sssd-devel November 2010

sssd-devel@lists.fedorahosted.org

13 participants
55 discussions

Config problem or bug(?) with sssd and Windows AD 2008
by Patrick Grieshaber 02 Feb '11

02 Feb '11

Hello folks, first let me say that the sssd project is great and I am lucky that this project is available for CentOS/Redhat through the EPEL repo :-). I've installed version sssd-1.2.1-27.el5.x86_64 and I want to be able to fetch user infos plus enable login through AD 2008 - but I fail.. sssd.conf: [domain/example.com] enumerate = false id_provider = ldap chpass_provider = krb5 ldap_uri = ldap://dc1.example.com, ldap://dc2.example.com ldap_search_base = dc=example,dc=com tls_reqcert = demand ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt ldap_tls_cacertdir = /etc/pki/tls/certs ldap_default_bind_dn = CN=serviceuser,DC=example,DC=com ldap_default_authtok_type = password ldap_default_authtok = serviceuserpassword ldap_user_name = sAMAccountName ldap_search_base = OU=IT,DC=example,DC=com ldap_pwd_policy = none ldap_user_object_class = person ldap_schema = rfc2307bis ldap_user_principal = userPrincipalName ldap_user_uid_number = sAMAccountName ldap_user_gid_number = sAMAccountName ldap_user_uuid = sAMAccountName ldap_user_fullname = displayName # kerberos config auth_provider = krb5 krb5_kdcip = dc1.example.com krb5_realm = EXAMPLE.COM krb5_changepw_principle = kadmin/changepw krb5_ccachedir = /tmp krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX krb5_auth_timeout = 15 For debugging reasons I run: sssd -d9 Here the output if I attempt: su - myuser(a)example.com ...snip... (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(&(sAMAccountName=myuser)(objectclass=person))][OU=IT,DC=example,DC=com]. ...snip... (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_parse_entry] (9): OriginalDN: [CN=my,OU=IT,DC=example,DC=com]. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_generic_done] (6): Search result: Success(0), (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_users_process] (6): Search for users, returned 1 results. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[(nil)], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [ldb] (9): start ldb transaction (nesting: 0) (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_user_send] (9): Save user (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_user_send] (1): no uid provided for [myuser] in domain [example.com]. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_users_process] (2): Failed to store user 0. Ignoring. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [ldb] (9): commit ldb transaction (nesting: 0) (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_users_done] (9): Saving 1 Users - Done (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success And su outputs: su: user myuser(a)example.com does not exist What is wrong? I do the mapping of a uid/gid... any help is appreciated! Thank you, pat -- Patrick Grieshaber Mobile: +41 (0)79 215 63 79 Xing: xing.com/profile/Patrick_Grieshaber Skype: patrickgrieshaber GPG Key Fingerprint 0252 0C05 410E C345 1AC7 7530 98ED B18E 62CB CF04

4 11

[PATCH] Make manual pages translatable
by Jakub Hrozek 22 Dec '10

22 Dec '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Utilizes PO4A to extract translatable strings from Docbook XML sources and allows translators to submit ordinary .PO files. PO4A then generates translated Docbook documents that can be used to generate translated end user documentation. https://fedorahosted.org/sssd/ticket/297 The second patch adds a skeleton of Czech translation I used for testing - -- at least one man page is localized so the whole process is testable. The general approach is based on what some of the Debian-based projects do. I have two questions about the patch: * the way the patch is written now, the localized manpages (and the respective xlm sources) are generated during every "make" invocation -- so they are always in sync. I couldn't decide it makes more sense to add a specialized "docs" and "docsinstall" targets or something similar..which would be trivial to do, I'm just not sure whether it's better or worse than keeping things done with "make all". * the .po files are distributed, not the localized .xml sources. I think it makes more sense since the localized .xml sources are generated from the .po files and the original .xml sources anyway, but it would be easy to change the distribution to .xml and only regenerate the .xml sources when releasing a new upstream tarball. Thanks, Jakub -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkz0nKwACgkQHsardTLnvCUhGQCg5AgH7VQ1NQNa5hVFaaQvf6KS fwYAoLuLvQd52kmhlH5gFNlQbDM35VbM =DFJj -----END PGP SIGNATURE-----

3 23

[PATCHES] Ding-libs patches.
by Dmitri Pal 20 Dec '10

20 Dec '10

Hello, Thanksgiving was productive... ;-) Please find attached 12 patches that I worked over the weekend. Each patch has a thorough description inside the patch comment. Some of them are independent but some rely on the previous patches so in general it is better to apply them in order. I tried to keep them small and readable. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 4

[PATCH] Generate ccache name at the beginning of auth process
by Jan Zelený 08 Dec '10

08 Dec '10

After some complications I finally made the patch solving ticket #533 (different ccache files during multiple simultaneous logins of the same user). It is based on Simo's idea to determine the ccache file name in advance and count references to it. Jan

2 3

[PATCHES] Add support for FAST in krb5 provider
by Sumit Bose 07 Dec '10

07 Dec '10

Hi, these two patches add support for FAST to the Kerberos provider as requested in trac ticket #237. The first patch just modifies some helper functions in krb5_child so that they can be used by the second patch. We support FAST only with MIT Kerberos 1.8 or later, because with 1.7 it is not possilbe to implement the 'try' option anthentication would fail if the server does not support FAST. bye, Sumit

2 10

[PATCHES] Use entry USN when available
by Simo Sorce 07 Dec '10

07 Dec '10

This set of patches allows SSSD to use the more reliable entryUSN against FreeIPA (and USNchanged against AD) when performing enumerations. If entryUSN(USNchanged) is not detected as available by checking rootdse for lastUSN(highestCommittedUSN) then we fall back to use modifyTimestamp which is fine in non-multimaster setups. This set comprises 4 patches. 1. pass sdap_id_ctx to sdap_id_op functions (needed later). 2. cleanup unused vars and functions about rootdse to avoid confusion 3. add connection checks to test if USNs are available. 4. Change the code around to use the best USN method available and fallback to the previous modifyTimestamp if not. These pacthes have been briefly tested against a FreeIPA server with the entryUSN configuration patch (still unpushed upstream) and all seem to working fine. Simo. -- Simo Sorce * Red Hat, Inc * New York

3 11

[PATCH] Add new account expired rule to LDAP access provider
by Sumit Bose 06 Dec '10

06 Dec '10

Hi, these two patches aim to fix trac ticket #672. While the first patch only makes a utility function public the second adds some new layers to the LDAP access provider. I've tried to make the changes in a way to make it easy to add new rules (#670) and new expire policies (#673, #674, #690). I would like to ask the reviewers to check if the new code is really as flexible as I think and if it enough to evaluate the shadow expire attribute here. TIA bye, Sumit

2 6

[PATCH] Add ldap_chpass_uri config option
by Sumit Bose 06 Dec '10

06 Dec '10

Hi, this patch adds a ldap_chpass_uri config option as requested in trac ticket #680. The first patch just removes an unused struct member. bye, Sumit

2 7

[PATCHES] Support automatic Kerberos ticket renewal
by Sumit Bose 03 Dec '10

03 Dec '10

Hi, this series for patches add support for automatic Kerberos ticket renewal, see also trac ticket #369. There are several things I like to discuss: - in the ticket a separate process which should handle the renewal was mentioned. Currently the patches just create a timed task in the krb5 provider because I think most of the typically uses cases do not justify to overhead we create with a separate process. But I'm open for other arguments. - I have added option to request TGT with a specific lifetime/renewal time. The corresponding option in krb5.conf have a trailing letter indicating the time unit. I have copied this behaviour to help migrations although we typically use only seconds without a unit in sssd.conf. Is this a good idea or shall I change it to seconds or do we want to support both formats. - Currently everything is held in RAM and after a restart nothing is renewed automatically. I plan to send a new patch which checks all ccfiles we have in the cache and if renewal is possible it adds them to the list at startup. I think this approach makes more sense than writing the list of renewable ticket to disk. Do you agree? bye, Sumit From dd0b3d75426765c5c8d03852584a35a58c19d144 Mon Sep 17 00:00:00 2001 From: Sumit Bose <sbose(a)redhat.com> Date: Mon, 8 Nov 2010 14:24:05 +0100 Subject: [PATCH 2/8] Add a renew task to krb5_child --- src/providers/krb5/krb5_child.c | 65 +++++++++++++++++++++++++++++++++++++++ src/sss_client/sss_cli.h | 8 ++++- 2 files changed, 72 insertions(+), 1 deletions(-) diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c index 5a5281a..0f729d8 100644 --- a/src/providers/krb5/krb5_child.c +++ b/src/providers/krb5/krb5_child.c @@ -863,6 +863,67 @@ static errno_t kuserok_child(int fd, struct krb5_req *kr) return ret; } +static errno_t renew_tgt_child(int fd, struct krb5_req *kr) +{ + int ret; + int status = PAM_AUTHTOK_ERR; + int kerr; + char *ccname; + krb5_ccache ccache = NULL; + + if (kr->pd->authtok_type != SSS_AUTHTOK_TYPE_CCFILE) { + DEBUG(1, ("Unsupported authtok type for TGT renewal [%d].\n", + kr->pd->authtok_type)); + goto done; + } + + ccname = talloc_strndup(kr, (char *) kr->pd->authtok, kr->pd->authtok_size); + if (ccname == NULL) { + DEBUG(1, ("talloc_strndup failed.\n")); + goto done; + } + + kerr = krb5_cc_resolve(kr->ctx, ccname, &ccache); + if (kerr != 0) { + KRB5_DEBUG(1, kerr); + goto done; + } + + kerr = krb5_get_renewed_creds(kr->ctx, kr->creds, kr->princ, ccache, NULL); + if (kerr != 0) { + KRB5_DEBUG(1, kerr); + goto done; + } + + kerr = krb5_cc_initialize(kr->ctx, ccache, kr->princ); + if (kerr != 0) { + KRB5_DEBUG(1, kerr); + goto done; + } + + kerr = krb5_cc_store_cred(kr->ctx, ccache, kr->creds); + if (kerr != 0) { + KRB5_DEBUG(1, kerr); + goto done; + } + + status = PAM_SUCCESS; + +done: + krb5_free_cred_contents(kr->ctx, kr->creds); + + if (ccache != NULL) { + krb5_cc_close(kr->ctx, ccache); + } + + ret = sendresponse(fd, 0, status, kr); + if (ret != EOK) { + DEBUG(1, ("sendresponse failed.\n")); + } + + return ret; +} + static errno_t create_empty_ccache(int fd, struct krb5_req *kr) { int ret; @@ -903,6 +964,7 @@ static errno_t unpack_buffer(uint8_t *buf, size_t size, struct pam_data *pd, p += len; if (pd->cmd == SSS_PAM_AUTHENTICATE || + pd->cmd == SSS_CMD_RENEW || pd->cmd == SSS_PAM_CHAUTHTOK_PRELIM || pd->cmd == SSS_PAM_CHAUTHTOK) { SAFEALIGN_COPY_UINT32_CHECK(&len, buf + p, size, &p); if ((p + len ) > size) return EINVAL; @@ -1017,6 +1079,9 @@ static int krb5_child_setup(struct krb5_req *kr, uint32_t offline) case SSS_PAM_ACCT_MGMT: kr->child_req = kuserok_child; break; + case SSS_CMD_RENEW: + kr->child_req = renew_tgt_child; + break; default: DEBUG(1, ("PAM command [%d] not supported.\n", kr->pd->cmd)); kerr = EINVAL; diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h index f8ccb4f..223524e 100644 --- a/src/sss_client/sss_cli.h +++ b/src/sss_client/sss_cli.h @@ -181,7 +181,9 @@ enum sss_cli_command { * operation where the PAM_PRELIM_CHECK * flag is set, see pam_sm_chauthtok(3) * for details */ - + SSS_CMD_RENEW = 0x00F8, /**< Renew a credential with a limited + * lifetime, e.g. a Kerberos Ticket + * Granting Ticket (TGT) */ }; /** @@ -228,6 +230,10 @@ enum sss_authtok_type { SSS_AUTHTOK_TYPE_PASSWORD = 0x0001, /**< Authentication token is a * password, it may or may no contain * a trailing \\0 */ + SSS_AUTHTOK_TYPE_CCFILE = 0x0002, /**< Authentication token is a path to + * a Kerberos credential cache file, + * it may or may no contain + * a trailing \\0 */ }; /** -- 1.7.3.2

3 11

[PATCH] Set up signal handlers before initializing sysdb
by Stephen Gallagher 02 Dec '10

02 Dec '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A temporary signal handler for SIGTERM is set up in server_setup() that calls exit() from within a pure signal handler. This causes a race condition where it's possible that if the SSSD is restarted immediately while it is still initializing the sysdb caches for the first time, it can leave the cache in a corrupt and unusable state. https://bugzilla.redhat.com/show_bug.cgi?id=658444 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkz1K/IACgkQeiVVYja6o6MC4ACcC4U1FUB/R4OaGdVXGHlFyk0v 0+oAnjPMJFC14pijWYDI9pg0r1dg2Fv0 =Zz8+ -----END PGP SIGNATURE-----

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel November 2010