From bc92758f57b904bac25709e09de5bb8aba7689f8 Mon Sep 17 00:00:00 2001 From: AmitKumar Date: Mon, 17 Jul 2017 21:44:04 +0530 Subject: [PATCH 1/5] MAN: Improve description of 'trusted domain section' in sssd.conf's man page PR generated to include explaination for ipa ad trust sssd configuration where ad has a child domain. Explanation is added to 'TRUSTED DOMAIN SECTION'. Also an example is included to better understanding. Resolves: https://pagure.io/SSSD/sssd/issue/3399 --- src/man/sssd.conf.5.xml | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml index 0f7822b29..92398a13d 100644 --- a/src/man/sssd.conf.5.xml +++ b/src/man/sssd.conf.5.xml @@ -2912,7 +2912,9 @@ ldap_user_extra_attrs = phone:telephoneNumber Some options used in the domain section can also be used in the trusted domain section, that is, in a section called - [domain/DOMAIN_NAME/TRUSTED_DOMAIN_NAME]. + [domain/DOMAIN_NAME/TRUSTED_DOMAIN_NAME]. + Where DOMAIN_NAME is actual joined-to base domain. Please refer + examples below for explanation. Currently supported options in the trusted domain section are: ldap_search_base, @@ -2931,9 +2933,9 @@ ldap_user_extra_attrs = phone:telephoneNumber - EXAMPLE + EXAMPLES - The following example shows a typical SSSD config. It does + 1. The following example shows a typical SSSD config. It does not describe configuration of the domains themselves - refer to documentation on configuring domains for more details. @@ -2962,6 +2964,17 @@ min_id = 10000 max_id = 20000 enumerate = False + + + + 2. The following example shows configuration in IPA AD trust. AD having + having child domain. Suppose IPA domain(ipa.com) has trust with AD + domain(ad.com). ad.com has child domain(child.ad.com). To enable + shortnames in child domain following configuration should be used. + +[domain/ipa.com/child.ad.com] +use_fully_qualified_names = false + From bb1543000ed5af929b91956cccf208edc5f96a84 Mon Sep 17 00:00:00 2001 From: AmitKumar Date: Fri, 14 Jul 2017 20:09:21 +0530 Subject: [PATCH 2/5] MAN: The timeout option doesn't say after how many heartbeats will the process be killed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Text added in timeout section of sssd.conf man page describing number of heartbeat missed before process self kills itself. Resolves: https://pagure.io/SSSD/sssd/issue/3398 Reviewed-by: Fabiano Fidêncio --- src/man/sssd.conf.5.xml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml index 0f7822b29..7ac511633 100644 --- a/src/man/sssd.conf.5.xml +++ b/src/man/sssd.conf.5.xml @@ -161,7 +161,9 @@ Timeout in seconds between heartbeats for this service. This is used to ensure that the process - is alive and capable of answering requests. + is alive and capable of answering requests. Note + that after three missed heartbeats the process + will terminate itself. Default: 10 From 2bd5bb45189c4916c09b5c8a13ebe509f8a0987a Mon Sep 17 00:00:00 2001 From: AmitKumar Date: Tue, 11 Jul 2017 23:05:25 +0530 Subject: [PATCH 3/5] MAN: Updating option ipa_server_mode in man sssd-ipa MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Changes done for section ipa_server_mode since description of section was bit vague. Text is re-phrased for better understanding. Resolves: https://pagure.io/SSSD/sssd/issue/3404 Reviewed-by: Fabiano Fidêncio --- src/man/sssd-ipa.5.xml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml index 98db5b96d..5e7f8ff1a 100644 --- a/src/man/sssd-ipa.5.xml +++ b/src/man/sssd-ipa.5.xml @@ -482,14 +482,15 @@ ipa_server_mode (boolean) - - This option should only be set by the IPA - installer. - - - The option denotes that the SSSD is running on - IPA server and should perform lookups of users - and groups from trusted domains differently. + + This option will be set by the IPA installer + (ipa-server-install) automatically and denotes + if SSSD is running on an IPA server or not. + + + On an IPA server SSSD will lookup users and groups + from trusted domains directly while on a client + it will ask an IPA server. Default: false From b294f9f082c97f0c6ef16739e19826a16375444e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 10 May 2017 11:33:14 +0200 Subject: [PATCH 4/5] INTG/FILES_PROVIDER: Test user and group override MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit User and group override have been failing when using it with files provider. This test helps us to avoid such regression in the future. As mentioned in the comment added to the test's code, there's an issue in nss_wrapper [0] and nss_wrapper always looks into the files first before using the NSS module, causing a test failure in case the fully-qualified name is not used when looking up for the original (not overriden) user and group. Related: https://pagure.io/SSSD/sssd/issue/3391 Signed-off-by: Fabiano Fidêncio Reviewed-by: Sumit Bose --- src/tests/intg/test_files_provider.py | 86 +++++++++++++++++++++++++++++++++-- 1 file changed, 81 insertions(+), 5 deletions(-) diff --git a/src/tests/intg/test_files_provider.py b/src/tests/intg/test_files_provider.py index 8f009227d..b26977e06 100644 --- a/src/tests/intg/test_files_provider.py +++ b/src/tests/intg/test_files_provider.py @@ -52,6 +52,11 @@ dir='/home/user2', shell='/bin/bash') +OV_USER1 = dict(name='ov_user1', passwd='x', uid=10010, gid=20010, + gecos='Overriden User 1', + dir='/home/ov/user1', + shell='/bin/ov_user1_shell') + CANARY_GR = dict(name='canary', gid=300001, mem=[]) @@ -60,6 +65,10 @@ gid=30001, mem=['user1']) +OV_GROUP1 = dict(name='ov_group1', + gid=30002, + mem=['user1']) + GROUP12 = dict(name='group12', gid=30012, mem=['user1', 'user2']) @@ -69,6 +78,14 @@ mem=[]) +def start_sssd(): + """Start sssd and add teardown for stopping it and removing state""" + os.environ["SSS_FILES_PASSWD"] = os.environ["NSS_WRAPPER_PASSWD"] + os.environ["SSS_FILES_GROUP"] = os.environ["NSS_WRAPPER_GROUP"] + if subprocess.call(["sssd", "-D", "-f"]) != 0: + raise Exception("sssd start failed") + + def stop_sssd(): pid_file = open(config.PIDFILE_PATH, "r") pid = int(pid_file.read()) @@ -81,6 +98,11 @@ def stop_sssd(): time.sleep(1) +def restart_sssd(): + stop_sssd() + start_sssd() + + def create_conf_fixture(request, contents): """Generate sssd.conf and add teardown for removing it""" conf = open(config.CONF_PATH, "w") @@ -91,11 +113,7 @@ def create_conf_fixture(request, contents): def create_sssd_fixture(request): - """Start sssd and add teardown for stopping it and removing state""" - os.environ["SSS_FILES_PASSWD"] = os.environ["NSS_WRAPPER_PASSWD"] - os.environ["SSS_FILES_GROUP"] = os.environ["NSS_WRAPPER_GROUP"] - if subprocess.call(["sssd", "-D", "-f"]) != 0: - raise Exception("sssd start failed") + start_sssd() def teardown(): try: @@ -294,6 +312,32 @@ def check_group_list(exp_groups_list): check_group(exp_group) +def assert_user_overriden(): + # There is an issue in nss_wrapper [0] and nss_wrapper always looks into + # the files first before using the NSS module. This lets this check fail + # because the user is found in the file and hence will be returned + # without overridden values. + # In order to work this around while there's no fix for nss_wrapper, let's + # use the fully-qualified name when looking up the USER1 + # + # https://bugzilla.samba.org/show_bug.cgi?id=12883) + ent.assert_passwd_by_name(USER1["name"]+"@files", OV_USER1) + ent.assert_passwd_by_name(OV_USER1["name"], OV_USER1) + + +def assert_group_overriden(): + # There is an issue in nss_wrapper [0] and nss_wrapper always looks into + # the files first before using the NSS module. This lets this check fail + # because the user is found in the file and hence will be returned + # without overridden values. + # In order to work this around while there's no fix for nss_wrapper, let's + # use the fully-qualified name when looking up the GROUP1 + # + # https://bugzilla.samba.org/show_bug.cgi?id=12883) + ent.assert_group_by_name(GROUP1["name"]+"@files", OV_GROUP1) + ent.assert_group_by_name(OV_GROUP1["name"], OV_GROUP1) + + # User tests def test_getpwnam_after_start(add_user_with_canary, files_domain_only): """ @@ -305,6 +349,38 @@ def test_getpwnam_after_start(add_user_with_canary, files_domain_only): assert user == USER1 +def test_user_overriden(add_user_with_canary, files_domain_only): + """ + Test that user override works with files domain only + """ + # Override + subprocess.check_call(["sss_override", "user-add", USER1["name"], + "-u", str(OV_USER1["uid"]), + "-g", str(OV_USER1["gid"]), + "-n", OV_USER1["name"], + "-c", OV_USER1["gecos"], + "-h", OV_USER1["dir"], + "-s", OV_USER1["shell"]]) + + restart_sssd() + + assert_user_overriden() + + +def test_group_overriden(add_group_with_canary, files_domain_only): + """ + Test that user override works with files domain only + """ + # Override + subprocess.check_call(["sss_override", "group-add", GROUP1["name"], + "-n", OV_GROUP1["name"], + "-g", str(OV_GROUP1["gid"])]) + + restart_sssd() + + assert_group_overriden() + + def test_getpwnam_neg(files_domain_only): """ Test that a nonexistant user cannot be resolved From 6bc291c26ee891042258a8d4e9c8d707db98be33 Mon Sep 17 00:00:00 2001 From: AmitKumar Date: Tue, 18 Jul 2017 20:39:04 +0530 Subject: [PATCH 5/5] MAN: Improve description of 'trusted domain section' in sssd.conf's man page PR generated to include explaination for ipa ad trust sssd configuration where ad has a child domain. Explanation is added to 'TRUSTED DOMAIN SECTION'. Also an example is included to better understanding. Resolves: https://pagure.io/SSSD/sssd/issue/3399 --- src/man/sssd.conf.5.xml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml index 5184d83f5..1c6eba85e 100644 --- a/src/man/sssd.conf.5.xml +++ b/src/man/sssd.conf.5.xml @@ -2914,8 +2914,8 @@ ldap_user_extra_attrs = phone:telephoneNumber Some options used in the domain section can also be used in the trusted domain section, that is, in a section called - [domain/DOMAIN_NAME/TRUSTED_DOMAIN_NAME]. - Where DOMAIN_NAME is actual joined-to base domain. Please refer + [domain/DOMAIN_NAME/TRUSTED_DOMAIN_NAME]. + Where DOMAIN_NAME is actual joined-to base domain. Please refer examples below for explanation. Currently supported options in the trusted domain section are: @@ -2967,10 +2967,9 @@ max_id = 20000 enumerate = False - - 2. The following example shows configuration in IPA AD trust. AD having - having child domain. Suppose IPA domain(ipa.com) has trust with AD + 2. The following example shows configuration in IPA AD trust. AD having + having child domain. Suppose IPA domain(ipa.com) has trust with AD domain(ad.com). ad.com has child domain(child.ad.com). To enable shortnames in child domain following configuration should be used.