sssd-devel March 2017

sssd-devel@lists.fedorahosted.org

13 participants
134 discussions

Remove https://github.com/SSSD/gh-mailinglist-notifications, add https://github.com/SSSD/docs
by Jakub Hrozek 03 Apr '17

03 Apr '17

Hi, I'd like to remove https://github.com/SSSD/gh-mailinglist-notifications -- we're not currently using it, but we're rather using Martin Basti's mail notifier. At the same time, I'd like to add a mirror of https://pagure.io/SSSD/docs to github in order to follow the same process for both docs and code. Right now it's quite confusing to have PRs for code on one place and PRs for docs on another. Anyone against?

4 16

[sssd PR#221][comment] sss_cert_pem_to_der: Accept certificate with data before header
by jhrozek 31 Mar '17

31 Mar '17

URL: https://github.com/SSSD/sssd/pull/221 Title: #221: sss_cert_pem_to_der: Accept certificate with data before header jhrozek commented: """ ok to test """ See the full comment at https://github.com/SSSD/sssd/pull/221#issuecomment-290816333

1 0

Regarding sssd.conf syntax check, going thru dinglib
by amit kumar 31 Mar '17

31 Mar '17

Hello, *Present **Behavior*: # vim /usr/local/etc/sssd/sssd.conf [sssd] services = nss, pam config_file_version = 2 domains = LDAP [domain/LDAP] ldap_search_base = dc=example,dc=com id_provider = ldap *auth_provider = ldap9001 **<== '**sssctl config_check' does not reports this 1* ldap_uri = ldap://server.example.com ldap_id_use_start_tls = True ldap_tls_cacert = /etc/openldap/certs/cacert.asc *debug_level = tt **<== 'sssctl config_check' does not reports this 2 **klala = 1 <== '**sssctl config_check' r**eports thi*s 3 *My **Interpretation*: sss_ini_call_validators_errobj() //sssd/src/util/sss_ini.c ini_rules_read_from_file(rules_path, &rules_cfgobj); //rules_path=/usr/share/sssd/cfg_rules.ini {All _keywords on left side of __assignment__are rules_ which are _read from cfg_rules.ini_ fills in struct ini_cfgobj} *Why sssd does**reports 3*? Because rule is not present in cfg_rules.ini *Why sssd doe**s not report 1,2*? May be - Because there is no such check in ding-lib about values of options. - OR Check is broken. I also find # cat /root/ding-libs-0.6.0/ini/ini.d/mysssd.conf [service] # Options available to all services debug_level = int, None, false <=Now what's this syntax. If it takes int, then is this broken. Please throw some light... -- Thanks Amit Kumar There are three ways to get something done: (1) Do it yourself. (2) Hire someone to do it for you. (3) Forbid your kids to do it.

2 3

Data Provider is offline
by Michaël Van de Borne 30 Mar '17

30 Mar '17

Hi all, So I have 2 Centos7 hosts, with same sssd and nsswitch configs. One does find the users in IPA, and the other doesn't. Looks like the Data Provider is offline. I sent the SIGUSR2 signal to sssd which is supposed to bring him online. Didn't help. The hosts can resolve the IPA server hostname. SElinux is enforced. Iptables is disabled. here's my sssd.conf [domain/vgt.vito.be] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = vgt.vito.be id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = epoddev8.vgt.vito.be chpass_provider = ipa ipa_server = _srv_, epoddev5.vgt.vito.be ldap_tls_cacert = /etc/ipa/ca.crt debug_level = 7 [sssd] services = nss, sudo, pam, ssh domains = vgt.vito.be [nss] homedir_substring = /home debug_level = 7 [pam] [sudo] [autofs] [ssh] [pac] [ifp] here's the log of sssd_nss.log (Wed Mar 22 16:27:22 2017) [sssd[nss]] [accept_fd_handler] (0x0400): Client connected! (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client version [1]. (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version [1]. (Wed Mar 22 16:27:22 2017) [sssd[nss]] [nss_cmd_getbynam] (0x0400): Running command [17][SSS_NSS_GETPWNAM] with input [vdbornem]. (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'vdbornem' matched without domain, user is vdbornem (Wed Mar 22 16:27:22 2017) [sssd[nss]] [nss_cmd_getbynam] (0x0100): Requesting info for [vdbornem] from [<ALL>] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting info for [vdbornem(a)vgt.vito.be] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [get_dp_name_and_id] (0x0400): Not a LOCAL view, continuing with provided values. (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x7f7ffd1d1880:1:vdbornem@vgt.vito.be@vgt.vito.be] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [vgt.vito.be][0x1][BE_REQ_USER][1][name=vdbornem@vgt.vito.be:-] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x7f7ffd1d1880:1:vdbornem@vgt.vito.be@vgt.vito.be] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider Error: 3, 5, Failed to get reply from Data Provider Will try to return what we have in cache (Wed Mar 22 16:27:22 2017) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x7f7ffd1d1880:1:vdbornem@vgt.vito.be@vgt.vito.be] (Wed Mar 22 16:27:22 2017) [sssd[nss]] [client_recv] (0x0200): Client disconnected! Any ideas appreciated. Thank you, Cheers, m.

2 1

[sssd PR#198][opened] secrets: support https in proxy provider
by pbrezina 30 Mar '17

30 Mar '17

URL: https://github.com/SSSD/sssd/pull/198 Author: pbrezina Title: #198: secrets: support https in proxy provider Action: opened PR body: """ I had to switch to libcurl as a client in order to communicate properly over HTTPS protocol. I added several new options that are necessary to initialize SSL (which certificates should be used and whether to check hostname in server's certificate or not). * Example SSSD configuration: ``` [secrets] debug_level = 0x3ff0 [secrets/users/10001] provider = proxy proxy_url = https://custodia.pb:10443/secrets auth_type = header auth_header_name = REMOTE_USER auth_header_value = mysecretkey cacert = /home/pbrezina/Downloads/cer/custodia-ca.pem cert = /home/pbrezina/Downloads/cer/custodia-client.pem key = /home/pbrezina/Downloads/cer/custodia-client.key verify_host = false ``` * Example custodia configuration (just modify default configuration, keeping the rest options intact): ``` [global] server_version = "Secret/0.0.7" debug = True server_url = https://0.0.0.0:10443 tls_certfile = tests/ca/custodia-server.pem tls_keyfile = tests/ca/custodia-server.key tls_cafile = tests/ca/custodia-ca.pem tls_verify_client = true umask = 027 [auth:header] handler = SimpleHeaderAuth header = REMOTE_USER value = mysecretkey [authz:paths] handler = SimplePathAuthz paths = /. ``` * Download certificates and key to your client and you can use it like this ```shell curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X POST http://localhost/secrets/mysecretkey/ curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X PUT http://localhost/secrets/mysecretkey/foo -d'{"type":"simple","value":"foosecret"}' curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X POST http://localhost/secrets/mysecretkey/foo curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X DELETE http://localhost/secrets/mysecretkey/foo curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X DELETE http://localhost/secrets/mysecretkey/ ``` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/198/head:pr198 git checkout pr198

4 41

[sssd PR#217][opened] KCM: Fix off-by-one error in secrets key validation
by jhrozek 30 Mar '17

30 Mar '17

URL: https://github.com/SSSD/sssd/pull/217 Author: jhrozek Title: #217: KCM: Fix off-by-one error in secrets key validation Action: opened PR body: """ This is a fix for a bug found by Fabiano. A simple reproducer is to try to kinit as root with KCM. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/217/head:pr217 git checkout pr217

3 7

[sssd PR#215][opened] Support for non-POSIX users and groups
by jhrozek 30 Mar '17

30 Mar '17

URL: https://github.com/SSSD/sssd/pull/215 Author: jhrozek Title: #215: Support for non-POSIX users and groups Action: opened PR body: """ This PR implements https://pagure.io/SSSD/sssd/issue/3310 The goal is to enable application users through the Apache modules or directly through the IFP interface and the PAM interface to authenticate users. To reproduce, you can add users w/o POSIX information like this to LDAP: dn: uid=nonposix,cn=users,cn=accounts,dc=ipa,dc=test displayName: new user uid: nonposix krbCanonicalName: nonposix(a)IPA.TEST objectClass: ipaobject objectClass: person objectClass: top objectClass: ipasshuser objectClass: inetorgperson objectClass: organizationalperson objectClass: krbticketpolicyaux objectClass: krbprincipalaux objectClass: inetuser objectClass: mepOriginEntry initials: nu sn: user mail: nonposix(a)ipa.test krbPrincipalName: nonposix(a)IPA.TEST givenName: new cn: new user And optionally add the user to groups, like this: dn: cn=npgr2,cn=groups,cn=accounts,dc=ipa,dc=test objectClass: ipaobject objectClass: top objectClass: ipausergroup objectClass: groupofnames objectClass: nestedgroup cn: npgr2 member: uid=nonposix,cn=users,cn=accounts,dc=ipa,dc=test Then, the D-Bus calls like GetUserAttrs should resolve extra attributes of the users, the groups the users are in should be resolvable as well. In addition, PAM authentication should work against application domains as long as the service invoking the PAM conversation is listed in the 'pam_app_services' option. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/215/head:pr215 git checkout pr215

4 24

[sssd PR#209][opened] IPA: lookup AD users by certificates on IPA clients
by sumit-bose 29 Mar '17

29 Mar '17

URL: https://github.com/SSSD/sssd/pull/209 Author: sumit-bose Title: #209: IPA: lookup AD users by certificates on IPA clients Action: opened PR body: """ Get a list of users mapped to a certificate back from the IPA server, look them up and store them together with the certificate used for the search as mapped attribute to the cache. Related to https://pagure.io/SSSD/sssd/issue/3050 This is another puzzle piece of looking up users by certificate, this time for AD users on IPA clients. If you think it should not run under #3050 anymore please let me know, then I'll open a new ticket. It turned out that although most of the code was already there to lookup AD users with the whole certificate it so far never worked, see 3rd patch. Even if this is fixed the fixed from a0b1bfa76073d3ce3208e67e6d72bb92088edac5 is needed on the IPA server side as well to allow the processing on reasonable sized certificates. Since it never worked it took the opportunity to replace the single user lookup with a lookup which returns a list of user to support mapping a certificate to multiple users. To test this the IPA server side must use the patch from https://github.com/freeipa/freeipa/pull/644 to get the user list reply. To test it the InfoPipe or python listbycert request can be used. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/209/head:pr209 git checkout pr209

3 12

[sssd PR#204][opened] krb5: return to responder that pkinit is not available
by sumit-bose 29 Mar '17

29 Mar '17

URL: https://github.com/SSSD/sssd/pull/204 Author: sumit-bose Title: #204: krb5: return to responder that pkinit is not available Action: opened PR body: """ If pkinit is not available for a user but other authentication methods are SSSD should still fall back to local certificate based authentication if Smartcard credentials are provided. Resolves https://pagure.io/SSSD/sssd/issue/3343 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/204/head:pr204 git checkout pr204

3 11

[sssd PR#201][opened] Fix handling of binary keys in the ssh responder
by sumit-bose 29 Mar '17

29 Mar '17

URL: https://github.com/SSSD/sssd/pull/201 Author: sumit-bose Title: #201: Fix handling of binary keys in the ssh responder Action: opened PR body: """ ssh-keys derived from certificates are already stored in binary from to avoid a useless base64 encoding/decoding cycle. In the second patch support for certificates from overrides from non-default views is added. I'm not sure if this is a regression of if it never worked so far. Related to https://pagure.io/SSSD/sssd/issue/3332 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/201/head:pr201 git checkout pr201

2 6

← Newer
1
2
3
4
5
6
7
...
14
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2017