August 2018 - sssd-devel - Fedora mailing-lists

[sssd PR#175][opened] Add module for starting services
by lslebodn 22 Nov '21

22 Nov '21

URL: https://github.com/SSSD/sssd/pull/175 Author: lslebodn Title: #175: Add module for starting services Action: opened PR body: """ This is a WIP version of reducing code duplication in our cwrap integration tests. I am still not sure whether we should also reuse function `create_sssd_fixture`. And if yes; then probably in different nodule then `services` And comments are welcome. BTW I wrote patches few weeks ago; therefore new tests are not converted. I am just sending patches to get some feedback. Site effect of this patches is that tests are cca 20% faster (IIRC) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/175/head:pr175 git checkout pr175

5 5

[sssd PR#616][opened] become_user: add supplementary groups so ad provider can access keytab
by asheplyakov 28 Jan '21

28 Jan '21

URL: https://github.com/SSSD/sssd/pull/616 Author: asheplyakov Title: #616: become_user: add supplementary groups so ad provider can access keytab Action: opened PR body: """ For security reasons one might want to run providers as a non-privileged user (say, _sssd). However some providers (in particular ad) might need an access to restricted (non world-readable) files (for instance, /etc/krb5.keytab). One of the possible ways to solve the problem is to - add a special group (for instance, _keytab) - set the owner:group of the file in question to root:_keytab - set the permissions of the file in question to 640 - make the _sssd user a member of the _keytab group For this to work become_user should assign supplementary groups, which is what this patch does. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/616/head:pr616 git checkout pr616

5 13

[sssd PR#269][opened] Add support for ActiveDirectory's logonHours restrictions
by NWilson 03 Sep '20

03 Sep '20

URL: https://github.com/SSSD/sssd/pull/269 Author: NWilson Title: #269: Add support for ActiveDirectory's logonHours restrictions Action: opened PR body: """ This is a straightforward patch for denying access to a user when the user is not permitted to access their account due to logonHours restrictions. This matches the default behaviour for domain-joined Windows machines. When outside the logonHours, all types of authentication are denied (password/Kerberos/certificate) - so it is appropriate to put this check inside the PAM "account" rules. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/269/head:pr269 git checkout pr269

9 30

[sssd PR#578][opened] proxy: proxy_child hardening
by amitkumar50 10 Aug '20

10 Aug '20

URL: https://github.com/SSSD/sssd/pull/578 Author: amitkumar50 Title: #578: proxy: proxy_child hardening Action: opened PR body: """ proxy_child will call chdir("/"), umask(022) and reset the environment with clearenv(). The --domain argument to be sanitized. Resolves: https://pagure.io/SSSD/sssd/issue/2689 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/578/head:pr578 git checkout pr578

5 14

[sssd PR#596][opened] [CONFDB]:[RFE] Add "enabled" option to domain section
by amitkumar50 24 Mar '20

24 Mar '20

URL: https://github.com/SSSD/sssd/pull/596 Author: amitkumar50 Title: #596: [CONFDB]:[RFE] Add "enabled" option to domain section Action: opened PR body: """ Upstream Request: Instead of enabling domains using the "domains" option in [sssd] section we could have [domain/*] option "enabled". This would allow admins to configure and enable domain in the same snippet file. This Fix would be submitted in 2 patches: Patch-1(This Patch): - Introduces 'enabled' option in domain section - Introduces 'CONFDB_DOMAIN_ENABLED' variable to retrieve enabled value from confdb - Code to call start_service() routine only for domains having enabled=1 Patch-2(Upcoming): - Would remove 'domains' option from sssd section. - Would remove corresponding code to parse 'domains' option - Providing a check that atlest One domain have enabled option set. Resolves: https://pagure.io/SSSD/sssd/issue/3735 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/596/head:pr596 git checkout pr596

7 12

[sssd PR#132][opened] Add "Wants=" to sssd unit and avoid PAC responder to be always running
by fidencio 02 Jan '20

02 Jan '20

URL: https://github.com/SSSD/sssd/pull/132 Author: fidencio Title: #132: Add "Wants=" to sssd unit and avoid PAC responder to be always running Action: opened PR body: """ The first patch changes the current logic of having the services' sockets disabled by default as it adds a "Wants=" to the sssd unit file, making all the services' sockets enabled by the moment sssd service is enabled. The second patch takes advantage of the first patch and avoids running PAC responder in case its socket is active, leaving the service to be socket-activated when needed. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/132/head:pr132 git checkout pr132

3 40

[sssd PR#558][opened] WIP: Add a test for sss_nss_getgrouplist_timeout and fix invalidating the initgroups cache
by jhrozek 04 Nov '19

04 Nov '19

URL: https://github.com/SSSD/sssd/pull/558 Author: jhrozek Title: #558: WIP: Add a test for sss_nss_getgrouplist_timeout and fix invalidating the initgroups cache Action: opened PR body: """ This is a WIP on adding tests for the sss_nss_ex interface. I covered only the sss_nss_getgrouplist_timeout function so far. I'm submitting the PR already in this state to get some feedback if this coverage is enough and the other functions can be covered similarly or if there is some issue with this approach. Also, I found a bug in invalidating the initgroups memory cache, that's the first of the two patches. Here I'm really not sure if the fix is even how the issue should be fixed, so I just hacked something up, even without allocation checks etc. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/558/head:pr558 git checkout pr558

3 10

[sssd PR#457][opened] ipa: Removal of umask(0) in selinux_child
by amitkumar50 30 Oct '19

30 Oct '19

URL: https://github.com/SSSD/sssd/pull/457 Author: amitkumar50 Title: #457: ipa: Removal of umask(0) in selinux_child Action: opened PR body: """ Code for calling umask(0) was added to address bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=1186422. Now this bugzilla is fixed, removing the workaround. Resolves: https://pagure.io/SSSD/sssd/issue/3583 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/457/head:pr457 git checkout pr457

11 27

[sssd PR#390][opened] NSS: Add option to disable memcache
by mzidek-rh 21 Oct '19

21 Oct '19

URL: https://github.com/SSSD/sssd/pull/390 Author: mzidek-rh Title: #390: NSS: Add option to disable memcache Action: opened PR body: """ Added option use_memcache to centrally disable memcache for all clients without the need to specify SSS_NSS_USE_MEMCACHE=NO environment variable. Resolves: https://pagure.io/SSSD/sssd/issue/3496 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/390/head:pr390 git checkout pr390

8 106

[sssd PR#546][opened] TESTS: Re-add tests for `kdestroy -A`
by fidencio 23 Sep '19

23 Sep '19

URL: https://github.com/SSSD/sssd/pull/546 Author: fidencio Title: #546: TESTS: Re-add tests for `kdestroy -A` Action: opened PR body: """ This reverts commit 89726be5a05493b7af312f0be9ac5ecb6f1822e1 and also do a few modifications on it in order to ensure we don't have any regression on https://pagure.io/SSSD/sssd/issue/3413 As this patch depends on a krb5 patch applied to the distros we run our internal CI on, I've opened a bug report providing patches for Fedora[0] and Debian[1]. [0]: https://bugzilla.redhat.com/show_bug.cgi?id=1561917 [1]: https://salsa.debian.org/debian/krb5/merge_requests/1 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/546/head:pr546 git checkout pr546

4 27

[sssd PR#560][opened] NSS: close files after mmap
by ChrisKowalczyk 17 Sep '19

17 Sep '19

URL: https://github.com/SSSD/sssd/pull/560 Author: ChrisKowalczyk Title: #560: NSS: close files after mmap Action: opened PR body: """ The files in MC cache folder were initialized by SSSD on startup, and mapped by using mmap function. due to the fact that they weren't closed afterwards, their File descriptors were still marker alive but marked as 'Deleted'. This was noticed by a customer of SUSE, see more details here: https://bugzilla.suse.com/show_bug.cgi?id=1080156 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/560/head:pr560 git checkout pr560

6 12

[sssd PR#636][opened] failover: tune up default timeouts
by pbrezina 31 Jul '19

31 Jul '19

URL: https://github.com/SSSD/sssd/pull/636 Author: pbrezina Title: #636: failover: tune up default timeouts Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/3217 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/636/head:pr636 git checkout pr636

3 22

[sssd PR#541][opened] memberof: keep memberOf attribute for nested member
by pbrezina 08 Apr '19

08 Apr '19

URL: https://github.com/SSSD/sssd/pull/541 Author: pbrezina Title: #541: memberof: keep memberOf attribute for nested member Action: opened PR body: """ If we have a member that is both direct and nested member, memberOf attribute was removed if the direct membership was deleted. 1) user ----------> groupB -> groupC -> groupA / 2) user -> groupA -> groupB -> groupC If we remove user->groupB from 1), we get 2) but groupB was still removed from user memberOf attribute. Resolves: https://pagure.io/SSSD/sssd/issue/3636 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/541/head:pr541 git checkout pr541

3 16

[sssd PR#644][opened] When multiple UIDs exist, use the username provided by the user as the first lookup
by joeFischetti 22 Nov '18

22 Nov '18

URL: https://github.com/SSSD/sssd/pull/644 Author: joeFischetti Title: #644: When multiple UIDs exist, use the username provided by the user as the first lookup Action: opened PR body: """ The current state of the code has no way of determining the "correct" UID to use when there are multiple values. If there are multiple values, and the RDN doesn't match, this update checks the UID's returned against the username that was provided by the user at the prompt. If that matches, it's used. If that doesn't match, it falls back to the existing code. Example: My ldap record includes multiple uid values, ["genericemployee1", "itstaff1"] I need access to machines as "itstaff1". "genericemployee1" is used as an identifier in other systems/services. If I log in with "itstaff1" at the prompt, and my ldap lookup with filter (uid=itstaff1) is successful, the array of UID's are checked against "itstaff1" and that's what *_primary is set to. With the current code, if I try to log in with "itstaff1" at the prompt, I'm actually logged into the system as "genericemployee1". Based on the order that the values are returned... some other staff are logged into their "genericemployee" or the "itstaff" accounts. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/644/head:pr644 git checkout pr644

4 17

[sssd PR#413][opened] mmap_cache: add SID and type to struct sss_mc_rec
by sumit-bose 16 Oct '18

16 Oct '18

URL: https://github.com/SSSD/sssd/pull/413 Author: sumit-bose Title: #413: mmap_cache: add SID and type to struct sss_mc_rec Action: opened PR body: """ This patchset updates the memory cache by adding some new members to struct sss_mc_rec. One is the addition of a hash value for SID based lookup which will be added in later patches. The other is a new record type and a member indicating the type. The new type is a link record which links an alias name, e.g. an UPN, to the original record of the related user or group object. Besides aliases this link record will be used in case in-sensitive setups. E.g. if getpwnam() returns the name of an AD users as Administrator(a)ad.domain bit some applications or users use administrator(a)ad.domain for lookups the memory cache is currently never used because there is no entry with the hash of 'administrator(a)ad.domain'. With this patch the original data record is created as before with the hash for 'Administrator(a)ad.domain' and a link record is create with the hash of 'administrator(a)ad.domain'. Now both lookups can be handled by the memory cache. If now another application uses ADMINISTRATOR(a)AD.DOMAIN for lookups the first request will go to the NSS responder but upcoming requests can use the memory cache as well because a link record for ADMINISTRATOR(a)AD.DOMAIN is created. The last patch in this series adds some additional data to the user and group lookup requests, the short name, the domain name, the short domain name and the SID. Those are needed to be able to support SID based lookups in the memory cache and allow applications to not depend on the name format returned by getpw{nam|uid}. Upcoming patches for libsss_nss_idmap will make those additional values available to applications I added them already here to keep the memory cache related changes in one PR. Application which will benefit here are the interfaces SSSD provides e.g. to Samba related applications like SSSD's version of libwbclient but also IPA plugins like extdom and slapi-nis. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/413/head:pr413 git checkout pr413

3 5

[sssd PR#642][opened] TESTS: Fixes to test library and add new test case for kcm.
by mrniranjan 11 Sep '18

11 Sep '18

URL: https://github.com/SSSD/sssd/pull/642 Author: mrniranjan Title: #642: TESTS: Fixes to test library and add new test case for kcm. Action: opened PR body: """ Fixes related to enabling of ssl in Directory Server Minor fixes on KCM, adding new exceptions Adding a new test case to test ssh login with KCM as default Signed-off-by: Niranjan M.R <mrniranjan(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/642/head:pr642 git checkout pr642

3 11

[sssd PR#639][opened] sbus: fix sbus_message_bound_ref and add unit tests for sbus_message public module
by pbrezina 06 Sep '18

06 Sep '18

URL: https://github.com/SSSD/sssd/pull/639 Author: pbrezina Title: #639: sbus: fix sbus_message_bound_ref and add unit tests for sbus_message public module Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/639/head:pr639 git checkout pr639

2 6

Add support for hosts and networks to NSS
by Chris Kowalczyk 05 Sep '18

05 Sep '18

Hello All, I was wondering if there are any plans of adding more maps -specifically networks or hosts- to NSS in sssd? As far as I know, it supports already the most important ones, like users, groups etc: https://docs.pagure.org/SSSD.sssd/users/ldap_with_ad.html#etc-nsswitch-conf I have also found later commits for adding netgroups: https://github.com/SSSD/sssd/commit/f128b7b865062da662127712935dcc58bd022384 https://github.com/SSSD/sssd/commit/ef39c0adcb61b16f9edc7beb4cdc8f3b0d5a8f15 But as far as I was able to find out, there was no works for networks or hosts. Is this something we would be interested to have in sssd, or for some reasons we wouldn't care about it? Regards, Chris Kowalczyk

2 4

[sssd PR#643][opened] KCM: Don't error out if creating a new ID as the first step
by jhrozek 30 Aug '18

30 Aug '18

URL: https://github.com/SSSD/sssd/pull/643 Author: jhrozek Title: #643: KCM: Don't error out if creating a new ID as the first step Action: opened PR body: """ We need to handle the case where the nextID operation is ran, but the secdb is totally empty, otherwise logins with sssd's krb5_child would fail. Resolves: https://pagure.io/SSSD/sssd/issue/3815 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/643/head:pr643 git checkout pr643

2 6

[sssd PR#641][opened] Minor fixes related to converting of ldap attributes to bytes
by mrniranjan 20 Aug '18

20 Aug '18

URL: https://github.com/SSSD/sssd/pull/641 Author: mrniranjan Title: #641: Minor fixes related to converting of ldap attributes to bytes Action: opened PR body: """ Minor fixes related to converting attribute values to bytes in function related to adding posix group Signed-off-by: Niranjan M.R <mrniranjan(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/641/head:pr641 git checkout pr641

4 6

[sssd PR#640][opened] Python3 changes to multihost tests
by mrniranjan 17 Aug '18

17 Aug '18

URL: https://github.com/SSSD/sssd/pull/640 Author: mrniranjan Title: #640: Python3 changes to multihost tests Action: opened PR body: """ 1. Python3 related changes 2. converting ldap attributes to use bytes Signed-off-by: Niranjan M.R <mrniranjan(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/640/head:pr640 git checkout pr640

4 14

Announcing SSSD 2.0
by Jakub Hrozek 14 Aug '18

14 Aug '18

SSSD 2.0 =========== The SSSD team is proud to announce the release of version 2.0 of the System Security Services Daemon. The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/ RPM packages will be made available for Fedora shortly. Feedback ———— Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users Highlights ---------- This release removes or deprecates functionality from SSSD, therefore the SSSD team decided it was time to bump the major version number. The sssd-1-16 branch will be still supported (most probably even as a LTM branch) so that users who rely on any of the removed features can either migrate or ask for the features to be readded. Except for the removed features, this release contains a reworked internal IPC and a new default storage back end for the KCM responder. Platform support removal ^^^^^^^^^^^^^^^^^^^^^^^^ * Starting with SSSD 2.0, upstream no longer supports RHEL-6 and its derivatives. Users of RHEL-6 are encouraged to stick with the sssd-1-16 branch. Removed features ^^^^^^^^^^^^^^^^ * The Python API for managing users and groups in local domains (``id_provider=local``) was removed completely. The interface had been packaged as module called ``pysss.local`` * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath was adding needless additional complexity for little performance gain and was rarely used. * The ``ldap_groups_use_matching_rule_in_chain`` and ``ldap_initgroups_use_matching_rule_in_chain`` options and the code that evaluated them was removed. Neither of these options provided a significant performance benefit and the code implementing these options was complex and rarely used. Deprecated features ^^^^^^^^^^^^^^^^^^^ * The local provider (``id_provider=local``) and the command line tools to manage users and groups in the local domains, such as ``sss_useradd`` is not built by default anymore. There is a configure-time switch ``--enable-local-domain`` you can use to re-enable the local domain support. However, upstream would like to remove the local domain completely in a future release. * The ``sssd_secrets`` responder is not packaged by default. The responder was meant to provide a REST API to access user secrets as well as a proxy to Custodia servers, but as Custodia development all but stopped and the local secrets handling so far didn't gain traction, we decided to not enable this code by default. This also means that the default SSSD configuration no longer requires libcurl and http-parser. Changed default settings ^^^^^^^^^^^^^^^^^^^^^^^^ * The ``ldap_sudo_include_regexp`` option changed its default value from ``true`` to ``false``. This means that wild cards in the ``sudoHost`` LDAP attribute are no longer supported by default. The reason we changed the default was that the wildcard was costly to evaluate on the LDAP server side and at the same time rarely used. New features ^^^^^^^^^^^^ * The KCM responder has a new back end to store credential caches in a local database. This new back end is enabled by default and actually uses the same storage as the ``sssd-secrets`` responder had used, so the switch from sssd-secrets to this new back end should be completely seamless. The ``sssd-secrets`` socket is no longer required for KCM to operate. * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option ``pam_p11_allowed_services``. Packaging Changes ----------------- * The ``sss_useradd``, ``sss_userdel``, ``sss_usermod``, ``sss_groupadd``, ``sss_groupdel``, ``sss_groupshow`` and ``sss_groupmod`` binaries and their manual pages are no longer packaged by default unless ``--enable-local-provider`` is selected. * The sssd_secrets responder is no longer packaged by default unless ``--enable-secrets-responder`` is selected. * The new internal IPC mechanism uses several private libraries that need to be packaged - ``libsss_sbus.so``, ``libsss_sbus_sync.so``, ``libsss_iface.so``, ``libsss_iface_sync.so``, ``libifp_iface.so`` and ``libifp_iface_sync.so`` * The new KCM ccache back end relies on a private library ``libsss_secrets.so`` that must be packaged in case either the KCM responder or the secrets responder are enabled. Documentation Changes --------------------- * The ``ldap_groups_use_matching_rule_in_chain`` and ``ldap_initgroups_use_matching_rule_in_chain`` options were removed. * The ``ldap_sudo_include_regexp`` option changed its default value from ``true`` to ``false``. Known issues ------------ * https://pagure.io/SSSD/sssd/issue/3807 - The sbus codegen script relies on "python" which might not be available on all distributions * There is a script that autogenerates code for the internal SSSD IPC. The script happens to call "python" which is not available on all distributions. Patching the ``sbus_generate.sh`` file to call e.g. python3 explicitly works around the issue Tickets Fixed ------------- * `3717 <https://pagure.io/SSSD/sssd/issue/3717>`_ - Don't package sssd-secrets by default * `3685 <https://pagure.io/SSSD/sssd/issue/3685>`_ - KCM: Default to a new back end that would write to the secrets database directly * `3530 <https://pagure.io/SSSD/sssd/issue/3530>`_ - Remove CONFDB_DOMAIN_LEGACY_PASS * `3515 <https://pagure.io/SSSD/sssd/issue/3515>`_ - Disable host wildcards in sudoHost attribute (ldap_sudo_include_regexp=false) * `3494 <https://pagure.io/SSSD/sssd/issue/3494>`_ - Remove the special-case for RFC2307bis with zero nesting level * `3493 <https://pagure.io/SSSD/sssd/issue/3493>`_ - Remove the pysss.local interface * `3492 <https://pagure.io/SSSD/sssd/issue/3492>`_ - Remove support for ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain * `3304 <https://pagure.io/SSSD/sssd/issue/3304>`_ - Only build the local provider conditionally * `2926 <https://pagure.io/SSSD/sssd/issue/2926>`_ - Make list of local PAM services allowed for Smartcard authentication configurable Detailed Changelog ------------------ * Amit Kumar (1): * providers: disable ldap_sudo_include_regexp by default * Fabiano Fidêncio (19): * man/sss_ssh_knownhostsproxy: fix typo pubkeys -> pubkey * providers: drop ldap_{init,}groups_use_matching_rule_in_chain support * ldap: remove parallel requests from rfc2307bis * tests: adapt common_dom to files_provider * tests: adapt test_sysdb_views to files provider * tests: adapt sysdb-tests to files_provider * tests: adapt sysdb_ssh tests to files provider * tests: adapt auth-tests to files provider * tests: adapt tests_fqnames to files provider * sysdb: sanitize the dn on cleanup_dn_filter * sysdb: pass subfilter and ts_subfilter to sysdb_search_*_by_timestamp() * tests: adapt test_ldap_id_cleanup to files provider * tests: remove LOCAL_SYSDB_FILE reference from test_sysdb_certmap * tests: remove LOCAL_SYSDB_FILE reference from test_sysdb_domain_resolution_order_ * tests: remove LOCAL_SYSDB_FILE reference from test_sysdb_subdomains * tests: remove LOCAL_SYSDB_FILE reference from common_dom * local: build local provider conditionally * pysss: fix typo in comment * pysss: remove pysss.local * Jakub Hrozek (55): * Updating the version to track 1.16.4 development * src/tests/python-test.py is GPLv3+ * src/tests/intg/util.py is licensed under GPLv3+ * src/tests/intg/test_ts_cache.py is licensed under GPLv3+ * src/tests/intg/test_sudo.py is licensed under GPLv3+ * src/tests/intg/test_sssctl.py is licensed under GPLv3+ * src/tests/intg/test_ssh_pubkey.py is licensed under GPLv3+ * src/tests/intg/test_session_recording.py is licensed under GPLv3+ * src/tests/intg/test_secrets.py is licensed under GPLv3+ * src/tests/intg/test_pysss_nss_idmap.py is licensed under GPLv3+ * src/tests/intg/test_pam_responder.py is licensed under GPLv3+ * src/tests/intg/test_pac_responder.py is licensed under GPLv3+ * src/tests/intg/test_netgroup.py is licensed under GPLv3+ * src/tests/intg/test_memory_cache.py is licensed under GPLv3+ * src/tests/intg/test_local_domain.py is licensed under GPLv3+ * src/tests/intg/test_ldap.py is licensed under GPLv3+ * src/tests/intg/test_kcm.py is licensed under GPLv3+ * src/tests/intg/test_infopipe.py is licensed under GPLv3+ * src/tests/intg/test_files_provider.py is licensed under GPLv3+ * src/tests/intg/test_files_ops.py is licensed under GPLv3+ * src/tests/intg/test_enumeration.py is licensed under GPLv3+ * src/tests/intg/sssd_passwd.py is licensed under GPLv3+ * src/tests/intg/sssd_nss.py is licensed under GPLv3+ * src/tests/intg/sssd_netgroup.py is licensed under GPLv3+ * src/tests/intg/sssd_ldb.py is licensed under GPLv3+ * src/tests/intg/sssd_id.py is licensed under GPLv3+ * src/tests/intg/sssd_group.py is licensed under GPLv3+ * src/tests/intg/secrets.py is licensed under GPLv3+ * src/tests/intg/ldap_local_override_test.py is licensed under GPLv3+ * src/tests/intg/ldap_ent.py is licensed under GPLv3+ * src/tests/intg/krb5utils.py is licensed under GPLv3+ * src/tests/intg/kdc.py is licensed under GPLv3+ * src/tests/intg/files_ops.py is licensed under GPLv3+ * src/tests/intg/ent_test.py is licensed under GPLv3+ * src/tests/intg/ent.py is licensed under GPLv3+ * src/tests/intg/ds_openldap.py is licensed under GPLv3+ * src/tests/intg/ds.py is licensed under GPLv3+ * src/config/setup.py.in is licensed under GPLv3+ * src/config/SSSDConfig/ipachangeconf.py is licensed under GPLv3+ * Explicitly add GPLv3+ license blob to several files * Updating the version before the 2.0 release * TESTS: the sys package was used but not imported * TESTS: Remove tests database in teardown * TESTS: Properly set argv[0] when starting the secrets responder * KCM: Move a confusing DEBUG message * KCM: Fix a typo * UTIL: Add libsss_secrets * SECRETS: Use libsss_secrets * KCM; Hide the secret URL as implementation detail instead of exposing it in the JSON-marshalling API * UTIL: libsss_secrets: Add an update function * KCM: Add a new back end that uses libsss_secrets directly * TESTS: Get rid of KCM_PEER_UID * TESTS: Add tests for the KCM libsss_secrets back end * KCM: Change the default ccache storage from the secrets responder to libsecrets * BUILD: Do not build the secrets responder by default * Lukas Slebodnik (6): * krb5_locator: Make debug function internal * krb5_locator: Simplify usage of macro PLUGIN_DEBUG * krb5_locator: Fix typo in debug message * krb5_locator: Fix formatting of the variable port * krb5_locator: Use format string checking for debug function * PAM: Allow to configure pam services for Smartcards * Pavel Březina (21): * include stdarg.h directly in debug.h * pam_add_response: fix talloc context * sss_ptr_hash: add sss_ptr_get_value to make it useful in delete callbacks * sss_ptr_list: add linked list of talloc pointers * sbus: move sbus code to standalone library * sbus: add sbus sssd error codes * sbus: add new implementation * sbus: build new sbus implementation * sbus: disable generating old api * sbus: fix indirect includes in sssd * sbus: add sss_iface library * sbus: convert monitor * sbus: convert backend * sbus: convert responders * sbus: convert proxy provider * sbus: convert infopipe * sbus: convert sssctl * sbus: remove old implementation * sbus: add new internal libraries to specfile * sbus: make tests run * tests: disable parse_inp_call_dp, parse_inp_call_attach in responder-get-domains-tests * amitkuma (1): * confdb: Remove CONFDB_DOMAIN_LEGACY_PASS

1 0

[sssd PR#630][closed] KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder
by jhrozek 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/630 Author: jhrozek Title: #630: KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder Action: closed To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/630/head:pr630 git checkout pr630

1 0

[sssd PR#630][+Pushed] KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder
by jhrozek 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/630 Title: #630: KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder Label: +Pushed

1 0

[sssd PR#630][comment] KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder
by jhrozek 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/630 Title: #630: KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder jhrozek commented: """ * master: fcbedf46fcfc66f443afa3171036b4bc7bbd380b f74feb08b86e72eb3e098ed097d0574f815f6de3 7dd1991c93a8c0ac5c887573a1be18523a861522 f91adcc8eb58294d0a69b5ce938d959f059a8a84 24ba2120697d95139ba6c0107608f31196532097 0b9001e3a8c820f137cbe07f853317474dac53ac e0bf64a736dc0fa244dc8023970ed4e65b4d7f31 fdfa36ae07dfc9bb7488d8dcde1e37ff95aeb3be 24b151e076313441518692a6afe7d3ec50e8c02f ca73eedba23f4746d57161f185a5da5e1c5b6b7c 80811f941160e481112adc6933f59e3d2e5c5c85 0294bcf7cdf21fe6702423f77554a880699c85bc aafaacd59d3ce935c4ca0a73a140f1e6f4cd49b0 4d7f07893fb3bcf9c39ec0ff318c73529f7f8278 """ See the full comment at https://github.com/SSSD/sssd/pull/630#issuecomment-412583793

1 0

[sssd PR#611][opened] Do not build the local provider by default
by fidencio 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/611 Author: fidencio Title: #611: Do not build the local provider by default Action: opened PR body: """ Folks, This series is the first attempt to avoid building the local provider by default. With we only build it conditionally and the default is set to not build it. The problems: - integration tests depend on the local provider: For this, I've changed our configure line, specifying to enable the local provider; - some unit tests depend on local provider: I've changed some tests (please, take a careful look at those in order to be sure I'm not invalidating the tests) and worked them around so they're still valid with both scenarios (building or not building the local provider); My **personal** preference would be to start using the **files** provider in our tests instead of using the "local" one. However, I've faced some issues related to the amount of users being find in some sysdb tests (ping me, we can discuss this either here or in the #sssd channel) (maybe because it also finds the local users/groups created on my machine?). Again, this is a first attempt, let's discuss improvements needed :-) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/611/head:pr611 git checkout pr611

3 31

[sssd PR#630][comment] KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder
by jhrozek 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/630 Title: #630: KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder jhrozek commented: """ retest this please """ See the full comment at https://github.com/SSSD/sssd/pull/630#issuecomment-412574163

1 0

[sssd PR#629][opened] ldap: remove parallel requests from rfc2307bis
by fidencio 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/629 Author: fidencio Title: #629: ldap: remove parallel requests from rfc2307bis Action: opened PR body: """ As this branch of code is not well tested, we've decided to just nuke it and, in the future, spend more time on improving the performance for the general case instead of maintaining this old "hack". Resolves: https://pagure.io/SSSD/sssd/issue/3494 Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> NOTE: This code needs careful review as I'm not 100% sure about the parts deleted! """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/629/head:pr629 git checkout pr629

3 6

[sssd PR#628][opened] providers: drop ldap_{init, }groups_use_matching_rule_in_chain support
by fidencio 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/628 Author: fidencio Title: #628: providers: drop ldap_{init,}groups_use_matching_rule_in_chain support Action: opened PR body: """ Resolves: https://pagure.io/SSSD/sssd/issue/3492 Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/628/head:pr628 git checkout pr628

2 6

[sssd PR#627][opened] providers: disable ldap_sudo_include_regexp by default
by fidencio 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/627 Author: fidencio Title: #627: providers: disable ldap_sudo_include_regexp by default Action: opened PR body: """ Using wildcard in sudoHost attribute is very costly to evaluate on LDAP server side and this features seems to be rarely used. Considering this, let's make it **not** enabled by default. Whoever is still interested on using it, can just add to their sssd.conf: `ldap_sudo_include_regexp = true`. NOTE: This PR is a revival of #387, submitted by @amitkumar50. As I just made a few changes on his PR I'm keeping him as author of the patch! """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/627/head:pr627 git checkout pr627

3 6

[sssd PR#397][opened] cleanup: Remove CONFDB_DOMAIN_LEGACY_PASS
by amitkumar50 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/397 Author: amitkumar50 Title: #397: cleanup: Remove CONFDB_DOMAIN_LEGACY_PASS Action: opened PR body: """ Since CONFDB_DOMAIN_LEGACY_PASS is legacy parameter that is rooted in pre-1.0 SSSD. We should just nuke it as we remove other legacy code. Resolves: https://pagure.io/SSSD/sssd/issue/3530 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/397/head:pr397 git checkout pr397

5 24

[sssd PR#601][opened] sbus: integrate sssd with sbus2
by pbrezina 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/601 Author: pbrezina Title: #601: sbus: integrate sssd with sbus2 Action: opened PR body: """ Hi folks, this is a really large patch set and I have now idea how to review it. I know that Jakub tried to review the proof of concept, but he have not managed to finish it so far. It is not in human power to review it all so hard testing should be done. I consider the code itself and the integration with sssd finished. I will push only bug fixes and review issues now. This first version does not run through make check so far because some tests needs to be altered, this however does not prevent manual testing and reviewing. I tried to make the changes small at first while running old and new sbus in parallel, but it was too hard as the changes were too much interconnected. Therefore each patch modifies one area, but completely and sssd will not build. There are new libraries, each in pair. Each pair consist of asynchronous (used inside sssd) and synchronous (used inside tools; sssctl) versions of API. - libsss_sbus, libsss_sbus_sync: sbus interface - libsss_iface, libsss_iface_sync: internal sssd interface, used for internal communication - libifp_iface, libifp_iface_sync: infopipe interface At this point, changes are mostly one to one. We still have separate server for monitor and backends. We still do not use signals, even though it is possible. I will file separate tickets with ideas how to improve our api further and we can work together after this patch set is tested and merged. I did my best with manual testing but I doubt I run all the scenarious. Especially, I want to ask @sbose to test ifp smartcard API and @fidencio to test Fleet Commander integration (the one dbus call in ipa code). Thank you. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/601/head:pr601 git checkout pr601

3 36

[sssd PR#620][opened] Add pam_cert_pam_services option
by abbra 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/620 Author: abbra Title: #620: Add pam_cert_pam_services option Action: opened PR body: """ Allow customizing which PAM services are allowed to perform smartcard authentication. Fixes: https://pagure.io/SSSD/sssd/issue/3775 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/620/head:pr620 git checkout pr620

4 13

RFC: 2.0 release notes
by Jakub Hrozek 13 Aug '18

13 Aug '18

Hi, we’re about to release 2.0. Here are my draft release notes: SSSD 2.0.0 =========== Highlights ---------- This release removes or deprecates functionality from SSSD, therefore the SSSD team decided it was time to bump the major version number. The sssd-1-16 branch will be still supported (most probably even as a LTM branch) so that users who rely on any of the removed features can either migrate or ask for the features to be readded. Except for the removed features, this release contains a reworked internal IPC and a new default storage back end for the KCM responder. Removed features ^^^^^^^^^^^^^^^^ * The Python API for managing users and groups in local domains (`id_provider=local`) was removed completely. The interface had been packaged as module called `pysss.local` * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath was adding needless additional complexity for little performance gain and was rarely used. * The `ldap_groups_use_matching_rule_in_chain` and `ldap_initgroups_use_matching_rule_in_chain` options and the code that evaluated them was removed. Neither of these options provided a significant performance benefit and the code implementing these options was complex and rarely used. Deprecated features ^^^^^^^^^^^^^^^^^^^ * The local provider (`id_provider=local`) and the command line tools to manage users and groups in the local domains, such as `sss_useradd` is not built by default anymore. There is a configure-time switch `--enable-local-domain` you can use to re-enable the local domain support. However, upstream would like to remove the local domain completely in a future release. * The `sssd_secrets`` responder is not packaged by default. The responder was meant to provide a REST API to access user secrets as well as a proxy to Custodia servers, but as Custodia development all but stopped and the local secrets handling so far didn't gain traction, we decided to not enable this code by default. This also means that the default SSSD configuration no longer requires libcurl and http-parser. Changed default settings ^^^^^^^^^^^^^^^^^^^^^^^^ * The `ldap_sudo_include_regexp` option changed its default value from `true` to `false`. This means that wild cards in the `sudoHost` LDAP attribute are no longer supported by default. The reason we changed the default was that the wildcard was costly to evaluate on the LDAP server side and at the same time rarely used. New features ^^^^^^^^^^^^ * The KCM responder has a new back end to store credential caches in a local database. This new back end is enabled by default and actually uses the same storage as the `sssd-secrets` responder had used, so the switch from sssd-secrets to this new back end should be completely seamless. The `sssd-secrets` socket is no longer required for KCM to operate. Packaging Changes ----------------- * The `sss_useradd`, `sss_userdel`, `sss_usermod`, `sss_groupadd`, `sss_groupdel`, `sss_groupshow` and `sss_groupmod` binaries and their manual pages are no longer packaged by default unless `--enable-local-provider` is selected. * The sssd_secrets responder is no longer packaged by default unless `--enable-secrets-responder` is selected. * The new internal IPC mechanism uses several private libraries that need to be packaged - `libsss_sbus.so`, `libsss_sbus_sync.so`, `libsss_iface.so`, `libsss_iface_sync.so`, `libifp_iface.so` and `libifp_iface_sync.so` * The new KCM ccache back end relies on a private library `libsss_secrets.so` that must be packaged in case either the KCM responder or the secrets responder are enabled. Documentation Changes --------------------- * The `ldap_groups_use_matching_rule_in_chain` and `ldap_initgroups_use_matching_rule_in_chain` options were removed. * The `ldap_sudo_include_regexp` option changed its default value from `true` to `false`. Tickets Fixed ------------- To be generated Detailed Changelog ------------------ To be generated

2 1

[sssd PR#637][opened] Relicense GPLv2 only files as GPLv3+
by jhrozek 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/637 Author: jhrozek Title: #637: Relicense GPLv2 only files as GPLv3+ Action: opened PR body: """ This patchset is seemingly large, but only the license blobs were in fact changed. There is one patch per changed file. In most cases, we should be totally fine as everyone who touched the file was a RH employee and RH owns the copyright and at the same time, the work was original, not a derivative of some original v2 only work. There are two exceptions: - there was an outside contributor who fixed some typos. I contacted him and Rene Genz kindly agreed to use v3+ - ipachangeconf.py was based on authconfig code. But since the authconfig code itself is v2+, there v2 only blob was a mistake in the first place. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/637/head:pr637 git checkout pr637

3 9

[sssd PR#638][opened] Explicitly add GPLv3+ license blob to several files
by jhrozek 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/638 Author: jhrozek Title: #638: Explicitly add GPLv3+ license blob to several files Action: opened PR body: """ In the absence of an explicit license blob in a file, the default GPLv3+ license applies, but it's better to be explicit. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/638/head:pr638 git checkout pr638

3 4

[sssd PR#635][opened] sss_ssh_knownhostsproxy: fix typo pubkey -> pubkeys
by fidencio 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/635 Author: fidencio Title: #635: sss_ssh_knownhostsproxy: fix typo pubkey -> pubkeys Action: opened PR body: """ In commit 36f2fe8f63 a discrepancy between the command line option and the manpage has been introduced. Related: https://pagure.io/SSSD/sssd/issue/3542 Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/635/head:pr635 git checkout pr635

2 7

[sssd PR#630][+Accepted] KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder
by fidencio 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/630 Title: #630: KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder Label: +Accepted

1 0

[sssd PR#630][comment] KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder
by fidencio 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/630 Title: #630: KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder fidencio commented: """ CI: http://vm-031.${abc}/logs/job/91/87/summary.html """ See the full comment at https://github.com/SSSD/sssd/pull/630#issuecomment-412494544

1 0

[sssd PR#630][comment] KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder
by fidencio 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/630 Title: #630: KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder fidencio commented: """ I gave it a try in the last version and it works as expected. I've fired an internal CI build and I'll add the "Accepted" label as soon as I get the results. """ See the full comment at https://github.com/SSSD/sssd/pull/630#issuecomment-412462154

1 0

[sssd PR#624][opened] Fix "test-find-uid" and "find_uid-tests" tests
by stanislavlevin 13 Aug '18

13 Aug '18

URL: https://github.com/SSSD/sssd/pull/624 Author: stanislavlevin Title: #624: Fix "test-find-uid" and "find_uid-tests" tests Action: opened PR body: """ Handle a "hidepid=1" mount option for procfs. One of the affects - this option makes impermissible non own pid subdirectories on /proc. Resolves: https://pagure.io/SSSD/sssd/issue/3789 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/624/head:pr624 git checkout pr624

4 11

Announcing SSSD 1.16.3
by Jakub Hrozek 12 Aug '18

12 Aug '18

SSSD 1.16.3 =========== The SSSD team is proud to announce the release of version 1.16.3 of the System Security Services Daemon. The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/ RPM packages will be made available for Fedora shortly. Feedback ———— Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users Highlights ---------- New Features ^^^^^^^^^^^^ * The ``kdcinfo`` files that SSSD uses to inform libkrb5 about which KDCs were discovered for a Kerberos realm used to be only generated for the joined domain, not the trusted domains. Starting with this release, the ``kdcinfo`` files are generated automatically also for trusted domains in setups that use ``id_provider=ad`` and IPA masters in a trust relationship with an AD domain. * The SSSD Kerberos locator plugin which processes the kdcinfo files and actually tells libkrb5 about the available KDCs can now process multiple address if SSSD generates more than one. At the moment, this feature is only used on IPA clients (see below). Please see the ``sssd_krb5_locator_plugin(8)`` manual page for more information about the Kerberos locator plugin. * On IPA clients, the AD DCs or the AD site which should be used to authenticate users can now be listed in a subdomain section. Please see `the feature design page <https://docs.pagure.org/SSSD.sssd/design_pages/kdcinfo_improvements.html>`_ or the section "trusted domains configuration" for more details. Notable bug fixes ^^^^^^^^^^^^^^^^^ * SECURITY: The permissions on ``/var/lib/sss/pipes/sudo`` were set so that anyone could read anyone else's sudo rules. This was considered an information leak and assigned CVE-2018-10852 (#3766) * IMPORTANT: The 1.16.2 release was storing the cached passwords without a salt prefix string. This bug was fixed in this release, but any password hashes generated by 1.16.2 are incompatible with the hashes generated by 1.16.3. The effect is that upgrade from 1.16.2 to 1.16.3 should be done when the authentication server is reachable so that the first authentication after the upgrade fix the cached password. * The ``sss_ssh`` proces leaked file descriptors when converting more than one x509 certificate to SSH public key (#3794) * SSSD, when configured with ``id_provider=ad`` was using too expensive LDAP search to find out whether the required POSIX attributes were replicated to the Global Catalog. Instead, SSSD now consults the Partial Attribute Set, which is much more effective (#3755) * The PAC responder is now able to process Domain Local in case the PAC uses SID compression. Typicaly this is the case with Windows Server 2012 and newer (#3767) * Some versions of OpenSSH (e.g. the one shipped in RHEL-7.5) would close the pipe towards ``sss_ssh_authorizedkeys`` when the matching key is found before the rest of the output is read. The ``sss_ssh_authorizedkeys`` helper was not handling this behaviour well and would exit with SIGPIPE, which also meant the public key authentication failed (#3747) * User lookups no longer fail if user's e-mail address conflicts with another user's fully qualified name (#3607) * The ``override_shell`` and ``override_homedir`` options are no longer applied to entries from the files domain. (#3758) * Several bugs related to the FleetCommander integration were fixed (#3773, #3774) * The grace logins with an expired password when authenticating against certain newer versions of the 389DS/RHDS LDAP server did not work (#3597) * Whitespace around netgroup triple separator is now stripped * The ``sss_ssh_knownhostproxy`` utility can now print the host key without proxying the connection. * Due to an overly restrictive check, the fast in-memory cache was sometimes skipped, which caused a high load on the ``sssd_nss`` process (#3776). Packaging Changes ----------------- * The python2 bindings are not built by default on Fedora 29 or newer * The sssd-secrets responder is now packaged in the sssd-kcm subpackage and might be removed in a future release Documentation Changes --------------------- * ``sss_ssh_knownhostsproxy`` has a new option `-k/--print`. Tickets Fixed ------------- * `3796 <https://pagure.io/SSSD/sssd/issue/3796>`_ - The IPA selinux provider can return an error if SELinux is completely disabled * `3794 <https://pagure.io/SSSD/sssd/issue/3794>`_ - sssd_ssh leaks file descriptors when more than one certificate is converted into an SSH key * `3791 <https://pagure.io/SSSD/sssd/issue/3791>`_ - The cached password does not store the salt prefix * `3778 <https://pagure.io/SSSD/sssd/issue/3778>`_ - When sssd is running as non-root user, the sudo pipe is created as sssd:sssd but then the private pipe ownership fails * `3777 <https://pagure.io/SSSD/sssd/issue/3777>`_ - If access check for a privileged pipe fails, the responder loops indefinitely * `3776 <https://pagure.io/SSSD/sssd/issue/3776>`_ - Spurious check in the sssd nss memcache can cause the memory cache to be skipped * `3774 <https://pagure.io/SSSD/sssd/issue/3774>`_ - Desktop Profile: The 10th policy is producing a wrong file name * `3773 <https://pagure.io/SSSD/sssd/issue/3773>`_ - SSSD bails out saving desktop profiles in case an invalid profile is found * `3767 <https://pagure.io/SSSD/sssd/issue/3767>`_ - Groups go missing with PAC enabled in sssd * `3766 <https://pagure.io/SSSD/sssd/issue/3766>`_ - CVE-2018-10852: information leak from the sssd-sudo responder * `3758 <https://pagure.io/SSSD/sssd/issue/3758>`_ - override_homedir should not apply to the files provider * `3755 <https://pagure.io/SSSD/sssd/issue/3755>`_ - The search filter for detecting POSIX attributes in global catalog is too broad and can cause a high load on the servers * `3754 <https://pagure.io/SSSD/sssd/issue/3754>`_ - SSSD AD uses LDAP filter to detect POSIX attributes stored in AD GC also for regular AD DC queries * `3747 <https://pagure.io/SSSD/sssd/issue/3747>`_ - sss_ssh_authorizedkeys exits abruptly if SSHD closes its end of the pipe before reading all the SSH keys * `3652 <https://pagure.io/SSSD/sssd/issue/3652>`_ - kdcinfo doesn't get populated for other domains * `3607 <https://pagure.io/SSSD/sssd/issue/3607>`_ - Handle conflicting e-mail addresses more gracefully * `3597 <https://pagure.io/SSSD/sssd/issue/3597>`_ - sssd doesn't allow user with expired password to login when PasswordgraceLimit set * `3596 <https://pagure.io/SSSD/sssd/issue/3596>`_ - A combination of the same qualified and unqualified sudoUser causes Error: 17: File exists * `3542 <https://pagure.io/SSSD/sssd/issue/3542>`_ - Get host key without proxying connection * `3475 <https://pagure.io/SSSD/sssd/issue/3475>`_ - Full information regarding priority of lookup of principal in keytab not in man page * `3291 <https://pagure.io/SSSD/sssd/issue/3291>`_ - RFE: sssd in cross realm trust configuration should be use AD KDC from a list or site defined in the config file Detailed Changelog ------------------ * Alexander Bokovoy (2): * ipa provider: always use a special keytab to talk to a trusted DC * ipa provider: expand search base to cover trusted domain objects * Alexey Sheplyakov (1): * nss: skip incomplete groups instead of bailing out * Amit Kumar (1): * Responder: simplify if-else structure in sss_dp_get_account_msg() * Fabiano Fidêncio (18): * intg: Do not hardcode nsslibdir * files: do not apply override_homedir to files provider * tests: add override_homedir tests for files provider * files: do not apply override_shell to files provider * tests: add override_shell tests for files provider * util: add is_files_provider() helper * files: make use of is_files_provider() helper * cache_req: keep the files provider as the first domain to be searched * tests: add basic tests for cache_req_domain_new_list_from_domain_resolution_order() * tests: add a test to ensure the output_fqnames is false for files provider * deskprofile: don't bail if we fail to save one profile * sdap: respect passwordGracelimit * deskprofile: fix a typo in _get_filename_path() * tests: add tests for ipa_deskprofile_get_filename_path() * util: introduce sss_ssh_print_pubkey() * ssh: make use of sss_ssh_print_pubkey() * sss_ssh_knownhostsproxy: add option to only print the pubkey * nss: remove unused label * Jakub Hrozek (38): * Bumping the version to track the 1.16.3 development * TESTS: Extend the schema with sshPublicKey attribute * TESTS: Allow adding sshPublicKey for users * TESTS: Add a basic SSH responder test * SSH: Do not exit abruptly if SSHD closes its end of the pipe before reading all the SSH keys * TESTS: Add a helper binary that can trigger the SIGPIPE to authorizedkeys * TESTS: Add a regression test for SIGHUP handling in sss_ssh_authorizedkeys * Revert "LDAP/IPA: add local email address to aliases" * util: Remove the unused function is_email_from_domain * TESTS: Allow storing e-mail address for users * TESTS: Add regression test for looking up users with conflicting e-mail addresses * AD/LDAP: Do not misuse the ignore_mark_offline to check if a connection needs to be checked for POSIX attribute presence * MAN: Remove outdated notes from the re_expression description * MAN: Document the re_expression needed to suport @-signs in the groupnames * SUDO: Create the socket with stricter permissions * AD: expose the helper function to format the site DNS query * RESOLV: Add a resolv_hostport_list request * KRB5/IPA/AD: Add a utility function to create a krb5_service instance * KRB5: Allow writing multiple addresses to the kdcinfo plugin * IPA: Add the options that the IPA subdomains code will read for trusted domains on the client * IPA: Populate kdcinfo files on trust clients with configured AD servers * MAN: Document the options available for AD trusted domains * SDAP: Detect schemaNamingContext from the rootDSE * AD: Add Global Catalog usability check in subdomain code by looking at the schema * AD: Remove the legacy check from ad_get_account_domain_posix_check request * LDAP/AD: Remove the legacy POSIX check from user, group and enumeration searches * LDAP: Remove the legacy POSIX check itself * sudo testcli: Use hand-crafted JSON for output so that the test CLI is usable in tests * TESTS: Load the sudo schema in the default OpenLDAP test instance and create ou=sudoers * TESTS: Add API to add sudo rules in tests * TESTS: Add a simple sudo LDAP test * SUDO: Don't save duplicates when saving qualified names * crypto: Silence a Coverity warning in OpenSSL version of sss_hmac_sha1() * crypto: Make one condition more defensive in NSS version of sss_hmac_sha1() * SDAP: Improve a confusing DEBUG message when initgroups search matches multiple entries * RESP: Terminate client connection if the permissions check on the priv pipe fails * SELINUX: Also call is_selinux_enabled as a check for selinux child * P11: Don't return int failure from a bool function * Josef Cejka (1): * Strip whitespaces in netgroup triple. * Lukas Slebodnik (15): * sss_seed: Remove unused parameter from seed_domain_user_info * SUDO: Fix running in unprivileged responder * SUDO: Root should be able to read/write sssd-sudo socket * SPEC: Drop unnecessary check for minor version of el7 * test_ssh_client: Do not ignore failure from read * SPEC: Move openssl deps away from unit tests deps * PYTHON: Avoid warnings with python3.7 * SPEC: Move secrets responder to the package sssd-kcm * SPEC: Do not build python2 bindings on latest distros * BUILD: Replace also runstatedir in templates * SYSTEMD: Allow to use "/run" in ListenStream * Revert "Revert "CRYPTO: Suppress warning Wstringop-truncation"" * CRYPTO: Save prefix in s3crypt_sha512 * crypto-tests: Add unit test for s3crypt_sha512 * SSS_CERT: Close file descriptors after executing p11_child * Michal Židek (1): * Revert "CRYPTO: Suppress warning Wstringop-truncation" * Stanislav Levin (1): * Fix "test-find-uid" and "find_uid-tests" tests * Sumit Bose (14): * krb5 locator: add support for multiple addresses * krb5 locator: fix IPv6 support * krb5 locator: make plugin more robust * krb5 locator: add unit tests * AD/IPA: Create kdcinfo file for sub-domains * krb5: refactor removal of krb5info files * krb5_common: add callback only once * data provider: run offline callbacks only once * utils: add libsss_child dependency to libsss_cert * AD: consider resource_groups in PAC as well * utils: make create_ipa_preauth_indicator() public as create_preauth_indicator() * PAM: create pre-auth indicator file * MC: Remove check if record is in the mapped address space * tests: fix sss_nss_idmap-tests * amitkumar50 (1): * MAN: Give information regarding priority of ldap lookup

2 2

[sssd PR#630][comment] KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder
by jhrozek 12 Aug '18

12 Aug '18

URL: https://github.com/SSSD/sssd/pull/630 Title: #630: KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder jhrozek commented: """ retest this please """ See the full comment at https://github.com/SSSD/sssd/pull/630#issuecomment-412369341

1 0

[sssd PR#630][+postponed until sssd 2.0] KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder
by jhrozek 12 Aug '18

12 Aug '18

URL: https://github.com/SSSD/sssd/pull/630 Title: #630: KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder Label: +postponed until sssd 2.0

1 0

[sssd PR#630][comment] KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder
by jhrozek 12 Aug '18

12 Aug '18

URL: https://github.com/SSSD/sssd/pull/630 Title: #630: KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder jhrozek commented: """ Thank you, I merged your patch. I also changed the patch that fixes to libsecrets by default, this is the diff: ``` diff --git a/src/man/sssd-kcm.8.xml b/src/man/sssd-kcm.8.xml index 78d3551d4..ec27aa57b 100644 --- a/src/man/sssd-kcm.8.xml +++ b/src/man/sssd-kcm.8.xml @@ -121,17 +121,9 @@ systemctl enable sssd-kcm.socket <refsect1 id='storage'> <title>THE CREDENTIAL CACHE STORAGE</title> <para> - The credential caches are stored in the SSSD secrets service (see - <citerefentry> - <refentrytitle>sssd-secrets</refentrytitle><manvolnum>5</manvolnum> - </citerefentry> - for more details). Therefore it is important that also the sssd-secrets - service is enabled and its socket is started: - <programlisting> -systemctl start sssd-secrets.socket -systemctl enable sssd-secrets.socket - </programlisting> - Your distribution should already set the dependencies between the services. + The credential caches are stored in a database, much like SSSD + caches user or group entries. The database is typically + located at <quote>/var/lib/sss/secrets</quote>. </para> </refsect1> ``` """ See the full comment at https://github.com/SSSD/sssd/pull/630#issuecomment-412364601

1 0

[sssd PR#631][opened] nss: remove unused label
by fidencio 10 Aug '18

10 Aug '18

URL: https://github.com/SSSD/sssd/pull/631 Author: fidencio Title: #631: nss: remove unused label Action: opened PR body: """ After 4937f2c6, Sumit noticed the following warning/breakage: make[2]: Leaving directory '/home/sbose/sssd/master_build/src/man' Making check in . make[2]: Entering directory '/home/sbose/sssd/master_build' CC src/responder/nss/nss_protocol_grent.o ../src/responder/nss/nss_protocol_grent.c: In function 'nss_protocol_fill_initgr': ../src/responder/nss/nss_protocol_grent.c:409:1: error: label 'done' defined but not used [-Werror=unused-label] done: ^~~~ cc1: all warnings being treated as errors Makefile:17808: recipe for target 'src/responder/nss/nss_protocol_grent.o' failed make[2]: *** [src/responder/nss/nss_protocol_grent.o] Error 1 make[2]: Leaving directory '/home/sbose/sssd/master_build' Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/631/head:pr631 git checkout pr631

2 11

[sssd PR#634][opened] P11: Don't return int failure from a bool function
by jhrozek 10 Aug '18

10 Aug '18

URL: https://github.com/SSSD/sssd/pull/634 Author: jhrozek Title: #634: P11: Don't return int failure from a bool function Action: opened PR body: """ The functions return bool as per their prototype, but returning EINVAL on failure meant that EINVAL (typically 22) was converted to 'true', so a certificate that was not processable was considered valid. Luckily this code only converts certificates into SSH public keys, so there are no security implications. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/634/head:pr634 git checkout pr634

4 7

[sssd PR#632][opened] tests: fix sss_nss_idmap-tests
by sumit-bose 10 Aug '18

10 Aug '18

URL: https://github.com/SSSD/sssd/pull/632 Author: sumit-bose Title: #632: tests: fix sss_nss_idmap-tests Action: opened PR body: """ If sss_nss_idmap-tests is complied with -Wl,-Bsymbolic-functions it fails because sss_nss_make_request_timeout() is not properly wrapped but the tests expects that the replacement call it provides is picked by the linker and not the original function. This patch wraps the call in the corresponding test library. As a consequence a small helper function had to be added to make dlopen-tests pass for the test library as well. Resolves https://pagure.io/SSSD/sssd/issue/3801 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/632/head:pr632 git checkout pr632

3 8

[sssd PR#630][comment] KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder
by fidencio 10 Aug '18

10 Aug '18

URL: https://github.com/SSSD/sssd/pull/630 Title: #630: KCM/SECRETS: Use a library to access the secrets storage instead of the secrets responder, deprecate secrets responder fidencio commented: """ @jhrozek, I found out a few more issues related to the last patch of the latest series, please, take a look at the following patch that could be squashed into yours: ``` diff --git a/Makefile.am b/Makefile.am index 23e094a37..0f36148e8 100644 --- a/Makefile.am +++ b/Makefile.am @@ -4663,8 +4663,6 @@ if HAVE_SYSTEMD_UNIT src/sysv/systemd/sssd-pam.socket \ src/sysv/systemd/sssd-pam-priv.socket \ src/sysv/systemd/sssd-pam.service \ - src/sysv/systemd/sssd-secrets.socket \ - src/sysv/systemd/sssd-secrets.service \ $(NULL) if BUILD_AUTOFS systemdunit_DATA += \ @@ -4683,6 +4681,12 @@ if BUILD_PAC_RESPONDER src/sysv/systemd/sssd-pac.service \ $(NULL) endif +if BUILD_SECRETS + systemdunit_DATA += \ + src/sysv/systemd/sssd-secrets.socket \ + src/sysv/systemd/sssd-secrets.service \ + $(NULL) +endif if BUILD_SSH systemdunit_DATA += \ src/sysv/systemd/sssd-ssh.socket \ @@ -4820,6 +4824,7 @@ src/sysv/systemd/sssd-pam.service: src/sysv/systemd/sssd-pam.service.in Makefile @$(MKDIR_P) src/sysv/systemd/ $(replace_script) +if BUILD_SECRETS src/sysv/systemd/sssd-secrets.socket: src/sysv/systemd/sssd-secrets.socket.in Makefile @$(MKDIR_P) src/sysv/systemd/ $(replace_script) @@ -4827,6 +4832,7 @@ src/sysv/systemd/sssd-secrets.socket: src/sysv/systemd/sssd-secrets.socket.in Ma src/sysv/systemd/sssd-secrets.service: src/sysv/systemd/sssd-secrets.service.in Makefile @$(MKDIR_P) src/sysv/systemd/ $(replace_script) +endif if BUILD_AUTOFS src/sysv/systemd/sssd-autofs.socket: src/sysv/systemd/sssd-autofs.socket.in Makefile @@ -4875,9 +4881,25 @@ src/sysv/systemd/sssd-sudo.service: src/sysv/systemd/sssd-sudo.service.in Makefi endif if BUILD_KCM +if BUILD_SECRETS +kcm_socket_requires = Requires=sssd-secrets.socket +else +kcm_socket_requires = +endif + +kcm_edit_cmd = $(edit_cmd) \ + -e 's|@kcm_socket_requires[@]|$(kcm_socket_requires)|g' + +kcm_replace_script = \ + @rm -f $@ $@.tmp; \ + srcdir=''; \ + test -f ./$@.in || srcdir=$(srcdir)/; \ + $(kcm_edit_cmd) $${srcdir}$@.in >$@.tmp; \ + mv $@.tmp $@ + src/sysv/systemd/sssd-kcm.socket: src/sysv/systemd/sssd-kcm.socket.in Makefile @$(MKDIR_P) src/sysv/systemd/ - $(replace_script) + $(kcm_replace_script) src/sysv/systemd/sssd-kcm.service: src/sysv/systemd/sssd-kcm.service.in Makefile @$(MKDIR_P) src/sysv/systemd/ diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index a9874a10e..706254deb 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -1351,10 +1351,10 @@ done %{_datadir}/sssd-kcm/kcm_default_ccache %{_unitdir}/sssd-kcm.socket %{_unitdir}/sssd-kcm.service -%{_unitdir}/sssd-secrets.socket -%{_unitdir}/sssd-secrets.service %{_mandir}/man8/sssd-kcm.8* %if (0%{?with_secrets} == 1) +%{_unitdir}/sssd-secrets.socket +%{_unitdir}/sssd-secrets.service %{_mandir}/man5/sssd-secrets.5* %endif %endif @@ -1372,7 +1372,6 @@ getent passwd sssd >/dev/null || useradd -r -g sssd -d / -s /sbin/nologin -c "Us %systemd_post sssd-pac.socket %systemd_post sssd-pam.socket %systemd_post sssd-pam-priv.socket -%systemd_post sssd-secrets.socket %systemd_post sssd-ssh.socket %systemd_post sssd-sudo.socket @@ -1383,7 +1382,6 @@ getent passwd sssd >/dev/null || useradd -r -g sssd -d / -s /sbin/nologin -c "Us %systemd_preun sssd-pac.socket %systemd_preun sssd-pam.socket %systemd_preun sssd-pam-priv.socket -%systemd_preun sssd-secrets.socket %systemd_preun sssd-ssh.socket %systemd_preun sssd-sudo.socket @@ -1398,8 +1396,6 @@ getent passwd sssd >/dev/null || useradd -r -g sssd -d / -s /sbin/nologin -c "Us %systemd_postun_with_restart sssd-pam.socket %systemd_postun_with_restart sssd-pam-priv.socket %systemd_postun_with_restart sssd-pam.service -%systemd_postun_with_restart sssd-secrets.socket -%systemd_postun_with_restart sssd-secrets.service %systemd_postun_with_restart sssd-ssh.socket %systemd_postun_with_restart sssd-ssh.service %systemd_postun_with_restart sssd-sudo.socket @@ -1426,6 +1422,18 @@ getent passwd sssd >/dev/null || useradd -r -g sssd -d / -s /sbin/nologin -c "Us %systemd_postun_with_restart sssd-kcm.service %endif +%if (0%{?with_secrets} == 1) +%post secrets +%systemd_postun_with_restart sssd-secrets.socket + +%preun secrets +%systemd_preun_with_restart sssd-secrets.socket + +%postun secrets +%systemd_postun_with_restart sssd-secrets.socket +%systemd_postun_with_restart sssd-secrets.service +%endif + %else # sysv %post common diff --git a/src/sysv/systemd/sssd-kcm.socket.in b/src/sysv/systemd/sssd-kcm.socket.in index 8b742847d..e8a5f0aca 100644 --- a/src/sysv/systemd/sssd-kcm.socket.in +++ b/src/sysv/systemd/sssd-kcm.socket.in @@ -1,7 +1,7 @@ [Unit] Description=SSSD Kerberos Cache Manager responder socket Documentation=man:sssd-kcm(8) -Requires=sssd-secrets.socket +@kcm_socket_requires@ [Socket] ListenStream=@runstatedir@/.heim_org.h5l.kcm-socket ``` """ See the full comment at https://github.com/SSSD/sssd/pull/630#issuecomment-412116116

1 0

[sssd PR#633][opened] nss_protocol_fill_initgr: fix label ‘done’ defined but not used
by pbrezina 10 Aug '18

10 Aug '18

URL: https://github.com/SSSD/sssd/pull/633 Author: pbrezina Title: #633: nss_protocol_fill_initgr: fix label ‘done’ defined but not used Action: opened PR body: """ CC src/responder/nss/nss_protocol_netgr.o /home/pbrezina/workspace/sssd/src/responder/nss/nss_protocol_grent.c: In function ‘nss_protocol_fill_initgr’: /home/pbrezina/workspace/sssd/src/responder/nss/nss_protocol_grent.c:409:1: error: label ‘done’ defined but not used [-Werror=unused-label] done: """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/633/head:pr633 git checkout pr633

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2018