEM_CLI_PID, (uint32_t) pi->cli_pid, &buf[rp]); @@ -1061,6 +1070,9 @@ static int get_pam_items(pam_handle_t *pamh, struct pam_items *pi) pi->domain_name = NULL; + if (pi->requested_domains == NULL) pi->requested_domains=""; + pi->requested_domains_size=strlen(pi->requested_domains)+1; + return PAM_SUCCESS; } @@ -1080,6 +1092,7 @@ static void print_pam_items(struct pam_items *pi) D(("Authtok: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_authtok))); D(("Newauthtok: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_newauthtok))); D(("Cli_PID: %d", pi->cli_pid)); + D(("Requested domains: %s", pi->requested_domains)); } static int send_and_receive(pam_handle_t *pamh, struct pam_items *pi, @@ -1271,7 +1284,8 @@ static int prompt_new_password(pam_handle_t *pamh, struct pam_items *pi) } static void eval_argv(pam_handle_t *pamh, int argc, const char **argv, - uint32_t *flags, int *retries, bool *quiet_mode) + uint32_t *flags, int *retries, bool *quiet_mode, + const char **domains) { char *ep; @@ -1284,6 +1298,14 @@ static void eval_argv(pam_handle_t *pamh, int argc, const char **argv, *flags |= FLAGS_USE_FIRST_PASS; } else if (strcmp(*argv, "use_authtok") == 0) { *flags |= FLAGS_USE_AUTHTOK; + } else if (strncmp(*argv, OPT_DOMAINS_KEY, strlen(OPT_DOMAINS_KEY)) == 0) { + if (*(*argv+strlen(OPT_DOMAINS_KEY)) == '\0') { + logger(pamh, LOG_ERR, "Missing argument to option domains."); + *domains = '\0'; + } else { + *domains = *argv+strlen(OPT_DOMAINS_KEY); + } + } else if (strncmp(*argv, OPT_RETRY_KEY, strlen(OPT_RETRY_KEY)) == 0) { if (*(*argv+6) == '\0') { logger(pamh, LOG_ERR, "Missing argument to option retry."); @@ -1443,12 +1465,15 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh, bool retry = false; bool quiet_mode = false; int retries = 0; + const char *domains = NULL; bindtextdomain(PACKAGE, LOCALEDIR); D(("Hello pam_sssd: %d", task)); - eval_argv(pamh, argc, argv, &flags, &retries, &quiet_mode); + eval_argv(pamh, argc, argv, &flags, &retries, &quiet_mode, &domains); + + pi.requested_domains = domains; ret = get_pam_items(pamh, &pi); if (ret != PAM_SUCCESS) { diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h index 16a08e1..15f8322 100644 --- a/src/sss_client/sss_cli.h +++ b/src/sss_client/sss_cli.h @@ -314,6 +314,7 @@ enum pam_item_type { SSS_PAM_ITEM_NEWAUTHTOK, SSS_PAM_ITEM_CLI_LOCALE, SSS_PAM_ITEM_CLI_PID, + SSS_PAM_ITEM_REQUESTED_DOMAINS, }; #define SSS_NSS_MAX_ENTRIES 256 -- 1.9.1

4 21

[PATCH] CI: Use default config for mock build
by Lukas Slebodnik 22 Sep '14

22 Sep '14

ehlo, The mock config with name default is usually symbolic link to the configuration file of local architecture. The side effect of this patch is that we will not try to rebuild on old architectures src.rpm for new architectures(fedora). It caused issues with mock tmpfs plugin. feel free to modify patch and add your signoff. I am goinng to be offline today. install-deps: success 00:00:21 ci-install-deps.log autoreconf: success 00:00:23 ci-autoreconf.log DEBUG BUILD: ci-build-debug configure: success 00:00:24 ci-build-debug/ci-configure.log make-tests: success 00:02:28 ci-build-debug/ci-make-tests.log make-check-valgrind: failure 00:01:06 ci-build-debug/ci-make-check-valgrind.log make-distcheck: success 00:06:19 ci-build-debug/ci-make-distcheck.log make-srpm: success 00:00:06 ci-build-debug/ci-make-srpm.log mock-build: success 00:02:48 ci-build-debug/ci-mock-build.log COVERAGE BUILD: ci-build-coverage configure: success 00:00:57 ci-build-coverage/ci-configure.log scan-make-tests: success 00:10:19 ci-build-coverage/ci-scan-make-tests.log scan report: ci-build-coverage/ci-report-scan/index.html scan-check: failure 00:00:00 ci-build-coverage/ci-scan-check.log lcov-pre: success 00:00:12 ci-build-coverage/ci-lcov-pre.log make-check: success 00:00:14 ci-build-coverage/ci-make-check.log lcov-post: success 00:00:16 ci-build-coverage/ci-lcov-post.log lcov-merge: success 00:00:03 ci-build-coverage/ci-lcov-merge.log lcov-clean: success 00:00:01 ci-build-coverage/ci-lcov-clean.log genhtml: success 00:00:05 ci-build-coverage/ci-genhtml.log coverage report: ci-build-coverage/ci-report-coverage/index.html lcov-check: success 00:00:00 ci-build-coverage/ci-lcov-check.log SUCCESS As you can see mock-build is almost fast as make-tests with attached patch and mock tmpfs plugin. Currently bottleneck is scan-make-tests and make-distcheck. scan-make-tests can be removed/commented out, because results are ignored anuway. (It would be -8 lines) LS

3 6

[PATCH] CI: Enforce Valgrind check
by Nikolai Kondrashov 22 Sep '14

22 Sep '14

Hi everyone, I've found some time to finish suppressing irrelevant Valgrind issues finally. Here are four patches working towards enabling Valgrind check in CI. Here is a job verifying the last commit: http://sssd-ci.duckdns.org/logs/job/0/91/summary.html I assume particular attention should be directed towards reviewing the suppressions themselves. Thank you. Nick

3 11

[BUG] SUDO: SSSD doesn't apply case-senstive=False to ldap sudo rules
by Michichael Folfsunè 19 Sep '14

19 Sep '14

Hello Everyone, Sorry if this is the wrong place to send this. Tried figuring out how to add a bug on the launchpad or the main site, but couldn't find anywhere to actually submit a *new* bug. I searched through the bug tracker and it doesn't look like this has been reported, so here you go: Linux Version: Oracle Enterprise Linux 6.4 and 6.5 (RHEL) SSSD Version: sssd-1.9.2-129.el6_5.4.x86_64 (No higher versions available in yum) Problem: When case_sensitive = False is set, groups are returned lower-case regardless of what the case of the group is in the directory. However, sudoers rules aren't being detected as applicable unless the case of the sudo rule in LDAP matches the case of the group. With just %test_admin, we get a "User is not allowed to run sudo" error. But if we add %TEST_Admin to the rule, sudo operates as expected. Below is some sanitized data. This is getent or id: util: /home/michichael> getent -s sss group test_admin test_admin:*:10004:michichael util: /home/michichael> getent -s sss group TEST_Admin test_admin:*:10004:michichael util: /home/michichael> id uid=10002(michichael) gid=10004(test_admin) groups=10004(test_admin) context=system_u:system_r:unconfined_t:s0-s0:c0.c1023 The LDAP entries in question are: dn: cn=TEST_Access,ou=sudoers,dc=domain,dc=local sudouser: %test_admin sudorunasuser: ALL sudocommand: ALL sudohost: ALL objectclass: top objectclass: sudoRole cn: TEST_Access dn: cn=test_admin,ou=security groups,dc=domain,dc=local uniquemember: cn=michichael folfsune,ou=test_users,ou=people,dc=domain,dc= local orclsourceobjectdn: CN=TEST_Admin,OU=Security Groups,DC=DOMAIN,DC=LOCAL orclsamaccountname: TEST_Admin gidnumber: 10004 displayname: TEST_Admin objectclass: orcladobject objectclass: groupofuniquenames objectclass: orcladgroup objectclass: orclgroup objectclass: top objectclass: posixgroup orclobjectguid: TJTtdC/I6UK6m3uwpo/UXA== cn: TEST_Admin description: TEST Administrators And the SSSD Config is: sudo cat /etc/sssd/sssd.conf [sudo] password for michichael: [domain/default] ldap_schema = rfc2307bis ldap_tls_cacertdir = /etc/oracle-certs/ ldap_tls_cacert = /etc/oracle-certs/InternalCA.pem ldap_user_member_of = uniqueMember ldap_group_object_class = posixGroup ldap_group_name = cn ldap_group_gid_number = gidNumber ldap_group_member = uniqueMember ldap_group_nesting_level = 6 ldap_default_bind_dn = cn=binduser,cn=Users,dc=domain,dc=local ldap_default_authtok_type = password ldap_default_authtok = bindpassword ldap_id_use_start_tls = True ldap_search_base = dc=domain,dc=local ldap_group_search_base = dc=domain,dc=local case_sensitive = False id_provider = ldap auth_provider = ldap chpass_provider = ldap sudo_provider = ldap ldap_uri = ldap://ldapserver.domain.local:389/,ldap://secondaryldap.domain.local:389/ ldap_sudo_search_base = ou=sudoers,dc=domain,dc=local [sssd] services = nss, pam, sudo config_file_version = 2 domains = default [nss] [pam] [sudo] sudo_timed = true [autofs] [ssh] [pac]

4 4

[PATCH v2] CI: Allow disabling distro-(in)dependent tests
by Nikolai Kondrashov 19 Sep '14

19 Sep '14

Hi everyone, This version removes the disabling of Valgrind memory leak check, which got into the first version accidentally and should be (and is) a separate patch. Nick

4 27

[PATCH] MAN: AD is allowed value of subdomains_provider
by Jakub Hrozek 18 Sep '14

18 Sep '14

Reported by Scott Poore.

2 2

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2014