sssd-devel May 2016

sssd-devel@lists.fedorahosted.org

13 participants
51 discussions

[PATCH] sdap: improve filtering of multiple results in GC lookups
by Sumit Bose 13 Jun '16

13 Jun '16

Hi, this patch fixes and issue during initgroups in AD forests. Please see the commit message for details. To reproduce this you can create a new user outside of CN=Users on the forest root. The new user can be created in an existing container or in a new OU container. Most important is that it is not a child of CN=Users. In a child domain (it must be a child, domains with a different base won't trigger the issue) create a user with the same name. With this setup 'id user(a)forest.root' will not return the complete list of group the user is a member of and the patch should fix this. bye, Sumit

3 8

[PATCH] RESPONDERS: Negative caching of local users
by Petr Cech 10 Jun '16

10 Jun '16

Hello, this patch resolves [1]. This adds new behaviour of negative caching of locals, so it needs new tests. I will send patch with tests soon, but not today. It is applicable after RESPONDERS: Negcache in resp_ctx [2]. For clarity, there is branch with all negative cache's patches [3]. Links: [1] https://fedorahosted.org/sssd/ticket/2928 [2] https://www.mail-archive.com/sssd-devel@lists.fedorahosted.org/msg26580.html [3] https://github.com/celestian/sssd/commits/ncache_v2 Regards -- Petr^4 Čech

4 16

[PATCH] systemtap-based performance probes
by Jakub Hrozek 10 Jun '16

10 Jun '16

Hi, the attached patches are the first self-contained part of my performance work. Using them, I analyzed the performance of 'id' as the worst-case, then realized most of the issues are around processing and storing large groups. The results gathered using these scripts are in fact the base of the improvements documented at: https://fedorahosted.org/sssd/wiki/DesignDocs/OneFourteenPerformanceImprove… I tried to add descriptive commit messages to the patches so that hopefully all the info is in those commit messages. We will probably add more probes into different areas of code, but these are the ones that I already haven't modified for weeks, so I think it should be safe to merge them. The probes are enabled in our RPMs and I would encourage downstreams to enable them as well. There is virtually no cost of having the probes compiled in by default and the benefit would be that admins can run them to see what are the bottlenecks in their environment. I was also wondering if it makes sense to add a generic back-end-request tracking probes and an associated script, but since the data provider is being re-factored at the moment, I think it would be better to land the DP changes first. The reason I split the sysdb probes into several commits (unlike the LDAP probes) is that I think in future, we can use these commits as a reference for adding more probes to different areas of SSSD. CI: http://sssd-ci.duckdns.org/logs/job/42/99/summary.html (BTW, thanks to Lukas for helping me a lot with the build failures on #sssd last week)

2 8

[PATCHES] ipa: add support for certificate overrides
by Sumit Bose 09 Jun '16

09 Jun '16

Hi, this set of patches should resolve https://fedorahosted.org/sssd/ticket/2897 "Smart Cards: Certificate in the ID View" and cover all other use cases from https://fedorahosted.org/sssd/wiki/DesignDocs/LookupUsersByCertificatePart2 as well. So basically certificates can be read from IPA and local overrides and from AD with direct in indirect integration. The patches are all about lookups, so Smartcards and authentication is not needed to test them. All is needed is a certificate which can be added to an AD user object or an override object and then try to lookup the user with dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Users.FindByCertificate string:"BASE64_CERTIFICATE_STRING" from a IPA client, IPA server or AD client with AD provier. If the certificate is store in the AD user object and the lookup is started on an IPA client a patch for the IPA server is needed, because the request has to run via the extdom plugin. I'll send a patch to freeipa-devel which will use the sss_nss_getnamebycert() call added by one of the patches to allow the extdom plugin to do lookups by certificate. This means that SSSD on the IPA server must used the attached patches as well. bye, Sumit

3 16

[PATCH] AD: use krb5_keytab for subdomain initialization
by Sumit Bose 09 Jun '16

09 Jun '16

Hi, this is a bit of a follow-up patch to "subdomains: inherit ldap_krb5_keytab". It turned out that if the default keytab contains some completely unrelated keys the SASL initialization might e.g. pick a wrong realm name because the alternative keytab was only added later during the initialization. bye, Sumit

3 6

[PATCH] AD_PROVIDER: Fix constant char *
by Petr Cech 07 Jun '16

07 Jun '16

Hello, there is simple patch attached. Please, look at commit message. Regards -- Petr^4 Čech

5 10

Design document - sssctl
by Pavel Reichl 07 Jun '16

07 Jun '16

Hello, Pavel Březina and I have prepared the 1st draft of design document. We mostly focused on summing up its future functionality and its interface. Please comment if you miss some essential functionality or if you would prefer some different interface. Thanks! https://fedorahosted.org/sssd/wiki/DesignDocs/sssctl

8 27

[PATCHES] Support starting SSSD from a default configuration
by Stephen Gallagher 03 Jun '16

03 Jun '16

These patches provide support for shipping a default configuration file that the monitor will automatically copy to /etc/sssd/sssd.conf if none already exists. The idea is for distributions to be able to provide a default (and resettable) configuration for out-of-the-box behavior. I considered writing the patch to check /etc/sssd and then check /usr/lib*/sssd in turn, but I realized that this would be too complicated with the infopipe interactions (which would need to be updated to do a copy-on-write the first time they changed something). It was simpler to just always create the /etc version and use that. Patch 0001: Create a secure copy function that can be used to duplicate the default configuration Patch 0002: Cosmetic patch; changes the name of an internal macro variable to make it clear that it's the active configuration file, not the default one. Patch 0003: Add the logic to confdb_setup.c to copy over the default configuration if and only if our attempt to load the configuration came up with ERR_MISSING_CONF. It will then try to load it again and proceed or fail from there. The default configuration provided here is to load the SSSD with a single proxy provider that reads from nss_files (and supports authentication through pam_unix). This does not have to be shipped with any downstream package; the idea is that downstreams would be expected to modify this configuration to their own needs. This would need to be called out in the release announcement for whatever version of SSSD incorporates this change. These patches will require a change to the SELinux policy, since the monitor needs to be able to write to the /etc/sssd directory. type=AVC msg=audit(1461088081.353:550): avc: denied { write } for pid=3721 comm="sssd" name="sssd" dev="dm-0" ino=4600013 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:sssd_conf_t:s0 tclass=dir permissive=0 Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access.

3 9

[PATCH] GPO: Add "polkit-1" to ad_gpo_map_allow
by Stephen Gallagher 03 Jun '16

03 Jun '16

Polkit is an authorization mechanism of its own (similar to sudo). SSSD doesn't need to apply additional authorization decisions atop it, so we'll just accept it as "allow". Resolves: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1578415

3 3

[PATCH] LDAP: Try also the AD access control for IPA users
by Jakub Hrozek 03 Jun '16

03 Jun '16

Hi, the attached patch implements Sumit's idea to solve https://fedorahosted.org/sssd/ticket/2927 The user who reported the bug confirmed that the patch works. As an additional improvement, they requested that these results should not be considered when the cache expires, but immediatelly. But honestly I don't know if and how this could be solved (we would need to fetch this attribute always on initgroups on both client and server..) so I would prefer additional ticket and merge this patch first.

2 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel May 2016