sssd-devel March 2015

sssd-devel@lists.fedorahosted.org

15 participants
74 discussions

[PATCH] Fixes for NSS getnamebysid requests
by Jakub Hrozek 24 Apr '15

24 Apr '15

Hi, another problem I found while testing another patchset was that NSS getnamebysid never consulted cache and went straight to BE. It was because the cacheExpire attribute wasn't requested, so the default value of 0 was used. Also negative cache wasn't consulted, but that's not so much of a problem. Attached are patches that fix both bugs and a unit test.

2 5

Design discussion: Mapping user names of proxy users onto Kerberos principals
by Jakub Hrozek 21 Apr '15

21 Apr '15

Hi, we talked about implementing ticket #2509 with Pavel in person, but it would be nice to see if other other developers agree before all the code is written :-) The design page is here: https://fedorahosted.org/sssd/wiki/DesignDocs/KerberosPrincipalMappingToPro… For your convenience, the text of the design page is also copied below: = Mapping Proxy ID provider names to Kerberos principals = Related ticket(s): * https://fedorahosted.org/sssd/ticket/2509 === Problem statement === Some users are migrating to SSSD from a legacy configuration that consisted of a traditional UNIX user stored in `/etc/passwd` and managing their Kerberos tickets either with the use of some GUI tool or just command-line `kinit`. While these users can use SSSD by configuring the `id_provider` proxy, very often the name of their UNIX user is different from the name of their company-wide Kerberos credentials. This feature helps the above use-case by mapping their UNIX user name to the Kerberos principal name. === Use cases === Joe User has a company laptop where his UNIX user has been traditionally named `joe`. At the same time, his company Kerberos principal is called `juser(a)EXAMPLE.COM`. Joe would like to start using SSSD to leverage features like offline kinit without having to rename his UNIX user and chown all his local files to the corporate user ID. === Overview of the solution === The Kerberos provider will acquire a new option that describes how are the user names from the ID provider mapped onto the user part of the Kerberos principal. The user would then add the appropriate mapping to the `domain` section of `sssd.conf`. === Implementation details === A new option `krb5_map_user` would be added to the Kerberos auth code. This option would have form similar to how we map the LDAP extra attributes, that is `local_name:krb5_name`. When mapping exists for the user who is authenticating, the krb5_auth module would use that user name for calls like `find_or_guess_upn` instead of `pd->name`. We should consider whether to keep using `pd->name` or introduce another attribute to the `krb5_child_req` structure. === Configuration changes === A new configuration option tentatively called `krb5_map_user` would be added. This option is unset by default, which means whatever user name the ID provider stores will be used. === How To Test === 1. Prepare a Kerberos KDC, add a user principal (`juser(a)EXAMPLE.COM`) 1. Add a local user using `useradd` with name that differs from Kerberos principal in the name portion. (`joe`) 1. Configure SSSD with `id_provider=proxy` with `proxy_lib_name=files` and `auth_provider=krb5` pointing to our test KDC 1. Attempt to authenticate using a PAM service. The authentication should fail and the logs would show authentication as `joe(a)EXAMPLE.COM` 1. Set `krb5_map_user` to `joe:juser` and restart SSSD. 1. Authenticate again. This time, authentication should succeed and the user's klist output should list `juser(a)EXAMPLE.COM`. The `id(1)` output should still list `joe`, though. 1. Test that Kerberos ticket renewals still work 1. Test that delayed kinit still works. === Authors === * Jakub Hrozek <jhrozek(a)redhat.com>

3 4

[PATCH] tests: Use cmocka-1.0+ API in test_sysdb_utils
by Jakub Hrozek 16 Apr '15

16 Apr '15

Hi, the attached patch avoid a warning in master.

3 4

[PATCHES] SPEC: Few cosmetic changes
by Lukas Slebodnik 08 Apr '15

08 Apr '15

ehlo, simple patches attached LS

2 2

[PATCH] LDAP: drop lockout option from ldap_access_order
by Pavel Reichl 02 Apr '15

02 Apr '15

Hello please see attached patch. The need for this patch was discussed in thread: SDAP: Lock out ssh keys when account naturally expires This patch implements point number 3. >> I would prefer if we didn't add a new option as well, but since we >> released >> a version that only supported the lockout and not any other semantics, >> I don't think we can get away with just changing the functionality. A >> minor version can break functionality. But a major version can >> >> So I propose the following: >> 1) Add a new value for ldap_access_order called "ppolicy" that would >> evaluate the pwdAccountLockedTime fully, including the new >> functionality in this patchset >> 2) In 1.12, deprecate the "lockout" option and log a warning that it >> will be removed in future relase and users should migrate to "ppolicy" >> option >> 3) In master (1.13), remove the "lockout" ldap_access_order value Thanks!

3 24

[PATCH] SSH: Ignore the default_domain_suffix
by Jakub Hrozek 01 Apr '15

01 Apr '15

Honza, can you review, please? To reproduce, just set default_domain_suffix on an IPA trust client to the AD domain value in the [sssd] section: [sssd] services = nss, pac, sudo, pam, ssh domains = linux.test config_file_version = 2 default_domain_suffix = ad.example.com Then request a host: sss_ssh_knownhostsproxy ipa1.linux.test btw default_domain_suffix is already ignored for the autofs responder.

3 3

[PATCH] PAC: Remove unused function
by Lukas Slebodnik 31 Mar '15

31 Mar '15

ehlo, simple patch is attached. LS

3 2

[PATCH] test_resolv_fake: Fix alignment warning
by Lukas Slebodnik 27 Mar '15

27 Mar '15

ehlo, there is a problem with allignment in tests. patch is attached. LS

3 2

[PATCH] MAN: Update ppolicy description
by Pavel Reichl 27 Mar '15

27 Mar '15

Hello, please see this trivial patch. I CCed Stephen in hope that he would be so kind and do the language review. Thanks!

3 4

[PATCH] BUILD: Add missing header file to tarball
by Lukas Slebodnik 27 Mar '15

27 Mar '15

ehlo, simple patch is attached. LS

5 22

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2015