sssd-devel April 2015

sssd-devel@lists.fedorahosted.org

16 participants
59 discussions

Start a nNew thread

[PATCH] IPA: check ghosts in groups found by uuid as well
by Sumit Bose 27 Apr '15

27 Apr '15

Hi, another idview/idoverride fix. bye, Sumit

2 3

[PATCH] Fixes for NSS getnamebysid requests
by Jakub Hrozek 24 Apr '15

24 Apr '15

Hi, another problem I found while testing another patchset was that NSS getnamebysid never consulted cache and went straight to BE. It was because the cacheExpire attribute wasn't requested, so the default value of 0 was used. Also negative cache wasn't consulted, but that's not so much of a problem. Attached are patches that fix both bugs and a unit test.

2 5

[PATCH] BUILD: Write hints about optional python bindings
by Lukas Slebodnik 24 Apr '15

24 Apr '15

ehlo, attached patch should fix issue with Pavel R. mentioned in mail[1] I thought it would be fixed as part of CI patches, becuase there were some related changes. But It takes ages. So Attached is a patch. LS [1] https://lists.fedorahosted.org/pipermail/sssd-devel/2015-February/022731.ht…

3 4

Segmentation fault in 1.11.6 - error 6 in libsss_idmap.so.0.4.0
by Sterling Sahaydak 23 Apr '15

23 Apr '15

Consistently getting a segfault in libsss_idmap resulting in a core dump in sssd 1.11.6 :Apr 22 13:25:50 ldap kernel: sssd_be[9236]: segfault at 10da000 ip 000= 07f785852b4f1 sp 00007fffbfbf6cf0 error 6 in libsss_idmap.so.0.4.0[7f78= 58528000+5000] :Apr 22 13:25:50 ldap abrt[9244]: Saved core dump of pid 9236 (/usr/lib= exec/sssd/sssd_be) to /var/spool/abrt/ccpp-2015-04-22-13:25:50-9236 (27= 68896 bytes) Taking a look at it deeper in gdb revealing: Loaded symbols for /lib64/libnss_dns-2.12.so Core was generated by `/usr/libexec/sssd/sssd_be --domain LDAP'. Program terminated with signal 11, Segmentation fault. #0 sss_idmap_bin_sid_to_dom_sid (ctx=<value optimized out>, bin_sid=<value optimized out>, length=<value optimized out>, _dom_sid=0x7fffbfbf6d38) at src/lib/idmap/sss_id map_conv.c:92 92 dom_sid->sub_auths[i] = le32toh(val); Missing separate debuginfos, use: debuginfo-install dbus-libs-1.2.24-8.el6_6.x86_64 popt-1.13-7.el6.x86_64 sqlite-3.6.20-1.el6.x86_64 (gdb) where #0 sss_idmap_bin_sid_to_dom_sid (ctx=<value optimized out>, bin_sid=<value optimized out>, length=<value optimized out>, _dom_sid=0x7fffbfbf6d38) at src/lib/idmap/sss_id map_conv.c:92 #1 0x00007f785852b648 in sss_idmap_bin_sid_to_sid (ctx=0xf84520, bin_sid=<value optimized out>, length=<value optimized out>, _sid=0x7fffbfbf6d60) at src/lib/idmap/sss_i dmap_conv.c:371 #2 0x00007f7858745ded in sdap_attrs_get_sid_str (mem_ctx=0x105fc10, idmap_ctx=0xf811e0, sysdb_attrs=<value optimized out>, sid_attr=0x7f7858783789 "objectSID", _sid_str= 0x7fffbfbf6e28) at src/providers/ldap/ldap_common.c:1857 #3 0x00007f785875e509 in sdap_add_incomplete_groups (sysdb=0xf63080, domain=0xf63780, opts=0xf7eec0, groupnames=<value optimized out>, ldap_groups=0x10b52b0, ldap_groups _count=9) at src/providers/ldap/sdap_async_initgroups.c:131 #4 0x00007f785875ea1b in sdap_nested_groups_store (sysdb=0xf63080, domain=0xf63780, opts=0xf7eec0, groups=0x10b52b0, count=9) at src/providers/ldap/sdap_async_initgroups .c:617 #5 0x00007f7858763095 in save_rfc2307bis_groups (subreq=0x0) at src/providers/ldap/sdap_async_initgroups.c:1878 #6 sdap_initgr_rfc2307bis_done (subreq=0x0) at src/providers/ldap/sdap_async_initgroups.c:1783 #7 0x00007f785876275a in rfc2307bis_nested_groups_process (subreq=0x0) at src/providers/ldap/sdap_async_initgroups.c:2554 #8 0x00007f785874f90f in sdap_get_generic_ext_done (op=<value optimized out>, reply=<value optimized out>, error=<value optimized out>, pvt=<value optimized out>) at src /providers/ldap/sdap_async.c:1439 #9 0x00007f7858751e2a in sdap_process_message (ev=<value optimized out>, pvt=<value optimized out>) at src/providers/ldap/sdap_async.c:374 #10 sdap_process_result (ev=<value optimized out>, pvt=<value optimized out>) at src/providers/ldap/sdap_async.c:213 #11 0x00000039dda08ebe in epoll_event_loop (ev=<value optimized out>, location=<value optimized out>) at ../tevent_epoll.c:736 #12 epoll_event_loop_once (ev=<value optimized out>, location=<value optimized out>) at ../tevent_epoll.c:931 #13 0x00000039dda072e6 in std_event_loop_once (ev=0xf5b580, location=0x39dea3d4f5 "src/util/server.c:602") at ../tevent_standard.c:112 #14 0x00000039dda0349d in _tevent_loop_once (ev=0xf5b580, location=0x39dea3d4f5 "src/util/server.c:602") at ../tevent.c:530 #15 0x00000039dda0351b in tevent_common_loop_wait (ev=0xf5b580, location=0x39dea3d4f5 "src/util/server.c:602") at ../tevent.c:634 #16 0x00000039dda07256 in std_event_loop_wait (ev=0xf5b580, location=0x39dea3d4f5 "src/util/server.c:602") at ../tevent_standard.c:138 #17 0x00000039dea2b963 in server_loop (main_ctx=0xf5c880) at src/util/server.c:602 #18 0x000000000040a286 in main (argc=3, argv=<value optimized out>) at src/providers/data_provider_be.c:2856 (gdb) print i $1 = <value optimized out> (gdb) print val $2 = 0 (gdb) print dom_sid $3 = (struct sss_dom_sid *) 0x10b4300 (gdb) print dom_sid->sub_auths $4 = {2927152313, 560816471, 256, 0, 113, 0, 0, 0, 0, 0, 17404592, 0, 17409264, 0, 0} (gdb) quit Above, you can see that "<value optimized out>" so not sure what I can conclude from this futher. This is a mirrored site being replicated that I have the same configuration files setup on another sub domain. I've recently run 'yum update' to verify and still end up with the same segmentation fault. I'm running the command 'getent passwd <username>' and noticing this is occurring when running in "/usr/sbin/sssd -i" mode. Environment: CentOS => OpenLDAP 2.4.39 with OpenLDAP Proxy => Active Directory 2012 containing Users Running the cmd: 'getent passwd <username>' is retrieving the correct user information along with groups, etc. I presume it's this: dom_sid->sub_auths[i] = le32toh(val); Where "i" is out of bounds or "val" is not being checked properly or ??? Please let me know what other information is needed to assist, before just dumping sssd.conf, nsswitch.conf, etc. Any help is greatly appreciated, Sterling

3 5

Design discussion: Mapping user names of proxy users onto Kerberos principals
by Jakub Hrozek 21 Apr '15

21 Apr '15

Hi, we talked about implementing ticket #2509 with Pavel in person, but it would be nice to see if other other developers agree before all the code is written :-) The design page is here: https://fedorahosted.org/sssd/wiki/DesignDocs/KerberosPrincipalMappingToPro… For your convenience, the text of the design page is also copied below: = Mapping Proxy ID provider names to Kerberos principals = Related ticket(s): * https://fedorahosted.org/sssd/ticket/2509 === Problem statement === Some users are migrating to SSSD from a legacy configuration that consisted of a traditional UNIX user stored in `/etc/passwd` and managing their Kerberos tickets either with the use of some GUI tool or just command-line `kinit`. While these users can use SSSD by configuring the `id_provider` proxy, very often the name of their UNIX user is different from the name of their company-wide Kerberos credentials. This feature helps the above use-case by mapping their UNIX user name to the Kerberos principal name. === Use cases === Joe User has a company laptop where his UNIX user has been traditionally named `joe`. At the same time, his company Kerberos principal is called `juser(a)EXAMPLE.COM`. Joe would like to start using SSSD to leverage features like offline kinit without having to rename his UNIX user and chown all his local files to the corporate user ID. === Overview of the solution === The Kerberos provider will acquire a new option that describes how are the user names from the ID provider mapped onto the user part of the Kerberos principal. The user would then add the appropriate mapping to the `domain` section of `sssd.conf`. === Implementation details === A new option `krb5_map_user` would be added to the Kerberos auth code. This option would have form similar to how we map the LDAP extra attributes, that is `local_name:krb5_name`. When mapping exists for the user who is authenticating, the krb5_auth module would use that user name for calls like `find_or_guess_upn` instead of `pd->name`. We should consider whether to keep using `pd->name` or introduce another attribute to the `krb5_child_req` structure. === Configuration changes === A new configuration option tentatively called `krb5_map_user` would be added. This option is unset by default, which means whatever user name the ID provider stores will be used. === How To Test === 1. Prepare a Kerberos KDC, add a user principal (`juser(a)EXAMPLE.COM`) 1. Add a local user using `useradd` with name that differs from Kerberos principal in the name portion. (`joe`) 1. Configure SSSD with `id_provider=proxy` with `proxy_lib_name=files` and `auth_provider=krb5` pointing to our test KDC 1. Attempt to authenticate using a PAM service. The authentication should fail and the logs would show authentication as `joe(a)EXAMPLE.COM` 1. Set `krb5_map_user` to `joe:juser` and restart SSSD. 1. Authenticate again. This time, authentication should succeed and the user's klist output should list `juser(a)EXAMPLE.COM`. The `id(1)` output should still list `joe`, though. 1. Test that Kerberos ticket renewals still work 1. Test that delayed kinit still works. === Authors === * Jakub Hrozek <jhrozek(a)redhat.com>

3 4

[PATCH] ad_opts: Use different default attribute for group name
by Lukas Slebodnik 17 Apr '15

17 Apr '15

ehlo, The MSFT docs [1,2] for LDAP attributes says: samAccountName is mandotory for 'user' and 'group' objectclasses via the 'Security-Principal' aux-class name is part of the 'top' class and *not* mandatory for 'user' or 'group'. Attached patch should fix #2593. LS [1] https://msdn.microsoft.com/en-us/library/ms679635%28v=vs.85%29.aspx [2] https://msdn.microsoft.com/en-us/library/ms678697%28v=vs.85%29.aspx

3 4

planning the 1.12.5 release
by Jakub Hrozek 16 Apr '15

16 Apr '15

Hi, as discussed on the phone with the other developers, I would like to release 1.12.5 soon, probably early next week (I'm travelling tomorrow). If there is a patch you'd like to have cherry-picked for 1.12 or a fix that you believe should be holding up 1.12.5, please speak up!

1 0

I changed mailman settings to catch more spam
by Jakub Hrozek 16 Apr '15

16 Apr '15

Hi, the sssd-devel list is receiving huge amounts of spam into moderation. To mitigate that, I added a spam rule into the mailman config: "^X-Spam-Status: Yes" This was recommended by the fedorahosted staff: https://fedorahosted.org/fedora-infrastructure/ticket/4711 Please ping me if you see anyone complaining that his mail got rejected. Thanks!

1 1

[PATCH] subdom: Remove unused function get_flat_name_from_subdomain_name
by Jakub Hrozek 16 Apr '15

16 Apr '15

Hi, I found an unused function while going through the subdomain code. A simple patch is attached.

2 2

[PATCH] tests: Use cmocka-1.0+ API in test_sysdb_utils
by Jakub Hrozek 16 Apr '15

16 Apr '15

Hi, the attached patch avoid a warning in master.

3 4

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel April 2015