URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: WIP: Don't ignore host entries in Group Policy security filters Action: opened
PR body: """ I'm posting my code here to hopefully receive some feedback while I work on host entries in gpo security filters. Any feedback/criticism is welcome!
Finished: Validate against host sid in ad_gpo_evaluate_dacl(), also test.
In progress: Host sid retrieval via sdap.
TODO: Caching host sid in sysdb. Test sdap search for host sid. """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/905/head:pr905 git checkout pr905
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: WIP: Don't ignore host entries in Group Policy security filters
centos-ci commented: """ Can one of the admins verify this patch? """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-543347505
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: WIP: Don't ignore host entries in Group Policy security filters
sumit-bose commented: """ ok to test """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-543549922
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: WIP: Don't ignore host entries in Group Policy security filters
abbra commented: """ Few observations: - we already have code to translate between string/structure for SIDs, why there is a need for another one? - may be you can simplify the code by passing the structure you have instead of doing conversion? - please don't use explicit `gethostname()` to retrieve the name of the machine. Instead, use SSSD configuration as `ad_hostname` can be used to redefine your real hostname """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-543558005
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: WIP: Don't ignore host entries in Group Policy security filters
dmulder commented: """ @abbra I assumed there was probably sid conversion code somewhere, but I'm not very familiar with sssd and couldn't find it. Also, I agree using gethostname is bad, but I couldn't find where to retrieve the hostname via sssd configuration. Could you point me in the right direction Alexander? """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-545493506
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: WIP: Don't ignore host entries in Group Policy security filters
abbra commented: """ Sure, David. See src/lib/idmap/sss_idmap.h for SID-related functions. For accessing `ad_hostname`, you have it already in the `struct ad_gpo_access_state`, prepopulated by the `ad_gpo_access_send()`. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-545499635
URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: WIP: Don't ignore host entries in Group Policy security filters Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/905/head:pr905 git checkout pr905
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: WIP: Don't ignore host entries in Group Policy security filters
Label: +Waiting for review
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: WIP: Don't ignore host entries in Group Policy security filters
mzidek-rh commented: """ Marking this as waiting for a review for now, so that someone from SSSD will also take a look at this. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-545847593
URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: WIP: Don't ignore host entries in Group Policy security filters Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/905/head:pr905 git checkout pr905
URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: WIP: Don't ignore host entries in Group Policy security filters Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/905/head:pr905 git checkout pr905
URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: Don't ignore host entries in Group Policy security filters Action: edited
Changed field: title Original value: """ WIP: Don't ignore host entries in Group Policy security filters """
URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: Don't ignore host entries in Group Policy security filters Action: edited
Changed field: body Original value: """ I'm posting my code here to hopefully receive some feedback while I work on host entries in gpo security filters. Any feedback/criticism is welcome!
Finished: Validate against host sid in ad_gpo_evaluate_dacl(), also test.
In progress: Host sid retrieval via sdap.
TODO: Caching host sid in sysdb. Test sdap search for host sid. """
URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: Don't ignore host entries in Group Policy security filters Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/905/head:pr905 git checkout pr905
URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: Don't ignore host entries in Group Policy security filters Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/905/head:pr905 git checkout pr905
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
dmulder commented: """ @abbra Any thoughts on these latest patches? """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-553475294
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
abbra commented: """ @dmulder they need to be reviewed by SSSD core team (I'm not the one ;)), so we need a review from @pbrezina and @sumit-bose, at least. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-553492150
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
pbrezina commented: """ Thank you for these patches. I have just few nitpicks:
We have a convention of prefixing output variables with underscore, i.e. `size_t *_num_hosts`. Can you amend new sysdb functions to this style please? Also there is a bad indentation of `sysdb_search_computer` parameters.
More important: can you add some rationale to the first commit message so it is clear why this change is done and what are the benefits?
The last commit contains few `FIXMEs`. Can you address them as well? Or what are the consequences if they are not addressed?
Thank you. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-559034141
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
Label: -Waiting for review
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
Label: +Changes requested
URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: Don't ignore host entries in Group Policy security filters Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/905/head:pr905 git checkout pr905
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
dmulder commented: """ Thanks for reviewing! I've fixed the issues you commented on, as well as one of my own. I noticed that the sssd-ad man page still contained a comment explaining that host entries in the Security Filter were not supported, so I removed that statement.
The last commit contains few `FIXMEs`. Can you address them as well? Or what are the consequences if they are not addressed?
The FIXME in sysdb_set_computer would be an enhancement, but is not required for this to function. The FIXME in ad_gpo_get_host_sid_retrieval_done is trivial, and not necessary. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-561767891
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
dmulder commented: """ @pbrezina Thanks for reviewing! I've fixed the issues you commented on, as well as one of my own. I noticed that the sssd-ad man page still contained a comment explaining that host entries in the Security Filter were not supported, so I removed that statement.
The last commit contains few `FIXMEs`. Can you address them as well? Or what are the consequences if they are not addressed?
The FIXME in sysdb_set_computer would be an enhancement, but is not required for this to function. The FIXME in ad_gpo_get_host_sid_retrieval_done is trivial, and not necessary. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-561767891
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
pbrezina commented: """ ``` /home/pbrezina/workspace/sssd/src/db/sysdb_computer.c: In function ‘sysdb_search_computer’: /home/pbrezina/workspace/sssd/src/db/sysdb_computer.c:42:20: error: unused variable ‘dn’ [-Werror=unused-variable] struct ldb_dn *dn; ```
The FIXME in sysdb_set_computer would be an enhancement, but is not required for this to function.
Can you open a ticket for it then, after the patches are merged? Otherwise it will be forgotten.
The FIXME in ad_gpo_get_host_sid_retrieval_done is trivial, and not necessary.
Please address this FIXME and introduce a new option for it. It is really not difficult as you wrote so I think it can be done as part of this PR.
There is also a crash in sssd_be responder. I setup some GPO, run SSSD and tried to login as Administrator:
``` warning: Loadable section ".note.gnu.property" outside of ELF segments Core was generated by `/usr/libexec/sssd/sssd_be --domain ad.vm --uid 0 --gid 0 -d 0x3ff0 --logger=std'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f699b10e647 in ad_gpo_get_host_sid_retrieval_done (subreq=0x0) at /home/pbrezina/workspace/sssd/src/providers/ad/ad_gpo.c:2150 2150 ret = sysdb_attrs_get_el(reply[0], AD_AT_SID, &el); Missing separate debuginfos, use: dnf debuginfo-install sssd-common-2.2.0-3.fc29.x86_64 (gdb) bt #0 0x00007f699b10e647 in ad_gpo_get_host_sid_retrieval_done (subreq=0x0) at /home/pbrezina/workspace/sssd/src/providers/ad/ad_gpo.c:2150 #1 0x00007f699ac1d924 in sdap_get_generic_done (subreq=0x1bfed80) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:1961 #2 0x00007f699ac1d219 in generic_ext_search_handler (subreq=0x0, opts=0x1aed450) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:1778 #3 0x00007f699ac1d63d in sdap_get_and_parse_generic_done (subreq=0x1bb9620) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:1886 #4 0x00007f699ac1cca3 in sdap_get_generic_op_finished (op=0x1baee10, reply=0x1bd2110, error=0, pvt=0x1bb9620) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:1668 #5 0x00007f699ac187ba in sdap_process_message (ev=0x1adb3f0, sh=0x1b5ec00, msg=0x1bc7270) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:341 #6 0x00007f699ac182e7 in sdap_process_result (ev=0x1adb3f0, pvt=0x1b5ec00) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:185 #7 0x00007f699ac17f85 in sdap_ldap_next_result (ev=0x1adb3f0, te=0x1be2b10, tv=..., pvt=0x1b5ec00) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:133 #8 0x00007f69a9cb7e79 in tevent_common_invoke_timer_handler (te=te@entry=0x1be2b10, current_time=..., removed=removed@entry=0x0) at ../tevent_timed.c:369 #9 0x00007f69a9cb800e in tevent_common_loop_timer_delay (ev=ev@entry=0x1adb3f0) at ../tevent_timed.c:441 #10 0x00007f69a9cb909b in epoll_event_loop_once (ev=0x1adb3f0, location=<optimized out>) at ../tevent_epoll.c:922 #11 0x00007f69a9cb74bb in std_event_loop_once (ev=0x1adb3f0, location=0x7f69aa1be8a8 "/home/pbrezina/workspace/sssd/src/util/server.c:718") at ../tevent_standard.c:110 #12 0x00007f69a9cb2838 in _tevent_loop_once (ev=ev@entry=0x1adb3f0, location=location@entry=0x7f69aa1be8a8 "/home/pbrezina/workspace/sssd/src/util/server.c:718") at ../tevent.c:772 #13 0x00007f69a9cb2a8b in tevent_common_loop_wait (ev=0x1adb3f0, location=0x7f69aa1be8a8 "/home/pbrezina/workspace/sssd/src/util/server.c:718") at ../tevent.c:895 #14 0x00007f69a9cb744b in std_event_loop_wait (ev=0x1adb3f0, location=0x7f69aa1be8a8 "/home/pbrezina/workspace/sssd/src/util/server.c:718") at ../tevent_standard.c:141 #15 0x00007f69aa18c41a in server_loop (main_ctx=0x1adb710) at /home/pbrezina/workspace/sssd/src/util/server.c:718 #16 0x000000000040baaf in main (argc=10, argv=0x7ffdad471268) at /home/pbrezina/workspace/sssd/src/providers/data_provider_be.c:780 ```
Thank you.
@mzidek-rh or @sumit-bose Since I'm goint to PTO would you mind to take over the review? It looks good code-wise in general, I was not able to test these patches function-wise due to this crash. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-562147931
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
dmulder commented: """
warning: Loadable section ".note.gnu.property" outside of ELF segments Core was generated by `/usr/libexec/sssd/sssd_be --domain ad.vm --uid 0 --gid 0 -d 0x3ff0 --logger=std'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f699b10e647 in ad_gpo_get_host_sid_retrieval_done (subreq=0x0) at /home/pbrezina/workspace/sssd/src/providers/ad/ad_gpo.c:2150 2150 ret = sysdb_attrs_get_el(reply[0], AD_AT_SID, &el); Missing separate debuginfos, use: dnf debuginfo-install sssd-common-2.2.0-3.fc29.x86_64 (gdb) bt #0 0x00007f699b10e647 in ad_gpo_get_host_sid_retrieval_done (subreq=0x0) at /home/pbrezina/workspace/sssd/src/providers/ad/ad_gpo.c:2150 #1 0x00007f699ac1d924 in sdap_get_generic_done (subreq=0x1bfed80) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:1961 #2 0x00007f699ac1d219 in generic_ext_search_handler (subreq=0x0, opts=0x1aed450) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:1778 #3 0x00007f699ac1d63d in sdap_get_and_parse_generic_done (subreq=0x1bb9620) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:1886 #4 0x00007f699ac1cca3 in sdap_get_generic_op_finished (op=0x1baee10, reply=0x1bd2110, error=0, pvt=0x1bb9620) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:1668 #5 0x00007f699ac187ba in sdap_process_message (ev=0x1adb3f0, sh=0x1b5ec00, msg=0x1bc7270) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:341 #6 0x00007f699ac182e7 in sdap_process_result (ev=0x1adb3f0, pvt=0x1b5ec00) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:185 #7 0x00007f699ac17f85 in sdap_ldap_next_result (ev=0x1adb3f0, te=0x1be2b10, tv=..., pvt=0x1b5ec00) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:133 #8 0x00007f69a9cb7e79 in tevent_common_invoke_timer_handler (te=te@entry=0x1be2b10, current_time=..., removed=removed@entry=0x0) at ../tevent_timed.c:369 #9 0x00007f69a9cb800e in tevent_common_loop_timer_delay (ev=ev@entry=0x1adb3f0) at ../tevent_timed.c:441 #10 0x00007f69a9cb909b in epoll_event_loop_once (ev=0x1adb3f0, location=<optimized out>) at ../tevent_epoll.c:922 #11 0x00007f69a9cb74bb in std_event_loop_once (ev=0x1adb3f0, location=0x7f69aa1be8a8 "/home/pbrezina/workspace/sssd/src/util/server.c:718") at ../tevent_standard.c:110 #12 0x00007f69a9cb2838 in _tevent_loop_once (ev=ev@entry=0x1adb3f0, location=location@entry=0x7f69aa1be8a8 "/home/pbrezina/workspace/sssd/src/util/server.c:718") at ../tevent.c:772 #13 0x00007f69a9cb2a8b in tevent_common_loop_wait (ev=0x1adb3f0, location=0x7f69aa1be8a8 "/home/pbrezina/workspace/sssd/src/util/server.c:718") at ../tevent.c:895 #14 0x00007f69a9cb744b in std_event_loop_wait (ev=0x1adb3f0, location=0x7f69aa1be8a8 "/home/pbrezina/workspace/sssd/src/util/server.c:718") at ../tevent_standard.c:141 #15 0x00007f69aa18c41a in server_loop (main_ctx=0x1adb710) at /home/pbrezina/workspace/sssd/src/util/server.c:718 #16 0x000000000040baaf in main (argc=10, argv=0x7ffdad471268) at /home/pbrezina/workspace/sssd/src/providers/data_provider_be.c:780
This is strange. It seems to be segfaulting on the dereference of reply. How did we get a null reply if sdap_get_generic_recv() returned EOK?
"""
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-562221172
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
dmulder commented: """
warning: Loadable section ".note.gnu.property" outside of ELF segments Core was generated by `/usr/libexec/sssd/sssd_be --domain ad.vm --uid 0 --gid 0 -d 0x3ff0 --logger=std'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f699b10e647 in ad_gpo_get_host_sid_retrieval_done (subreq=0x0) at /home/pbrezina/workspace/sssd/src/providers/ad/ad_gpo.c:2150 2150 ret = sysdb_attrs_get_el(reply[0], AD_AT_SID, &el); Missing separate debuginfos, use: dnf debuginfo-install sssd-common-2.2.0-3.fc29.x86_64 (gdb) bt #0 0x00007f699b10e647 in ad_gpo_get_host_sid_retrieval_done (subreq=0x0) at /home/pbrezina/workspace/sssd/src/providers/ad/ad_gpo.c:2150 #1 0x00007f699ac1d924 in sdap_get_generic_done (subreq=0x1bfed80) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:1961 #2 0x00007f699ac1d219 in generic_ext_search_handler (subreq=0x0, opts=0x1aed450) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:1778 #3 0x00007f699ac1d63d in sdap_get_and_parse_generic_done (subreq=0x1bb9620) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:1886 #4 0x00007f699ac1cca3 in sdap_get_generic_op_finished (op=0x1baee10, reply=0x1bd2110, error=0, pvt=0x1bb9620) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:1668 #5 0x00007f699ac187ba in sdap_process_message (ev=0x1adb3f0, sh=0x1b5ec00, msg=0x1bc7270) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:341 #6 0x00007f699ac182e7 in sdap_process_result (ev=0x1adb3f0, pvt=0x1b5ec00) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:185 #7 0x00007f699ac17f85 in sdap_ldap_next_result (ev=0x1adb3f0, te=0x1be2b10, tv=..., pvt=0x1b5ec00) at /home/pbrezina/workspace/sssd/src/providers/ldap/sdap_async.c:133 #8 0x00007f69a9cb7e79 in tevent_common_invoke_timer_handler (te=te@entry=0x1be2b10, current_time=..., removed=removed@entry=0x0) at ../tevent_timed.c:369 #9 0x00007f69a9cb800e in tevent_common_loop_timer_delay (ev=ev@entry=0x1adb3f0) at ../tevent_timed.c:441 #10 0x00007f69a9cb909b in epoll_event_loop_once (ev=0x1adb3f0, location=<optimized out>) at ../tevent_epoll.c:922 #11 0x00007f69a9cb74bb in std_event_loop_once (ev=0x1adb3f0, location=0x7f69aa1be8a8 "/home/pbrezina/workspace/sssd/src/util/server.c:718") at ../tevent_standard.c:110 #12 0x00007f69a9cb2838 in _tevent_loop_once (ev=ev@entry=0x1adb3f0, location=location@entry=0x7f69aa1be8a8 "/home/pbrezina/workspace/sssd/src/util/server.c:718") at ../tevent.c:772 #13 0x00007f69a9cb2a8b in tevent_common_loop_wait (ev=0x1adb3f0, location=0x7f69aa1be8a8 "/home/pbrezina/workspace/sssd/src/util/server.c:718") at ../tevent.c:895 #14 0x00007f69a9cb744b in std_event_loop_wait (ev=0x1adb3f0, location=0x7f69aa1be8a8 "/home/pbrezina/workspace/sssd/src/util/server.c:718") at ../tevent_standard.c:141 #15 0x00007f69aa18c41a in server_loop (main_ctx=0x1adb710) at /home/pbrezina/workspace/sssd/src/util/server.c:718 #16 0x000000000040baaf in main (argc=10, argv=0x7ffdad471268) at /home/pbrezina/workspace/sssd/src/providers/data_provider_be.c:780
This is strange. It seems to be segfaulting on the dereference of reply. How did we get a null reply if sdap_get_generic_recv() returned EOK?
I suppose that we should at least check if reply_count > 0 here. @pbrezina getting this result means an ldap lookup failed for your host object in ad. Could you tell me more about your host object, is it stored somewhere strange or something? I'm just not sure how this could have happened. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-562221172
URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: Don't ignore host entries in Group Policy security filters Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/905/head:pr905 git checkout pr905
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
dmulder commented: """ Fixed the unused variable, and added a check for a NULL reply when searching the host sid. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-562236314
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
dmulder commented: """ Fixed the unused variable, and added a check for a NULL reply when searching the host sid. Also added a computer_timeout option. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-562236314
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
dmulder commented: """ Ping. Any progress here? """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-572146196
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
dmulder commented: """ Ping. Any progress here? @pbrezina? """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-572146196
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
pbrezina commented: """ Sorry for the delay I was on PTO. I will be much more responsive now so we can finally finish it.
It does not crash anymore, though it is unable to retrieve host SID: ``` (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(name=master.client.vm)(objectClass=computer))][dc=ad,dc=vm]. (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSid] (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 16 (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_op_add] (0x2000): New operation 16 timeout 6 (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace: sh[0x2459b50], connected[1], ops[0x2499160], ldap[0x2462510] (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace: sh[0x2459b50], connected[1], ops[0x2499160], ldap[0x2462510] (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_add_references] (0x1000): Additional References: ldap://child.ad.vm/DC=child,DC=ad,DC=vm (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace: sh[0x2459b50], connected[1], ops[0x2499160], ldap[0x2462510] (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_add_references] (0x1000): Additional References: ldap://ForestDnsZones.ad.vm/DC=ForestDnsZones,DC=ad,DC=vm (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace: sh[0x2459b50], connected[1], ops[0x2499160], ldap[0x2462510] (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_add_references] (0x1000): Additional References: ldap://DomainDnsZones.ad.vm/DC=DomainDnsZones,DC=ad,DC=vm (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace: sh[0x2459b50], connected[1], ops[0x2499160], ldap[0x2462510] (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_ext_add_references] (0x1000): Additional References: ldap://ad.vm/CN=Configuration,DC=ad,DC=vm (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_process_result] (0x2000): Trace: sh[0x2459b50], connected[1], ops[0x2499160], ldap[0x2462510] (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [sdap_op_destructor] (0x2000): Operation 16 finished (Thu Jan 9 11:05:33 2020) [sssd[be[ad.vm]]] [ad_gpo_get_host_sid_retrieval_done] (0x0040): sdap_get_generic_recv failed to receive host sid ```
Probably because the computure object has `name=MASTER` instead of `name=master.client.vm`. However this is after fresh enrollment to AD via `realm` command so we need to be looking for the correct name here. Perhaps we can do base search on `state->target_dn` which is `target_dn = 0x219dc70 "CN=MASTER,CN=Computers,DC=ad,DC=vm"`.
I wonder why did this search work for you? """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-572490512
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
pbrezina commented: """
This is strange. It seems to be segfaulting on the dereference of reply. How did we get a null reply if sdap_get_generic_recv() returned EOK?
I suppose that we should at least check if reply_count > 0 here.
Yes. `sdap_get_generic_recv` afaik does not return `ENOENT` but `EOK` and `count=0, replies=NULL`.
"""
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-573015611
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
dmulder commented: """
Probably because the computure object has `name=MASTER` instead of `name=master.client.vm`. However this is after fresh enrollment to AD via `realm` command so we need to be looking for the correct name here. Perhaps we can do base search on `state->target_dn` which is `target_dn = 0x219dc70 "CN=MASTER,CN=Computers,DC=ad,DC=vm"`.
I wonder why did this search work for you?
Here's the entry on my test machine:
dn: name=dmm-sssd-test,cn=computers,cn=custom,cn=toady.suse.de,cn=sysdb name: dmm-sssd-test objectCategory: computer objectSIDString: S-1-5-21-1898687337-2196588786-2775055786-1103 objectClass: computer createTimestamp: 1572970904 distinguishedName: name=dmm-sssd-test,cn=computers,cn=custom,cn=toady.suse.de, cn=sysdb
So, my computer name matched the cn, that's why it didn't fail for me. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-573108501
URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: Don't ignore host entries in Group Policy security filters Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/905/head:pr905 git checkout pr905
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
dmulder commented: """ @pbrezina I've pushed a patch that works for me, and seems to resolve the issue you encountered. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-573149921
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
pbrezina commented: """ Code looks good and works as expected. Ack.
Thank you for your time and I'm sorry it took such a long time to get though our review process. """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-573652930
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
Label: +Accepted
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
Label: -Changes requested
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
dmulder commented: """
Code looks good and works as expected. Ack.
Thank you for your time and I'm sorry it took such a long time to get though our review process.
Thanks for taking the time to review @pbrezina! """
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-573691623
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
Label: +Ready to push
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
pbrezina commented: """ * `master` * 5c8f7960f10686e62ef12799f4243e4eb2aad16e - Resolve computer lookup failure when sam!=cn * a2e7f687533800753e3062aac83e17c3af2df82f - Create a computer_timeout for caching GPO security filter * d6f0b432af30243b83999d0fcb6ca55cabb970a3 - Remove sssd Security Filtering host comment from man * 8d333499a2acb1dfbe0bb00ce7fe6982a1a30e4d - AD: Improve host SID retrieval * 8aa2f9edc95ceeed28c4e4c45d27287246e5a175 - Test the host sid checking * d1f8ec8a974d20aa0476bf1701c70dfa179303f3 - SSSD should accept host entries from GPO's security filter
"""
See the full comment at https://github.com/SSSD/sssd/pull/905#issuecomment-574100001
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
Label: +Pushed
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
Label: -Ready to push
URL: https://github.com/SSSD/sssd/pull/905 Author: dmulder Title: #905: Don't ignore host entries in Group Policy security filters Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/905/head:pr905 git checkout pr905
URL: https://github.com/SSSD/sssd/pull/905 Title: #905: Don't ignore host entries in Group Policy security filters
Label: -Accepted
sssd-devel@lists.fedorahosted.org
-
abbra -
centos-ci
-
dmulder
-
mzidek-rh
-
pbrezina
-
sumit-bose