March 2017 - sssd-devel - Fedora mailing-lists

[sssd PR#175][opened] Add module for starting services
by lslebodn 22 Nov '21

22 Nov '21

URL: https://github.com/SSSD/sssd/pull/175 Author: lslebodn Title: #175: Add module for starting services Action: opened PR body: """ This is a WIP version of reducing code duplication in our cwrap integration tests. I am still not sure whether we should also reuse function `create_sssd_fixture`. And if yes; then probably in different nodule then `services` And comments are welcome. BTW I wrote patches few weeks ago; therefore new tests are not converted. I am just sending patches to get some feedback. Site effect of this patches is that tests are cca 20% faster (IIRC) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/175/head:pr175 git checkout pr175

5 5

[sssd PR#132][opened] Add "Wants=" to sssd unit and avoid PAC responder to be always running
by fidencio 02 Jan '20

02 Jan '20

URL: https://github.com/SSSD/sssd/pull/132 Author: fidencio Title: #132: Add "Wants=" to sssd unit and avoid PAC responder to be always running Action: opened PR body: """ The first patch changes the current logic of having the services' sockets disabled by default as it adds a "Wants=" to the sssd unit file, making all the services' sockets enabled by the moment sssd service is enabled. The second patch takes advantage of the first patch and avoids running PAC responder in case its socket is active, leaving the service to be socket-activated when needed. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/132/head:pr132 git checkout pr132

3 40

[sssd PR#128][opened] Fix group renaming issue when "id_provider = ldap" is set
by fidencio 25 Apr '18

25 Apr '18

URL: https://github.com/SSSD/sssd/pull/128 Author: fidencio Title: #128: Fix group renaming issue when "id_provider = ldap" is set Action: opened PR body: """ Those two patches fix https://bugzilla.redhat.com/show_bug.cgi?id=1401241 The sssd.conf used in order to reproduce this issue looks like: ``` [sssd] config_file_version = 2 services = nss, pam domains = ad.fidencio.lan [nss] [pam] [domain/ad.fidencio.lan] ad_domain = ad.fidencio.lan krb5_realm = AD.FIDENCIO.LAN realmd_tags = manages-system joined-with-adcli cache_credentials = True krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = True fallback_homedir = /home/%u@%d ldap_referrals = false enumerate = false id_provider = ldap #id_provider = ad auth_provider = krb5 chpass_provider = krb5 access_provider = ldap ldap_sasl_mech = GSSAPI ldap_schema = ad ldap_user_object_class = user ldap_user_home_directory = unixHomeDirectory ldap_user_principal = userPrincipalName ldap_group_object_class = group ldap_access_order = expire ldap_account_expire_policy = ad ldap_force_upper_case_realm = true ``` The reproducer can be found in the bug report. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/128/head:pr128 git checkout pr128

5 90

[sssd PR#139][opened] Initial revision of sssd pytest framework
by fidencio 21 Nov '17

21 Nov '17

URL: https://github.com/SSSD/sssd/pull/139 Author: mrniranjan Title: #139: Initial revision of sssd pytest framework Action: opened PR body: """ sssd-testlib: library containing shared functions to automtate sssd using pytest copr: https://copr.fedorainfracloud.org/coprs/mrniranjan/sssd-testlib/ Signed-off-by: Niranjan M.R <mrniranjan(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/139/head:pr139 git checkout pr139

4 62

[sssd PR#218][opened] TEST: Adding paython-requests to dependencies
by celestian 05 Oct '17

05 Oct '17

URL: https://github.com/SSSD/sssd/pull/218 Author: celestian Title: #218: TEST: Adding paython-requests to dependencies Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/3353 Note: I am not sure if this is the correct dependency which we were looking for. But it is needed anyway. If we need more don't hesitate to write me. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/218/head:pr218 git checkout pr218

4 25

[sssd PR#50][opened] [RFC] Use GNULIB's compiler warning code
by fidencio 09 Sep '17

09 Sep '17

URL: https://github.com/SSSD/sssd/pull/50 Author: fidencio Title: #50: [RFC] Use GNULIB's compiler warning code Action: opened PR body: """ This patch series was sent to the sssd-devel and some discussions already happened there[0]. I've decided to open the PR because there are some few patches that can be pushed even if we decide to not use the "many warnings" patches. Let's keep track of those patches (and discussions related to them) in the github, in this way we can avoid them to get lost. :-) [0]: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.… Best Regards, Changes: 683f72d (Fabiano Fidêncio, 10 weeks ago) BUILD: Make use of GNULIB's compiler warning code As GNULIB has the 'manywarnings' module, which basically turns on every GCC warning, let's make use of it. We can easily blacklist the warnings we cannot cope with, but the main goal should be to have enabled every possible GCC warning. When new GCC warnings are created the 'manywarnings' file can be refreshed from upstream GNULIB. Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> f59828a (Fabiano Fidêncio, 5 days ago) NSS: Fix "old-style-definition" warning caught by GCC Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> f22aff7 (Fabiano Fidêncio, 5 days ago) SIFP: Fix a "jump-misses-init" warning caught by GCC Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> 58609d3 (Fabiano Fidêncio, 5 days ago) RESOLV: Fix a "-Werror=null-dereference" caught by GCC Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> bd1d7fd (Fabiano Fidêncio, 5 days ago) RESOLV: Simplify reply_weight_rearrange() a little bit Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/50/head:pr50 git checkout pr50

1 20

[sssd PR#211][opened] IFP: Fix of limit = 0 (unlimited result)
by celestian 25 Aug '17

25 Aug '17

URL: https://github.com/SSSD/sssd/pull/211 Author: celestian Title: #211: IFP: Fix of limit = 0 (unlimited result) Action: opened PR body: """ If we set limit to 0 it means that result is unlimited. Internally we restrict number of result by allocation of result array. In unlimited case there was a bug and zero array was allocated. This fix allocates neccessary array when we know real result size. Resolves: https://pagure.io/SSSD/sssd/issue/3306 How to test (this reproducer needs #208 "IFP: Filter with * in Users.ListByName method" applied) ``` systemctl daemon-reload sudo su -c "truncate -s0 /var/log/sssd/*.log" sudo su -c "rm -f /var/lib/sss/db/*" sudo su -c "rm -f /var/lib/sss/mc/*" sudo systemctl restart sssd.service sudo su -c "truncate -s0 /var/log/sssd/*.log" dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Users.ListByName \ string:"*" uint32:"0" dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Groups \ org.freedesktop.sssd.infopipe.Groups.ListByName \ string:"*" uint32:"100" dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Users.ListByDomainAndName \ string:"domain.cygnus" string:"*" uint32:"100" ``` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/211/head:pr211 git checkout pr211

4 16

[sssd PR#214][opened] UTIL: Set udp_preference_limit=0 in krb5 snippet
by celestian 14 Aug '17

14 Aug '17

URL: https://github.com/SSSD/sssd/pull/214 Author: celestian Title: #214: UTIL: Set udp_preference_limit=0 in krb5 snippet Action: opened PR body: """ We add udp_preference_limit = 0 to krb5 snippet. This option enable TCP connection before UDP, when sending a message to the KDC. Resolves: https://pagure.io/SSSD/sssd/issue/3254 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/214/head:pr214 git checkout pr214

5 50

[sssd PR#202][opened] T3315 infopipe group users master
by celestian 03 Aug '17

03 Aug '17

URL: https://github.com/SSSD/sssd/pull/202 Author: celestian Title: #202: T3315 infopipe group users master Action: opened PR body: """ Reproducer is: ``` # PREPARING ipa user-add --first=Test --last=User --email=u1(a)test-domain.sssd test_user ipa group-add test_group # REPRODUCER systemctl daemon-reload sudo su -c "truncate -s0 /var/log/sssd/*.log" sudo su -c "rm -f /var/lib/sss/db/*" sudo su -c "rm -f /var/lib/sss/mc/*" sudo systemctl restart sssd.service ipa group-add-member --users=test_user test_group sss_cache -UG getent group test_group # getent show user test_user in test_group, but dbus call doesn't: dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Groups \ org.freedesktop.sssd.infopipe.Groups.FindByName \ string:test_group # command above returns <RESULT_OBJECT> # We need to update group in cache because method "org.freedesktop.DBus.Properties.GetAll" # doesn't update records (<-- this should be better commented) dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe \ <RESULT_OBJECT> \ org.freedesktop.sssd.infopipe.Groups.Group.UpdateMemberList # --> this call doesn't work without patch "IFP: Parse ghost name in Group.UpdateMemberList" # after this call group is updated in cache and we can call: dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe \ <RESULT_OBJECT> \ org.freedesktop.DBus.Properties.GetAll \ string:"org.freedesktop.sssd.infopipe.Groups.Group" # We expect test_user in result users array. # CLEANING ipa group-del test_group ipa user-del test_user ``` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/202/head:pr202 git checkout pr202

5 29

[sssd PR#189][opened] SELINUX: Use getseuserbyname to get IPA seuser
by justin-stephenson 31 Jul '17

31 Jul '17

URL: https://github.com/SSSD/sssd/pull/189 Author: justin-stephenson Title: #189: SELINUX: Use getseuserbyname to get IPA seuser Action: opened PR body: """ Retrieve SELinux username utilizing libselinux API as a more reliable method than libsemanage calls and remove get_seuser function which is no longer needed. Resolves: https://pagure.io/SSSD/sssd/issue/3308 Tested on IPA client with: - running `semanage login -d testuser` - login as **testuser** and check `/var/log/sssd/selinux_child.log` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/189/head:pr189 git checkout pr189

6 15

[sssd PR#208][opened] IFP: Filter with * in Users.ListByName method
by celestian 31 Jul '17

31 Jul '17

URL: https://github.com/SSSD/sssd/pull/208 Author: celestian Title: #208: IFP: Filter with * in Users.ListByName method Action: opened PR body: """ This patch fixed asterisk in filter of Users.ListByName method. Resolves: https://pagure.io/SSSD/sssd/issue/3305 How to test ``` # We have sssd configured and there are some users # Wee need also ifp service enabled in sssd.conf # Restart sssd systemctl daemon-reload sudo su -c "truncate -s0 /var/log/sssd/*.log" sudo su -c "rm -f /var/lib/sss/db/*" sudo su -c "rm -f /var/lib/sss/mc/*" sudo systemctl restart sssd.service sudo su -c "truncate -s0 /var/log/sssd/*.log" # It will return users (without patch, it will crash). dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Users.ListByName \ string:"*" uint32:"100" ``` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/208/head:pr208 git checkout pr208

5 16

[sssd PR#136][opened] Tlog integration WIP
by fidencio 27 Jul '17

27 Jul '17

URL: https://github.com/SSSD/sssd/pull/136 Author: spbnick Title: #136: Tlog integration WIP Action: opened PR body: """ @lslebodn, @pbrezina, this is the work-in-progress tlog integration patchset I'd like to work on with you. This is not for merging as it is. We can go over it when we meet :) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/136/head:pr136 git checkout pr136

5 87

[sssd PR#32][opened] Requesting a pull to SSSD:master from fidencio:wip/#3138
by fidencio 27 Jul '17

27 Jul '17

URL: https://github.com/SSSD/sssd/pull/32 Author: fidencio Title: #32: Requesting a pull to SSSD:master from fidencio:wip/#3138 Action: opened PR body: """ This patch series is intended to solve #3138 by adding a new service that updates the confdb. As part of the series this service is used by secrets service. I only ran CI locally and the two secrets tests have been failing. /o\ Also, I've noticed some weird behavior, where the sssd-update-confdb service starts for apparently no reason, when upgrading fedora packages. Anyways, these pieces of code really need some detailed review as it was the first time I've been "seriously" playing with TEvent requests. So, please, consider it more like an RFC than a well finished and polished code. Best Regards, """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/32/head:pr32 git checkout pr32

3 14

[sssd PR#181][opened] README.md: Point to our releases on pagure
by jhrozek 19 Jul '17

19 Jul '17

URL: https://github.com/SSSD/sssd/pull/181 Author: jhrozek Title: #181: README.md: Point to our releases on pagure Action: opened PR body: """ Since the README.md is more or less what the wiki front page used to be, it makes sense, especially for Github users, to point to our releases from README.md """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/181/head:pr181 git checkout pr181

3 13

[sssd PR#171][opened] Make our readme.md a bit more user-friendly and add a note about filing bugs
by jhrozek 19 Jul '17

19 Jul '17

URL: https://github.com/SSSD/sssd/pull/171 Author: jhrozek Title: #171: Make our readme.md a bit more user-friendly and add a note about filing bugs Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/171/head:pr171 git checkout pr171

3 14

Fragile test enumeration
by Lukas Slebodnik 19 May '17

19 May '17

2 3

[sssd PR#191][opened] Few spec file fixes
by lslebodn 03 May '17

03 May '17

URL: https://github.com/SSSD/sssd/pull/191 Author: lslebodn Title: #191: Few spec file fixes Action: opened PR body: """ Mostly related to https://pagure.io/SSSD/sssd/issue/3327 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/191/head:pr191 git checkout pr191

2 18

[sssd PR#220][opened] Fix setting up [application] domains without inherit_from
by jhrozek 28 Apr '17

28 Apr '17

URL: https://github.com/SSSD/sssd/pull/220 Author: jhrozek Title: #220: Fix setting up [application] domains without inherit_from Action: opened PR body: """ To test, just define an application domain as the only domain in the config file and do not use the inherit_from attribute. A more detailed description is in the commit description. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/220/head:pr220 git checkout pr220

2 5

[sssd PR#199][opened] SPEC: Drop conditional build for krb5_local_auth_plugin
by lslebodn 19 Apr '17

19 Apr '17

URL: https://github.com/SSSD/sssd/pull/199 Author: lslebodn Title: #199: SPEC: Drop conditional build for krb5_local_auth_plugin Action: opened PR body: """ It was mainly aimed for time when stable CentOS and rhel nightly had different versions of krb5. Anyway, rhel7.0 and rhel <= 6.6 are already out of support """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/199/head:pr199 git checkout pr199

2 5

[sssd PR#206][opened] IFP: Fix of names in GetUserGroups method
by celestian 19 Apr '17

19 Apr '17

URL: https://github.com/SSSD/sssd/pull/206 Author: celestian Title: #206: IFP: Fix of names in GetUserGroups method Action: opened PR body: """ This patch adds code which chooses the right domain for creation of output group's name. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/206/head:pr206 git checkout pr206

3 11

OK to just push converted docs from fedorahosted wiki to the pagure docs repo?
by Jakub Hrozek 18 Apr '17

18 Apr '17

Hi, would anyone complain if I just push converted content from fedorahosted to the docs repo w/o review as long as there are no changes OR the changes are just alingnment of 1.15 design documents with the actual implementation? As 1.15 is making its way to downstreams, there are people interested in what we've accomplished in this release and we should make sure the changes are documented. For totally new content, I think we should have at least spot-check the docs during a review.

2 4

[sssd PR#193][opened] UTIL: Use max 15 characters for AD host UPN
by lslebodn 18 Apr '17

18 Apr '17

URL: https://github.com/SSSD/sssd/pull/193 Author: lslebodn Title: #193: UTIL: Use max 15 characters for AD host UPN Action: opened PR body: """ We do not want to use host principal with AD "host/name.domain.tld(a)DOMAIN.TLD" becasue it does not work. We need to use correct user principal for AD hosts. And we cannot rely all fallback "*$" becuase of other principals in keytab. Resolves: https://pagure.io/SSSD/sssd/issue/3329 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/193/head:pr193 git checkout pr193

5 24

Design document - SSSD KCM server
by Jakub Hrozek 10 Apr '17

10 Apr '17

Hi, I was working on a KCM server for SSSD for some time already in parallel with the files provider and had some discussions with Simo as well. Of course my intent wasn't to implement a feature secretly without a design review, but to have a prototype to base a proper design on :) However it makes sense to have a peer-reviewed design page now, also because of Fedora's move towards Kerberos and KDC proxy, which leads to questions on the Fedora lists about ccache renewals and so on -- so I think it makes sense to pitch the design to Fedora at least already.. Here is the design page: https://fedorahosted.org/sssd/wiki/DesignDocs/KCM and here is the code of the KCM responder so far: https://github.com/jhrozek/sssd/tree/kcm Time-wise, I would like to pivot to return to working on KCM now that the files provider is more or less done and tested. For your convenience, the design page text is included below as well. = KCM server for SSSD = Related ticket(s): * https://fedorahosted.org/sssd/ticket/2887 External links: * [http://k5wiki.kerberos.org/wiki/Projects/KCM_client MIT wiki KCM documentation] === Problem statement === This design page describes adding a new SSSD responder, called `sssd_kcm`. This component would manage Kerberos credential caches and store them in SSSD's secrets storage. === Use cases === * A sysadmin needs to deploy applications in containers without worrying about applications clobbering each other's credential caches in a kernel keyring as keyrings are not namespaced * A user wants to keep having her Kerberos ticket automatically renewed regardless of the ticket being acquired through a PAM conversation with SSSD or from the command line with kinit * A system admin wants to leverage a collection-aware credentials cache for most of applications on their systems, yet enable a legacy application that can only work with a FILE-based ccache to interoperate with them === Overview of the solution === Over time, both libkrb5 and SSSD used different credential cache types to store Kerberos credentials - going from a simple file-based storage (`FILE:`) to a directory (`DIR:`) and most recently a kernel-keyring based cache (`KEYRING:`). Each of these caches has its own set of advantages and disadvantages. The `FILE` ccache is very widely supported, but does not support multiple primary caches. The `DIR` cache does, but creating and managing the directories including proper access control can be tricky. The `KEYRING` cache is not well suited for cases where multiple semi-isolated environments might share the same kernel. Managing credential caches' lifetime is not well solved in neither of these cache types automatically, only with the help of a daemon like SSSD. An interesting credentials cache that might solve the issues mentioned above is `KCM`. With KCM, the Kerberos caches are not stored in a "passive" store, but managed by a daemon. In this setup, the Kerberos library (typically used through an application, like for example, `kinit`) is a "KCM client" and the daemon is being referred to as a "KCM server". Having the Kerberos credential caches managed by a deamon has several advantages: * the daemon is stateful and can perform tasks like Kerberos credential cache renewals or reaping old ccaches. Some tasks, like renewals are possible already with SSSD, but only for tickets that SSSD itself acquired (typically via a login through `pam_sss.so`) and tracks. Tickets acquired otherwise, most notably though kinit wouldn't be tracked and renewed. * since the process runs in userspace, it is subject to UID namespacing, [http://www.projectatomic.io/blog/2014/09/yet-another-reason-containers-don-… unlike the kernel keyring] * unlike the kernel keyring-based cache, which is entirely dependant on UIDs of the caller and in a containerized environment is shared between all containers, the KCM server's entry point is a UNIX socket which can be bind-mounted to only some containers * the protocol between the client and the server can be extended for custom operations such as dumping a cache in a different format to a specific location. This would be beneficial for applications that only understand a certain Kerberos ccache type - for example, some legacy applications only know how to deal with a FILE-based cache, thus preventing the use of cache collections Only the Heimdal Kerberos implementation currently implements a KCM server, but both Heimdal and MIT implement the client-side operations (in libkrb5) to manage KCM-based Kerberos ccaches. This design page describes adding a KCM server to SSSD. While it's of course possible to create a completely standalone deamon that would implement a KCM server, doing so in the context of SSSD has several advantages, notably: * An easy access to the authentication provider of SSSD that already has existing and tested code to renew Kerberos credentials on user's behalf * SSSD already has a D-Bus API that could publish information about Kerberos tickets and for example emit signals that a graphical application can consume * SSSD has a 'secrets provider' to store data at rest. It makes sense to leverage this component to store Kerberos ccaches persistently === Implementation details === A new SSSD responder will be added. Since accessing the Kerberos credentials is quite an infrequent operation, the responder will be socket-activated. This responder would implement the same subset of the KCM protocol the MIT client libraries implement. Contrary to Heimdal's KCM server that just stores the credential caches in memory, the SSSD KCM server would store the ccaches in the secrets database through the sssd-secret's responder [https://jhrozek.fedorapeople.org/sssd/1.14.2/man/sssd-secrets.5.html public REST API]. For user credentials the KCM Server would use a secrets responder URI like `/kcm/users/1234/X` where 1234 is the user ID and X is the residual. The client then gets assigned a KRB5CCNAME of KCM:1234:X. Internally in the secrets responder we will store the credential caches under a new base DN `cn=kcm`. The secret responder's quota on secrets must be made modular to allow different number of secrets per base DN (so, different number of secrets and credentials pretty much). What to do in case the quota is reached is debatable - we should probably first remove service (non-TGT) tickets first for valid TGTs and if that's not possible, just fail. A failure in this case would be no different than a failure if a disk is full when trying to store a FILE-based ccache. The KCM responder would renew the user credentials by starting a tevent timer which would then contact the SSSD Data Provider for the given UID and principal, asking for the credentials to be renewed. Another tevent timer would reap and remove a ccache that reaches its lifetime. In the future, SSSD-specific operations such as writing out a FILE-based ccache might be added. The SSSD D-Bus interface would also be extended to publish information about credentials activity (such as - a ticket being acquired, a ticket was renewed etc) === Configuration changes === No KCM-specific configuration options will be added. The SSSD KCM responder would use the same common options like other SSSD services such as idle timeout. We can add a configurable KCM socket location later, if needed, but for the start it's fine to default to `/var/run/.heim_org.h5l.kcm-socket` mostly because that's what MIT defaults to as well. '''Q''': Should we add an option to explicitly enable ccache renewals and default to no renewals? I don't think this would any any security though, the attacker can just run 'kinit -R' on behalf of the user anyway. === How To Test === In order for the admin to start using the KCM service, the sssd-kcm responder's systemd service must be enabled. Then, libkrb5 must also be configured to use KCM as its default ccache type in `/etc/krb5.conf` {{{ [libdefaults] default_ccache_name = KCM }}} After that, all common operations like kinit, kdestroy or login through pam_sss should just work and store their credentials in the KCM server. The KCM server must implement access control correctly, so even trying to access other user's KCM credentials by setting KRB5CCNAME to `KCM:1234:RESIDUAL` would not work (except for root). Restarting the KCM server or rebooting the machine must persist the tickets. As far as automatic unit and integration testing is required, we need to make sure that MIT's testsuite passes with Kerberos ccache defaulting to KCM and SSSD KCM deamon running. In the SSSD upstream, we should write integration tests that run a MIT KDC under socket_wrapper to exercise the KCM server. === How To Debug === The SSSD KCM server would use the same DEBUG facility as other SSSD services. In order to debug the client side operations, setting the `KRB5_TRACE` variable might come handy. When debugging the setup, the admin might also inspect the SSSD secrets database (if permissable by SELinux policy) to see what credential caches have been stored by the SSSD. === Authors === * Jakub Hrozek <jhrozek(a)redhat.com> * Simo Sorce <simo(a)redhat.com>

3 7

[sssd PR#196][opened] SSSD-1.15 - config-check: Message when sssd.conf is missing
by mzidek-rh 10 Apr '17

10 Apr '17

URL: https://github.com/SSSD/sssd/pull/196 Author: mzidek-rh Title: #196: SSSD-1.15 - config-check: Message when sssd.conf is missing Action: opened PR body: """ SSSD 1.15 version for patch recently pushed to 1.14. sssctl config-check should print a message for user if no sssd.conf was found. Resolves: https://pagure.io/SSSD/sssd/issue/3330 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/196/head:pr196 git checkout pr196

2 9

[sssd PR#200][opened] Improve PAM test client
by sumit-bose 10 Apr '17

10 Apr '17

URL: https://github.com/SSSD/sssd/pull/200 Author: sumit-bose Title: #200: Improve PAM test client Action: opened PR body: """ This patch set makes the PAM test client more flexible and adds additional lookups of the user via NSS and InfoPipe. For simplicity this version uses libsss_simpleifp to access InfoPipe. A later version might use libdbus directly to reduce the number of dependencies. Related to https://pagure.io/SSSD/sssd/issue/3292 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/200/head:pr200 git checkout pr200

4 16

WIP design page: Subdomain configuration
by Michal Židek 07 Apr '17

07 Apr '17

Hi, I started working on the design page for subdomain configuration in server mode. It is located here: https://fedorahosted.org/sssd/wiki/DesignDocs/SubdomConf The implementation details and how to debug sections will be added later. For now, the design page is short but should at least set the proper expectations for the feature. Please tell me if you think something is unclear. I will add more to the page soon. Michal

3 5

[RFC] Matching and Mapping Certificates
by Sumit Bose 07 Apr '17

07 Apr '17

Hi, I've started to write a SSSD design page about enhancing the current mapping of certificates to users and how to select/match a suitable certificate if multiple certificates are on a Smartcard. My currently thoughts and idea and be found at https://fedorahosted.org/sssd/wiki/DesignDocs/MatchingAndMappingCertificates and for your convenience below as well. Comments and suggestions are welcome. Please let me know about concerns, alternatives and missing use-cases/user-stories. bye, Sumit = Matching and Mapping Certificates = Related ticket(s): * http://www.freeipa.org/page/V4/User_Certificates#Certificate_Identity_Mappi… === Problem statement === ==== Mapping ==== Currently it is required that a certificate used for authentication is either stored in the LDAP user entry or in a matching override. This might not always be applicable and other ways are needed to relate a user with a certificate. ==== Matching ==== Even if SSSD will support multiple certificates on a Smartcard in the context of https://fedorahosted.org/sssd/ticket/3050 it might be necessary to restrict (or relax) the current certificate selection in certain environments. === Use cases === ==== Mapping ==== In some environments it might not be possible or would cause unwanted effort to add certificates to the LDAP entry of the users to allow Smartcard based authentication. Reasons might be: * Certificates/Smartcards are issued externally * LDAP schema extension is not possible or not allowed ==== Matching ==== A user might have multiple certificate on a Smartcard which are suitable for authentication. But on some host in the environment only certificates from a specific CA (while all other CAs are trusted as well) or with some special extension should be valid for login. === Overview of the solution === To match a certificate a language/syntax has to be defined which allows to reference items from the certificate and compare the values with the expected data. To map the certificates to a user the language/syntax should allow to relate certificate items with LDAP attributes so that the value(s) from the certificate item can be used in a LDAP search filter. === Implementation details === ==== Matching ==== The pkinit plugin of MIT Kerberos must find a suitable certificate from a Smartcard as well and has defined the following syntax (see the pkinit_cert_match section of the krb5.conf man page or http://web.mit.edu/Kerberos/krb5-1.14/doc/admin/conf_files/krb5_conf.html for details). The main components are * <SUBJECT>regular-expression * <ISSUER>regular-expression * <SAN>regular-expression * <EKU>extended-key-usage-list * <KU>key-usage-list and can be grouped together with a prefixed '&&' (and) or '`||`' (or) operator ('&&' is the default). If multiple rules are given they are iterated with the order in the config file as long as a rule matches exactly one certificate. '''Question: MIT Kerberos use case-sensitive matching and POSIX Extended Regular Expression syntax, shall we do the same?''' While <SUBJECT> and <ISSUER> are (imo) already quite flexible I can see some potential extensions for the other components. <EKU> and <KU> in MIT Kerberos only accept certain string values related to some allowed values in those field as defined in https://www.ietf.org/rfc/rfc3280.txt . The selection is basically determined by what is supported on server side of the pkinit plugin of MIT Kerberos. Since we plan to extend pkinit and support local authentication without pkinit as well I would suggest to allow OID strings for those components as well (the comparison is done on the OID level nonetheless). The <SAN> component in MIT Kerberos only checks the otherName SAN component for the id-pkinit-san OID as defined in https://www.ietf.org/rfc/rfc4556.txt or the szOID_NT_PRINCIPAL_NAME OID as mentioned in https://support.microsoft.com/en-us/kb/287547. While this is sufficient for the default pkinit user case of MIT Kerberos I would suggest to extend this component by allowing to specific an OID with <SAN:O.I.D> ==== Mapping ==== Since different certificates, e.g. issued by different CAs, might have different mapping rule, a matching rule must be added if there are more than 1 mapping rule. A single mapping rule without a matching rule might be used as default/catch-all rule in this case. If multiple rules matches the derived LDAP filter components can be grouped with the or-operator "|". A mapping rule can use a similar syntax like the matching rule where the LDAP attribute can be added with a ':', e.g. * <SUBJECT:ldapAttributeName> * <SAN:O.I.D.:ldapAttributeName> Currently I see no usage for <ISSUER>, <KU> and <EKU> in mapping rules because they do not contain any user-specific data. If at some point we will have personal CAs we might consider to add <ISSUER> based mappings. '''Question, do we need search-and-replace at all (or at this stage)? Most of the interesting values from the SAN should be directly map-able to LDAP attributes. And processing the string representation of <SUBJECT> might be tricky as discussed below. Nevertheless the following might be possible: * <SUBJECT:ldapAttributeName>/regexp/replacement/ * <SAN:O.I.D.:ldapAttributeName>/regexp/replacement/ '''where "/regexp/replacement/" stands for optional sed-like substitution rules. E.g. a rule like {{{ <SUBJECT:samAccountName>/^CN=$[^,]*$.*$/\1/ }}} '''would take the subject string 'CN=Certuser,CN=Users,DC=example,DC=com' from the certificate and generate a LDAP search filter component '(samAccountName=Certuser)' which can be included in a LDAP search filter which includes additional components like e.g. an objectClass. '''The search-and-replace does not has to be sed-like because afaik there is not library which offers this and I would like to avoid implementing it. GLib e.g. has [https://developer.gnome.org/glib/stable/glib-Perl-compatible-regular-expres… g_regex_replace]. Since we already have a GLib dependency in SSSD due to soem utf8 helper functions using might be acceptable as well. Nevertheless it would be nice to hear if there are alternative libraries available as well. ''' ===== Some notes about DNs ===== The X.500 family of standards define names as "SEQUENCE OF RelativeDistinguishedName" where the sequence is "starting with the root and ending with the object being named" (see X.501 section 9.2 for details). On the other hand RFC4514 section 2.1 says "Otherwise, the output consists of the string encoding of each RelativeDistinguishedName in the RDNSequence (according to Section 2.2), starting with the last element of the sequence and moving backwards toward the first." This means that the ASN.1 encoded issuer and subject DN from the X.509 certificate can be either displayed as string in the * X.500 order: DC=com,DC=example,CN=users,CN=Certuser or in the * LDAP order: CN=Certuser,CN=Users,DC=example,DC=com As a consequence different tools will use a different order when printing the issuer and subject DN. While NSS's certutil will use the LDAP order, 'openssl x509' and gnutls's certtool will use the X.500 order (the latter might change due to https://gitlab.com/gnutls/gnutls/issues/111) This makes it important to specific the order which is used by SSSD for mapping and matching. I would prefer the LDAP order here. E.g. by default the AD CA uses the DN of the users entry in AD as subject in the issues certificate. So a matching rule like '<SUBJECT:dn>' could tell SSSD to directly search the user based on its DN (which btw is the original intention of the subject field in the certificate, only that the DN should be looked up in a more general DAP as defined by X.500 and not in the lightweight version called LDAP) Another issue is the limited set of attribute names/types required by the RFCs (see section 4.1.2.4 of RFC 3280 and section 3 of RFC 4514). If e.g. the deprecated OID [http://www.oid-info.com/get/1.2.840.113549.1.9.1 1.2.840.113549.1.9.1] is used all tools are able to identify it as an email address but OpenSSL displays it as 'emailAddress=user(a)example.com', certtool as 'EMAIL=user(a)example.com' and certutil as 'E=user(a)example.com'. So matching rules should try to avoid attribute names or only the ones from [https://www.ietf.org/rfc/rfc4514.txt RFC 4514]: * CN commonName (2.5.4.3) * L localityName (2.5.4.7) * ST stateOrProvinceName (2.5.4.8) * O organizationName (2.5.4.10) * OU organizationalUnitName (2.5.4.11) * C countryName (2.5.4.6) * STREET streetAddress (2.5.4.9) * DC domainComponent (0.9.2342.19200300.100.1.25) * UID userId (0.9.2342.19200300.100.1.1) ==== About restricting or enforcing the mapping an matching any further ==== The goal of the matching rules in MIT Kerberos is to select a single certificate from a Smartcard which will then be used for PKINIT. Since we already plan to enhance SSSD to support multiple certificates on a Smartcard and if needed prompt the user which one to use for login we should not enforce that the matching rules should return only a single certificate or nothing. Similar we plan to enhance SSSD to use the same certificate to log in with different user identities, e.g. as a user with standard privileges or as a user with administrator privileges. So it can make sense that multiple mapping rules apply to the same certificate and the related LDAP search filter components are or-ed together. In many cases the login program will first ask for a user name which will help to restrict the number of suitable certificates even further and the mapping rules are only needed to check if the certificate belongs to the user trying to log in. But gdm has a feature where gdm will detect when a Smartcard is inserted and call PAM without a user name. In this case SSSD has to determine the user name based on the certificates found on the Smartcard. If in this case multiple valid certificates are on the card and the mapping rules will return multiple users for each certificate gdm has to display a quite long selection of certificate-user pairs the user has to choose from. So it should be underlined in the documentation that the matching and mapping rules should be detailed and specific so that for the given environment they help to avoid cases where the user is prompted to select a certificate (or user name in the gdm case) when trying to log in. ==== Storing matching and mapping configuration ==== On the IPA server a new objectclass can be created to store an matching-mapping rule pair. Both attributes are optional because a missing mapping rule would mean that the user entry will be search with the whole certificate. A missing matching rule will indicate catch-all rule with a default mapping. Specifying matching-mapping rules in sssd.conf is a bit more complicated because SSSD does not respect multiple entries with the same keyword, only the last one is used. So all rules have to be added to a single line. To give it a little bit of structure the rules can be enclosed by curly-braces '{}{}' and each rule pair is separated by a comma ','. A single rule in curly braces indicates a matching rule and the mapping will be done with the whole certificate. A default/catch-all mapping rule will start with an empty pair of curly braces followed by a pair containing the mapping rule. ===== Examples ===== * '''certificate_rules = {<EKU>msScLogin}''': only allow certificates with have the Microsoft OID for Smartcard logon 1.3.6.1.4.1.311.20.2.2 set. use the whole certificate to look-up the user. The same result can be achieved with * '''certificate_rules = {<EKU>1.3.6.1.4.1.311.20.2.2}''': see above * '''certificate_rules = {<ISSUER>*my-company*<SAN:rfc822Name>*(a)my-company.com$}{<SAN:rfc822Name:mail>}''': only allow certificates form the 'my-company' issuer which have an email address from the 'my-company.com' domain in the rfc882Name SAN attribute. Use the email address in a LDAP search filter '(mail=email-address)' to find the matching user. === Configuration changes === Does your feature involve changes to configuration, like new options or options changing values? Summarize them here. There's no need to go into too many details, that's what man pages are for. === How To Test === This section should explain to a person with admin-level of SSSD understanding how this change affects run time behaviour of SSSD and how can an SSSD user test this change. If the feature is internal-only, please list what areas of SSSD are affected so that testers know where to focus. === How To Debug === Explain how to debug this feature if something goes wrong. This section might include examples of additional commands the user might run (such as keytab or certificate sanity checks) or explain what message to look for. === Authors === Give credit to authors of the design in this section.

7 23

[sssd PR#165][opened] selinux: Do not fail if SELinux is not managed
by mzidek-rh 06 Apr '17

06 Apr '17

URL: https://github.com/SSSD/sssd/pull/165 Author: mzidek-rh Title: #165: selinux: Do not fail if SELinux is not managed Action: opened PR body: """ Previously we failed if selinux_is_managed returned 0 or -1 (not managed or error). With this patch we only fail in case of error and continue normally if selinux is not managed by libsemanage at all. Resolves: https://fedorahosted.org/sssd/ticket/3297 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/165/head:pr165 git checkout pr165

4 22

[sssd PR#219][opened] BUILD: Fix compilation of libsss_certmap with libcrypto
by lslebodn 03 Apr '17

03 Apr '17

URL: https://github.com/SSSD/sssd/pull/219 Author: lslebodn Title: #219: BUILD: Fix compilation of libsss_certmap with libcrypto Action: opened PR body: """ CC src/lib/certmap/libsss_certmap_la-sss_cert_content_nss.lo src/lib/certmap/sss_cert_content_nss.c:25:18: fatal error: cert.h: No such file or directory #include <cert.h> ^ compilation terminated. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/219/head:pr219 git checkout pr219

2 6

Design discussion: Support for non-POSIX users and groups
by Jakub Hrozek 03 Apr '17

03 Apr '17

Hi, I prepared a design page for a new feature about fetching and authenticating non-POSIX users: https://docs.pagure.org/SSSD.sssd/design_pages/non_posix_support.html For your convenience, I'm also copying the .rst text below: Support for non-POSIX users and groups ====================================== Related ticket(s): ------------------ https://pagure.io/SSSD/sssd/issue/3310 Problem statement ----------------- SSSD, with its D-Bus interface is appealing to applications as a gateway to an LDAP directory where users and groups are stored. However, contrary to the traditional SSSD deployment where all users and groups either have POSIX attributes or those attributes can be inferred from the Windows SIDs, in many cases the users and groups in the application support scenario have no POSIX attributes. At the same time, SSSD especially on the back end (LDAP provider) level currently requires the presence of either an UID number or a Windows SID. This feature tracks adding support for user and group resolution through the D-Bus interface and authn/authz through the PAM interface even for setups without UIDs or Windows SIDs present on the LDAP directory side. Use cases --------- * As an application developer, I want to fetch user attributes for my application from an LDAP server that only uses a fairly generic LDAP objectclasses such as ``groupOfNames`` for groups or ``person`` for users. The application can either issue D-Bus calls itself or rely on Apache modules such as `mod_lookup_identity <https://github.com/adelton/mod_lookup_identity/>`_ * As an application developer, I want to authenticate users to my application using the `mod_authnz_pam <https://github.com/adelton/mod_authnz_pam>`_ module even if the users lack PAM attributes. Overview of the solution ------------------------ On a high level, the most work is tweaking the internal LDAP searches so that they are less restrictive and match users and groups based on just the requested key (typically a name or a UPN) and the configured objectclass. Whether SSSD will restrict the lookups to only POSIX accounts or allow even non-POSIX lookups will be controlled `at the domain level`. This is important for several reasons: * To avoid "leaking" the non-POSIX accounts or, perhaps more importantly, their non-POSIX group memberships to interfaces such as NSS that otherwise require a complete POSIX entry. While these checks could be implemented by the POSIX interfaces as well, making the distinction at the domain level is much safer. * To minimize the number of inconsistencies. These include: * One interface requesting a non-POSIX user through a D-Bus call, then later a POSIX interface searching for the same user. The latter call, having a more restrictive filter, would not match the object in the domain and because we tend to treat the domain reply as authoritative, remove the cached non-POSIX users. * Mixed POSIX and non-POSIX group memberships would require a large amount of special-casing and very careful testing to make sure requests for such hybrid user would return the correct group memberships but at the same time not remove the non-POSIX parts in all cases. * Interfaces that serve both the POSIX and non-POSIX case such as the D-Bus interface need to know whether to return only the list of POSIX group membership if a user that has POSIX attributes is requested. The interfaces cannot assume the intent of the caller and forcing the caller to decide based on the target domain helps here. In short, by forcing to make the distinction on the domain level, the SSSD code would be made more robust and error-prone while limiting the complexity. A non-POSIX domain would be skipped during lookups by interfaces that require POSIX attributes, such as ``sudo`` or ``NSS``. Better distinction must be made for interfaces that support both POSIX and non-POSIX users, though and the details are discussed below. In the simplest case, only a single domain will be defined. The tricky part are setups that must serve data to both the application from a non-POSIX domain and for the OS. For these setups, two ``[domain/]`` sections pointing to the same remote server must be defined, one marked as ``posix`` and one marked as ``application`` type (see below). To distinguish between accounts with the same name that exist in both these domains by interfaces that support both POSIX and non-POSIX domains, a qualified name is the safest way. In addition, the PAM responder will keep a list of application PAM services so that if an unqualified name arrives from an OS-level PAM service (such as ``ssh``), the PAM responder will know it is safe to skip the non-POSIX domains and route the PAM request to POSIX domains only. This would make life easier for accounts that both use the application and OS-level PAM services in the sense that the OS-level PAM interface will be usable even without qualified names. For distinguishing accounts between a POSIX and a non-POSIX domain from the D-Bus inteface, a fully qualified name must be used. But since the D-Bus interface is normally used only by the application, putting the non-POSIX domain first in the ``domains`` list should be enough to avoid using qualified names from the application while still making it possible to use the POSIX domain defined as second in the list. Implementation details and configuration changes ------------------------------------------------ A new SSSD domain option will be added. The option will be called ``domain_type`` and would support two values - ``posix`` and ``application``. The default value will be ``posix``, the non-POSIX support will be enabled by setting the ``domain_type`` to ``application``. When the ``domain_type`` is set to ``application``, SSSD responders that are only usable on a POSIX system (currently ``nss``, ``ssh``, ``sudo``, ``kcm`` and ``secrets``) will skip over ``application`` type domains. This logic will be implemented at the ``cache_req`` level and set by the caller, which is the responder, by adding a ``cache_req`` option. In particular, the ``cache_req`` requests will include an enum with allowed values ``CACHE_REQ_POSIX`` and ``CACHE_REQ_APP`` where the POSIX responders will only use the ``CACHE_REQ_POSIX`` value. The logic that determines which value the ``ifp`` and ``pam`` responders use is described below. The responders that are usable by both applications and the OS as well (that's ``pam`` and ``ifp``) will set a flag for the ``cache_req`` request that will instruct the ``cache_req`` domain-loop to also consider ``application`` domains. The ``ifp`` responder will consider ``application`` domains for all requests. Therefore in order to resolve a POSIX user with only POSIX membership, the request towards the ``ifp`` interface must be qualified with the domain name. The ``pam`` responder will gain a new option ``application_services``. This option will be empty by default. Only PAM services listed in this option will be allowed to contact the ``application`` domains. This option will be added to make sure that unqualified names can still be used in PAM conversations in case both ``posix`` and ``applications`` domains are configured for SSSD. In future, we might add a similar option (with ``UID`` of the caller of the interface as the key) to the ``ifp`` responder as well, but such option will not be added in the first iteration. The last change needed is for Kerberos authentication. Since the Kerberos ticket returned cannot be owned by a POSIX owner in application domains, especially in cases the system would otherwise use a FILE-based ccache, we will use a temporary MEMORY-based ccache in the ``krb5_child`` process destroy the ticket when ``krb5_child`` finishes and only return the resulting error code from the child process to the Data Provider. How To Test ----------- The best way of testing this feature is to test the "full stack" together with an application and the Apache modules. However, isolated testing can be performed as well. All tests expect that the LDAP server is populated with entries that do not contain POSIX attributes or might contain POSIX attributes in the case of mixed setup tests. For testing PAM authn and authz, the ``pam_test_client`` binary built from SSSD sources can be used until ``sssctl`` provides a better way. The users in the test setup should be members of non-POSIX groups, or a mix of POSIX and non-POSIX groups in the mixed scenario setups. #. SSSD with only the ``application`` domain can be reached through the D-Bus and PAM interfaces * Add a domain as follows:: [sssd] domains = appdomain.test services = ifp, pam, nss [pam] application_services = sss_test [ifp] user_attributes = +phone [domain/appdomain.test] id_provider=ldap ldap_uri = ldap://server.test domain_type = application ldap_user_extra_attrs = phone:telephoneNumber * Make sure that a D-Bus call towards the SSSD interface can resolve the ``phone`` attribute of ``$user`` * Test that calling ``pam_test_client auth $user`` succeeds with the correct password. Please note that testing ``auth_provider=krb5`` is also important here to make sure the krb5 provider can deal with ccaches that cannot be owned by a POSIX owner. #. No users or groups from an ``application domain`` can be resolved through the system interfaces * With the setup above, make sure that ``getent passwd $user`` doesn't return the user and even doesn't contact the remote server. * Same test should be performed for the ``ssh``, ``sudo`` and other responders. #. A mixed setup with two domains, one ``posix`` and one ``application`` reports the proper results from all interfaces * Modify the test domain to look like:: [sssd] domains = appdomain.test, posixdomain.test services = ifp, pam, nss [pam] application_services = sss_test [ifp] user_attributes = +phone [domain/appdomain.test] id_provider = ldap ldap_uri = ldap://server.test domain_type = application ldap_user_extra_attrs = phone:telephoneNumber [domain/posixdomain.test] id_provider = ldap ldap_uri = ldap://server.test * Make sure the LDAP server contains a mix of POSIX and non-POSIX users and groups. The POSIX users should be members of a mix of both POSIX and non-POSIX groups. * The tests from the first test case against a non-POSIX user should function as before * However, retrieving the POSIX users should now hit the domain ``posixdomain.test``, so the following should work: * ``getent passwd $posix_user`` should return the POSIX user * ``id $posix_user`` should return only POSIX groups the user is a member of and omit non-POSIX groups * ``getent group $posix_group`` should list all POSIX members of this group. In all the above tests, the NSS responder should skip the ``appdomain.test`` domain completely. * Since the ``appdomain.test`` domain comes first in the domain list, running ``GetUserAttr`` with an unqalified name should return non-POSIX users * Also invoking the ``GetUserGroups`` function should list their non-POSIX groups. Requests qualified to reach the ``posixdomain.test`` domain should only list POSIX groups. #. A mixed setup with two domains, one ``posix`` and one ``application`` can be used for OS-level authentication and authorization * Use the setup from the previous test * Make sure that running a PAM application on the OS level (``su`` or ``ssh`` are good tests) allows the user to log in using shortname as the NSS responder would skip the ``appdomain.test`` completely when the PAM application calls ``initgroups`` and the PAM responder would skip the ``appdomain.test`` domain because the PAM service is not listed in the ``application_services`` option How To Debug ------------ Debug messages listing the domain type must be added to the ``cache_req`` code. Then, the regular method of issuing a request and watching the logs should work. Expiring the cache and using the qualified names is recommeded. Authors ------- * Sumit Bose * Jakub Hrozek * Simo Sorce

3 12

Remove https://github.com/SSSD/gh-mailinglist-notifications, add https://github.com/SSSD/docs
by Jakub Hrozek 03 Apr '17

03 Apr '17

Hi, I'd like to remove https://github.com/SSSD/gh-mailinglist-notifications -- we're not currently using it, but we're rather using Martin Basti's mail notifier. At the same time, I'd like to add a mirror of https://pagure.io/SSSD/docs to github in order to follow the same process for both docs and code. Right now it's quite confusing to have PRs for code on one place and PRs for docs on another. Anyone against?

4 16

[sssd PR#221][comment] sss_cert_pem_to_der: Accept certificate with data before header
by jhrozek 31 Mar '17

31 Mar '17

URL: https://github.com/SSSD/sssd/pull/221 Title: #221: sss_cert_pem_to_der: Accept certificate with data before header jhrozek commented: """ ok to test """ See the full comment at https://github.com/SSSD/sssd/pull/221#issuecomment-290816333

1 0

Regarding sssd.conf syntax check, going thru dinglib
by amit kumar 31 Mar '17

31 Mar '17

Hello, *Present **Behavior*: # vim /usr/local/etc/sssd/sssd.conf [sssd] services = nss, pam config_file_version = 2 domains = LDAP [domain/LDAP] ldap_search_base = dc=example,dc=com id_provider = ldap *auth_provider = ldap9001 **<== '**sssctl config_check' does not reports this 1* ldap_uri = ldap://server.example.com ldap_id_use_start_tls = True ldap_tls_cacert = /etc/openldap/certs/cacert.asc *debug_level = tt **<== 'sssctl config_check' does not reports this 2 **klala = 1 <== '**sssctl config_check' r**eports thi*s 3 *My **Interpretation*: sss_ini_call_validators_errobj() //sssd/src/util/sss_ini.c ini_rules_read_from_file(rules_path, &rules_cfgobj); //rules_path=/usr/share/sssd/cfg_rules.ini {All _keywords on left side of __assignment__are rules_ which are _read from cfg_rules.ini_ fills in struct ini_cfgobj} *Why sssd does**reports 3*? Because rule is not present in cfg_rules.ini *Why sssd doe**s not report 1,2*? May be - Because there is no such check in ding-lib about values of options. - OR Check is broken. I also find # cat /root/ding-libs-0.6.0/ini/ini.d/mysssd.conf [service] # Options available to all services debug_level = int, None, false <=Now what's this syntax. If it takes int, then is this broken. Please throw some light... -- Thanks Amit Kumar There are three ways to get something done: (1) Do it yourself. (2) Hire someone to do it for you. (3) Forbid your kids to do it.

2 3

Data Provider is offline
by Michaël Van de Borne 30 Mar '17

30 Mar '17

Hi all, So I have 2 Centos7 hosts, with same sssd and nsswitch configs. One does find the users in IPA, and the other doesn't. Looks like the Data Provider is offline. I sent the SIGUSR2 signal to sssd which is supposed to bring him online. Didn't help. The hosts can resolve the IPA server hostname. SElinux is enforced. Iptables is disabled. here's my sssd.conf [domain/vgt.vito.be] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = vgt.vito.be id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = epoddev8.vgt.vito.be chpass_provider = ipa ipa_server = _srv_, epoddev5.vgt.vito.be ldap_tls_cacert = /etc/ipa/ca.crt debug_level = 7 [sssd] services = nss, sudo, pam, ssh domains = vgt.vito.be [nss] homedir_substring = /home debug_level = 7 [pam] [sudo] [autofs] [ssh] [pac] [ifp] here's the log of sssd_nss.log (Wed Mar 22 16:27:22 2017) [sssd[nss]] [accept_fd_handler] (0x0400): Client connected! (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client version [1]. (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version [1]. (Wed Mar 22 16:27:22 2017) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17][SSS_NSS_GETPWNAM] with input [vdbornem]. (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'vdbornem' matched without domain, user is vdbornem (Wed Mar 22 16:27:22 2017) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [vdbornem] from [<ALL>] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting info for [vdbornem(a)vgt.vito.be] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [get_dp_name_and_id] (0x0400): Not a LOCAL view, continuing with provided values. (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x7f7ffd1d1880:1:vdbornem@vgt.vito.be@vgt.vito.be] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [vgt.vito.be][0x1][BE_REQ_USER][1][name=vdbornem@vgt.vito.be:-] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x7f7ffd1d1880:1:vdbornem@vgt.vito.be@vgt.vito.be] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider Error: 3, 5, Failed to get reply from Data Provider Will try to return what we have in cache (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x7f7ffd1d1880:1:vdbornem@vgt.vito.be@vgt.vito.be] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [client_recv] (0x0200): Client disconnected! Any ideas appreciated. Thank you, Cheers, m.

2 1

[sssd PR#198][opened] secrets: support https in proxy provider
by pbrezina 30 Mar '17

30 Mar '17

URL: https://github.com/SSSD/sssd/pull/198 Author: pbrezina Title: #198: secrets: support https in proxy provider Action: opened PR body: """ I had to switch to libcurl as a client in order to communicate properly over HTTPS protocol. I added several new options that are necessary to initialize SSL (which certificates should be used and whether to check hostname in server's certificate or not). * Example SSSD configuration: ``` [secrets] debug_level = 0x3ff0 [secrets/users/10001] provider = proxy proxy_url = https://custodia.pb:10443/secrets auth_type = header auth_header_name = REMOTE_USER auth_header_value = mysecretkey cacert = /home/pbrezina/Downloads/cer/custodia-ca.pem cert = /home/pbrezina/Downloads/cer/custodia-client.pem key = /home/pbrezina/Downloads/cer/custodia-client.key verify_host = false ``` * Example custodia configuration (just modify default configuration, keeping the rest options intact): ``` [global] server_version = "Secret/0.0.7" debug = True server_url = https://0.0.0.0:10443 tls_certfile = tests/ca/custodia-server.pem tls_keyfile = tests/ca/custodia-server.key tls_cafile = tests/ca/custodia-ca.pem tls_verify_client = true umask = 027 [auth:header] handler = SimpleHeaderAuth header = REMOTE_USER value = mysecretkey [authz:paths] handler = SimplePathAuthz paths = /. ``` * Download certificates and key to your client and you can use it like this ```shell curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X POST http://localhost/secrets/mysecretkey/ curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X PUT http://localhost/secrets/mysecretkey/foo -d'{"type":"simple","value":"foosecret"}' curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X POST http://localhost/secrets/mysecretkey/foo curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X DELETE http://localhost/secrets/mysecretkey/foo curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X DELETE http://localhost/secrets/mysecretkey/ ``` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/198/head:pr198 git checkout pr198

4 41

[sssd PR#217][opened] KCM: Fix off-by-one error in secrets key validation
by jhrozek 30 Mar '17

30 Mar '17

URL: https://github.com/SSSD/sssd/pull/217 Author: jhrozek Title: #217: KCM: Fix off-by-one error in secrets key validation Action: opened PR body: """ This is a fix for a bug found by Fabiano. A simple reproducer is to try to kinit as root with KCM. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/217/head:pr217 git checkout pr217

3 7

[sssd PR#215][opened] Support for non-POSIX users and groups
by jhrozek 30 Mar '17

30 Mar '17

URL: https://github.com/SSSD/sssd/pull/215 Author: jhrozek Title: #215: Support for non-POSIX users and groups Action: opened PR body: """ This PR implements https://pagure.io/SSSD/sssd/issue/3310 The goal is to enable application users through the Apache modules or directly through the IFP interface and the PAM interface to authenticate users. To reproduce, you can add users w/o POSIX information like this to LDAP: dn: uid=nonposix,cn=users,cn=accounts,dc=ipa,dc=test displayName: new user uid: nonposix krbCanonicalName: nonposix(a)IPA.TEST objectClass: ipaobject objectClass: person objectClass: top objectClass: ipasshuser objectClass: inetorgperson objectClass: organizationalperson objectClass: krbticketpolicyaux objectClass: krbprincipalaux objectClass: inetuser objectClass: mepOriginEntry initials: nu sn: user mail: nonposix(a)ipa.test krbPrincipalName: nonposix(a)IPA.TEST givenName: new cn: new user And optionally add the user to groups, like this: dn: cn=npgr2,cn=groups,cn=accounts,dc=ipa,dc=test objectClass: ipaobject objectClass: top objectClass: ipausergroup objectClass: groupofnames objectClass: nestedgroup cn: npgr2 member: uid=nonposix,cn=users,cn=accounts,dc=ipa,dc=test Then, the D-Bus calls like GetUserAttrs should resolve extra attributes of the users, the groups the users are in should be resolvable as well. In addition, PAM authentication should work against application domains as long as the service invoking the PAM conversation is listed in the 'pam_app_services' option. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/215/head:pr215 git checkout pr215

4 24

[sssd PR#209][opened] IPA: lookup AD users by certificates on IPA clients
by sumit-bose 29 Mar '17

29 Mar '17

URL: https://github.com/SSSD/sssd/pull/209 Author: sumit-bose Title: #209: IPA: lookup AD users by certificates on IPA clients Action: opened PR body: """ Get a list of users mapped to a certificate back from the IPA server, look them up and store them together with the certificate used for the search as mapped attribute to the cache. Related to https://pagure.io/SSSD/sssd/issue/3050 This is another puzzle piece of looking up users by certificate, this time for AD users on IPA clients. If you think it should not run under #3050 anymore please let me know, then I'll open a new ticket. It turned out that although most of the code was already there to lookup AD users with the whole certificate it so far never worked, see 3rd patch. Even if this is fixed the fixed from a0b1bfa76073d3ce3208e67e6d72bb92088edac5 is needed on the IPA server side as well to allow the processing on reasonable sized certificates. Since it never worked it took the opportunity to replace the single user lookup with a lookup which returns a list of user to support mapping a certificate to multiple users. To test this the IPA server side must use the patch from https://github.com/freeipa/freeipa/pull/644 to get the user list reply. To test it the InfoPipe or python listbycert request can be used. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/209/head:pr209 git checkout pr209

3 12

[sssd PR#204][opened] krb5: return to responder that pkinit is not available
by sumit-bose 29 Mar '17

29 Mar '17

URL: https://github.com/SSSD/sssd/pull/204 Author: sumit-bose Title: #204: krb5: return to responder that pkinit is not available Action: opened PR body: """ If pkinit is not available for a user but other authentication methods are SSSD should still fall back to local certificate based authentication if Smartcard credentials are provided. Resolves https://pagure.io/SSSD/sssd/issue/3343 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/204/head:pr204 git checkout pr204

3 11

[sssd PR#201][opened] Fix handling of binary keys in the ssh responder
by sumit-bose 29 Mar '17

29 Mar '17

URL: https://github.com/SSSD/sssd/pull/201 Author: sumit-bose Title: #201: Fix handling of binary keys in the ssh responder Action: opened PR body: """ ssh-keys derived from certificates are already stored in binary from to avoid a useless base64 encoding/decoding cycle. In the second patch support for certificates from overrides from non-default views is added. I'm not sure if this is a regression of if it never worked so far. Related to https://pagure.io/SSSD/sssd/issue/3332 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/201/head:pr201 git checkout pr201

2 6

[sssd PR#187][opened] Add support to lookup for users/groups in subdomains just by the user shortname
by fidencio 29 Mar '17

29 Mar '17

URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: opened PR body: """ The patches are rebased on top of #154 and provide a solution for https://pagure.io/SSSD/sssd/issue/3001 There are no PAM related tests for those changes. Shall I do it using cmocka tests? Shall I rely on our downstream tests for this? """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187

5 50

[sssd PR#213][opened] intg: Remove bashism from intgcheck-prepare
by lslebodn 29 Mar '17

29 Mar '17

URL: https://github.com/SSSD/sssd/pull/213 Author: lslebodn Title: #213: intg: Remove bashism from intgcheck-prepare Action: opened PR body: """ env variable UID is not defined in all shells (eg. dash) ================================ FAILURES =================================== ________________________ test_kcm_mem_init_list_destroy ________________________ Traceback (most recent call last): File "/home/build/sssd/src/tests/intg/test_kcm.py", line 198, in test_kcm_mem_init_list_destroy kcm_init_list_destroy(testenv) File "/home/build/sssd/src/tests/intg/test_kcm.py", line 183, in kcm_init_list_destroy exp_ccname = testenv.ccname() File "/home/build/sssd/src/tests/intg/test_kcm.py", line 45, in ccname my_uid = self.my_uid() File "/home/build/sssd/src/tests/intg/test_kcm.py", line 41, in my_uid return int(s_myuid) ValueError: invalid literal for int() with base 10: '' And we already use different approach in top level Makefile.am 3488) $(INTGCHECK_CONFIGURE_FLAGS) \ 3489) CFLAGS="$$CFLAGS $(AM_CFLAGS) -DKCM_PEER_UID=$$(id -u)"; \ 3490) $(MAKE) $(AM_MAKEFLAGS) ; \ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/213/head:pr213 git checkout pr213

2 6

[sssd PR#216][opened] Subdomain shortnames
by mzidek-rh 29 Mar '17

29 Mar '17

URL: https://github.com/SSSD/sssd/pull/216 Author: mzidek-rh Title: #216: Subdomain shortnames Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/216/head:pr216 git checkout pr216

2 7

[sssd PR#212][opened] intg: fix configure failure with strict cflags
by lslebodn 28 Mar '17

28 Mar '17

URL: https://github.com/SSSD/sssd/pull/212 Author: lslebodn Title: #212: intg: fix configure failure with strict cflags Action: opened PR body: """ The warning -Wstrict-prototypes is a part of AM_CFLAGS which was appended for CFLAGS in make target intgcheck-prepare. And combination with strict CFLAGS in environment variable (e.g. -Werror) caused failures. sh$ CFLAGS="-Werror" make intgcheck-prepare checking for gcc... gcc checking whether the C compiler works... no configure: error: in `/home/build/sssd/ci-build-debug/intg/bld': configure: error: C compiler cannot create executables configure:3719: checking whether the C compiler works configure:3741: gcc -g3 -O2 -Werror -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-s trings -Wundef -Werror-implicit-function-declaration -Winit-self -Wmissing-include-dirs -fno-strict-aliasing -std=gnu99 -DKCM_PEER_UID=1000 conftest.c >&5 conftest.c:11:1: error: function declaration isn't a prototype [-Werror=strict-prototypes] main () ^~~~ cc1: all warnings being treated as errors """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/212/head:pr212 git checkout pr212

2 7

[sssd PR#210][opened] Kcm configure
by lslebodn 28 Mar '17

28 Mar '17

URL: https://github.com/SSSD/sssd/pull/210 Author: lslebodn Title: #210: Kcm configure Action: opened PR body: """ I am not sure about 2nd patch "CONFIGURE: Update error messages for missing curl" because IIRC secrets responder will require curl as well. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/210/head:pr210 git checkout pr210

2 9

[sssd PR#197][+Pushed] KCM responder
by jhrozek 27 Mar '17

27 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder Label: +Pushed

1 0

[sssd PR#197][closed] KCM responder
by jhrozek 27 Mar '17

27 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: closed To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 27 Mar '17

27 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ Pushed to master: * e89ba95737202d551db2c9524127e6c4cf308796 * 2b5518eeaacc6245cfa77ee4a7086f16208060fc * 35c9dfe9ba78d3a635cd1af0fb6349ba44344623 * cac0db2f8004ae88b9263dc3888a11a2d3d3d114 * c9db8b8b19827c3d492b8d2769aa77a37dbc12d3 * 60612b5fbdaaa62ebe6c7f4c27200316f08506d6 * 73ce539aa70f43ccd5302b3ef8a02ff028558b12 * 8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1 * 0700118d8388c38b8cb28279510b206b76a3a411 * ba89271f594e5ed381b4dcb876a2d2787cf51902 * 1ec4198f38d34a1f82a2db55d8c9782a434fb55f * 70fe6e2bb398b8669ad1aebeaf0abcbffc307475 * bea0dc79faf609de8603cb42f190adae544bc8fb * 9dcdbf596e138df3eec202487549a67cd3b0091b * b9c563c29243291f40489bb0dcbf3946fca72d58 * 1dbf09404e20b6e30a24afe72b6d349734aee62f * 5f7f45a64bdb9353f15b945db4ad2564b4b28ab2 * 4f511a4c5f0084e22ce4c7613f1b279533c68cc5 * c194e8d7cad0184d710d9979e9f12d5cfe176f4a * 24889dc5e7eb7bc992ab0fa05edfdfa1d157131a * 3a4a88259ba90d3dc45c1adbbfd39bd7c0204a12 """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-289382353

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 24 Mar '17

24 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ OK, hopefully final CI run: http://sssd-ci.duckdns.org/logs/job/65/48/summary.html """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-289083382

1 0

[sssd PR#197][comment] KCM responder
by lslebodn 24 Mar '17

24 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder lslebodn commented: """ retest this please """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-289045128

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 24 Mar '17

24 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ I also squashed Lukas' patch to fix some python3 issues. I'm just waiting for our CI to finish. """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-289036591

1 0

[sssd PR#197][synchronized] KCM responder
by jhrozek 24 Mar '17

24 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 24 Mar '17

24 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ @lslebodn I pushed a new patchset that should fix the warning in the kcm_queue test, can you verify if all warnings you saw are fixed? """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-289021612

1 0

[sssd PR#197][synchronized] KCM responder
by jhrozek 24 Mar '17

24 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

[sssd PR#197][comment] KCM responder
by simo5 24 Mar '17

24 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder simo5 commented: """ All looks good to go. """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-289009240

1 0

[sssd PR#197][+Accepted] KCM responder
by mzidek-rh 24 Mar '17

24 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder Label: +Accepted

1 0

[sssd PR#197][comment] KCM responder
by mzidek-rh 24 Mar '17

24 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder mzidek-rh commented: """ All my concerns have been addressed (and If I am not mistaken also Simo's). ACK from me. """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288987732

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 24 Mar '17

24 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ CI on the rebased patches: http://sssd-ci.duckdns.org/logs/job/65/45/summary.html """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288949515

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 23 Mar '17

23 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ rebased on master """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288860242

1 0

[sssd PR#197][synchronized] KCM responder
by jhrozek 23 Mar '17

23 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

[sssd PR#203][opened] IPA: Enhance debug logging for ipa s2n operations
by justin-stephenson 23 Mar '17

23 Mar '17

URL: https://github.com/SSSD/sssd/pull/203 Author: justin-stephenson Title: #203: IPA: Enhance debug logging for ipa s2n operations Action: opened PR body: """ Troubleshooting IPA client issues during AD Trust user and group resolution can be a difficult task requiring review of IPA client and IPA server SSSD logs during the full timeframe of a lookup request. If groups go missing on the client or client operations timeout with no obvious error then it is difficult to understand which requests to the IPA server are failing. Often times, client-side ipa_s2n functions will fail with a generic `s2n exop request failed` and the SSSD server-side logs are very busy for large AD environments. This PR is intended to help assist in log analysis and troubleshooting efforts by adding more useful information in the IPA client logs to help narrow down the focus for searching SSSD failures on the server. - Before patch: ``` [root@ipa-client-f25 ~]# id sssduser(a)ad.jstephen [root@ipa-client-f25 ~]# grep 'ipa_s2n' /var/log/sssd/sssd_idm.jstephen.log (Thu Mar 16 15:49:43 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (Thu Mar 16 15:49:43 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 17 (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_done] (0x0400): ldap_extended_operation result: Success(0), (null). (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 18 (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_done] (0x0400): ldap_extended_operation result: Success(0), (null). (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x4000): Found original AD upn [sssduser(a)AD.JSTEPHEN] (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x2000): Updating memberships for sssduser(a)ad.jstephen (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 19 (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_done] (0x0400): ldap_extended_operation result: Success(0), (null). (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x0400): Processing group secondarygroup(a)ad.jstephen (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 20 (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_done] (0x0400): ldap_extended_operation result: Success(0), (null). (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x0400): Processing group domain users(a)ad.jstephen (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 21 (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_done] (0x0400): ldap_extended_operation result: Success(0), (null). (Thu Mar 16 15:49:44 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x0400): Processing group parentofprimarygroup(a)ad.jstephen (Thu Mar 16 15:49:45 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x4000): Found original AD upn [sssduser(a)AD.JSTEPHEN] (Thu Mar 16 15:49:45 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x2000): Updating memberships for sssduser(a)ad.jstephen ``` - After patch ``` [root@ipa-client-f25 ~]# id sssduser(a)ad.jstephen [root@ipa-client-f25 ~]# grep 'ipa_s2n' /var/log/sssd/sssd_idm.jstephen.log (Thu Mar 16 15:59:39 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_acct_info_send] (0x0400): Sending request_type: [3] for trust user [sssduser] to IPA server (Thu Mar 16 15:59:39 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (Thu Mar 16 15:59:39 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 17 (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_done] (0x0400): ldap_extended_operation result: Success(0), (null). (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_user_done] (0x0400): Received [4] groups in group list from IPA Server (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_user_done] (0x0400): [sssduser(a)ad.jstephen] (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_user_done] (0x0400): [secondarygroup(a)ad.jstephen] (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_user_done] (0x0400): [domain users(a)ad.jstephen] (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_user_done] (0x0400): [parentofprimarygroup(a)ad.jstephen] (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_list_step] (0x0400): Sending request_type: [3] for group [sssduser(a)ad.jstephen] (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 18 (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_done] (0x0400): ldap_extended_operation result: Success(0), (null). (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_list_next] (0x0400): Received [sssduser(a)ad.jstephen] attributes from IPA server. (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x4000): Found original AD upn [sssduser(a)AD.JSTEPHEN] (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x2000): Updating memberships for sssduser(a)ad.jstephen (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_list_step] (0x0400): Sending request_type: [3] for group [secondarygroup(a)ad.jstephen] (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 19 (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_done] (0x0400): ldap_extended_operation result: Success(0), (null). (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_list_next] (0x0400): Received [secondarygroup(a)ad.jstephen] attributes from IPA server. (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x0400): Processing group secondarygroup(a)ad.jstephen (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_list_step] (0x0400): Sending request_type: [3] for group [domain users(a)ad.jstephen] (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 20 (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_done] (0x0400): ldap_extended_operation result: Success(0), (null). (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_list_next] (0x0400): Received [domain users(a)ad.jstephen] attributes from IPA server. (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x0400): Processing group domain users(a)ad.jstephen (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_list_step] (0x0400): Sending request_type: [3] for group [parentofprimarygroup(a)ad.jstephen] (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 21 (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_exop_done] (0x0400): ldap_extended_operation result: Success(0), (null). (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_get_list_next] (0x0400): Received [parentofprimarygroup(a)ad.jstephen] attributes from IPA server. (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x0400): Processing group parentofprimarygroup(a)ad.jstephen (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x4000): Found original AD upn [sssduser(a)AD.JSTEPHEN] (Thu Mar 16 15:59:40 2017) [sssd[be[idm.jstephen]]] [ipa_s2n_save_objects] (0x2000): Updating memberships for sssduser(a)ad.jstephen ``` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/203/head:pr203 git checkout pr203

4 19

[sssd PR#207][opened] nss-idmap: add sss_nss_getlistbycert()
by sumit-bose 23 Mar '17

23 Mar '17

URL: https://github.com/SSSD/sssd/pull/207 Author: sumit-bose Title: #207: nss-idmap: add sss_nss_getlistbycert() Action: opened PR body: """ This patch adds a getlistbycert() call to libsss_nss_idmap to make it on par with InfoPipe. Related to https://pagure.io/SSSD/sssd/issue/3050 The easiest way to test is via the python bindings with python -c "import pysss_nss_idmap; print pysss_nss_idmap.getlistbycert('MIIFvz....')" where the argument is the base64 encoded certificate. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/207/head:pr207 git checkout pr207

2 7

[sssd PR#197][comment] KCM responder
by jhrozek 23 Mar '17

23 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ I pushed new patches. CI passed: http://sssd-ci.duckdns.org/logs/job/65/29/summary.html """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288756506

1 0

[sssd PR#197][synchronized] KCM responder
by jhrozek 23 Mar '17

23 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

[sssd PR#192][opened] Add certificate mapping library
by sumit-bose 23 Mar '17

23 Mar '17

URL: https://github.com/SSSD/sssd/pull/192 Author: sumit-bose Title: #192: Add certificate mapping library Action: opened PR body: """ This is the last major part related to https://pagure.io/SSSD/sssd/issue/3050. With this users and certificates cannot only be mapped by adding the full certificate to the user's LDAP entry but based on rules. The library itself is in the third patch and the rules are described in the included sss-certmap man page. I tried to cover most of the functionality by unit tests. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/192/head:pr192 git checkout pr192

3 32

[sssd PR#197][synchronized] KCM responder
by jhrozek 23 Mar '17

23 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

[sssd PR#197][-Changes requested] KCM responder
by jhrozek 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder Label: -Changes requested

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ Thank you for the testing and the review, I hope I addressed all comments. """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288486811

1 0

[sssd PR#197][synchronized] KCM responder
by jhrozek 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

[sssd PR#205][opened] MAN: Mention sssd-secrets in "SEE ALSO" section
by lslebodn 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/205 Author: lslebodn Title: #205: MAN: Mention sssd-secrets in "SEE ALSO" section Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/3344 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/205/head:pr205 git checkout pr205

2 4

[sssd PR#197][+Changes requested] KCM responder
by mzidek-rh 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder Label: +Changes requested

1 0

[sssd PR#197][comment] KCM responder
by mzidek-rh 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder mzidek-rh commented: """ Some nitpicks mostly regarding the lack of DEBUG messages. src/responder/kcm/kcmsrv_cmd.c 164 /* First 16 bits are 8 bit major and 8bit major protocol version */ ^^^^^ Should be minor ----------------------------------- src/responder/kcm/kcmsrv_cmd.c - this module could use more debug messages. First because it is tevent code and second because the debug messages server as "natural" comments. For example: 311 static void kcm_send_reply(struct cli_ctx *cctx, 312 struct kcm_op_io *op_io, 313 struct kcm_repbuf *repbuf) 314 { 315 errno_t ret; 316 317 ret = kcm_output_construct(op_io, repbuf); 318 if (ret != EOK) { It would be good to print DEBUG message here with the error code. 319 kcm_reply_error(cctx, ret, repbuf); 320 return; 321 } ----------------------------------- This function: 509 static int kcm_send_data(struct cli_ctx *cctx) Could have a debug a message after each kcm_write_iovec operation saying what it failed to write. ----------------------------------- 369 static void kcm_cmd_request_done(struct tevent_req *req) 389 static errno_t kcm_recv_data(int fd, struct kcm_reqbuf *reqbuf) IMO the above functions should also print DEBUG messages on errors. ----------------------------------- The function bool kcm_cc_access(struct kcm_ccache *cc Should IMO include TRACE_FUNC level debug messages at least for all cases when the result is false. The root cause is lost in the above calling functions and it ends up later in some async code. ----------------------------------- 1166 static errno_t sec_list_recv(struct tevent_req *req, 1167 TALLOC_CTX *mem_ctx, 1168 const char ***_sec_key_list, 1169 size_t *_sec_key_list_len) 1170 1171 { 1172 struct sec_list_state *state = tevent_req_data(req, 1173 struct sec_list_state); 1174 1175 TEVENT_REQ_RETURN_ON_ERROR(req); 1176 1177 if (_sec_key_list != NULL) { 1178 *_sec_key_list = talloc_steal(mem_ctx, state->sec_key_list); 1179 } 1180 if (_sec_key_list_len) { ^^^^^^ use != NULL here too 1181 *_sec_key_list_len = state->sec_key_list_len; 1182 } 1183 return EOK; 1184 } ----------------------------------- 1247 static void sec_get_done(struct tevent_req *subreq) 1248 { 1249 errno_t ret; 1250 struct tevent_req *req = tevent_req_callback_data(subreq, struct tevent_req); 1251 struct sec_get_state *state = tevent_req_data(req, 1252 struct sec_get_state); 1253 struct sss_iobuf *outbuf; 1254 const char *sec_value; 1255 int http_code; 1256 1257 ret = tcurl_http_recv(state, subreq, &http_code, &outbuf); 1258 talloc_zfree(subreq); 1259 if (ret != EOK) { 1260 DEBUG(SSSDBG_OP_FAILURE, 1261 "GET HTTP request failed [%d]: %s\n", ret, sss_strerror(ret)); 1262 tevent_req_error(req, ret); 1263 return; 1264 } 1265 1266 if (http_code != 200) { 1267 ret = http2errno(http_code); Add DEBUG message here 1268 tevent_req_error(req, ret); 1269 return; 1270 } """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288409105

1 0

[sssd PR#197][comment] KCM responder
by mzidek-rh 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder mzidek-rh commented: """ Other than that it LGTM and what I tried worked for me. """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288409819

1 0

[sssd PR#197][comment] KCM responder
by mzidek-rh 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder mzidek-rh commented: """ Other then that it LGTM and what I tried worked for me. """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288409819

1 0

[sssd PR#197][comment] KCM responder
by mzidek-rh 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder mzidek-rh commented: """ Some nitpicks mostly regarding the lack of DEBUG messages. src/responder/kcm/kcmsrv_cmd.c 164 /* First 16 bits are 8 bit major and 8bit major protocol version */ ^^^^^ Should be minor ----------------------------------- src/responder/kcm/kcmsrv_cmd.c - this module could use more debug messages. First because it is tevent code and second because the debug messages server as "natural" comments. For example: 311 static void kcm_send_reply(struct cli_ctx *cctx, 312 struct kcm_op_io *op_io, 313 struct kcm_repbuf *repbuf) 314 { 315 errno_t ret; 316 317 ret = kcm_output_construct(op_io, repbuf); 318 if (ret != EOK) { It would be good to print DEBUG message here with the error code. 319 kcm_reply_error(cctx, ret, repbuf); 320 return; 321 } ----------------------------------- This function: 509 static int kcm_send_data(struct cli_ctx *cctx) Could have a debug a message after each kcm_write_iovec operation saying what it failed to write. ----------------------------------- 369 static void kcm_cmd_request_done(struct tevent_req *req) 389 static errno_t kcm_recv_data(int fd, struct kcm_reqbuf *reqbuf) IMO the above functions should also print DEBUG messages on errors. ----------------------------------- The function bool kcm_cc_access(struct kcm_ccache *cc Should IMO include TRACE_FUNC level debug messages at least for all cases when the result is false. The root cause is lost in the above calling functions and it ends up later in some async code. ----------------------------------- 1166 static errno_t sec_list_recv(struct tevent_req *req, 1167 TALLOC_CTX *mem_ctx, 1168 const char ***_sec_key_list, 1169 size_t *_sec_key_list_len) 1170 1171 { 1172 struct sec_list_state *state = tevent_req_data(req, 1173 struct sec_list_state); 1174 1175 TEVENT_REQ_RETURN_ON_ERROR(req); 1176 1177 if (_sec_key_list != NULL) { 1178 *_sec_key_list = talloc_steal(mem_ctx, state->sec_key_list); 1179 } 1180 if (_sec_key_list_len) { ^^^^^^ use != NULL here too 1181 *_sec_key_list_len = state->sec_key_list_len; 1182 } 1183 return EOK; 1184 } ----------------------------------- 1247 static void sec_get_done(struct tevent_req *subreq) 1248 { 1249 errno_t ret; 1250 struct tevent_req *req = tevent_req_callback_data(subreq, struct tevent_req); 1251 struct sec_get_state *state = tevent_req_data(req, 1252 struct sec_get_state); 1253 struct sss_iobuf *outbuf; 1254 const char *sec_value; 1255 int http_code; 1256 1257 ret = tcurl_http_recv(state, subreq, &http_code, &outbuf); 1258 talloc_zfree(subreq); 1259 if (ret != EOK) { 1260 DEBUG(SSSDBG_OP_FAILURE, 1261 "GET HTTP request failed [%d]: %s\n", ret, sss_strerror(ret)); 1262 tevent_req_error(req, ret); 1263 return; 1264 } 1265 1266 if (http_code != 200) { 1267 ret = http2errno(http_code); Add DEBUG message here 1268 tevent_req_error(req, ret); 1269 return; 1270 } """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288409105

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ CI: http://sssd-ci.duckdns.org/logs/job/65/17/summary.html """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288347513

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ I also removed the declaration of sss_krb5_marshal_creds which was a leftover from parsing the creds (which is something I have in a different branch until we need to renew credentials..) """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288331340

1 0

[sssd PR#197][synchronized] KCM responder
by jhrozek 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ I made two fixes related to documentation and packaging. They are already squashed, but to ease the review, the documentation fix was: ``` diff --git a/src/man/sssd-kcm.8.xml b/src/man/sssd-kcm.8.xml index b28b3bf..5dc9383 100644 --- a/src/man/sssd-kcm.8.xml +++ b/src/man/sssd-kcm.8.xml @@ -119,6 +119,24 @@ systemctl enable sssd-kcm.service </para> </refsect1> + <refsect1 id='storage'> + <title>THE CREDENTIAL CACHE STORAGE</title> + <para> + The credential caches are stored in the SSSD secrets service (see + <citerefentry> + <refentrytitle>sssd-secrets</refentrytitle><manvolnum>5</manvolnum> + </citerefentry> + for more details). Therefore it is important that also the sssd-secrets + service is enabled and its socket is started: + <programlisting> +systemctl start sssd-secrets.socket +systemctl enable sssd-secrets.socket +systemctl enable sssd-secrets.service + </programlisting> + Your distribution should already set the dependencies between the services. + </para> + </refsect1> + <refsect1 id='options'> <title>CONFIGURATION OPTIONS</title> <para> ``` And the packaging fix was about pointing to the right socket -- I didn't notice the wrong socket name because I had the configuration on the sssd side overriden in the same manner: ``` index 45d4853..ac88fca 100644 --- a/contrib/kcm_default_ccache +++ b/contrib/kcm_default_ccache @@ -2,8 +2,11 @@ # directory that is included from the Kerberos configuration file (/etc/krb5.conf) # On Fedora/RHEL/CentOS, this is /etc/krb5.conf.d/ # -# To enable the KCM credential cache, uncomment the two following lines and enable the KCM socket: +# To enable the KCM credential cache, uncomment the following lines and +# enable the KCM socket and the service: # systemctl enable sssd-kcm.socket +# systemctl start sssd-kcm.socket +# systemctl enable sssd-kcm.service #[libdefaults] # default_ccache_name = KCM: diff --git a/src/sysv/systemd/sssd-kcm.socket.in b/src/sysv/systemd/sssd-kcm.socket.in index b115b9a..80ec1c0 100644 --- a/src/sysv/systemd/sssd-kcm.socket.in +++ b/src/sysv/systemd/sssd-kcm.socket.in @@ -1,9 +1,10 @@ [Unit] Description=SSSD Secrets Service responder socket -Documentation=man:sssd-kcm(5) +Documentation=man:sssd-kcm(8) +Requires=sssd-secrets.socket [Socket] -ListenStream=@localstatedir@/run/kcm.socket +ListenStream=@localstatedir@/run/.heim_org.h5l.kcm-socket [Install] WantedBy=sockets.target ``` """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288329922

1 0

[sssd PR#197][synchronized] KCM responder
by jhrozek 22 Mar '17

22 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 21 Mar '17

21 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ On Tue, Mar 21, 2017 at 10:31:10AM -0700, mzidek-rh wrote: > Nitpick: In the contrib/kcm_default_ccache it would be good to indicate (in the comments) where the snippet belongs. Done. > It is written in the commit message, but if someone just opens the file > he/she The gender neutral pronoun is they :-P """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288195004

1 0

[sssd PR#197][synchronized] KCM responder
by jhrozek 21 Mar '17

21 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

[sssd PR#197][comment] KCM responder
by mzidek-rh 21 Mar '17

21 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder mzidek-rh commented: """ Nitpick: In the contrib/kcm_default_ccache it would be good to indicate (in the comments) where the snippet belongs. It is written in the commit message, but if someone just opens the file he/she may come to a wrong conclusion that it is a sssd config snippet. """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288156558

1 0

[sssd PR#197][synchronized] KCM responder
by jhrozek 21 Mar '17

21 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 21 Mar '17

21 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ On Tue, Mar 21, 2017 at 09:26:23AM -0700, mzidek-rh wrote: > Actually we do check for libcurl in configure. The reproducer is: > > > $ sudo dnf remove libcurl-devel > $ configure | grep curl > configure: WARNING: > The libcurl development library was not found. Some features will be disabled. > > $ make > <snip> > CC src/util/sssd_kcm-tev_curl.o > CC src/responder/common/sssd_kcm-negcache_files.o > CC src/responder/common/sssd_kcm-negcache.o > /home/user/gitrepo/sssd/src/util/tev_curl.c:32:23: fatal error: curl/curl.h: No such file or directory > #include <curl/curl.h> > > > > So we try to build some parts with curl even if curl is not available. Yes, this was because previously curl was only needed for tests. I changed the curl condition to error out and moved the check for libcurl to the section that is evaluated only if kcm is selected. """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288141611

1 0

[sssd PR#197][comment] KCM responder
by mzidek-rh 21 Mar '17

21 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder mzidek-rh commented: """ Actually we do check for libcurl in configure. The reproducer is: $ sudo dnf remove libcurl-devel $ configure | grep curl configure: WARNING: The libcurl development library was not found. Some features will be disabled. $ make <snip> CC src/util/sssd_kcm-tev_curl.o CC src/responder/common/sssd_kcm-negcache_files.o CC src/responder/common/sssd_kcm-negcache.o /home/user/gitrepo/sssd/src/util/tev_curl.c:32:23: fatal error: curl/curl.h: No such file or directory #include <curl/curl.h> So we try to build some parts with curl even if curl is not available. """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288135023

1 0

[sssd PR#197][comment] KCM responder
by mzidek-rh 21 Mar '17

21 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder mzidek-rh commented: """ On VM with were libcurl-devel is not installed, the configure succeeds, but compilation fails with: /home/user/gitrepo/sssd/src/util/tev_curl.c:32:23: fatal error: curl/curl.h: No such file or directory #include <curl/curl.h> We should check for libcurl headers in configure. """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288128390

1 0

[sssd PR#197][comment] KCM responder
by mzidek-rh 21 Mar '17

21 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder mzidek-rh commented: """ On VM with were libcurl-devel is not installed, the configure succeeds, but compilation fails with: /home/user/gitrepo/sssd/src/util/tev_curl.c:32:23: fatal error: curl/curl.h: No such file or directory #include <curl/curl.h> We should check for libcurl headers in configure. """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288128390

1 0

[sssd PR#197][-Changes requested] KCM responder
by jhrozek 21 Mar '17

21 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder Label: -Changes requested

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 21 Mar '17

21 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ I pushed new patches that implement what Simo asked for: * the kcm_ops module now queues all requests from the same UID * the secrets module does no special casing of the KCM paths * the KCM data is stored at cn=kcm top-level container in secrets * HTTP patch is no longer used, but instead delete/put is used because we now serialize the operations from the same UID """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-288089610

1 0

[sssd PR#197][synchronized] KCM responder
by jhrozek 21 Mar '17

21 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

[sssd PR#197][+Changes requested] KCM responder
by jhrozek 21 Mar '17

21 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder Label: +Changes requested

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 20 Mar '17

20 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ also remove all the KCM-specific knowledge from sssd-secrets, like the session/peristent checks. """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-287810557

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 20 Mar '17

20 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ also, store the ccaches at cn=kcm not at cn=ccaches """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-287805107

1 0

[sssd PR#197][comment] KCM responder
by jhrozek 20 Mar '17

20 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Title: #197: KCM responder jhrozek commented: """ I had an IRC discussion with @simo5 about the patches and he requested some changes: * don't special case /kcm in the routing protocol and allow routing KCM to Custodia * serialize write operations from the same UIDs (or all operations from the same UIDs if that's easier for start) to avoid races between operations that need multiple HTTP round-trips * don't use HTTP PATCH until Custodia supports it. First, open an issue against Custodia to support PATCH and then support the same semantics """ See the full comment at https://github.com/SSSD/sssd/pull/197#issuecomment-287802001

1 0

[sssd PR#197][synchronized] KCM responder
by jhrozek 20 Mar '17

20 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: KCM responder Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/197/head:pr197 git checkout pr197

1 0

https://pagure.io/SSSD/sssd/issue/3158 {where to find source code ini_rules_check(), may be sss_util.c}
by amit kumar 20 Mar '17

20 Mar '17

Hello, sssctl config-check does not show what file contains the problem ./src/util/sss_ini.c:578: ret = ini_rules_check(rules_cfgobj, data->sssd_config, NULL, *errobj*); *errobj =*> This contains errorObjects which are thrown on screen. # grep -rwn . -e "ini_rules_check" Binary file ./src/util/.libs/libsss_util_la-sss_ini.o matches ./src/util/sss_ini.c:578: ret = ini_rules_check(rules_cfgobj, data->sssd_config, NULL, errobj); ./src/util/sss_ini.c:581: "ini_rules_check failed %d [%s]\n", ret, strerror(ret)); Binary file ./x86_64/src/util/.libs/libsss_util_la-sss_ini.o matches Binary file ./x86_64/.libs/*libsss_util.so* matches <=Query[where to find libsss_util.so source code (may be sss_util.c)] Binary file ./x86_64/.libs/libsss_util.soT matches Binary file ./.libs/libsss_util.so matches Binary file ./.libs/libsss_util.soT matches I know libsss_util.so is created during reconfig & chmake, as it creates x86_64. -- Thanks Amit Kumar There are three ways to get something done: (1) Do it yourself. (2) Hire someone to do it for you. (3) Forbid your kids to do it.

3 3

[sssd PR#195][opened] UTIL: Typo in comment
by mzidek-rh 17 Mar '17

17 Mar '17

URL: https://github.com/SSSD/sssd/pull/195 Author: mzidek-rh Title: #195: UTIL: Typo in comment Action: opened PR body: """ I hope this patch makes it to the rebase. I do not understand how people were even able to use SSSD without it. Someone with deep knowledge of SSSD internals should start the review immediately. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/195/head:pr195 git checkout pr195

2 4

RFC: Migrating SSSD documentation to pagure.io
by Jakub Hrozek 16 Mar '17

16 Mar '17

Hi, I started on migrating the wiki content from fedorahosted to pagure. Because we are working hard on finishing the 1.15.1 and 1.15.2 releases, I want to only migrate the content that we need right now, which is the releases page (so that we can put the release notes somewhere) and design pages for 1.15 features. So far I was trying the documentation out in a sandbox repo: https://pagure.io/docs/jhrozek-doctest/ I think it looks OK and I like the rst->sphinx->html workflow: https://docs.pagure.org/pagure/usage/using_doc.html Regarding the repositories, I propose we do this: 1) create a new repo under the SSSD namespace, perhaps: https://pagure.io/SSSD/docs This repo will only contain the rst sources. I would like to ask Patrick to mirror this repo to github so we can use PRs to update documentation. 2) When a PR to this repo is merged, one of the maintainers will run "make html" in the docs repo. This will generate HTML documentation from the rst sources. 3) This HTML documentation will be pushed to: ssh://git@pagure.io/docs/SSSD/sssd.git Since I would only like to put up the releases and changelogs for now, I would like to ask to temporarily not review the RST changes with PRs until we are done with 1.15 development. Please speak up if you disagree :-)

4 8

Announcing SSSD 1.15.2
by Jakub Hrozek 15 Mar '17

15 Mar '17

SSSD 1.15.2 =========== The SSSD team is proud to announce the release of version 1.15.2 of the System Security Services Daemon. The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/ RPM packages will be made available for Fedora shortly. Feedback -------- Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users Highlights ---------- * It is now possible to configure certain parameters of a trusted domain in a configuration file sub-section. In particular, it is now possible to configure which Active Directory DCs the SSSD talks to with a configuration like this:: [domain/ipa.test] # IPA domain configuration. This domain trusts a Windows domain win.test [domain/ipa.test/win.test] ad_server = dc.win.test * Several issues related to socket-activating the NSS service, especially if SSSD was configured to use a non-privileged userm were fixed. The NSS service now doesn't change the ownership of its log files to avoid triggering a name-service lookup while the NSS service is not running yet. Additionally, the NSS service is started before any other service to make sure username resolution works and the other service can resolve the SSSD user correctly. * A new option "cache_first" allows the administrator to change the way multiple domains are searched. When this option is enabled, SSSD will first try to "pin" the requested name or ID to a domain by searching the entries that are already cached and contact the domain that contains the cached entry first. Previously, SSSD would check the cache and the remote server for each domain. This option brings performance benefit for setups that use multiple domains (even auto-discovered trusted domains), especially for ID lookups that would previously iterate over all domains. Please note that this option must be enabled with care as the administrator must ensure that the ID space of domains does not overlap. * The SSSD D-Bus interface gained two new methods: "FindByNameAndCertificate" and "ListByCertificate". These methods will be used primarily by IPA and `mod_lookup_identity <https://github.com/adelton/mod_lookup_identity/> to correctly match multple users who use the same certificate for Smart Card login. * A bug where SSSD did not properly sanitize a username with a newline character in it was fixed. Packaging Changes ----------------- None in this release Documentation Changes --------------------- * A new option "cache_first" was added. Please see the Highlights section for more details * The "override_homedir" option supports a new template expansion "l" that expands to the first letter of username Tickets Fixed ------------- Please note that due to a bug in the pagure.io tracker, some tickets that have dependencies set to other tickets cannot be closed at the moment. * <https://pagure.io/SSSD/sssd/issue/3317> - Newline characters (\n) must be sanitized before LDAP requests take place * <https://pagure.io/SSSD/sssd/issue/3316> - sssd-secrets doesn't exit on idle * <https://pagure.io/SSSD/sssd/issue/3314> - sssd ignores entire groups from proxy provider if one member is listed twice * <https://pagure.io/SSSD/sssd/issue/3164> - when group is invalidated using sss_cache dataExpireTimestamp entry in the domain and timestamps cache are inconsistent * <https://pagure.io/SSSD/sssd/issue/2668> - [RFE] Add more flexible templating for override_homedir config option * <https://pagure.io/SSSD/sssd/issue/2599> - Make it possible to configure AD subdomain in the server mode * <https://pagure.io/SSSD/sssd/issue/3322> - chown in ExecStartPre of sssd-nss.service hangs forever * <https://pagure.io/SSSD/sssd/issue/843> - Login time increases strongly if more than one domain is configured * <https://pagure.io/SSSD/sssd/issue/2320> - use the sss_parse_inp request in other responders than dbus Detailed Changelog ------------------ * Fabiano Fidêncio (7): * RESPONDER: Wrap up the code to setup the idle timeout * SECRETS: Shutdown the responder in case it becomes idle * CACHE_REQ: Move cache_req_next_domain() into a new tevent request * CACHE_REQ: Check the caches first * NSS: Don't set SocketUser/SocketGroup as "sssd" in sssd-nss.socket * NSS: Ensure the NSS socket is started before any other services' sockets * NSS: Don't call chown on NSS service's ExecStartPre * Ignacio Reguero (1): * UTIL: first letter of user name template for override_homedir * Jakub Hrozek (9): * Updating the version for the 1.15.2 release * Allow manual start for sssd-ifp * NSS: Fix invalidating memory cache for subdomain users * UTIL: Add a new macro SAFEALIGN_MEMCPY_CHECK * UTIL: Add a generic iobuf module * BUILD: Detect libcurl during configure * UTIL: Add a libtevent libcurl wrapper * TESTS: test the curl wrapper with a command-line tool * Updating the translations for the 1.15.2 release * Justin Stephenson (1): * MAN: Add dyndns_auth option * Lukas Slebodnik (3): * test_secrets: Fail in child if sssd_secrets cannot start * test_utils: Add test coverage for %l in override_homedir * util-test: Extend unit test for sss_filter_sanitize_ex * Michal Židek (4): * data_provider: Fix typo in DEBUG message * SUBDOMAINS: Configurable search bases * SUBDOMAINS: Allow options ad(_backup)_server * MAN: Add trusted domain section man entry * Pavel Březina (4): * cache_req: use rctx as memory context during midpoint refresh * CACHE_REQ: Make "cache_req_{create_and_,}add_result()" more generic * CACHE_REQ: Move result manipulation into a separate module * CACHE_REQ: shortcut if object is found * Petr Čech (2): * sss_cache: User/groups invalidation in domain cache * PROXY: Remove duplicit users from group * Sumit Bose (7): * sysdb: allow multiple results for searches by certificate * cache_req: allow multiple matches for searches by certificate * ifp: add ListByCertificate * ifp: add FindByNameAndCertificate * PAM: allow muliple users mapped to a certificate * nss: ensure that SSS_NSS_GETNAMEBYCERT only returns a unique match * IPA: get overrides for all users found by certificate * Thorsten Scherf (1): * Fixed typo in debug output * Victor Tapia (1): * UTIL: Sanitize newline and carriage return characters.

1 0

RFC: 1.15.2 release notes
by Jakub Hrozek 15 Mar '17

15 Mar '17

Hi, I prepared release notes for today's release. They are written in anticipation that PR#186 with the subdomain config will be merged. The RST I pushed to the sssd/docs repo is below: SSSD 1.15.2 =========== Highlights ---------- * It is now possible to configure certain parameters of a trusted domain in a configuration file sub-section. In particular, it is now possible to configure which Active Directory DCs the SSSD talks to with a configuration like this:: [domain/ipa.test] # IPA domain configuration. This domain trusts a Windows domain win.test [domain/ipa.test/win.test] ad_server = dc.win.test * Several issues related to socket-activating the NSS service, especially if SSSD was configured to use a non-privileged user were fixed. The NSS service now starts as root to avoid triggering a name-service lookup while the NSS service is not running yet. Additionally, the NSS service is started before any other service to make sure username resolution works and the other service can resolve the SSSD user correctly. * A new option ``cache_first`` allows the administrator to change the way multiple domains are searched. When this option is enabled, SSSD will first try to "pin" the requested name or ID to a domain by searching the entries that are already cached and contact the domain that contains the cached entry first. Previously, SSSD would check the cache and the remote server for each domain. This option brings performance benefit for setups that use multiple domains (even auto-discovered trusted domains), especially for ID lookups that would previously iterate over all domains. Please note that this option must be enabled with care as the administrator must ensure that the ID space of domains does not overlap. * The SSSD D-Bus interface gained two new methods: ``FindByNameAndCertificate`` and ``ListByCertificate``. These methods will be used primarily by IPA to correctly match multple users who use the same certificate for Smart Card login. * A bug where SSSD did not properly sanitize a username with a newline character in it was fixed. Packaging Changes ----------------- None in this release Documentation Changes --------------------- * A new option ``cache_first`` was added. Please see the Highlights section for more details * The ``override_homedir`` option supports a new template expansion ``l`` that expands to the first letter of username Tickets Fixed ------------- Please note that due to a bug in the pagure.io tracker, some tickets that have dependencies set to other tickets cannot be closed at the moment. * `#3317 <https://pagure.io/SSSD/sssd/issue/3317>`_ - Newline characters (\n) must be sanitized before LDAP requests take place * `#3316 <https://pagure.io/SSSD/sssd/issue/3316>`_ - sssd-secrets doesn't exit on idle * `#3314 <https://pagure.io/SSSD/sssd/issue/3314>`_ - sssd ignores entire groups from proxy provider if one member is listed twice * `#3164 <https://pagure.io/SSSD/sssd/issue/3164>`_ - when group is invalidated using sss_cache dataExpireTimestamp entry in the domain and timestamps cache are inconsistent * `#2668 <https://pagure.io/SSSD/sssd/issue/2668>`_ - [RFE] Add more flexible templating for override_homedir config option * `#2599 <https://pagure.io/SSSD/sssd/issue/2599>`_ - Make it possible to configure AD subdomain in the server mode * `#3223 <https://pagure.io/SSSD/sssd/issue/3323>`_ - The sssd-$RESPONDER.service units should bind to their socket units * `#3322 <https://pagure.io/SSSD/sssd/issue/3322>`_ - chown in ExecStartPre of sssd-nss.service hangs forever * `#843 <https://pagure.io/SSSD/sssd/issue/843>`_ - Login time increases strongly if more than one domain is configured * `#2320 <https://pagure.io/SSSD/sssd/issue/2320>`_ - use the sss_parse_inp request in other responders than dbus Detailed Changelog ------------------

3 4

[sssd PR#186][opened] Subdomain config
by mzidek-rh 15 Mar '17

15 Mar '17

URL: https://github.com/SSSD/sssd/pull/186 Author: mzidek-rh Title: #186: Subdomain config Action: opened PR body: """ This is the part of subdomain configuration feature needed to allow specify the search bases for the subdomain (one of the two use cases that were specified in the desin doc). The second part with the server was more complicated then I expected, so I will send it separately (hopefully today or tomorrow), but I can not delay this first part anymore). In order to test create a ipa-ad trust and redefine for example the ldap_search_base or ldap_user_search_base on the server side SSSD. BOth client and server side SSSDs will be able to use the alternative search base (no config changes needed on the client side SSSD). """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/186/head:pr186 git checkout pr186

2 14

[sssd PR#183][opened] More socket-activation fixes
by fidencio 15 Mar '17

15 Mar '17

URL: https://github.com/SSSD/sssd/pull/183 Author: fidencio Title: #183: More socket-activation fixes Action: opened PR body: """ This series contain two patches for bugs reported by @sgallagher. Please, see the patches ... """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/183/head:pr183 git checkout pr183

5 26

[sssd PR#170][opened] PROXY: Remove duplicit users from group
by celestian 15 Mar '17

15 Mar '17

URL: https://github.com/SSSD/sssd/pull/170 Author: celestian Title: #170: PROXY: Remove duplicit users from group Action: opened PR body: """ It is possible to have duplicit members in local files (/etc/group). This patch removes duplicity in groups in proxy provider. Resolves: https://fedorahosted.org/sssd/ticket/3314 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/170/head:pr170 git checkout pr170

3 8

[sssd PR#197][edited] These patches add a new service for managing Kerberos credential patches. It follows the design document here: https://fedorahosted.org/sssd/wiki/DesignDocs/KCM
by jhrozek 15 Mar '17

15 Mar '17

URL: https://github.com/SSSD/sssd/pull/197 Author: jhrozek Title: #197: These patches add a new service for managing Kerberos credential patches. It follows the design document here: https://fedorahosted.org/sssd/wiki/DesignDocs/KCM Action: edited Changed field: title Original value: """ These patches add a new service for managing Kerberos credential patches. It follows the design document here: https://fedorahosted.org/sssd/wiki/DesignDocs/KCM """

1 0

[sssd PR#188][opened] Add the first version of the KCM responder
by jhrozek 15 Mar '17

15 Mar '17

URL: https://github.com/SSSD/sssd/pull/188 Author: jhrozek Title: #188: Add the first version of the KCM responder Action: opened PR body: """ These patches add a new service for managing Kerberos credential patches. It follows the design document here: https://fedorahosted.org/sssd/wiki/DesignDocs/KCM So far all the credential caches are stored in memory. However, all the internal APIs are ready for talking to sssd-secrets and store the caches there which is what I'm working on now. As per testing, it should be enough to set the default ccache name to "KCM:" and make sure the sssd-kcm socket is enabled and started and the sssd-kcm service is enabled. It is important to test access control. Manually, I tested two different UNIX users, tested setting the KRB5CCNAME variable to someone else's ccache and so on, but more testing is welcome. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/188/head:pr188 git checkout pr188

1 4

[sssd PR#194][opened] config-check: Message when sssd.conf is missing
by mzidek-rh 15 Mar '17

15 Mar '17

URL: https://github.com/SSSD/sssd/pull/194 Author: mzidek-rh Title: #194: config-check: Message when sssd.conf is missing Action: opened PR body: """ sssctl config-check should print a message for user if no sssd.conf was found. Resolves: https://pagure.io/SSSD/sssd/issue/3330 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/194/head:pr194 git checkout pr194

4 16

[sssd PR#152][opened] Add a tevent wrapper around libcurl's asynchronous interface
by jhrozek 14 Mar '17

14 Mar '17

URL: https://github.com/SSSD/sssd/pull/152 Author: jhrozek Title: #152: Add a tevent wrapper around libcurl's asynchronous interface Action: opened PR body: """ This patch set adds a generic utility module that uses libcurl's multi interface to allow the caller to talk HTTP using libcurl. The patch set was part of the KCM responder branch, but as it might be useful to unblock pbrezina's development, I'm submitting it separately. The iobuf module might seem like an overkill for the libcurl tevent wrapper, but please also check the KCM branch during review -- there it proved quite valuable, so I think it makes sense to just reuse the same code in the curl wrapper as well. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/152/head:pr152 git checkout pr152

4 59

[sssd PR#154][opened] Confront caches first
by fidencio 14 Mar '17

14 Mar '17

URL: https://github.com/SSSD/sssd/pull/154 Author: fidencio Title: #154: Confront caches first Action: opened PR body: """ This patch set has been written on top of PR#141, thus PR#141 should be merged before this one and also the following patches* are don't have to be reviewed as part of this PR. *: - CACHE_REQ: Add cache_req_data_set_bypass_cache() - PAM: Use cache_req to perform initgroups lookups - TESTS: Adapt pam-srv-tests to deal with cache_req related changes The other 2 patches, the important ones. are basically introducing a new configurable option to define whether the responder should query all the caches before querying the data providers and reasonable debug info for the work. I'm not 100% sure those changes are the only changes needed (but seems so), so I'd like to ask @jhrozek and @pbrezina for a first review just in order to be sure this series is according to their ideas. Those 2 important patches could be squashed, in case it's the preference of the reviewers. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/154/head:pr154 git checkout pr154

4 37

[sssd PR#166][opened] Please see the commit message for commit description.
by jhrozek 13 Mar '17

13 Mar '17

URL: https://github.com/SSSD/sssd/pull/166 Author: jhrozek Title: #166: Please see the commit message for commit description. Action: opened PR body: """ To reproduce, log in as a user from a trusted domain. Before the patch, you should see an error message about the domain not being found such as: (Wed Feb 22 20:35:33 2017) [sssd[nss]] [nss_update_initgr_memcache] (0x0040): Unknown domain (win.trust.test) requested by provider and the memory cache wouldn't be in fact be invalidated. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/166/head:pr166 git checkout pr166

3 7

[sssd PR#174][opened] One certificate for multiple users
by sumit-bose 10 Mar '17

10 Mar '17

URL: https://github.com/SSSD/sssd/pull/174 Author: sumit-bose Title: #174: One certificate for multiple users Action: opened PR body: """ This is the first set of patches related to https://pagure.io/SSSD/sssd/issue/3050 to allow to authenticate as different users with a single certificate. Besides the needed changes for cache_req and PAM it include 2 new InfoPipe methods ListByCertificate and FindByNameAndCertificate to list all accounts mapped to a certificate and check if a certificates can be used to authenticate to a given account. To test e.g. with FreeIPA just add the certificate not only to a single user but to other users as well. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/174/head:pr174 git checkout pr174

3 19

[sssd PR#190][opened] Few unit tests for recent contribution from community
by lslebodn 10 Mar '17

10 Mar '17

URL: https://github.com/SSSD/sssd/pull/190 Author: lslebodn Title: #190: Few unit tests for recent contribution from community Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/190/head:pr190 git checkout pr190

2 6

[RFC] Smartcard authentication with PKINIT and local authentication
by Sumit Bose 10 Mar '17

10 Mar '17

Hi, with the recent addition of PKINIT support there is now a second method available to Smartcard authentication besides local authentication. I was about to add some sssd.conf option which can control the fallback to local authentication if PKINIT fails. Currently there is only a fallback to local authentication if the backend is offline or if PKINIT is not available because either the client or the server side do not support it. It came to my mind that it might be more flexible to add the fallback scheme to the certificate matching rules discussed earlier on this list. With this it would be possible e.g. to require PKINIT for a set of certificates and allow local authentication to a different set. Do you think this would make sense or is it sufficient an option in sssd.conf which covers all certificates? bye, Sumit

2 5

Tlog integration and packages
by Nikolai Kondrashov 10 Mar '17

10 Mar '17

Hi everyone, I'd like to continue the discussion of tlog integration, and also present you the first release of tlog - a development preview, which has the configuration interface necessary to implement the integration: https://github.com/spbnick/tlog/releases/tag/v1 You're more than welcome to download RPMs, install, read tlog-rec(8) and tlog-rec.conf(5), and experiment! Building from the Git tree and the tarball works as well, if you're so inclined. I'm also attaching those manpages for convenience. Here are the integration plans so far, as discussed with Jakub on our devconf.cz trip meetings and before on the list. Jakub, please correct me or add details. * We follow the route similar to that taken by SELinux rule control implementation [1][2]. I.e. store the configuration in LDAP HBAC rules, write to files on the client side and then specify them to tlog upon user login. However, I'm also rather fond of the idea of specifying the whole configuration through an environment variable instead of through a file referenced by an environment variable - it's not big at all, and we'll avoid the hassle of managing the files. I implemented support for both in tlog (was easy). * We'll have to make nss_sss report user's shell as tlog-rec (how?) and specify the actual shell to tlog-rec via an environment variable, through pam_sss (with SSS_PAM_ENV_ITEM messages). I.e.: * Nss_sss would always report tlog-rec as the user's shell. * During login (e.g. through "login" or "sshd") pam_sss would add a variable to the user environment, containing, or pointing at, a tlog-rec configuration (TLOG_REC_CONF_TEXT or TLOG_REC_CONF_FILE). That configuration would contain the user's actual shell. I can also implement support for a separate variable just for the shell (TLOG_REC_SHELL?) to simplify the implementation for the start. * Tlog-rec would read the system-wide configuration and overlay it with the one specified in the environment, adding the specific user shell, and then would spawn it. Please also see the draft integration design page [3] for reference. I hope to refine and extend it in the coming weeks to match FreeIPA standards. Please chime in and suggest, object, discuss! Also, please report tlog bugs at https://github.com/spbnick/tlog/issues Thank you! Nick [1]: http://www.freeipa.org/page/SELinux_user_mapping [2]: http://www.freeipa.org/images/b/b9/Freeipa30_SELinuxUserMap.pdf [3]: http://www.freeipa.org/page/Session_Recording

5 22

[sssd PR#127][opened] ssh: use cache_req
by fidencio 10 Mar '17

10 Mar '17

URL: https://github.com/SSSD/sssd/pull/127 Author: pbrezina Title: #127: ssh: use cache_req Action: opened PR body: """ This patches makes SSH responder use the cache_req interface. Since this responder uses that same `cache-domain-cache` lookup logic for host certificates I implemented `host by name` request in `cache_req`. In order to achieve this I moved data provider lookup function from `cache_req` code into plugins. The first two patches fixes minor issues in the SSH responder and should be pushed to earlier versions as well. The first patch fix a little issue introduced probably by overrides and the second patch removes name qualification since it is already qualified in the sysdb since fqname patches. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/127/head:pr127 git checkout pr127

4 22

[sssd PR#153][opened] SYSDB: Changing dataExpireTimestamp in domain cache
by celestian 10 Mar '17

10 Mar '17

URL: https://github.com/SSSD/sssd/pull/153 Author: celestian Title: #153: SYSDB: Changing dataExpireTimestamp in domain cache Action: opened PR body: """ When a group/users are invalidated from sss cache, the group/user information in Domain (cache_LDAP.ldb) and timestamps cache are inconsistent with regard to dataExpireTimestamp attribute. This patch fixes it. Resolves: https://fedorahosted.org/sssd/ticket/3164 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/153/head:pr153 git checkout pr153

4 43

[sssd PR#182][opened] cache_req: use rctx as memory context during midpoint refresh
by pbrezina 10 Mar '17

10 Mar '17

URL: https://github.com/SSSD/sssd/pull/182 Author: pbrezina Title: #182: cache_req: use rctx as memory context during midpoint refresh Action: opened PR body: """ Otherwise the tevent request is freed when we return data from cache_req to caller. It is no big deal since the request is still finished on provider side but the reply wouldn't be processed. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/182/head:pr182 git checkout pr182

4 6

[sssd PR#184][opened] sssd-ifp wouldn't socket activate with RefuseManualStart
by jhrozek 08 Mar '17

08 Mar '17

URL: https://github.com/SSSD/sssd/pull/184 Author: jhrozek Title: #184: sssd-ifp wouldn't socket activate with RefuseManualStart Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/184/head:pr184 git checkout pr184

2 7

[sssd PR#185][opened] Fixed typo in debug output
by tscherf 08 Mar '17

08 Mar '17

URL: https://github.com/SSSD/sssd/pull/185 Author: tscherf Title: #185: Fixed typo in debug output Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/185/head:pr185 git checkout pr185

4 9

[sssd PR#180][opened] SECRETS: Shutdown the responder in case it becomes idle
by fidencio 08 Mar '17

08 Mar '17

URL: https://github.com/SSSD/sssd/pull/180 Author: fidencio Title: #180: SECRETS: Shutdown the responder in case it becomes idle Action: opened PR body: """ Similarly to what has been done for the other responders, let's shutdown the secrets responder in case it becomes idle. Resolves: https://pagure.io/SSSD/sssd/issue/3316 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/180/head:pr180 git checkout pr180

3 18

[sssd PR#177][opened] first letter of user name template for override_homedir
by reguero 07 Mar '17

07 Mar '17

URL: https://github.com/SSSD/sssd/pull/177 Author: reguero Title: #177: first letter of user name template for override_homedir Action: opened PR body: """ This is needed in order to remap homedirs onto large filesystems such as AFS or EOS where there is a filesystem level with the first letter of the user name such as /whatever/r/reguero rather than /whatever/reguero. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/177/head:pr177 git checkout pr177

4 13

[sssd PR#173][opened] test_secrets: Fail in child if sssd_secrets cannot start
by lslebodn 07 Mar '17

07 Mar '17

URL: https://github.com/SSSD/sssd/pull/173 Author: lslebodn Title: #173: test_secrets: Fail in child if sssd_secrets cannot start Action: opened PR body: """ If there is a problem to execute sssd_secrets then exception is raised. Test will not continue in parent process because it is waiting for socket for a second. The child process will continue in execution of tests because parent process will kill child in teardown after test execution. This patch makes starting of secret service more robust and immediately fail child process when there was a problem to start sssd_secrets. It also adds few assertions for ensuring that setup passed as it should. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/173/head:pr173 git checkout pr173

2 5

[sssd PR#167][opened] Add missing dyndns_auth option to AD and IPA provider man pages
by justin-stephenson 07 Mar '17

07 Mar '17

URL: https://github.com/SSSD/sssd/pull/167 Author: justin-stephenson Title: #167: Add missing dyndns_auth option to AD and IPA provider man pages Action: opened PR body: """ Add the **dyndns_auth** option into the `sssd-ad` and `sssd-ipa` provider man pages for more configuration information regarding nsupdate behavior. There was no ticket for this, I wasn't sure if it was required to create one for this already-implemented option. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/167/head:pr167 git checkout pr167

4 12

[sssd PR#178][opened] UTIL: Sanitize newline characters.
by vtapia 07 Mar '17

07 Mar '17

URL: https://github.com/SSSD/sssd/pull/178 Author: vtapia Title: #178: UTIL: Sanitize newline characters. Action: opened PR body: """ Introducing valid usernames with a trailing newline character triggers the removal of valid LDB cache entries Resolves: https://fedorahosted.org/sssd/ticket/3317 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/178/head:pr178 git checkout pr178

4 14

Announcing SSSD 1.15.1
by Jakub Hrozek 06 Mar '17

06 Mar '17

SSSD 1.15.1 =========== The SSSD team is proud to announce the release of version 1.15.1 of the System Security Services Daemon. This is the first release that is available from SSSD's new home at https://pagure.io/SSSD/sssd The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/ RPM packages will be made available for Fedora shortly. Feedback -------- Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users Highlights ---------- * Several issues related to starting the SSSD services on-demand via socket activation were fixed. In particular, it is no longer possible to have a service started both by sssd and socket-activated. Another bug which might have caused the responder to start before SSSD started and cause issues especially on system startup was fixed. * A new 'files' provider was added. This provider mirrors the contents of '/etc/passwd' and '/etc/shadow' into the SSSD database. The purpose of this new provider is to make it possible to use SSSD's interfaces, such as the D-Bus interface for local users and enable leveraging the in-memory fast cache for local users as well, as a replacement for `nscd`. In future, we intend to extend the D-Bus interface to also provide setting and retrieving additional custom attributes for the files users. * SSSD now autogenerates a fallback configuration that enables the files domain if no SSSD configuration exists. This allows distributions to enable the 'sssd' service when the SSSD package is installed. Please note that SSSD must be build with the configuration option '--enable-files-domain' for this functionality to be enabled. * Support for public-key authentication with Kerberos (PKINIT) was added. This support will enable users who authenticate with a Smart Card to obtain a Kerberos ticket during authentication. Packaging Changes ----------------- * The new files provider comes as a new shared library 'libsss_files.so' and a new manual page * A new helper binary called 'sssd_check_socket_activated_responders' was added. This binary is used in the 'ExecStartPre' directive to check if the service that corresponds to socket about to be started was also started explicitly and abort the socket startup if it was. Documentation Changes --------------------- * A new PAM module option 'prompt_always' was added. This option is related to fixing https://pagure.io/SSSD/sssd/issue/2984 which changed the behaviour of the PAM module so that 'pam_sss' always uses an auth token that was on stack. The new 'prompt_always' option makes it possible to restore the previous behaviour. Tickets Fixed ------------- * https://pagure.io/SSSD/sssd/issue/3112 - When sssd.conf is missing, create one with id_provider=files * https://pagure.io/SSSD/sssd/issue/3220 - Improve successful Dynamic DNS update log messages * https://pagure.io/SSSD/sssd/issue/3227 - sssd doesn't update PTR records if A/PTR zones are configured as non-secure and secure * https://pagure.io/SSSD/sssd/issue/3230 - Use the same logic for matching GC results in initgroups and user lookups * https://pagure.io/SSSD/sssd/issue/3260 - handle default_domain_suffix for ssh requests with default_domain_suffix * https://pagure.io/SSSD/sssd/issue/3262 - Implement a files provider to mirror the contents of /etc/passwd and /etc/groups * https://pagure.io/SSSD/sssd/issue/3270 - [RFE] Add PKINIT support to SSSD Kerberos proivder * https://pagure.io/SSSD/sssd/issue/3298 - Socket activation of SSSD doesn't work and leads to chaos * https://pagure.io/SSSD/sssd/issue/3299 - SSSD does not start if using only the local provider and services line is empty * https://pagure.io/SSSD/sssd/issue/3300 - Avoid running two instances of the same service * https://pagure.io/SSSD/sssd/issue/3309 - Coverity warns about an unused value in IPA sudo code * https://pagure.io/SSSD/sssd/issue/3313 - cache_req should use an negative cache entry for UPN based lookups * https://pagure.io/SSSD/sssd/issue/2984 - Don't prompt for password if there is already one on the stack * https://pagure.io/SSSD/sssd/issue/1126 - Reuse cache_req() in responder code Detailed Changelog ------------------ * Fabiano Fidêncio (11): * IFP: Update ifp_iface_generated.c * MONITOR: Wrap up sending sd_notify "ready" into a new function * MONITOR: Don't timeout if using local provider + socket-activated responders * MONITOR: Don't return an error in case we fail to register a service * SYSTEMD: Add "After=sssd.service" to the responders' sockets units * SYSTEMD: Avoid starting a responder socket in case SSSD is not started * SYSTEMD: Don't mix up responders' socket and monitor activation * SYSTEMD: Force responders to refuse manual start * CACHE_REQ: Add cache_req_data_set_bypass_cache() * PAM: Use cache_req to perform initgroups lookups * TESTS: Adapt pam-srv-tests to deal with cache_req related changes * Jakub Hrozek (42): * Updating the version to track the 1.15.1 release * AD: Use ad_domain to match forest root domain, not the configured domain from sssd.conf * SUDO: Only store lowercased attribute value once * NEGCACHE: Add API to reset all users and groups * NSS: Add sbus interface to clear memory cache * UTIL: Add a new domain state called DOM_INCONSISTENT * RESPONDER: Add a responder sbus interface to set domain state * RESPONDER: A sbus interface to reset negatively cached users and groups * DP: Add internal DP interface to set domain state * DP: Add internal interface to reset negative cache from DP * DP: Add internal interface to invalidate memory cache from DP * RESPONDER: Use the NEED_CHECK_DOMAIN macro * RESPONDER: Include the files provider in NEEDS_CHECK_PROVIDER * RESPONDER: Contact inconsistent domains * UTIL: Add a generic inotify module * CONFDB: Re-enable the files provider * FILES: Add the files provider * CONFDB: Make pwfield configurable per-domain * CONFDB: The files domain defaults to "x" as pwfield * MAN: Document the pwfield configuration option * TESTS: move helper fixtures to back up and restore a file to a utility module * TESTS: add a helper module with shared NSS constants * TESTS: Add a module to call nss_sss's getpw* from tests * TESTS: Add a module to call nss_sss's getgr* from tests * TESTS: Add files provider integration tests * MONITOR: Remove checks for sssd.conf changes * MONITOR: Use the common inotify code to watch resolv.conf * MAN: Add documentation for the files provider * EXAMPLES: Do not point to id_provider=local * SBUS: Document how to free the result of sbus_create_message * FILES: Fix reallocation logic * TESTS: Remove unused import * DOC: Deprecate README, add README.md * MONITOR: Enable an implicit files domain if one is not configured * TESTS: Enable the files domain for all integration tests * TESTS: Test the files domain autoconfiguration * CONFDB: Refactor reading the config file * CONFDB: If no configuration file is provided, create a fallback configuration * UTIL: Store UPN suffixes when creating a new subdomain * SYSDB: When searching for UPNs, search either the whole DB or only the given domain * CACHE_REQ: Only search the given domain when looking up entries by UPN * Updating translations for the 1.15.1 release * Justin Stephenson (5): * FAILOVER: Improve port status log messages * SUDO: Add skip_entry boolean to sudo conversions * TESTS: Add to IPA DN test * DYNDNS: Update PTR record after non-fatal error * DYNDNS: Correct debug log message of realm * Lukas Slebodnik (13): * BUILD: Fix linking of test_wbc_calls * Suppres implicit-fallthrough from gcc 7 * pam_sss: Suppress warning format-truncation * TOOLS: Fix warning format-truncation * sssctl: Fix warning may be used uninitialized * ldap_child: Fix use after free * SYSTEMD: Update journald drop-in file * Partially revert "CONFIG: Use default config when none provided" * BUILD: Fix linking of test_sdap_initgr * intg: Fix python3 issues * FILES: Remove unnecessary check * Update link to commit template * Use pagure links as a reference to upstream * Pavel Březina (17): * SBUS: remove unused symbols * SBUS: use sss_ptr_hash for opath table * SBUS: use sss_ptr_hash for nodes table * SBUS: use sss_ptr_hash for signals table * ssh: fix number of output certificates * ssh: do not create again fq name * sss_parse_inp_send: provide default_domain as parameter * cache_req: add ability to not use default domain suffix * cache_req: search user by name with attrs * cache_req: add api to create ldb_result from message * cache_req: move dp request to plugin * cache_req: add host by name search * ssh: rewrite ssh responder to use cache_req * ssh: fix typo * cache_req: always go to dp first when looking up host * NSS: Rename the interface to invalidate memory cache initgroup records for consistency * CONFDB: The files provider always enumerates * Petr Čech (5): * LDAP: Better logging message * SYSDB: Removing of sysdb_try_to_find_expected_dn() * TEST: create_multidom_test_ctx() extending * TESTS: Tests for sdap_search_initgr_user_in_batch * IPA_SUDO: Unused value fix * Sumit Bose (17): * sdap_extend_map: make sure memory can be freed * check_duplicate: check name member before using it * pam_sss: check conversation callback * PAM: store user object in the preq context * PAM: fix memory leak in pam_sss * PAM: use sentinel error code in PAM tests * utils: new error codes * LDAP/proxy: tell frontend that Smartcard auth is not supported * authtok: enhance support for Smartcard auth blobs * PAM: forward Smartcard credentials to backends * p11: return name of PKCS#11 module and key id to pam_sss * pam: enhance Smartcard authentication token * KRB5: allow pkinit pre-authentication * authtok: fix tests on big-endian * pam: use authtok from PAM stack if available * cache_req: use own namespace for UPNs * PAM: Improve debugging on smartcard creds forward

2 2

[sssd PR#179][opened] Search UPN only in the given domain
by jhrozek 03 Mar '17

03 Mar '17

URL: https://github.com/SSSD/sssd/pull/179 Author: jhrozek Title: #179: Search UPN only in the given domain Action: opened PR body: """ We were searching UPNs in the whole sysdb, which made cache_req think the result came in from the domain it was searching. The bug manifested when a user from a trusted domain was looked by UPN, then cache_req searched the main domain, the result from subdomain was considered as coming from the main domain and as a result, the getpwnam() output was not qualified. That is a problem, because PAM applications often sanitize the user with getpwnam, so effectively a login with UPN was shortened to just a shortname and failed. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/179/head:pr179 git checkout pr179

2 10

RFC: 1.15.1 release notes
by Jakub Hrozek 03 Mar '17

03 Mar '17

Hi, I prepared the release notes for the upcoming 1.15.1 release. You can view them in your browser: https://docs.pagure.org/jhrozek-doctest/users/releases/notes_1_15_1.html Or read the inline RST text. Comments welcome! SSSD 1.15.1 =========== Highlights ---------- * Several issues related to starting the SSSD services on-demand by the systemd service manager were fixed. In particular, it is no longer possible to have a service started both by sssd and by systemd. Another bug which might have caused the responder to start before SSSD started and cause issues especially on system startup was fixed. * A new ``files`` provider was added. This provider mirrors the contents of ``/etc/passwd`` and ``/etc/shadow`` into the SSSD database. The purpose of this new provider is to make it possible to use SSSD's interfaces, such as the D-Bus interface for local users and enable leveraging the in-memory fast cache for local users as well, as a replacement for `nscd`. In future, we intend to extend the D-Bus interface to also provide setting and retrieving additional custom attributes for the files users. * SSSD now autogenerates a fallback configuration that enables the files domain if no SSSD configuration exists. This allows distributions to enable the ``sssd`` service when the SSSD package is installed. Please note that SSSD must be build with the configuration option ``--enable-files-domain`` for this functionality to be enabled. * Support for public-key authentication with Kerberos (PKINIT) was added. This support will enable users who authenticate with a Smart Card to obtain a Kerberos ticket during authentication. Packaging Changes ----------------- * The new files provider comes as a new shared library ``libsss_files.so`` and a new manual page * A new helper binary called ``sssd_check_socket_activated_responders`` was added. This binary is used in the ``ExecStartPre`` directive to check if the service that corresponds to socket about to be started was also started explicitly and abort the socket startup if it was. Documentation Changes --------------------- * A new PAM module option ``prompt_always`` was added. This option is related to fixing `<https://pagure.io/SSSD/sssd/issue/2984>`_ which changed the behaviour of the PAM module so that ``pam_sss`` always uses an auth token that was on stack. The new ``prompt_always`` option makes it possible to restore the previous behaviour. Tickets Fixed ------------- * `#3112 <https://pagure.io/SSSD/sssd/issue/3112>`_ - When sssd.conf is missing, create one with id_provider=files * `#3220 <https://pagure.io/SSSD/sssd/issue/3220>`_ - Improve successful Dynamic DNS update log messages * `#3227 <https://pagure.io/SSSD/sssd/issue/3227>`_ - sssd doesn't update PTR records if A/PTR zones are configured as non-secure and secure * `#3230 <https://pagure.io/SSSD/sssd/issue/3230>`_ - Use the same logic for matching GC results in initgroups and user lookups * `#3260 <https://pagure.io/SSSD/sssd/issue/3260>`_ - handle default_domain_suffix for ssh requests with default_domain_suffix * `#3262 <https://pagure.io/SSSD/sssd/issue/3262>`_ - Implement a files provider to mirror the contents of /etc/passwd and /etc/groups * `#3270 <https://pagure.io/SSSD/sssd/issue/3270>`_ - [RFE] Add PKINIT support to SSSD Kerberos proivder * `#3298 <https://pagure.io/SSSD/sssd/issue/3298>`_ - Socket activation of SSSD doesn't work and leads to chaos * `#3299 <https://pagure.io/SSSD/sssd/issue/3299>`_ - SSSD does not start if using only the local provider and services line is empty * `#3300 <https://pagure.io/SSSD/sssd/issue/3300>`_ - Avoid running two instances of the same service * `#3309 <https://pagure.io/SSSD/sssd/issue/3309>`_ - Coverity warns about an unused value in IPA sudo code * `#3313 <https://pagure.io/SSSD/sssd/issue/3313>`_ - cache_req should use an negative cache entry for UPN based lookups * `#2984 <https://pagure.io/SSSD/sssd/issue/2984>`_ - Don't prompt for password if there is already one on the stack * `#1126 <https://pagure.io/SSSD/sssd/issue/1126>`_ - Reuse cache_req() in responder code Detailed Changelog ------------------

3 4

[sssd PR#141][opened] PAM: Use cache_req_user_by_name_*()
by fidencio 03 Mar '17

03 Mar '17

URL: https://github.com/SSSD/sssd/pull/141 Author: fidencio Title: #141: PAM: Use cache_req_user_by_name_*() Action: opened PR body: """ PAM responder has been already using a lot from cache_req and one of the missing parts (most likely the only one?) was that pam_check_user_search() has been using sss_dp_get_account_send(), which could be dropped (and a lot of code around it) in favour of using cache_req_user_by_name_*() instead. Resolves: https://fedorahosted.org/sssd/ticket/1126 Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/141/head:pr141 git checkout pr141

5 50

The SSSD project has migrated from fedorahosted.org to pagure.io
by Jakub Hrozek 03 Mar '17

03 Mar '17

Hi, because fedorahosted.org was sunset: https://lwn.net/Articles/711887/ we have migrated the SSSD project hosting to pagure.io: https://pagure.io/SSSD/sssd Currently we are in a bit of a flux in the sense that the git repo has been migrated: https://pagure.io/SSSD/sssd.git And the github mirror is fetching data from the canonical pagure repo. The bug tracker has been migrated: https://pagure.io/SSSD/sssd/roadmap the bug numbers are the same as they were in Trac and the trac issue links should redirect seamlesly. However, the wiki has not been migrated yet. The fedora project kindly agreed to keep the old wiki around until we migrate the text to pagure: https://fedorahosted.org/sssd/wiki We are working on migrating the wiki, but because we need to prioritize this work together with development, it might take a bit of time. Please report any issues you see with the new tracking system.

2 1

[sssd PR#176][opened] Fix detecting UPN suffixes in IPA subdomain code
by jhrozek 02 Mar '17

02 Mar '17

URL: https://github.com/SSSD/sssd/pull/176 Author: jhrozek Title: #176: Fix detecting UPN suffixes in IPA subdomain code Action: opened PR body: """ To reproduce, start with a fresh domain and attempt to log in as a user with an UPN suffix. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/176/head:pr176 git checkout pr176

3 5

[sssd PR#146][opened] Avoid running two instances of the same service
by fidencio 02 Mar '17

02 Mar '17

URL: https://github.com/SSSD/sssd/pull/146 Author: fidencio Title: #146: Avoid running two instances of the same service Action: opened PR body: """ Those two patches together are responsible for avoiding running two "instances" of the same service. The commit message of each patch has quite a lot of explanation. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/146/head:pr146 git checkout pr146

4 34

[sssd PR#159][opened] pam: use authtok from PAM stack if available
by sumit-bose 02 Mar '17

02 Mar '17

URL: https://github.com/SSSD/sssd/pull/159 Author: sumit-bose Title: #159: pam: use authtok from PAM stack if available Action: opened PR body: """ With this patch the behavior of pam_sss is slightly changed to be more similar to the behavior of other PAM modules. Currently pam_sss expects that there is a authtok (password) on the PAM stack if the 'use_first_pass' option was used. Without the option pam_sss unconditionally prompts for credentials. With this patch pam_sss will use an authtok from the PAM stack even if 'use_first_pass' is not set but it will assume that it is a password. To return to the previous behavior the new 'prompt_always' can be used. Resolves https://fedorahosted.org/sssd/ticket/2984 Besides the use-case mentioned in the ticket with this change it should be possible to change the default PAM configuration in Fedora and RHEL to allow a fallback to pam_sss if pam_unix fails, so auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass can be changed to auth [sufficient] pam_unix.so nullok try_first_pass 'sufficient' is equivalent to '[success=done new_authtok_reqd=done default=ignore]' so the 'default=die' is remove here and the next PAM modules is called. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/159/head:pr159 git checkout pr159

3 8

[sssd PR#162][opened] cache_req: use own namespace for UPNs
by sumit-bose 02 Mar '17

02 Mar '17

URL: https://github.com/SSSD/sssd/pull/162 Author: sumit-bose Title: #162: cache_req: use own namespace for UPNs Action: opened PR body: """ If the UPN use the same domain name as the configured domain an unsuccessful lookup by name will already create an entry in the negative cache. If the lookup by UPN would use the same namespace the lookup will immediately be finished because there would already be an entry in the negative cache. Resolves https://fedorahosted.org/sssd/ticket/3313 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/162/head:pr162 git checkout pr162

4 10

[sssd PR#143][opened] Explicitly add ordering dependency for the responders' sockets
by fidencio 01 Mar '17

01 Mar '17

URL: https://github.com/SSSD/sssd/pull/143 Author: fidencio Title: #143: Explicitly add ordering dependency for the responders' sockets Action: opened PR body: """ This patch set is intended to solve https://fedorahosted.org/sssd/ticket/3298 and more details can be find in the commit messages. **SYSTEMD: Add "After=sssd.service" to the responders' sockets units** is the patch that actually solves the problem. **SYSTEMD: Add "WantedBy=sockets.target" to the responders' sockets units** is a desirable patch that slipped off during the development of the series and would be nice to have merged as well. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/143/head:pr143 git checkout pr143

3 24

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2017