June 2016 - sssd-devel - Fedora mailing-lists

Tlog integration and packages
by Nikolai Kondrashov 10 Mar '17

10 Mar '17

Hi everyone, I'd like to continue the discussion of tlog integration, and also present you the first release of tlog - a development preview, which has the configuration interface necessary to implement the integration: https://github.com/spbnick/tlog/releases/tag/v1 You're more than welcome to download RPMs, install, read tlog-rec(8) and tlog-rec.conf(5), and experiment! Building from the Git tree and the tarball works as well, if you're so inclined. I'm also attaching those manpages for convenience. Here are the integration plans so far, as discussed with Jakub on our devconf.cz trip meetings and before on the list. Jakub, please correct me or add details. * We follow the route similar to that taken by SELinux rule control implementation [1][2]. I.e. store the configuration in LDAP HBAC rules, write to files on the client side and then specify them to tlog upon user login. However, I'm also rather fond of the idea of specifying the whole configuration through an environment variable instead of through a file referenced by an environment variable - it's not big at all, and we'll avoid the hassle of managing the files. I implemented support for both in tlog (was easy). * We'll have to make nss_sss report user's shell as tlog-rec (how?) and specify the actual shell to tlog-rec via an environment variable, through pam_sss (with SSS_PAM_ENV_ITEM messages). I.e.: * Nss_sss would always report tlog-rec as the user's shell. * During login (e.g. through "login" or "sshd") pam_sss would add a variable to the user environment, containing, or pointing at, a tlog-rec configuration (TLOG_REC_CONF_TEXT or TLOG_REC_CONF_FILE). That configuration would contain the user's actual shell. I can also implement support for a separate variable just for the shell (TLOG_REC_SHELL?) to simplify the implementation for the start. * Tlog-rec would read the system-wide configuration and overlay it with the one specified in the environment, adding the specific user shell, and then would spawn it. Please also see the draft integration design page [3] for reference. I hope to refine and extend it in the coming weeks to match FreeIPA standards. Please chime in and suggest, object, discuss! Also, please report tlog bugs at https://github.com/spbnick/tlog/issues Thank you! Nick [1]: http://www.freeipa.org/page/SELinux_user_mapping [2]: http://www.freeipa.org/images/b/b9/Freeipa30_SELinuxUserMap.pdf [3]: http://www.freeipa.org/page/Session_Recording

5 22

[PATCH] Unit tests for pam_sss using pam_wrapper (need help with CI..)
by Jakub Hrozek 08 Dec '16

08 Dec '16

Hi, the attached patches implement unit tests for the pam_sss module using pam_wrapper and libpamtest. In my testing, the coverage is around 75% with mostly the parts that require running as root being untested. I worked on this patchset even though the features for 1.14 are in full swing because there are several tickets that will require us to patch pam_sss, so it's important to have the code that changes tested. In addition, when we merge Dan's patches to use TLS with integration tests, then we'll be able to also test authentication in integration tests easily using libpamtest-python. However, our CI fails for me constantly: http://sssd-ci.duckdns.org/logs/job/42/75/fedora_rawhide/ci.html The strange thing is that running CI locally works fine and so does make check. Can anyone help point me in the right direction as to what should I check next? I suspect some of the environment variables might not be set correctly, but I don't see why..

2 8

[PATCHES] Fix warnings Wsign-compare
by Lukas Slebodnik 17 Oct '16

17 Oct '16

ehlo, I found few warnings on rawhide when I build sssd-1.13.2 https://kojipkgs.fedoraproject.org//work/tasks/8618/11918618/build.log LS

2 6

[PATCH] sss_override: improve --debug description
by Pavel Březina 24 Sep '16

24 Sep '16

https://fedorahosted.org/sssd/ticket/2813 I wanted to split include/debug_levels.xml into more files so we don't duplicate information, but I didn't figure out how to use xi:include in files that are already beeing included. I always managed to fail on dtd validation. Maybe someone more familiar with docbook may chime in.

4 12

[PATCH] ssh: skip invalid certificates
by Sumit Bose 22 Sep '16

22 Sep '16

Hi, currently the code which generates ssh key from the public keys in the user certificates fails if one certificate cannot be validated and terminates the whole request. It is of course valid that the user entry might contain certificates which SSSD cannot validate and since we just won't generate a ssh-key in this case SSSD should just skip those entires and return ssh-keys for every valid certificate. You can test the patch even without a real certificate by e.g. adding a ssh-key to an IPA user object. Then 'sss_ssh_authorizedkeys username' should return this key. If you now add some random data the the userCertificate object of the same user, call 'sss_cache -E' and call 'sss_ssh_authorizedkeys username' again, you get nothing because the random data cannot be validated and hence the whole request is aborted. With the attached patch sss_ssh_authorizedkeys should return the ssh-key again. bye, Sumit

3 7

[PATCHES] p11: add no_verification option
by Sumit Bose 19 Sep '16

19 Sep '16

Hi, the following 3 patches are related to the Smartcard authentication feature but imo can be tested even without having one. The first patch just adds some missing pieces. The second adds a new 'no_verification' switch to the 'certificate_verification' option, which is already tested by the unit tests. The third adds two new OCSP related switches. With OCSP a certificate can be validates online by talking to a server which is listed in the certificate. Of course it might not always be possible to directly talk to this server. We already have the 'no_ocsp' switch to disable OCSP completely. The two new switches allow SSSD to talk to a different server or a proxy. To see how it is working you can do to following: - call 'make check' to build and rung all the tests - call './pam-srv-tests' to run the PAM responder tests but do not let it complete but stop it with CTRL-C. This is needed to create the test nss database in /dev/shm/tp_pam_srv_tests-test_pam_srv/, it can be created differently but this way it is most easy :-) - add a OCSP signing cert with echo "MIIDaTCCAlGgAwIBAgIBAjANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlJUEEuREVWRUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNTA5MjMxMTI2MjBaFw0xNzA5MTIxMTI2MjBaMC0xEjAQBgNVBAoMCUlQQS5ERVZFTDEXMBUGA1UEAwwOT0NTUCBTdWJzeXN0ZW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDEXVzkTN9R03+hvAbkiCYqdKKe7Nr0YDlchny+IsJl5cYiFBtWqiVJK5N0L6uCS9bVBtuG7y9Vv1TJrv2U8hqjXYZFM6HzYwwmbE2tv1Yyx0dQyYiYTT0nVyXPrXDJe0PFdYTsAlw7C54wZuBsdDADUTA1ThAP22Z6Zy+UyQFtlqEfCErvHK+VolCfkTJ4dYlQb5x7Gs6fEmLbnaGpJXW1JnRzMZ4hM+/mV3xSsjFuYwwoFCHG6GQu/LJgosBX9M+OMavMOO/AzeUlHfUoyMUNn0iNeiDqeYPBCNf4czK0CpeJdE4qBBgu0vSfC0mzjKRuFQEAUuBGxGE+2BP09uXAgMBAAGjgYwwgYkwHwYDVR0jBBgwFoAU0aLh2me2OKzMbu3zckJNNu3Hd1swDgYDVR0PAQH/BAQDAgHGMEEGCCsGAQUFBwEBBDUwMzAxBggrBgEFBQcwAYYlaHR0cDovL2lwYS1kZXZlbC5pcGEuZGV2ZWw6ODAvY2Evb2NzcDATBgNVHSUEDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAQEAAJzUjm39nsMlxc0ivEm77PN9ZFFWIfY6fOteNpJnOADlOatkXKq6PTFS0lRo/53HjYvmvrjnUTYHK3hmRlDvwr+49UqhSkKai8v6PSS4jYJplETME032OwGL17qCjoX2yU55Ovm3CIamUNNOSIvMBbS7HB0EBe/KHMhme5+Uhtfgjql9B9ihuwT1U3vXQP+cavxe37PJOCUuuATLyd0GX+Islkq2v1pEKX0dsXhMpDwLOYLqckBZHOoAKEo2VYZN0P1KZZkJd4kQHGsADYfuIrLACwzLxlEWmCIq4AOwpYtkMSx85DgT6lW3ECgfbFYVVUzqHUuTiogEsgJ0kouCJw==" | base64 -d | certutil -A -d sql:/dev/shm/tp_pam_srv_tests-test_pam_srv -t TC,TC,TC -n ocsp_cert the NSS library call check this certificate first before trying to connect to the OCSP responder, so a valid one with the right key usage must be added to make NSS try to reach the new OCSP responder - call strace -s 128 -f -esend .libs/lt-p11_child --debug-microseconds=1 --debug-timestamps=1 --debug-to-stderr --debug-level=10 --pre --nssdb sql:/dev/shm/tp_pam_srv_tests-test_pam_srv where you should see lines like send(7, "\313D\1\0\0\1\0\0\0\0\0\0\6ipa-ca\3ipa\5devel\0\0\1\0\1", 34, MSG_NOSIGNAL) = 34 from the DNS lookups for ipa-ca.ipa.devel which is the OCSP server from the ticket - call strace -s 128 -f -esend ./p11_child --debug-microseconds=1 --debug-timestamps=1 --debug-to-stderr --debug-level=10 --pre --nssdb sql:/dev/shm/tp_pam_srv_tests-test_pam_srv --verify 'ocsp_default_responder=http://oooo.cccc.ssss.pppp:80,ocsp_default_responder_signing_cert=ocsp_cert' where you should now see lines like send(7, "yO\1\0\0\1\0\0\0\0\0\0\4oooo\4cccc\4ssss\4pppp\0\0\1\0\1", 37, MSG_NOSIGNAL) = 37 from the DNS lookups for the OCSP responder from the command line. Of course all the validations will fail with "Certificate [SSSD Test Token:Server-Cert][CN=ipa-devel.ipa.devel,O=IPA.DEVEL] not valid [-8071], skipping" because none of the OCSP responders are available but I think this test is sufficient to see that the patch is working as expected. bye, Sumit

3 11

[PATCH] Failover to next server if authentication fails
by Pavel Březina 19 Sep '16

19 Sep '16

We can fail in sasl_bind_send() with ERR_AUTH_FAILED for basically unspecified reason but we do not failover to next server. This patch should fix it. As said on the meeting, I didn't reproduce it and I'm not sure if it will fix the customer issue unless they confirm it, but it seems to be a valid patch anyway.

2 6

[PATCH] sudo man page: say that we support IPA schema
by Pavel Březina 16 Sep '16

16 Sep '16

SSIA

5 12

[PATCH] Warn if ad_server contains IP address
by Justin Stephenson 16 Aug '16

16 Aug '16

First patch, see attached. This is for easy fix from ticket https://fedorahosted.org/sssd/ticket/2789 I am going on the assumption that if the first 2 characters of ad_server are digits then it is likely an IP address and not hostname. If you have a better idea for this please let me know. Kind regards, Justin Stephenson

4 11

[PATCHES] sssctl: print active server and server list
by Pavel Březina 16 Aug '16

16 Aug '16

Failover patches for the sssctl tool. The output looks like: [master.ipa.pb: ~]$ sudo sssctl domain-status ad.pb Online status: Online Active servers: AD Global Catalog: root-dc.ad.pb AD Domain Controller: root-dc.ad.pb IPA: master.ipa.pb Discovered AD Global Catalog servers: - root-dc.ad.pb - invalid.ad.pb - root-dc.ad.pb Discovered AD Domain Controller servers: - root-dc.ad.pb Discovered IPA servers: - master.ipa.pb This is the best output format I could thing of so far, but I'm opened for suggestions.

3 21

[PATCH SET] AD_PROVIDER: ad_enabled_domains
by Petr Cech 09 Aug '16

09 Aug '16

Hello list, there is patch set attached resolving: https://fedorahosted.org/sssd/ticket/2828 You can also see: https://github.com/celestian/sssd/commits/subdomains_v2 This patch set is without tests yet. I will send tests after Pavel B. refactor of AD provider. I would like to remark couple of things: 1) Option ad_enabled_domains disabled by default. 2) We use labels master domain and root domain in code. Master domain belongs to one that SSSD is connected to. Root domain means AD forest root. 3) There is a lot of different environment setup. So this option has slightly different meaning in each of them. 4) There is secret feature if you forget fill in master domain to the option it will be added automatically. What is this option good for? Let's imagine environment like: A (forest root) | |-- S1 (SSSD client) | |-- B (AD client) | | | |-- S2 (SSSD client) | |-- C (AD client) | |-- D (AD client) A ... forest root B, C, D ... AD clients S1 ... SSSD client connected to A S2 ... SSSD client connected to B We could write: * on S1: ad_enabled_domain = A, B, C and then S1 will not attempt to connect D. * on S1: ad_enabled_domain = B, C the same as above because A is automagically filled in. * on S2: ad_enabled_domain = A, C and then B is filled in automatically and S2 will not attempt to connect D. * on S2: ad_enabled_domain = C and then B is filled in automatically and S2 will not attempt to connect D and A. (I am wondering that it is possible but it happened during manual testing.) Regards -- Petr^4 Čech

4 14

[PATCH] TOOLS: Prevent dereference of null pointer
by Lukas Slebodnik 12 Jul '16

12 Jul '16

ehlo, simple aptch is attached. LS

4 9

[PATCH] nss-srv-tests: Fix prototype of wrapped function sss_ncache_check_cert
by Lukas Slebodnik 12 Jul '16

12 Jul '16

ehlo, simple patch is attached. I wonder how it could work because argument ttl was previously in the midle between two other arguments. LS

3 3

[PATCH] FO: Set port to NOT_WORKING when trying a next server
by Jakub Hrozek 12 Jul '16

12 Jul '16

Hi, attached is a patch that I think is correct and it did solve a bug I was seeing, but I'm not sure if it's the right thing to do since the code was stable since 2009.. What I was seeing was a scenario where an LDAP server was listening on port 389, so we were able to connect there with a socket, but then all searches timed out during rootDSE discovery.. What happened in the sdap_id_ops.c code was that we hit this part: 810 switch (retval) { 811 case EIO: 812 ---> case ETIMEDOUT: 813 /* this currently the only possible communication error after connection is established */ 814 communication_error = true; 815 break; 816 817 default: 818 communication_error = false; 819 break; 820 } 821 And then we went here, because the connection was already established: 822 if (communication_error && current_conn != 0 823 && current_conn == op->conn_cache->cached_connection) { 824 /* do not reuse failed connection */ 825 op->conn_cache->cached_connection = NULL; 826 827 DEBUG(SSSDBG_FUNC_DATA, 828 "communication error on cached connection, moving to next server\n"); 829 ----> be_fo_try_next_server(op->conn_cache->id_conn->id_ctx->be, 830 op->conn_cache->id_conn->service->name); 831 } But I admit I don't understand why does be_fo_try_next_server() set the port status to NEUTRAL. That caused the connection code to run again, hit the same timeout issue and then cycle again and again.. Can anyone parse from the code why do we set the port to neutral instead of not_working in be_fo_try_next_server() ?

2 2

[PATCH] SYSDB: Fixing DB update
by Petr Cech 11 Jul '16

11 Jul '16

Hi, there is patch for #3023 attached. Reason for this patch is explained in commit message. I am open to discussion. In my opinion we don't need to connect sysdb pointer with domain structure because it is not used in other upgrade functions too. Regards -- Petr^4 Čech

3 7

[PATCH] PAM: Allow to configure pam services for smartcards
by Lukas Slebodnik 08 Jul '16

08 Jul '16

ehlo, attached patch should fix ticket #2926 The default case (no adding, no removing services) is tested by pam-srv-tests. If the patch is not ready for stable branch sssd-1-13 then we might merge this case with GPO code which uses slightly modified way using hash tables. LS

3 7

[PATCH] SSH-CERT: always initialize cert_verify_opts
by Sumit Bose 07 Jul '16

07 Jul '16

Hi, please find attached two small patches related to the conversion of the public key in a certificate to a public ssh-key. The first fixes an issue which should only happen in master. The second might be useful for already released versions as well, but I would wait until we get a report that the old scheme fails with some certificates. bye, Sumit

2 2

[PATCH] sudo: solve problems with fully qualified names
by Pavel Březina 07 Jul '16

07 Jul '16

See commit message for details. Two configurations needs to be tested -- a domain with use_fully_qualified_name = true and configuration with IPA-AD trusts where default_domain_suffix is set to AD domain.

2 5

[PATCH][PUSHED] MAN: Include idmap_sss.8.xml in the manpage sources
by Jakub Hrozek 07 Jul '16

07 Jul '16

Hi, I pushed the attached patch under the one-liner rule (which I'm not a big fan of, but it's late and I've been wanting to do this release for almost a week..) I hope it's OK with everybody. I added a silly RB to satisfy our git hook.

4 5

fully qualified sysdb names for users and groups
by Jakub Hrozek 07 Jul '16

07 Jul '16

Hi, here is my branch that implements using the fully qualified names in sysdb for users and groups: https://github.com/jhrozek/sssd/commits/sysdb-fqdn The SSSD code changes are done. There are some downstream tests that are failing (some sudo and some HBAC tests), but I think I can chase those down quickly. But -- I still don't have the upgrade code written and I only tested the IPA overrides and IPA-AD trust code manually, so there might be a lot of bugs there. It is also a lot of stuff to review. With that in mind, I would like to ask other developers for opinions -- should we still pursue pushing this refactoring into 1.14? Or should we release 1.14.0 first and push this patchset as the first thing into 1.15? I'm really on the fence myself.

5 15

[PATCH] LDAP: Change the default rfc2307 autofs attribute mappings
by Jakub Hrozek 06 Jul '16

06 Jul '16

Hi, our rfc2307 attribute mappings are wrongs. Because we are close to releasing a major release, I think this is the time to change them. Attached is a patch that changes the attributes and warns users who use any of the changed attributes in default mappings. If we decide to accept this patch, we should also file a ticket to remove the warnings in the next release to avoid warning forever.

4 11

[PATCH] PAM/KRB5: optional otp and password prompting
by Sumit Bose 06 Jul '16

06 Jul '16

Hi, this patch is the SSSD part of the Authentication Indicator related changes in FreeIPA. The basic part is that now it is possible to authenticate at will with either password or 2FA as described on https://fedorahosted.org/sssd/wiki/DesignDocs/PromptingForMultipleAuthentic…. To test you need a FreeIPA server build from the FreeIPA master branch and optionally Nathaniel's '[PATCH 0093] Enable service authentication indicator management' which is currently under review for the kvno related test. Additionally you need MIT Kerberos packages which contain the fix for https://bugzilla.redhat.com//show_bug.cgi?id=1340304. Since this patch changes how libkrb5 gets the password for password authentication with newer version of MIT Kerberos it would be nice if someone can run some regression tests with the AD or plain KRB5 auth_provider. bye, Sumit

3 6

[PATCH] SSH: Do not print an error message if sss_ssh_authorizedkeys is asked for a local user
by Jakub Hrozek 01 Jul '16

01 Jul '16

Hi, please see the attached patch. I didn't find any information in the ssh man pages about the expected error codes from the AuthorizedKeysCommand, but I think we should at least suppress the error messages.. I tested with: $ sss_ssh_authorizedkeys root $ sss_ssh_authorizedkeys user-from-passwd $ sss_ssh_authorizedkeys user-from-ipa $ sss_ssh_authorizedkeys non-existing-user The first three should be silent, the last one still prints an error message. I think that's acceptable, because I would expect ssh to call getpwnam() on its own before calling the AuthorizedKeysCommand.

3 3

[PATCH] IPA: Handle requests for netgroups from trusted domains gracefully
by Jakub Hrozek 01 Jul '16

01 Jul '16

To reproduce, just run: getent netgroup some_name(a)trusted.domain Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the lookup is for anything else than a user or a group.

3 6

[PATCH] Changes to allow SSSD to be used for access control with a machine account belonging to a domain controller.
by Jakub Hrozek 01 Jul '16

01 Jul '16

Hi, I'm resending a patch for ticket #2870 on behalf of the original reporter who also kindly submitted a patch. The patch looks good to me, as soon as we fix CI, I'll submit it as well and I think we can push it..

3 5

Announcing SSSD 1.14 Beta
by Jakub Hrozek 29 Jun '16

29 Jun '16

== SSSD 1.14 Beta === The SSSD team is proud to announce the release of version 1.14 Beta of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * SSSD's cache performance was improved. SSSD now stores operational attributes of cache entries to a separate database with asynchronous writes mode, which results in substantially faster cache update times in most cases. Note that the performance of the initial cache write with an empty cache does not improve, only subsequent updates. * SSSD is able to merge configuration file snippets from an include directory. This functionality requires the latest libini release 1.3.0. * The GPO evaluator is able to skip malformed INI files. This feature is also only available with libini release 1.3.0 or newer. * A new command line tool, called sssctl was added. This tool allows the administrator to observe the status of SSSD. In this version, the tool is able to: * list SSSD domains and subdomains, including their online and offline status * print information about objects stored in the cache * backup or remove the local databases * help truncate SSSD logs * SSSD is able to validate configuration files against a built-in schema. To retain backwards-compatibility with configuration files that would otherwise not validate, the validator only warns about errors in the config file in this version. * An ID-mapping plugin for the winbind deamon was added. With this plugin, it's possible for winbind to use the same ID-mapping scheme as SSSD uses, producing consistent ID values * A new "secrets" responder was added. This responder allows an application to communicate with SSSD over a UNIX socket using the Custodia API. SSSD then stores the secrets either in its local database or proxies them to a remote Custodia server. == Packaging Changes == * SSSD stores ephemeral attributes in a new ldb database called timestamps_$domain.ldb stored in the same directory as the regular caches. * The winbind ID-mapping plugin is packages in its own subpackage called winbind-idmap * The SSSD configuration snippets are being read from a newly-owned directory /etc/sssd/conf.d. * SSSD ships a file with rules for the configuration validator. In Fedora, this file is located at /var/lib/sss/cfg_rules.ini == Tickets Fixed == #385 [RFE] Provide a Method to Display SSSD Status Information #1662 [RFE] Provide a force reload utility #1800 [RFE] create a generic sssdctl utility #1937 [RFE] Improve LDAP error logging #2028 sssd does not detail which line in configuration is invalid #2166 [RFE] SSSD cache database reporting #2247 [RFE] SSSD should be able to merge configuration from multiple files #2466 [RFE] Method for setting custom shells without Unix Attributes in AD account #2602 Optimize cache writes to sysdb #2671 RFE: sss_cache: Add an option to rm the database files #2735 Document best practices from security standpoint for OpenScap team #2751 SSSD can't process GPO from Active Directory when it contains lines with no equal sign #2913 Add a Secrets as a Service component #2918 Make cli_ctx more generic #2921 Replace the monitor ping with an in-process heartbeat #2957 Extend interface between DP and IFP #3070 Add infrastructure for socket-activated responders == Detailed Changelog == Christian Heimes (1): * Secrets: m4 macros for jansson and http-parser Jakub Hrozek (19): * Updating the version for the 1.14 beta release * SYSDB: Move sysdb initialization into a new module sysdb_init.c * UTIL: Add error codes for sysdb too old or too new * SYSDB: Refactor database connection * SYSDB: Add a second, timestamp-only ldb cache * SYSDB: Open a timestamps cache for caching domains * SYSDB: Wrap sysdb_store_group in a transaction and split it into smaller functions * SYSDB: Search the timestamp caches in addition to the sysdb cache * SYSDB: If modifyTimestamp is the same, only update the TS cache * SYSDB: Check if group attributes differ before saving a group * SYSDB: Refactor sysdb_store_user * SYSDB: Only update user attributes if needed * TESTS: Add a unit test for timestamps caches * TESTS: Add an integration test for the timestamps cache * LDAP: Shortcut looking up for group members sooner * Contrib: Add a gdbinit file * BUILD: Fall back to non-strict http parser, if strict is not available * MAN: Include idmap_sss.8.xml in the manpage sources * Updating the translations for the 1.14 beta release Lukas Slebodnik (6): * Prepare ini schema with rules for validation * UTIL: Fix debug message in sssd_async_connect_done * UTIL: Revent connection handling in sssd_async_connect_send * Downcast to errno_t after tevent_req_is_error * BUILD: Fix detection of systemd * BUILD: Detect libsystemd-daemon or libsystemd Michal Židek (3): * GPO: ignore non-KVP lines if possible * confdb: Make it possible to use config snippets * confdb: Check for config file errors on sssd startup Pavel Březina (25): * IFP: Add domain nodes * IFP: new header file that contains interface definitions * sss_sifp: make it compatible with latest version of the infopipe * sss_sifp: return context even on IO error * sss_sifp: bump version to 1:0:1 * sss_tools: add command description * sss_tools: add help commands to usage message * sss_tools: unify description of --debug * sss_tools: tell whether an option was provided * sss_tools: add commands delimiter * sss_tools: pad help message properly * sss_tools: return errno_t instead of system code * sss_tools: add test if sssd is running * sss_tools: create confdb if not exist * sss_override: return EXIT_SUCCESS even when no overrides are found * sss_override: return EXIT_FAILURE if file does not exist during import * ERRORS: Add errors to indicated whether SSSD is running or not * SBUS ERRORS: Add unknown domain * SBUS: Fix typo in comment * SBUS: Add string helper macros * DP: Add function to get be_ctx directly from dp_client * DP: Add org.freedesktop.sssd.DataProvider?.Backend * DP: Add org.freedesktop.sssd.DataProvider?.Failover * IFP: Provide domain and failover status * sssctl: new tool Simo Sorce (14): * Util: Add watchdog helper * Server: Enable Watchdog in all daemons * Monitor: Remove ping infrastructure * Responders: Make the client context more generic * Responders: Add support for socket activation * ConfDB: Add helper function to get "subsections" * Secrets: Add autoconf macros to build with secrets * Secrets: Add initial responder code for secrets service * Add initial providers infrastructure. * Secrets: Add encryption at rest * Secrets: Add Proxy backend * Local secrets provider Content-Type handling * Secrets: Add local container entries support * Monitor: Add mode to generate confdb only Sumit Bose (1): * Add winbind idmap plugin

1 0

[PATCH] BUILD: Fix detection of systemd
by Lukas Slebodnik 29 Jun '16

29 Jun '16

ehlo, @see commit message in attached patch. LS

2 7

[PATCH SET} A new Secrets service
by Simo Sorce 29 Jun '16

29 Jun '16

This patchset implements a new responder like service in SSSD called secrets. It uses the Custodia project API to offer a service where applications/users can store secrets in a way that makes requests remotizable and routable with a high degree of configurability (esp, in conjunction with a Custodia proxy). Included are also accessory patches to change the monitor and other aspects of service startup and monitoring necessary to have this new kind of service which is more independent than the pam/nss based services. There is no testsuite for the service yet. The work is also not complete in that the monitor does not start the service yet, I have an experimental unit file I am working on but it is not fully functional and not included yet.. I do not expect all patches to be accepted right away, but they all work individually (manually tested), but I think it is a good time to start review and bring in what works, as we are going to spread some of the remaining work across multiple people. HTH, Simo. -- Simo Sorce * Red Hat, Inc * New York

4 28

[PATCH] UTIL: Use errno_t in TEVENT_REQ_RETURN_ON_ERROR
by Lukas Slebodnik 29 Jun '16

29 Jun '16

ehlo, attached is a patch for TEVENT_REQ_RETURN_ON_ERROR which was discussed in dp_provider related thread. It "fixes" 6 clang warnings and 150 UNINIT from coverity (visible only in --agresive mode) BTW feel fre to prose different error code for result of down casting == 0. It should not happen but one never knows. LS

2 4

[PATCH 2/2] UTIL: Revent connection handling in sssd_async_connect_send
by Lukas Slebodnik 28 Jun '16

28 Jun '16

ehlo, Simo Did you have a special reason for changing connection handling in commit https://git.fedorahosted.org/cgit/sssd.git/commit/?id=e05d3f5872263aadfbc2f… Because with such change it takes mugh longer unit sssd go into offline mode. I added few debug messages into sssd_async_connect_done. But most important is time of operations. old behaviour with TEVENT_FD_READ | TEVENT_FD_WRITE --------------------------------------------------- (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [generic_ext_search_handler] (0x0040): sdap_get_generic_ext_recv failed [110]: Connection timed out (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sdap_id_op_done] (0x0200): communication error on cached connection, moving to next server (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP' (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sdap_uri_callback] (0x0400): Constructed uri 'ldaps://ibm-x3650m4-01-vm-07.example.com' (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_send] (0x4000): Using file descriptor [21] for the connection. (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Creating request (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Before connect (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): After connect ret:-1 (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Calling tevent_add_fd TEVENT_FD_READ | TEVENT_FD_WRITE (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_connect_done] (0x0020): Before connect (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_connect_done] (0x0020): After connect ret:-1 errno:113 (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_connect_done] (0x0020): connect failed [113][No route to host]. (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_done] (0x0020): sdap_async_sys_connect request failed: [113]: No route to host. (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_socket_state_destructor] (0x0400): closing socket [21] (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sss_ldap_init_sys_connect_done] (0x0020): sssd_async_socket_init request failed: [113]: No route to host. (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sdap_sys_connect_done] (0x0020): sdap_async_connect_call request failed: [113]: No route to host. (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [get_port_status] (0x1000): Port status of port 636 for server 'ibm-x3650m4-01-vm-07.example.com' is 'not working' (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0020): No available servers for service 'LDAP' (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [be_resolve_server_done] (0x1000): Server resolution failed: [5]: Input/output error (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error]) current behaviour with TEVENT_FD_WRITE -------------------------------------- (Sat Jun 18 12:04:27 2016) [sssd[be[LDAP]]] [generic_ext_search_handler] (0x0040): sdap_get_generic_ext_recv failed [110]: Connection timed out (Sat Jun 18 12:04:27 2016) [sssd[be[LDAP]]] [sdap_id_op_done] (0x0200): communication error on cached connection, moving to next server (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP' (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sdap_uri_callback] (0x0400): Constructed uri 'ldaps://ibm-x3650m4-01-vm-07.example.com' (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Creating request (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Before connect (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): After connect ret:-1 (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Calling tevent_add_fd (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sssd_async_connect_timeout] (0x0100): The connection timed out (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_done] (0x0020): sdap_async_sys_connect request failed: [110]: Connection timed out. (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sss_ldap_init_sys_connect_done] (0x0020): sssd_async_socket_init request failed: [110]: Connection timed out. (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sdap_sys_connect_done] (0x0020): sdap_async_connect_call request failed: [110]: Connection timed out. (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sdap_handle_release] (0x2000): Trace: sh[0xfe49dc0], connected[0], ops[(nil)], ldap[(nil)], destructor_lock[0], release_memory[0] (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [get_port_status] (0x1000): Port status of port 636 for server 'ibm-x3650m4-01-vm-07.example.com' is 'not working' (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0020): No available servers for service 'LDAP' (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [be_resolve_server_done] (0x1000): Server resolution failed: [5]: Input/output error (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error]) If you did not have a special reason for this change then I would appreciate if we could change it back. Two patches attached. LS

3 6

[PATCH] confdb: Check for config file errors on sssd startup
by Lukas Slebodnik 27 Jun '16

27 Jun '16

ehlo The first patch is sligtly modified version of Michal's patch. It depends on patch for config snippet. Because config validation is optional if it isn't supported in libini_config. And detection for new libini_config is in patch for config snippets You might see "typos" in sssd.log e.g. (Thu Jun 23 10:48:39:370079 2016) [sssd] [sss_ini_call_validators] (0x0020): [rule/allowed_domain_options]: Attribute 'ldapi_uri' is not allowed in section 'domain/example.com'. Check for typos. BTW don't forget to build with ding-libs-0.6 (libini_config 1.3.0) LS

3 14

[PATCH] confd: Make it possible to use config snippets
by Lukas Slebodnik 27 Jun '16

27 Jun '16

ehlo, Attached is a sligtly modified version of Michal's patch. I fixed few coding style issues + added missing creation of directory + spec file change. You might notice that Michal removed detection of sssd.conf modified time. It is because mtime could be obtiained from sssd.conf before parsing. However, snippets files are open after parsing sssd.conf and mtime of snippet files is ignored in the process. We have few options. * check mtime directly in sssd * add new function to libini_config to get latest mtime before parsing (max_mtime(main.conf + alowed snippet files) // it's little bit a complication for user of libini_config // because user will need to paste regex for allowed snippets twice // 1st time in new function for checking mtime and 2nd time in function // ini_config_augment * modify libini_config to set max mtime while parsing snippet files // but we will need to parse files anyway. So I'm not sure what will be // benefit of cehcking mtime after parsing. * last option is to ignore mtime. (Michal's current version) // and remove FIXME :-) The main purpose of this mail is to decide wheteer we want change in ding-libs or no. BTW. We cannot change directory for snippet files from command line. Do we want such feature? [root@graviton ~]# /usr/sbin/sssd --help Usage: sssd [OPTION...] -d, --debug-level=INT Debug level -f, --debug-to-files Send the debug output to files instead of stderr --debug-timestamps=INT Add debug timestamps --debug-microseconds=INT Show timestamps with microseconds -D, --daemon Become a daemon (default) -i, --interactive Run interactive (not a daemon) -c, --config=STRING Specify a non-default config file --version Print version number and exit Help options: -?, --help Show this help message --usage Display brief usage message LS

4 30

[PATCH] Pavel's sssctl work
by Jakub Hrozek 27 Jun '16

27 Jun '16

Hi, Pavel's sssctl tool is at: https://fedorapeople.org/cgit/pbrezina/public_git/sssd.git/log/?h=sssctl I'll try to have a first pass at review today in the evening, but I thought I'll pass on the branch in case anyone else is interested..

4 18

release notes for the 1.14 beta release
by Jakub Hrozek 27 Jun '16

27 Jun '16

Hi, I prepared release notes for the beta release: https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0beta I wanted to release the tarball today, but I would also like to push the secrets responder and wait for CI to finish..let's try tomorrow.

2 2

[PATCH] Add winbind idmap plugin
by Sumit Bose 24 Jun '16

24 Jun '16

Hi, this patch adds a new plugin similar to the one for the cifs-utils which allows winbind to use the same id-mapping as SSSD. Currently I only added it to the dlopen test because I think it would be best to test it directly when Samba becomes available in the CI. bye, Sumit

4 10

I renamed the 1.15 milestone to 1.16, the new 1.15 tracks Fedora 25 development
by Jakub Hrozek 23 Jun '16

23 Jun '16

Hi, ssia, mostly. The previous 1.15 bucket was just a huge ball of everything we want to work on for the next release. But we're looking at some enhancements sooner, in time for Fedora 25, so I just shifted the version numbers and will add some tickets that we would like to include in Fedora 25 to the new 1.15 milestone. Whether we will call the next version 1.15 or 2.0 or something else is a detail we can sort out later, but for now the idea is that it would be better visible what we are planning for F-25 if we have a smaller milestone.

1 0

[PATCH] Improve sysdb write performance
by Jakub Hrozek 23 Jun '16

23 Jun '16

Hi, the attached patchset improves SSSD by performance by adding a second ldb cache file that is opened with LDB_FLG_NOSYNC and contains empeheral data like timestamps. The reason is to avoid updating the sync-cache in case nothing in fact changed and SSSD is only refreshing the cache to add new timestamps. Especially for group lookups, this can improve performance a bit. The first lookup, or any where the actual data changes is still slow, though. I don't have a CI link yet, because I'm having issues installing pyldb on our test machines. The last patch doesn't touch sysdb, but the LDAP provider. I hope it's fine to include it in the same set, though. The full design document is at: https://fedorahosted.org/sssd/wiki/DesignDocs/OneFourteenPerformanceImprove… I tried to keep the operations contained to the sysdb interface itself, no provider or responder changes were required. To test, you can use the systemtap scripts I sent earlier to the list. For my test user who is a member of about ~200 groups, each containing several hundred members, running 'id' with an empty cache takes: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Total run time of id was: 8581 ms Number of zero-level cache transactions: 166 Time spent in level-0 sysdb transactions: 6045 ms Time spent writing to LDB: 2550 ms Number of LDAP searches: 326 Time spent waiting for LDAP: 1780 ms LDAP searches breakdown: Number of user requests: 1 Time spent in user requests: 20 Number of group requests: 162 Time spent in group requests: 7965 Number of initgroups requests: 1 Time spent in initgroups requests: 115 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Without the patches, the updates take about the same time as filing the empty cache. With the patches, when the cache is expired with "sss_cache -E" and refreshed: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Total run time of id was: 3934 ms Number of zero-level cache transactions: 165 Time spent in level-0 sysdb transactions: 1404 ms Time spent writing to LDB: 6 ms Number of LDAP searches: 326 Time spent waiting for LDAP: 1756 ms LDAP searches breakdown: Number of user requests: 1 Time spent in user requests: 3 Number of group requests: 162 Time spent in group requests: 3377 Number of initgroups requests: 1 Time spent in initgroups requests: 39 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ With the patches, the group lookups performance analysis looks like this: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Time spent in group sssd_be searches: 3570 Time spent in sdap_nested_group_send/recv: 1609 ms (ratio: 45.07%) Time spent in zero-level sysdb transactions: 1694 ms (ratio: 47.45%) Breakdown of sdap_nested_group req (total: 1609 ms) sdap_nested_group_process req: 1608 sdap_nested_group_process_split req: 152 sdap_nested_group_check_cache: 147 sdap_nested_group_sysdb_search_users: 94 sdap_nested_group_sysdb_search_groups: 49 ldap request breakdown of total 1405 sdap_nested_group_deref req: 1455 sdap_deref_search_send req 1405 processing deref results: 50 sdap_nested_group_lookup_user req: 0 sdap_nested_group_lookup_group req: 0 Time spent refreshing unknown members: 0 Breakdown of results processing (total 1694) Time spent populating nested members: 1454 Time spent searching ldb while populating nested members: 1328 Time spent saving nested members: 145 Time spent writing to the ldb: 9 ms ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Apparently, we still can improve the sdap_async.c module to do fewer cache lookups and optimize the dereference results processing to not parse all received attributes if the modifyTimestamp is the same as we already have stored in the cache. But I think the attached patchset already improves the situation quite a bit and can be reviewed on its own. So far I tested IPA client and AD client. I still need to test the IPA server itself and run downstream tests. But I don't think this needs to block the review.

3 8

Announcing ding-libs 0.6.0
by Jakub Hrozek 22 Jun '16

22 Jun '16

A new version of ding-libs was released today! ding-libs, or "Ding is not GLib" is a a set of helpful libraries used by projects such as SSSD or gss-proxy. The tarball can be downloaded from: https://fedorahosted.org/sssd/wiki/Releases == Highlights == * libini_config * libini now supports validators that check for well-formed INI files. Please see the Doxygen documentation for more details on using the new functions. The new functions include: * ini_rules_read_from_file * ini_rules_check * ini_rules_destroy * ini_errobj_* == Note for distribution packagers == * API and ABI is backward compatible with last release (0.5.0) == Detailed Changelog == Dmitri Pal (1): * ini: Add INI_PARSE_IGNORE_NON_KVP flag Lukas Slebodnik (6): * INI: Enable string format check for ini_errobj_add_msg * INI: Extend validator unit test for corner cases * INI: Reduce count of argumets for ini_rules_check * INI: Prepare for schema validation * Bump version-info * Update versions before 0.6.0 release Michal Židek (6): * ini_parse: Add missing TRACE_FLOW_EXIT * Add unit test for INI_PARSE_IGNORE_NON_KVP * ini: Add infrastructure for validators * ini: Add internal validator ini_allowed_options * tests: Tests for rules/validators infrastructure * ini: Add internal validator allowed_sections Robbie Harwood (3): * Document ini_config_augment alphabetical file processing * Fix comment in ini_augment_ut.c * Ensure ding-linbs metapackage depends on libbasicobjects

1 0

[ding-libs] [PATCH] ini: Add infrastructure for validators
by Lukas Slebodnik 22 Jun '16

22 Jun '16

ehlo, The first 4 patches are slightly modified version of Michal's patches. Mostly coding style issues, fixed reports from static analyzers + fixed small issues which would be fixed as part of review process. Last two patches are optional improvements which changes ofiginal API. It was not discussed as part of desing review but these ideas come to my mind as a part or reading code. Please review patches. LS

2 5

release notes for the ding-libs 0.6.0 release
by Jakub Hrozek 22 Jun '16

22 Jun '16

Hi, I prepared very simple release notes for ding-libs 0.6.0: https://fedorahosted.org/sssd/wiki/Releases/DingNotes-0.6.0

1 0

[PATCHES] gpo and ding libs
by Michal Židek 22 Jun '16

22 Jun '16

Hello! See patches in attachment that are part of solution for https://fedorahosted.org/sssd/ticket/2751 There are few ding libs patches. The first is unrelated, but I just added some missing trace info. The second is a patch for new parser flag that Dmitri wrote in discussion for ticket https://fedorahosted.org/sssd/ticket/2986 I modified the patch a little so I can not ack it (the check was necessary on one more place, so I added it there). The third ding libs patch ads unit test for the new flag. I decided to add a new check based test rather than adding the test to ini_parse_ut.c. So it is the only test in the suite for now. There is also a patch for SSSD attached that can take advantage of this flag to solve GPO issues once the new version of ding libs is released. Michal

4 11

Announcing SSSD 1.14 Alpha
by Jakub Hrozek 20 Jun '16

20 Jun '16

== SSSD 1.14 Alpha === The SSSD team is proud to announce the release of version 1.14 Alpha of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * Several internal interfaces were refactored, providing cleaner code and better memory hierarchy. This change will allow the code to be easier to maintain and extend and get rid of sssd_be crashes on service restarts while active requests are running. * The IPA provider allows looking up users from trusted Active Directory domains by certificates that are included in the IPA ID-views. Please note that this functionality requires a recent IPA server. * The AD provider is now able to look up users from Active Directory domains by certificate. This change enables logins for Active Directory users with the help of a smart card. * The sss_override tool is now able to add certificates as local overrides in the SSSD cache. Please note that the certificate overrides are stored in the local cache, so removing the cache also removes all the certificates! * Invalid certificates are skipped instead of aborting the whole operation when logging in with a smart card using SSH. * A new option local_negative_timeout was added. This option allows the admin to specify the time during which lookups for users that are not handled by SSSD but are present on the system (typically in /etc/passwd and /etc/group) and prevents repeated lookups of local users on the remote server during initgroups operation. * This version allows several OCSP-related options such as the OCSP responder to be configured during smart card authentication * SSSD is now able to determine the name of the user who logs in from the inserted smart card without having to type in the username. Please note that this functionality must be enabled with the allow_missing_name pam_sss option. * The sss_cache command line tool is now able to invalidate SUDO rules with its new -r/-R switches. Please note that the sudo rules are not refreshed with the sss_cache tool immediately. Refer to the sssd-sudo man page for the existing refresh timeouts. * The AD provider as well as the IPA provider part that handles AD users is able to use the PAC blob attached to the Kerberos ticket to resolve group memberships for a user if available. If the PAC blob is not available, other methods such as tokenGroups are used instead. * The libipa_hbac library was decorated with debug statements, allowing the administrator to see individual parts of the HBAC rules as well as the request passed to the evaluator * Several systemtap probes were added across the SSSD codebase as well as example systemtap scripts that use these probes. The scripts allow the administrator to observe the performance of some operations such as saving a group or the 'id' command with systemtap. == Packaging Changes == * The libsss_sudo.so and libsss_autofs.so libraries were moved to individual subpackage. This change allows the sudo and autofs libraries to be installed in containers when the SSSD deamon is running on the host or in another container. * The PolicyKit rules used by the p11 child during smartcard authentication were moved into their own subpackage to prevent conflict in ownership with the polkit package * The upstream RPMs no longer run as an unprivileged user, because there are several known issues related to running SSSD completely unprivileged. It it still possible to switch to a non-privileged user in the sssd.conf file. * If no configuration file exists on SSSD startup, the SSSD is now able to read a default sssd.conf on first start. Downstreams are encouraged to ship a default sssd.conf to allow SSSD to be enabled by default. == Documentation Changes == * It is possible to configure SSSD debugging with the debug option which is an alias to the existing debug_level option. * A new local_negative_timeout option was added to configure the time during which lookups for users that exist on the system but are not handled by SSSD are negatively cached. * The PAC responder allows the time during which data read from the PAC bloc is considered valid with a new pac_lifetime option. * Several PAM services were added to the default list of Group Policy mappings. These include adding the unity login manager to the ad_gpo_map_interactive list and the polkit-1 service to the ad_gpo_map_allow list. * The p11 responder allows configuring the default OCSP responder with its new option ocsp_default_responder and the certificate expected to sign the OCSP response with the new ocsp_default_responder_signing_cert option. * The pam_sss.so PAM module has a new option allow_missing_name that allows looking up the user (typically with the help of a certificate on a smartcard) during login. * The sss_override tool gained a new option -x/--certificate that can be used to specify a local (as in the local cache) certificate for a particular user. * The sss_cache tool gained new options -r/-R that allow the administrator to invalidate the sudo rules in the cache. == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1656 Name-space add_string and make it clear it can also remove string https://fedorahosted.org/sssd/ticket/2081 [RFE] sss_cache: invalidate sudo rules https://fedorahosted.org/sssd/ticket/2151 [RFE] Integrate SSSD with containers https://fedorahosted.org/sssd/ticket/2158 PAC responder needs much time to process large group lists https://fedorahosted.org/sssd/ticket/2317 make the negcache timeout part of nc_ctx https://fedorahosted.org/sssd/ticket/2369 check correct usage of talloc_realloc https://fedorahosted.org/sssd/ticket/2424 review the use of umask() in sssd code https://fedorahosted.org/sssd/ticket/2683 man sssd.conf should clarify details about subdomain_inherit option. https://fedorahosted.org/sssd/ticket/2703 Need better libhbac debuging added to sssd https://fedorahosted.org/sssd/ticket/2715 Make it possible to lookup user via UPN / Kerberos principal https://fedorahosted.org/sssd/ticket/2816 CI: whitespace_test FAILED without any output https://fedorahosted.org/sssd/ticket/2848 cache_req: add SID lookups https://fedorahosted.org/sssd/ticket/2855 Move libsss_sudo.so outside sssd-common https://fedorahosted.org/sssd/ticket/2866 Cannot authenticate AD trust users after disconnecting network https://fedorahosted.org/sssd/ticket/2869 cache_req tests don't use leak_check_push/leak_check_pop in fixtures https://fedorahosted.org/sssd/ticket/2870 AD GPO fails if the machine account belongs to a domain controller https://fedorahosted.org/sssd/ticket/2897 Smart Cards: Certificate in the ID View https://fedorahosted.org/sssd/ticket/2903 Review and update wiki pages for 1.14 Alpha https://fedorahosted.org/sssd/ticket/2924 Incorrect mapping for locked vs expired accounts with the krb provider https://fedorahosted.org/sssd/ticket/2928 NSS responder should negatively cache local users for a longer time https://fedorahosted.org/sssd/ticket/2941 Screen locks and smart card is removed - must show a message to insert the correct smartcard https://fedorahosted.org/sssd/ticket/2968 Abstract async connect functions from sss_ldap https://fedorahosted.org/sssd/ticket/2973 Common responder code closes socket to early on client shutdown https://fedorahosted.org/sssd/ticket/2977 ssh with Smartcards - skip invalid certificates https://fedorahosted.org/sssd/ticket/2999 RFE - alias log_level to debug_level https://fedorahosted.org/sssd/ticket/3005 [Patch] Vague error message: [sss_ldap_init_sys_connect_done] (0x0020): ldap_install_tls failed: Connect error https://fedorahosted.org/sssd/ticket/3010 SSSD doesn't fail over to next GC if authentication fails == Detailed Changelog == Alexander Bokovoy (1): * SPEC: Move polkit rules into sssd-polkit-rules subpackage Dan Lavu (5): * sss_override: Add restart requirements to man page * MAN: Clarify that subdomain_inherit only works for IPA and AD * URL in BUILD.txt is incorrect * Clarify that subdomains always use service discovery * PAM: Fix man for pam_account_{expired,locked}_message David Disseldorp (1): * build: detect endianness at configure time Fabiano Fidêncio (4): * sysdb: move add_string() convenience to sysdb.c * sysdb: add sysdb_{add,replace,delete}_string() * sysdb: move add_ulong() convenience to sysdb.c * sysdb: add sysdb_{add,replace,delete}_ulong() Graham Leggett (1): * Add underlying diagnostic message for SSL errors. Jakub Hrozek (72): * Updating the version to track 1.14 development * MAN: Clarify pam_trusted_users option description * MAN: proxy and krb5 are valid access control modules * contrib: Add a pre-push hook to warn about commits without Reviewed-By * AD: Provide common connection list construction functions * AD: Consolidate connection list construction on ad_common.c * tests: Fix compilation warning * FO: Don't free rc-allocated structure * tests: Reduce failover code duplication * FO: Use refcount to keep track of servers returned to callers * tools: Don't shadow 'exit' * IFP: Skip non-POSIX groups properly * SSSD: Add a new option diag_cmd * DP: Drop dp_pam_err_to_string * DP: Check callback messages for valid UTF-8 * sbus: Check string arguments for valid UTF-8 strings * DP: Do not confuse static analysers with dead code * CONTRIB: Add a gdb pretty-printer for ldb and sysdb_attrs * BUILD: Only install polkit rules if the directory is available * AD: Add autofs provider * KRB5: Handle preauth request timeout more gracefully * KRB5: Handle KRB5_REALM_UNKNOWN as ERR_NETWORK_IO * FO: Use tevent_req_defer_callback() when notifying callers * IPA: Use search timeout, not enum timeout for searching overrides * DP: Reduce code duplication in the callback handlers * DP: Reduce code duplication in Data Provider handlers * MAN: Clarify when should TGs be disabled for group nesting restriction * DP: Print warning when the handler is not configured * tests: use unittest.TestCase?.assertCountEqual if possible * Fix pep8 warnings in pyhbac-test.py * SDAP: Make it possible to silence errors from dereference * Add a new option ldap_group_external_member * IPA: Add interface to call into IPA provider from LDAP provider * LDAP: Use the IPA provider interface to resolve external group members * IPA: Use the common if-else coding style * tests: Extend test_child_common.c to include tests for the only_extra_args functionality * NSS: Move a DEBUG message so that it's less confusing * MAN: Move subdomain_inherit to the correct man section * MAN: Move proxy_fast_alias to the correct man section * memberof: Don't allocate on a NULL context * tests: Add a unit test for the external groups resolution * libipa_hbac: Do not use C99 * libipa_hbac: Add more debug messages * libipa_hbac: Fix typo in constant name * libipa_hbac: Move the library to src/lib/ipa_hbac * MAN: Remove duplicate description of the pam_account_locked_message option * AD: Recognize Windows Server 2016 * memberof: Fix a memory leak when removing ghost users * memberof: Don't allocate on NULL when deleting memberUids * tests: Check NULL context in sysdb-tests when removing group members * MAN: Drop the reference to IPAv2 in the man page * Make sdap_process_group_send() static * MAN: Remove references to the obsolete PubkeyAgent? ssh option * UTIL: Add ERR_SBUS_REQUEST_HANDLED * IFP: Do not crash on invalid arguments to GetUserAttr? * UTIL: exit() the forked process if exec()-ing a child process fails * AD: Do not schedule the machine renewal task if adcli is not executable * AD: Do not leak file descriptors during machine password renewal * Do not leak fds in case of failures setting up a child process * LDAP: Try also the AD access control for IPA users * RESPONDER: Fix error check in cache_req.c * UTIL: Add a PROBE macro into probes.h * BUILD: Add build infrastructure for systemtap scripts * SYSDB: Track transaction nesting in sysdb_ctx * SYSDB: Add systemtap probes to track sysdb transactions * STAP: Add helper functions to for human-readable account request representation * LDAP: Decorate the hot paths in the LDAP provider with systemtap probes * CONTRIB: Add a systemtap script to analyze the performance of the 'id' command * CONTRIB: Add a systemstap script to measure nested group code performance * BUILD: Enable systemtap during RPM build and CI * Updating the translations for the 1.14 alpha release * Updating the version for the 1.14 beta release Lukas Slebodnik (107): * CONTRIB: pre-push hook could work with python3 * BUILD: Link just libsss_crypto with crypto libraries * BUILD: Link crypto_tests with existing library * BUILD: Remove unused variable TEST_MOCK_OBJ * BUILD: Avoid symlinks with python modules * SSSDConfigTest: Try load saved config * SSSDConfigTest: Test real config without config_file_version * intg_tests: Fix PEP8 warnings * responder_common_tests: Removed unused libraries * BUILD: Remove unused variables * BUILD: Remove SSS_CRYPTO_LIBS from common libraries * BUILD: Accept krb5 1.14 for building the PAC plugin * BUILD: Fix detection of pthread with strict CFLAGS * sbus_codegen_tests: Suppress warning Wmaybe-uninitialized * BUILD: Fix cleanup without NLS * SDAP: Remove unused sdap_id_ctx from sdap_id_conn_cache_create * BUILD: Fix doc directory for sss_simpleifp * LDAP: Fix leak of file descriptors * BUILD: Remove sudo doxygen file * CI: Workaroung for code coverage with old gcc * FAIL_OVER: Fix warning value computed is not used * cache_req: Fix warning -Wshadow * SBUS: Fix warnings -Wshadow * TESTS: Fix warnings -Wshadow * INIT: Drop syslog.target from service file * AD: Remove unused memory context from ad_user_conn_list * DP_PTASK: Fix warning may be used uninitialized * UTIL: Fix memory leak in switch_creds * TESTS: Initialize leak check * TESTS: Check return value of check_leaks_pop * TESTS: Make check_leaks static function * TESTS: Add warning for unused result of leak check functions * sss_client: Fix underflow of active_threads * sssd_client: Do not use removed memory cache * test_memory_cache: Test removing mc without invalidation * Revert "intg: Invalidate memory cache before removing files" * CONFIGURE: Bump AM_GNU_GETTEXT_VERSION * test_sysdb_subdomains: Do not use assignment in assertions * ldap_local_override_test: Fix failure with python2.6 * sbus_codegen_tests: Use portable definition of large constants * CI: Update suppression file for 32bit el6 * DEBUG: Add missing new lines * AD: Log SID in debug message * SPEC: Change package ownership of %{pubconfpath}/krb5.include.d * SPEC: Move libsss_sudo.so outside sssd-common * SPEC: Fix unowned directories * SPEC: Use systemd macros * pam-srv-tests: Reuse test directory for IO tests * FAILOVER: Improve reporting of errors * TOOLS: Fix warning Wsign-compare * pysss_murmur: Fix warning Wsign-compare * pyhbac: Fix warning Wsign-compare * SPEC: Remove unnecessary clean-up of buildroot * SPEC: Fix packaging of libsss_simpleifp * CONFIGURE: Replace obsoleted macro AC_PROG_LIBTOOL * TESTS: Fix race condition in python test * server-tests: Fix clean-up after successful test * PYTHON: sss_obfuscate should work with python3 * PYTHON: Fix pep8 errors in sss_obfuscate * intg: Change preference of openldap module path * SPEC: Move libsss_autofs.so outside sssd-common * SPEC: Remove unnecessary requirements * sss_idmap-tests: Fix segmentation fault * krb5_child: Warn if user cannot read krb5.conf * Fix typos reported by lintian * UTIL: Use prefix for debug function * UTIL: Provide varargs version of debug_fn * IPA: Use sss_vdebug_fn in hbac_debug_messages * IPA: log real hbac function * HBAC: Check format string in hbac log function * UTIL: Use sss_vdebug_fn for callbacks * Revert "DEBUG: Preventing chown_debug_file if journald on" * DEBUG: Ignore ENOENT for change owner of log files * TOOLS: Fix minor memory leak in sss_colondb_writeline * CI: Use yum-deprecated instead of dnf * BUILD: Remove unused include directories * BUILD: Simplify build of cwrap tests * UTIL: Fix indentation in dlinklist.h * UTIL: Fix warning misleading-indentation * CLIENT: Reduce code duplication * CLIENT: Retry request after EPIPE * libipa_hbac: Ensure we always build with C90 * UTIL: Do not call stderr with negative number * UTIL: Move debug part from util.h -> new debug.h * UTIL: Allow to append new line in sss_vdebug_fn * AUTOMAKE: Force usage of parallel test harness * CI: Use make check instead of make-check-wrap * IPA: Remove unused parameter from ipa_ext_group_member_check * SDAP: Remove unused parameter talloc context * test_ipa_subdom_server: Workaround for slow krb5 + SELinux * SPEC: Run extra unit tests with epel * GPO: Soften umask in gpo_child * GPO_CHILD: Create directories in gpo_cache with right permissions * GPO: Process GPOS in offline mode if ldap search failed * IPA: Check RDN in ipa_add_ad_memberships_get_next * dp_ptask: Fix memory leak in synchronous ptask * test_be_ptask: Check leaks in tests * test_ad_common: Include missing header if building with NSS * SYSDB_SUDO: Remove useless test * IPA_SUDO: Prevent dereference of NULL pointer * intg: Use different uid range for add_remove tests * LDAP: Print port in sdap_print_server * TOOLS: Fix warning maybe-uninitialized * pam-srv-tests: Increase cached_auth_timeout * CI: Exclude files in /tmp during coverage runs * pam-srv-tests: Fix warning unused-function * SPEC: Run sssd as privileged user Mathieu Deaudelin-Lemay (1): * Changes to allow SSSD to be used for access control with a machine account belonging to a domain controller. Michal Židek (15): * SSSDConfig: Do not raise exception if config_file_version is missing * spec: Missing initgroups mmap file * util: Update get_next_domain's interface * tests: Add get_next_domain_flags test * sysdb: Include disabled domains in link_forest_roots * sysdb: Use get_next_domain instead of dom->next * Refactor some conditions * util: Continue if setlocale fails * server_setup: Log failed attempt to set locale * tests: Run intgcheck without libsemanage * tests: Regression test with wrong LC_ALL * ldap_local_override_test: Remove sss_cache from teardown * MAN: sssd.conf should mention SSS_NSS_USE_MEMCACHE * NSS: do not skip cache check for netgoups * GPO: log specific ini parse error messages Nikolai Kondrashov (15): * CI: Exclude whitespace_test from Valgrind checks * TESTS: Make whitespace_test pass without whitespace * man: Mention groups in filter_groups description * man: Note filter_groups are not affecting nesting * intg: Get base DN from LDAP connection object * intg: Add support for specifying all user attrs * intg: Split LDAP test fixtures for flexibility * intg: Reduce sssd.conf duplication in test_ldap.py * intg: Fix RFC2307bis group member creation * intg: Do not use non-existent pre-increment * CI: Do not skip tests not checked with Valgrind * CI: Handle dashes in valgrind-condense * intg: Fix all PEP8 issues * CI: Enforce coverage make check failures * intg: Add more LDAP tests Pavel Březina (131): * sbus codegen tests: free ctx * sss tools: improve option handling * cache_req: provide extra flag for oob request * cache_req: add support for UPN * cache_req tests: reduce code duplication * cache_req: remove raw_name and do not touch orig_name * intg: fix typos * sss_override: fix comment describing format * sss_override: explicitly set ret = EOK * sss_override: steal msgs string to objs * nss: send original name and id with local views if possible * sudo: search with view even if user is found * sudo: send original name and id with local views if possible * sss_tools: always show common and help options * sss_override: fix exporting multiple domains * sss_override: add user-find * sss_override: add group-find * sss_override: add user-show * sss_override: add group-show * sss_override: do not free ldb_dn in get_object_dn() * sss_override: use more generic help text * sss_tools: do not allow unexpected free argument * BE: Add IFP to known clients * AD: remove annoying debug message * man sssd-ad: fix typo * SYSDB: Add missing include to sysdb_services.h * LDAP: Mark globals in ldap_opts.h as extern * AD: Mark globals in ad_opts.h as extern * IPA: Mark globals in ipa_opts.h as extern * KRB5: Mark globals in krb5_opts.h as extern * SUDO: convert periodical refreshes to be_ptask * SUDO: move refreshes from sdap_sudo.c to sdap_sudo_refresh.c * SUDO: move offline check to handler * SUDO: simplify error handling * SUDO: fix sdap_id_op logic * SUDO: fix tevent style * SUDO: fix sdap_sudo_smart_refresh_recv() * SUDO: sdap_sudo_load_sudoers improve iterator * SUDO: set USN inside sdap_sudo_refresh request * SUDO: built host filter inside sdap_sudo_refresh request * SUDO: do not imitate full refresh if usn is unknown in smart refresh * SUDO: fix potential memory leak in sdap_sudo_init * SUDO: obtain host information when going online * SUDO: remove finalizer * SUDO: make sdap_sudo_handler static * SUDO: use size_t instead of int in for cycles * SUDO: get srv_opts after we are connected * AD SRV: prefer site-local DCs in LDAP ping * SDAP: handle ret properly in ldap_get_options() * SDAP: do not fail if refs are found but not processed * SDAP: Add request that iterates over all search bases * SDAP: rename sdap_get_id_specific_filter * SDAP: support empty filters in sdap_combine_filters() * SUDO: use sdap_search_bases instead custom sb iterator * SUDO: make sudo sysdb interface more reusable * SUDO: move code shared between ldap and ipa to separate module * SUDO: allow to disable ptask * SUDO: fail on failed request that cannot be retry * IPA: add ipa_get_rdn and ipa_check_rdn * SDAP: use ipa_get_rdn() in nested groups * IPA SUDO: choose between IPA and LDAP schema * IPA SUDO: Add ipasudorule mapping * IPA SUDO: Add ipasudocmdgrp mapping * IPA SUDO: Add ipasudocmd mapping * IPA SUDO: Implement sudo handler * IPA SUDO: Implement full refresh * IPA SUDO: Implement rules refresh * IPA SUDO: Remember USN * SDAP: Add sdap_or_filters * IPA SUDO: Implement smart refresh * SUDO: sdap_sudo_set_usn() do not steal usn * SUDO: remove full_refresh_in_progress * SUDO: assume zero if usn is unknown * SUDO: allow disabling full refresh * SUDO: remember usn as number instead of string * SUDO: simplify usn filter * IPA SUDO: Add support for ipaSudoRunAsExt* attributes * sdap_connect_send: fail if uri or sockaddr is NULL * MAKE: Do not compile generated header files * cache_req: simplify cache_req_cache_check() * cache_req: do not lookup views if possible * remove user certificate if not found on the server * IPA SUDO: download externalUser attribute * cache_req: bring together search parameters * cache_req: fix typo in debug message * cache_req: break cache_req_input_create into more functions * cache_req: rename debug_fqn to debugobj * cache_req: improve debugging * cache_req tests: remove unused users and groups * mock domain: reset ldb errors * cache_req tests: use leak check in test fixtures * cache_req tests: improve user and group creation * utils: return const char from dup_string_list * cache_req: add SID lookups * cache_req test: add lookup by sid * cache_req: hide input and pass parameters in struct * cache_req: rename cache_req_input to cache_req * cache_req: remove old comment * IPA SUDO: fix typo * IPA SUDO: support old ipasudocmd rdn * SUDO: be able to parse modifyTimestamp correctly * sudo: remove unused structure sudo_dp_request * sudo: use cache_req for initgroups * sudo: do not use tevent when parsing query * sudo: convert get_sudorules to tevent * Inform about (un)successful connection * Failover to next server if authentication fails * Remove braces from DEBUG statements * Rename dp_ptask to be_ptask * Rename dp_refresh.h to be_refresh.h * Rename dp_refresh.c to be_refresh.c * Rename dp_dyndns.h to be_dyndns.h * Rename dp_dyndns.c to be_dyndns.c * Rename dp_backend.h to backend.h * SBUS: Add sbus_conn_register_iface_map * SBUS: Add data provider errors * SBUS: Print debug message when handler fails * ERRORS: Add ERR_OFFLINE * ERRORS: Add ERR_TERMINATED * ERRORS: Add ERR_INVALID_DATA_TYPE * ERRORS: Add ERR_MISSING_DP_TARGET * sdap_search_bases: allow map to be NULL * sdap_search_bases: allow returning only the first reply * sdap ops: add support for deref * DP: Introduce new interface for backend * DP: Add callback for backward compatibility * DP TESTS: Mock data_provider * DP TESTS: Add unit tests for dp_request_table.c * DP: Switch to new interface * RESPONDER: New interface for client registration * DP: Move be_req_acct and remove discard_const Pavel Reichl (39): * SDAP: Relax POSIX check * AD: fix minor memory leak * IPA: fix minor memory leak * SDAP: fix minor memory leak * PROXY: fix minor memory leak * sss_override: amend man page - overrides do not stack * DYNDNS: use realm and server commands only as fallback * DYNDNS: improve nsupdate_msg_add_fwd() * intg: fix assert messages in test_memory_cache * HBAC: remove misleading comment about deny rules * sudo: remove unused param. in ldap_get_sudo_options * autofs: remove unused params in del_autofs_entries * LDAP: remove unused param. in sdap_fallback_local_user * PAM: remove unused parameter cdb * sss_override: Remove unused parameter tool_ctx * SDAP: optional warning - sizelimit exceeded in POSIX check * SDAP: allow_paging in sdap_get_generic_ext_send() * SDAP: change type of attrsonly in sdap_get_generic_ext_state * SDAP: pass params in sdap_get_and_parse_generic_send * sss_override: Removed overrides might be in memcache * sudo: remove unused param name in sdap_sudo_get_usn() * pam-srv-tests: split pam_test_setup() so it can be reused * pam-srv-tests: Add UT for cached 'online' auth. * intg: Add test for user and group local overrides * sysdb-tests: Fix warning - incompatible pointer type * IDMAP: Fix computing max id for slice range * IDMAP: New structure for domain range params * IDMAP: Add support for automatic adding of ranges * IDMAP: Fix minor memory leak * IDMAP: Man change for ldap_idmap_range_size option * NSS: Fix memory leak netgroup * SDAP: Add error code to debug message * IDMAP: Add test to validate off by one bug * SDAP: Add return code ERR_ACCOUNT_LOCKED * PAM: Pass account lockout status and display message * IDMAP: Add minor performance improvements * IDMAP: Make parameter names more descriptive * DP TESTS: Add unit tests for dp_request.c * DP TESTS: Add unit tests for dp_builtin.c Petr Cech (56): * TESTS: Fixing of uninitialized pointer. * HBAC: Better libhbac debugging * REFACTOR: umask(0177) --> umask(SSS_DFL_UMASK) * REFACTOR: DFL_RSP_UMASK constant in responder code * REFACTOR: umask(077) --> umask(SSS_DFL_X_UMASK) * REFACTOR: SCKT_RSP_UMASK constant in responder code * P11_CHILD_NSS: More restrictive permissions * UTILS: More restrictive permissions in domain_info * UTIL-TESTS: More restrictive permissions * TESTS: More restrictive permissions in debug_tests * TESTS: Restrictive permissions in check_and_open * DEBUG: Preventing chown_debug_file if journald on * KRB5_CHILD: More restrictive umask * UTIL: More restrictive umask on sss_unique_file() * TOOLS: DFL_UMASK --> SSS_DFL_UMASK * TEST: Add test_user_by_recent_filter_valid * TEST: Refactor of test_responder_cache_req.c * TEST: Refactor of test_responder_cache_req.c * TEST: Add common function are_values_in_array() * TEST: Add test_users_by_recent_filter_valid * TEST: Add test_group_by_recent_filter_valid * TEST: Refactor of test_responder_cache_req.c * TEST: Add test_groups_by_recent_filter_valid * IPA_PROVIDER: Explicit no handle of services * KRB5_CHILD: Debug logs for PAC timeout * KRB5: Adding DNS SRV lookup for krb5 provider * TOOLS: Fix memory leak after getline() failed * TOOLS: Add comments on functions in colondb * TEST_TOOLS_COLONDB: Add tests for sss_colondb_* * TESTS: global_talloc_context push/pop remove * NEGCACHE: Fixing typo in test_sss_ncache_gid() * NEGCACHE: Removing of condition for ttl = -1 * SYSDB: Add new funtions into sysdb_sudo * TESTS: Test of sysdb_search_sudo_rules * SSS_CACHE: Refactor * TOOL: Invalidation of sudo rules at sss_cache * AUTOFS: Removing of redudant debug message * TEST: Removing duplication of mock_rctx * NEGCACHE: Adding timeout to struct sss_nc_ctx * NEGCACHE: Removing timeout from sss_ncache_check_* * NEGCACHE: Adding getter for timeout * RESPONDER: Removing neg_timeout from pam responder * RESPONDER: Removing neg_timeout from pac_ctx * RESPONDER: Removing neg_timeout from sudo resp. * RESPONDER: Removing neg_timeout from ifp repsonder * RESPONDER: Removing neg_timeout from nss responder * RESPONDERS: Negcache in resp_ctx preparing * RESPONDER: Removing ncache from nss_ctx * RESPONDER: Removing ncache from ifp_ctx * RESPONDER: Removing ncache from pac_ctx * RESPONDER: Removing ncache from pam_ctx * RESPONDER: Removing ncache from sudo_ctx * RESPONDER: Removing of redudant function * AD_PROVIDER: Fix constant char * * RESPONDERS: Negative caching of local users * TEST: New tests for negative caching of locals Robert Antoni Buj Gelonch (1): * Add Catalan translation to LINGUAS Simo Sorce (6): * Krb5/PAM: Fix account lockout error handling * Util: Improve code to get connection credentials * Util: Move socket setup in a common utility file * Util: Set socket options and flags separately * Util Sockets: Tidy up connect() handling * Responders: Fix client destructor Stephen Gallagher (11): * LDAP: Inform about small range size * Monitor: Show service pings at debug level 8 * GPO: Add Cockpit to the Remote Interactive defaults * GPO: Add other display managers to interactive logon * Netlink: Ignore RTM_NEWADDR signals from link-local * GPO: Add "unity" to ad_gpo_map_interactive * UTIL: Add secure copy function * Internal: Rename CONFDB_DEFAULT_CONFIG_FILE * CONFIG: Use default config when none provided * GPO: Add "polkit-1" to ad_gpo_map_allow * DEBUG: Add debug alias for debug_level Sumit Bose (69): * PAM: only allow missing user name for certificate authentication * fix ldb_search usage * fix upn cache_req for sub-domain users * nss: fix UPN lookups for sub-domain users * DP: successful authentication sets explicitly PAM_SUCCESSS * NSS: fix a use-after-free issue * pam-srv-tests: Change service name * cache_req: check all domains for lookups by certificate * IPA: fix override with the same name * p11: allow p11_child to run completely unprivileged * p11: check if cert is valid before selecting it * p11: enable ocsp checks * ldap: skip sdap_save_grpmem() if ignore_group_members is set * initgr: only search for primary group if it is not already cached * LDAP: check early for missing SID in mapping check * nfs idmap: fix infinite loop * ipa_s2n_save_objects(): use configured user and group timeout * Use right domain for user lookups * sdap_save_grpmem: determine domain by SID if possible * ldap: remove originalMeberOf if there is no memberOf * UTIL: allow to skip default options for child processes * DP_TASK: add be_ptask_get_timeout() * AD: add task to renew the machine account password if needed * FO: add fo_get_active_server() * FO: add be_fo_get_active_server_name() * AD: try to use current server in the renewal task * p11: add gnome-screensaver to list of allowed services * Just return NULL if tevent_req_create() fails * subdomains: inherit ldap_krb5_keytab * IPA: lookup idview name even if there is no master domain record * IPA: invalidate override data if original view is missing * sdap: improve filtering of multiple results in GC lookups * pam_sss: reorder pam_message array * SDAP: make some AD specific calls public * LDAP: refactor sdap_ad_tokengroups_initgr_mapping_done() * util: make concatenate_string_array() reusable * AD: process PAC during initgroups request * IPA: rename ipa_s2n_get_fqlist* to ipa_s2n_get_list* * IPA: ipa_s2n_get_list_send() allow other list types * IPA: resolve PAC for trusted users on IPA clients * PAC: only save PAC blob into the cache * sss_override: do not generate DN, search object * tools: read additional data of the master domain * sss_override: only add domain if name is not fully qualified * intg: local override for user with mixed case name * krb5_auth_store_creds: silence spurious debug message * build: move ndr_krb5pac check to the other Samba checks * IPA: terminate properly if view name lookup fails * IPA: use forest name when looking up the Global Catalog * libwbclient: wbcSidsToUnixIds() don't fail on errors * AD: use krb5_keytab for subdomain initialization * p11: add missing man page entry and config API * p11: add no_verification option * p11: add OCSP default responder options * PAM: add pam_sss option allow_missing_name * p11: add PKCS11_LOGIN_TOKEN_NAME environment variable * sysdb: add sysdb_attrs_add_base64_blob() * sysdb: add searches by certificate with overrides * cache_req: use overide aware call for lookup by certificate * ipa: add support for certificate overrides * nss: include certificates in full result list * ipa: save cert as blob in the cache * AD: read user certificate if available * nss: return user certificate base64 encoded * sss_override: add certificate support * IPA: allow lookups by cert in sub-domains on the client * NSS: add SSS_NSS_GETNAMEBYCERT request * nss-idmap: add sss_nss_getnamebycert() * ssh: skip invalid certificates

1 0

[PATCHES] Data provider refactoring
by Pavel Březina 20 Jun '16

20 Jun '16

Hi, the patches are finally ready to be tested and reviewed. It is too huge to be sent to the list so please checkout my fedorapeople or github repo: https://fedorapeople.org/cgit/pbrezina/public_git/sssd.git/log/?h=backend https://github.com/pbrezina/sssd/tree/backend Subdomain handlers are not yet converted so subdomain support is disabled, otherwise everything should work although I'm sure you'll find some bugs. I managed to do some simple tests (initgroups, authentication) with ldap provider so far and will continue testing and fixing so if you find a bug make sure you run with the latest version before reporting it please :-) Since the changes touch almost all areas of SSSD I encourage everyone to run and try. Some handlers were converted quite easily, some took more handy work. Areas that are most likely to contain some bugs are these (please give it extra attention): - proxy provider - if group membership changes during initgroups, nss memory cache should be clear through dbus call - selinux support - hbac support - change password - password migration (ipa) Don't be alarmed with the number of new lines -- there is not that many changes. I copied all touched files and suffixed them with _new so sssd can be compiled and kept working until the latest patches. I also wanted to keep the original code intact for comparison (it was easier for development and it may be handy for bug chasing), you can simply use some diff tool to see the changes. We can squash it in the end. When I will be confident that the patches are stable I will do some clean up and remove content that is no longer needed.

3 22

RFC: 1.14 alpha release notes
by Jakub Hrozek 20 Jun '16

20 Jun '16

Hi, I would like to release 1.14 alpha today, so I prepared the release notes: https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.0alpha I will also move the tickets that didn't make the Alpha release out of the Trac milestone. Please comment or edit the notes directly. For convenience, I copied the first version of the notes below: == Highlights == * Several internal interfaces were refactored, providing cleaner code and better memory hierarchy. This change will allow the code to be easier to maintain and extend and get rid of sssd_be crashes on service restarts while active requests are running. * The IPA provider allows looking up users from trusted Active Directory domains by certificates that are included in the IPA ID-views. Please note that this functionality requires a recent IPA server. * The AD provider is now able to look up users from Active Directory domains by certificate. This change enables logins for Active Directory users with the help of a smart card. * The sss_override tool is now able to add certificates as local overrides in the SSSD cache. Please note that the certificate overrides are stored in the local cache, so removing the cache also removes all the certificates! * Invalid certificates are skipped instead of aborting the whole operation when logging in with a smart card using SSH. * A new option local_negative_timeout was added. This option allows the admin to specify the time during which lookups for users that are not handled by SSSD but are present on the system (typically in /etc/passwd and /etc/group) and prevents repeated lookups of local users on the remote server during initgroups operation. * This version allows several OCSP-related options such as the OCSP responder to be configured during smart card authentication * SSSD is now able to determine the name of the user who logs in from the inserted smart card without having to type in the username. Please note that this functionality must be enabled with the allow_missing_name pam_sss option. * The sss_cache command line tool is now able to invalidate SUDO rules with its new -r/-R switches. Please note that the sudo rules are not refreshed with the sss_cache tool immediately. Refer to the sssd-sudo man page for the existing refresh timeouts. * The AD provider as well as the IPA provider part that handles AD users is able to use the PAC blob attached to the Kerberos ticket to resolve group memberships for a user if available. If the PAC blob is not available, other methods such as tokenGroups are used instead. * The libipa_hbac library was decorated with debug statements, allowing the administrator to see individual parts of the HBAC rules as well as the request passed to the evaluator * Several systemtap probes were added across the SSSD codebase as well as example systemtap scripts that use these probes. The scripts allow the administrator to observe the performance of some operations such as saving a group or the 'id' command with systemtap. == Packaging Changes == * The libsss_sudo.so and libsss_autofs.so libraries were moved to individual subpackage. This change allows the sudo and autofs libraries to be installed in containers when the SSSD deamon is running on the host or in another container. * The PolicyKit rules used by the p11 child during smartcard authentication were moved into their own subpackage to prevent conflict in ownership with the polkit package * The upstream RPMs no longer run as an unprivileged user, because there are several known issues related to running SSSD completely unprivileged. It it still possible to switch to a non-privileged user in the sssd.conf file. * If no configuration file exists on SSSD startup, the SSSD is now able to read a default sssd.conf on first start. Downstreams are encouraged to ship a default sssd.conf to allow SSSD to be enabled by default. == Documentation Changes == * It is possible to configure SSSD debugging with the debug option which is an alias to the existing debug_level option. * A new local_negative_timeout option was added to configure the time during which lookups for users that exist on the system but are not handled by SSSD are negatively cached. * The PAC responder allows the time during which data read from the PAC bloc is considered valid with a new pac_lifetime option. * Several PAM services were added to the default list of Group Policy mappings. These include adding the unity login manager to the ad_gpo_map_interactive list and the polkit-1 service to the ad_gpo_map_allow list. * The p11 responder allows configuring the default OCSP responder with its new option ocsp_default_responder and the certificate expected to sign the OCSP response with the new ocsp_default_responder_signing_cert option. * The pam_sss.so PAM module has a new option allow_missing_name that allows looking up the user (typically with the help of a certificate on a smartcard) during login. * The sss_override tool gained a new option -x/--certificate that can be used to specify a local (as in the local cache) certificate for a particular user. * The sss_cache tool gained new options -r/-R that allow the administrator to invalidate the sudo rules in the cache.

1 0

[PATCH] Remove braces from DEBUG statements
by Pavel Březina 18 Jun '16

18 Jun '16

I realized my template that generates tevent request has still braces around debug message and few of them got in.

2 4

[PATCH] SPEC: Run sssd as privileged user
by Lukas Slebodnik 17 Jun '16

17 Jun '16

ehlo, attached patch makes my life easier. I needn't patch spec file before building sssd for downstream tests. SSSD still has some issues with non-root mode and complicated providers. I would appreciate review. LS

2 4

[PATCH] pam-srv-tests: Fix warning unused-function
by Lukas Slebodnik 17 Jun '16

17 Jun '16

ehlo, attached small patch fix tiny complier warning when building with openssl instead of nss. LS

2 2

[PATCH] DEBUG: Add `debug` alias for debug_level
by Stephen Gallagher 16 Jun '16

16 Jun '16

Our users constantly make the mistake of typing `debug = 9` in the sssd.conf instead of `debug_level = 9` as would be correct. This happens frequently-enough that we should just alias it rather than continue to have people make mistakes. Resolves: https://fedorahosted.org/sssd/ticket/2999

5 10

[PATCH] Add underlying diagnostic message for SSL errors.
by Jakub Hrozek 16 Jun '16

16 Jun '16

Hi, the reporter of https://fedorahosted.org/sssd/ticket/3005 kindly submitted a patch. I'm resending it here for review (looks good to me btw)

2 2

[PATCH] sdap: improve filtering of multiple results in GC lookups
by Sumit Bose 13 Jun '16

13 Jun '16

Hi, this patch fixes and issue during initgroups in AD forests. Please see the commit message for details. To reproduce this you can create a new user outside of CN=Users on the forest root. The new user can be created in an existing container or in a new OU container. Most important is that it is not a child of CN=Users. In a child domain (it must be a child, domains with a different base won't trigger the issue) create a user with the same name. With this setup 'id user(a)forest.root' will not return the complete list of group the user is a member of and the patch should fix this. bye, Sumit

3 8

[PATCH] RESPONDERS: Negative caching of local users
by Petr Cech 10 Jun '16

10 Jun '16

Hello, this patch resolves [1]. This adds new behaviour of negative caching of locals, so it needs new tests. I will send patch with tests soon, but not today. It is applicable after RESPONDERS: Negcache in resp_ctx [2]. For clarity, there is branch with all negative cache's patches [3]. Links: [1] https://fedorahosted.org/sssd/ticket/2928 [2] https://www.mail-archive.com/sssd-devel@lists.fedorahosted.org/msg26580.html [3] https://github.com/celestian/sssd/commits/ncache_v2 Regards -- Petr^4 Čech

4 16

[PATCH] systemtap-based performance probes
by Jakub Hrozek 10 Jun '16

10 Jun '16

Hi, the attached patches are the first self-contained part of my performance work. Using them, I analyzed the performance of 'id' as the worst-case, then realized most of the issues are around processing and storing large groups. The results gathered using these scripts are in fact the base of the improvements documented at: https://fedorahosted.org/sssd/wiki/DesignDocs/OneFourteenPerformanceImprove… I tried to add descriptive commit messages to the patches so that hopefully all the info is in those commit messages. We will probably add more probes into different areas of code, but these are the ones that I already haven't modified for weeks, so I think it should be safe to merge them. The probes are enabled in our RPMs and I would encourage downstreams to enable them as well. There is virtually no cost of having the probes compiled in by default and the benefit would be that admins can run them to see what are the bottlenecks in their environment. I was also wondering if it makes sense to add a generic back-end-request tracking probes and an associated script, but since the data provider is being re-factored at the moment, I think it would be better to land the DP changes first. The reason I split the sysdb probes into several commits (unlike the LDAP probes) is that I think in future, we can use these commits as a reference for adding more probes to different areas of SSSD. CI: http://sssd-ci.duckdns.org/logs/job/42/99/summary.html (BTW, thanks to Lukas for helping me a lot with the build failures on #sssd last week)

2 8

[PATCH] RESPONDER: Fix error check in cache_req.c
by Jakub Hrozek 10 Jun '16

10 Jun '16

Hi, I found this little bug when reviewing Pavel's sudo patch.

3 8

[TESTS] FAIL: pam-srv-tests
by Lukas Slebodnik 10 Jun '16

10 Jun '16

ehlo, I took some time to find out why pam-srv-tests fails so often. https://fedorahosted.org/sssd/ticket/2994 It is caused by slow execution of function sysdb_cache_password_ex. (Thu Jun 9 22:13:36:771048 2016) [sssd] [sysdb_cache_password_ex] (0x0100): start. (Thu Jun 9 22:13:36:771317 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before s3crypt_gen_salt (Thu Jun 9 22:13:36:771678 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before s3crypt_sha512 (Thu Jun 9 22:13:38:022470 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_new_attrs (Thu Jun 9 22:13:38:023115 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_attrs_add_string (Thu Jun 9 22:13:38:023431 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_attrs_add_long (Thu Jun 9 22:13:38:023829 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_attrs_add_long v2 (Thu Jun 9 22:13:38:024156 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_attrs_add_long v3 (Thu Jun 9 22:13:38:024482 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_attrs_add_uint32 (Thu Jun 9 22:13:38:024816 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_set_user_attr (Thu Jun 9 22:13:38:035319 2016) [sssd] [sysdb_cache_password_ex] (0x0100): return eok As you can see, the execution of function s3crypt_sha512 took almost two seconds. Is it caused by valgrind all low entropy? I can try to go deeper and find out which part of function sha512_crypt_r is very slow. But it's faster to write to mailing list rather than wait for results from CI. LS

3 6

[PATCHES] ipa: add support for certificate overrides
by Sumit Bose 09 Jun '16

09 Jun '16

Hi, this set of patches should resolve https://fedorahosted.org/sssd/ticket/2897 "Smart Cards: Certificate in the ID View" and cover all other use cases from https://fedorahosted.org/sssd/wiki/DesignDocs/LookupUsersByCertificatePart2 as well. So basically certificates can be read from IPA and local overrides and from AD with direct in indirect integration. The patches are all about lookups, so Smartcards and authentication is not needed to test them. All is needed is a certificate which can be added to an AD user object or an override object and then try to lookup the user with dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Users.FindByCertificate string:"BASE64_CERTIFICATE_STRING" from a IPA client, IPA server or AD client with AD provier. If the certificate is store in the AD user object and the lookup is started on an IPA client a patch for the IPA server is needed, because the request has to run via the extdom plugin. I'll send a patch to freeipa-devel which will use the sss_nss_getnamebycert() call added by one of the patches to allow the extdom plugin to do lookups by certificate. This means that SSSD on the IPA server must used the attached patches as well. bye, Sumit

3 16

[PATCH] PAM: add pam_sss option allow_missing_name
by Sumit Bose 09 Jun '16

09 Jun '16

Hi, that attached two patches would allow to use the Smartcard support in gdm with SSSD. To use it you should replace pam_pkcs11 in /etc/pam.d/smartcard-auth in the auth section by auth sufficient pam_sss.so allow_missing_name and drop the password section completely. To enable the Smartcard support in gdm the easiest way is to use dconf-editor: DCONF_PROFILE=gdm dconf-editor In the org/gnome/login-screen section you can switch the Smartcard support on and off. Additionally you might want to tune the removal action in org/gnome/settings-daemon/peripherals/smartcard . If now a Smartcard is inserted gdm should register it, call /etc/pam.d/gdm-smartcard which calls /etc/pam.d/smartcard-auth without a user name. With the new option from the first patch pam_sss will accept this and send it to the pam responder. The pam responder can handle this if Smartcard authentication is enabled, tries to read the certificate from the Smartcard, tries to find and matching user and if successful, returns the user name to pam_sss which puts it on the PAM stack and continues with the authentication. It would be nice if someone can review the code even without testing the functionality. In this case I will ask someone else with access to Smartcards and reader to do some functional testing. I think these patches are candidates for the pam wrapper based tests Jakub has for review on the list. I'll start reviewing those and add tests when they are in master. bye, Sumit

3 5

[PATCH] AD: use krb5_keytab for subdomain initialization
by Sumit Bose 09 Jun '16

09 Jun '16

Hi, this is a bit of a follow-up patch to "subdomains: inherit ldap_krb5_keytab". It turned out that if the default keytab contains some completely unrelated keys the SASL initialization might e.g. pick a wrong realm name because the alternative keytab was only added later during the initialization. bye, Sumit

3 6

Session Recording control options
by Nikolai Kondrashov 07 Jun '16

07 Jun '16

Hi everyone, After a little discussion with Dmitri and Sumit we decided that we'll need options for controlling session recording in sssd.conf, after all. The options should be something like this: record_sessions - string, one of: none/some/all, default is "none" record_sessions_users - string, space-separated list of users to record record_sessions_groups - string, space-separated list of groups to record I'm not sure where we should put them. They can't be put into "nss" or "pam" sections alone, as they concern both (nss fakes the shell, pam adds enviroment variables). I would rather put them into the global "sssd" section and have fully-qualified usernames listed there, but I see that there is very little options there otherwise, so I suspect they wouldn't be welcome. Otherwise, we can put them into domain sections, but that would mean duplicating the "record_sessions" option in every one of them, which is inconvenient. What do you think about any of the above? Thanks! Nick

4 8

[PATCH] AD_PROVIDER: Fix constant char *
by Petr Cech 07 Jun '16

07 Jun '16

Hello, there is simple patch attached. Please, look at commit message. Regards -- Petr^4 Čech

5 10

Design document - sssctl
by Pavel Reichl 07 Jun '16

07 Jun '16

Hello, Pavel Březina and I have prepared the 1st draft of design document. We mostly focused on summing up its future functionality and its interface. Please comment if you miss some essential functionality or if you would prefer some different interface. Thanks! https://fedorahosted.org/sssd/wiki/DesignDocs/sssctl

8 27

[PATCH] libwbclient: wbcSidsToUnixIds() don't fail on errors
by Sumit Bose 07 Jun '16

07 Jun '16

Hi, this patch fixes an issue in SSSD's implementation of libwbclient. wbcSidsToUnixIds() translates a list of SID to POSIX IDs and it is expected that if one SID cannot be mapped the related output entry should just get type WBC_ID_TYPE_NOT_SPECIFIED. Currently the request fail completely if one SID cannot be mapped. To test, use 'wbinfo --sids-to-unix-ids' with an invalid SID. Without fix: $ wbinfo --sids-to-unix-ids=S-1-5-21-3692237560-1981608775-3610128199-1104,S-1-5-21-3692237560-1981608775-3610128199-5 wbcSidsToUnixIds failed: WBC_ERR_UNKNOWN_FAILURE wbinfo_sids_to_unix_ids failed With fix: $ wbinfo --sids-to-unix-ids=S-1-5-21-3692237560-1981608775-3610128199-1104,S-1-5-21-3692237560-1981608775-3610128199-5 S-1-5-21-3692237560-1981608775-3610128199-1104 -> uid 700201104 S-1-5-21-3692237560-1981608775-3610128199-5 -> unmapped Even with completely random SIDs you should see a proper output: $ wbinfo --sids-to-unix-ids=S-2-3-4,S-5-6-7 S-2-3-4 -> unmapped S-5-6-7 -> unmapped bye, Sumit

3 4

[PATCHES] Support starting SSSD from a default configuration
by Stephen Gallagher 03 Jun '16

03 Jun '16

These patches provide support for shipping a default configuration file that the monitor will automatically copy to /etc/sssd/sssd.conf if none already exists. The idea is for distributions to be able to provide a default (and resettable) configuration for out-of-the-box behavior. I considered writing the patch to check /etc/sssd and then check /usr/lib*/sssd in turn, but I realized that this would be too complicated with the infopipe interactions (which would need to be updated to do a copy-on-write the first time they changed something). It was simpler to just always create the /etc version and use that. Patch 0001: Create a secure copy function that can be used to duplicate the default configuration Patch 0002: Cosmetic patch; changes the name of an internal macro variable to make it clear that it's the active configuration file, not the default one. Patch 0003: Add the logic to confdb_setup.c to copy over the default configuration if and only if our attempt to load the configuration came up with ERR_MISSING_CONF. It will then try to load it again and proceed or fail from there. The default configuration provided here is to load the SSSD with a single proxy provider that reads from nss_files (and supports authentication through pam_unix). This does not have to be shipped with any downstream package; the idea is that downstreams would be expected to modify this configuration to their own needs. This would need to be called out in the release announcement for whatever version of SSSD incorporates this change. These patches will require a change to the SELinux policy, since the monitor needs to be able to write to the /etc/sssd directory. type=AVC msg=audit(1461088081.353:550): avc: denied { write } for pid=3721 comm="sssd" name="sssd" dev="dm-0" ino=4600013 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:sssd_conf_t:s0 tclass=dir permissive=0 Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access.

3 9

[PATCH] GPO: Add "polkit-1" to ad_gpo_map_allow
by Stephen Gallagher 03 Jun '16

03 Jun '16

Polkit is an authorization mechanism of its own (similar to sudo). SSSD doesn't need to apply additional authorization decisions atop it, so we'll just accept it as "allow". Resolves: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1578415

3 3

[PATCH] LDAP: Try also the AD access control for IPA users
by Jakub Hrozek 03 Jun '16

03 Jun '16

Hi, the attached patch implements Sumit's idea to solve https://fedorahosted.org/sssd/ticket/2927 The user who reported the bug confirmed that the patch works. As an additional improvement, they requested that these results should not be considered when the cache expires, but immediatelly. But honestly I don't know if and how this could be solved (we would need to fetch this attribute always on initgroups on both client and server..) so I would prefer additional ticket and merge this patch first.

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel June 2016