sssd-devel August 2010

sssd-devel@lists.fedorahosted.org

17 participants
48 discussions

Re: [SSSD] sssd and kerberos.
by Timo Aaltonen 10 Aug '10

10 Aug '10

On Tue, 10 Aug 2010, Stephen Gallagher wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 08/10/2010 10:29 AM, Timo Aaltonen wrote: >> On Thu, 5 Aug 2010, Stephen Gallagher wrote: >> >>> Someone else just reported this same issue to me :( >>> >>> Can you attach the /var/log/sssd/sssd_<domain>.log and >>> /var/log/sssd/ldap_child.log for this? >>> >>> I suspect you'll see the ldap_child.log report that it couldn't find a >>> KDC for the realm. >> >> I can now enumerate the user, but auth fails because of this: >> >> /var/log/sssd/krb5_child.log: >> (Tue Aug 10 16:54:10 2010) [[sssd[krb5_child[13472]]]] [get_and_save_tgt] >> (1): 524: [-1765328230][Cannot find KDC for requested realm] >> (Tue Aug 10 16:54:10 2010) [[sssd[krb5_child[13472]]]] [tgt_req_child] >> (1): 756: [-1765328230][Cannot find KDC for requested realm] > > See: https://bugzilla.redhat.com/show_bug.cgi?id=621541 Yes, exactly the same errors with SSSD_KRB5_LOCATOR_DEBUG=1. I have the KDC's in /etc/krb5.conf, btw. >> also, I don't know what to use for searching the group information :) So >> it cannot find the name for the default group. I checked from AD that the >> values below should be correct. >> >> ldap_schema = rfc2307bis >> ldap_search_base = dc=org,dc=aalto,dc=fi >> ldap_user_object_class = person >> ldap_user_home_directory = unixHomeDirectory >> ldap_user_principal = userPrincipalName >> ldap_group_search_base = ou=Users,dc=org,dc=aalto,dc=fi >> ldap_group_object_class = group >> > > I'm almost certain your value for ldap_group_search_base is wrong. In > fact, you probably don't need ldap_group_search_base at all. The > ldap_search_base is enough here. hah, I'm pretty sure I tried without that, but yep that did the trick :) nexus6 sssd # groups tjaalton tjaalton : Domain Users though I'm 'memberOf' several other groups as well, but if they don't have gidNumber set they won't be shown here, right? -- Timo Aaltonen Systems Specialist, Aalto IT

1 0

Re: [SSSD] sssd and kerberos.
by Timo Aaltonen 10 Aug '10

10 Aug '10

On Thu, 5 Aug 2010, Stephen Gallagher wrote: > Someone else just reported this same issue to me :( > > Can you attach the /var/log/sssd/sssd_<domain>.log and > /var/log/sssd/ldap_child.log for this? > > I suspect you'll see the ldap_child.log report that it couldn't find a > KDC for the realm. I can now enumerate the user, but auth fails because of this: /var/log/sssd/krb5_child.log: (Tue Aug 10 16:54:10 2010) [[sssd[krb5_child[13472]]]] [get_and_save_tgt] (1): 524: [-1765328230][Cannot find KDC for requested realm] (Tue Aug 10 16:54:10 2010) [[sssd[krb5_child[13472]]]] [tgt_req_child] (1): 756: [-1765328230][Cannot find KDC for requested realm] also, I don't know what to use for searching the group information :) So it cannot find the name for the default group. I checked from AD that the values below should be correct. [domain/aalto] description = LDAP domain with AD server min_id = 1000 id_provider = ldap auth_provider = krb5 krb5_kdcip = 130.233.251.4 krb5_realm = ORG.AALTO.FI ldap_sasl_mech = gssapi # meh ldap_sasl_authid = NEXUS6$(a)ORG.AALTO.FI ldap_uri = ldap://dc01.org.aalto.fi ldap_force_upper_case_realm = True ldap_schema = rfc2307bis ldap_search_base = dc=org,dc=aalto,dc=fi ldap_user_object_class = person ldap_user_home_directory = unixHomeDirectory ldap_user_principal = userPrincipalName ldap_group_search_base = ou=Users,dc=org,dc=aalto,dc=fi ldap_group_object_class = group -- Timo Aaltonen Systems Specialist, Aalto IT

2 1

Re: [SSSD] sssd and kerberos.
by Timo Aaltonen 10 Aug '10

10 Aug '10

On Fri, 6 Aug 2010, Patrik Martinsson wrote: > Ah, yes i do use kerberized NFS, and i also want to use sasl gssapi to > authenticate the sssd. > > My understanding was that i needed upn=nfs/* to get nfsv4 krb, however > with your patch (i applied it on nfs-utils-1.2.2-4.el6.x86_64) i dont > need upn=nfs/* anymore as you say. Although i do need upn=host/*, but > maybe that's how it supporse to be ? My knowledge to kerberos and AD is > very limited unfortunately so when discussing this I'm on very thin ice. No, with the patch you don't need to use 'upn=...' at all, gssd would then use the default HOST$ principalname. though the problem with sssd remains. Maybe I should begin using 'upn=host/..' too.. > Now with that nfs-utils-patch applied, and sssd 1.3 i got both sssd and > nfsv4 working with upn=host/*. > > > Maybe a similar approach could be used with sssd, so there would be no > > need to specify the authid (which is different for every hostname)? > > I think it do use that approach, however it gives you the possibility to > change your authid if want to, that's > how i understand anyways. > > Again, maybe this is not the correct mailinglist for this discussion. > > Btw,. if your patch is correct why isn't it accepted upstreams ? It's making an already complicated function more unreadable, so it needs to be cleaned up first and then add a revised patch on top. -- Timo Aaltonen Systems Specialist, Aalto IT

1 0

sssd and weak crypto
by Marcus Moeller 09 Aug '10

09 Aug '10

Hi all, does sssd support an option like: allow_weak_crypto = true As I am getting an error: (Mon Aug 9 17:06:21 2010) [[sssd[ldap_child[4085]]]] [ldap_child_get_tgt_sync] (0): Failed to init credentials: KDC has no support for encryption type while trying to connect with DES/CDC against an Windows 2003 server. This option has been set in krb5.conf and manual kinit works fine. -- Greets Marcus

2 1

Recommended settings.
by Patrik Martinsson 06 Aug '10

06 Aug '10

Hello again, I was wondering about "recommending" settings about sssd. We have an AD with around 1500 users. Before sssd was introduced we used nss/ldap to query user-data from AD. However i figured it would be nice to get sssd working and started to configure that instead, got it working mostly as i want (posted some issuers earlier on the mailing-list). Question though, With earlier setup it was possible to do, 'getent passwd' and get a list of all users, right. With the new setup, i only get the users in the passwd file when doing 'getent passwd', however if i do 'getent passwd username', i get the info i want. Then i tried with the setting, enumerate=true for current domain, and that seemed to fix the getent problem as it would return all the users, however that really of slow, having sssd running in debug-mode it produces thousands of lines with, (Fri Aug 6 11:00:34 2010) [sssd[be[SMHI]]] [ldb] (9): tevent: Added timed event "ltdb_timeout": 0x4257310 (Fri Aug 6 11:00:34 2010) [sssd[be[SMHI]]] [ldb] (9): tevent: Destroying timer event 0x2ac70f0 "ltdb_timeout" (Fri Aug 6 11:00:34 2010) [sssd[be[SMHI]]] [ldb] (9): tevent: Ending timer event 0x425c200 "ltdb_callback" Then it finishes kind of, then after a couple of minutes its doing the same thing again. So basically, what I'm wondering is, cant i have getent passwd returning all my users without having enumerate = true in the config ? Here's my config, [sssd] config_file_version = 2 reconnection_retries = 3 sbus_timeout = 30 services = nss, pam domains = foo [nss] filter_groups = root filter_users = root reconnection_retries = 3 [pam] reconnection_retries = 3 [domain/foo] description = LDAP domain with AD server enumerate = true/false min_id = 0 id_provider = ldap auth_provider = krb5 krb5_kdcip = 123 krb5_realm = foo krb5_changepw_principle = kadmin/changepw krb5_ccachedir = /tmp krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX krb5_auth_timeout = 15 krb5_keytab = /etc/krb5.keytab krb5_validate = true ldap_sasl_mech = gssapi ldap_krb5_keytab = /etc/krb5.keytab ldap_uri = ldap://foo ldap_schema = rfc2307bis ldap_search_base = DC=xx,DC=xxxx,DC=xx ldap_user_search_scope = sub ldap_user_search_base = ou=People,dc=xx,dc=xxxx,dc=xx ldap_group_search_base = ou=Groups,dc=xx,dc=smhi,dc=xx ldap_user_object_class = person ldap_user_name = cn ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_home_directory = msSFUHomeDirectory ldap_user_shell = loginShell ldap_user_principal = userPrincipalName ldap_user_gecos = mail ldap_group_object_class = Group ldap_group_name = cn ldap_group_gid_number = msSFU30GidNumber ldap_force_upper_case_realm = True ldap_tls_reqcert = demand ldap_tls_cacert = /etc/openldap/cacerts/CADOUBLE.cer ldap_tls_cacertdir = /etc/openldap/cacerts Best regards, Patrik Martinsson, Sweden.

3 7

getent passwd works with LDAP but *not* getent group
by Cochran, Wayne Owen 06 Aug '10

06 Aug '10

Hi all. Just installed Fedora and I am trying to setup authentication with our LDAP server. I followed the convenient authentication installation instructions (I am using TLS / no SASL). Unfortunately authentication was not working, so I decided to see if get first get nsswitch going and found about your sssd daemon. Any way here are the pertinent lines from from nsswitch.conf passwd: files sss shadow: files sss group: files sss The command getent passwd cochran did not work until I tweaked the sssd.conf file (sort of guessing here); Here are the tweeks domains = LDAP #domains = LOCAL,LDAP [domain/LDAP] id_provider = ldap auth_provider = ldap ldap_uri = ldap://encs-nexus.vancouver.wsu.edu ldap_user_search_base = dc=encs,dc=vancouver,dc=wsu,dc=edu ldap_tls_reqcert = demand cache_credentials = true enumerate = true Now the following works (it gets the correct info from LDAP): getent passwd cochran cochran:*:10001:10099::/home/cochran:/bin/bash but alas the command getent group faculty does *not* work Running sssd in debug mode usr/sbin/sssd -i -d 5 reveals the following (Thu Aug 5 09:41:49 2010) [sssd[nss]] [accept_fd_handler] (4): Client connected! (Thu Aug 5 09:41:49 2010) [sssd[nss]] [sss_cmd_get_version] (5): Received client version [1]. (Thu Aug 5 09:41:49 2010) [sssd[nss]] [sss_cmd_get_version] (5): Offered version [1]. (Thu Aug 5 09:41:49 2010) [sssd[nss]] [nss_cmd_getgrnam] (4): Requesting info for [faculty] from [<ALL>] (Thu Aug 5 09:41:49 2010) [sssd[nss]] [nss_cmd_getgrnam] (4): Requesting info for [faculty@LDAP] (Thu Aug 5 09:41:49 2010) [sssd[nss]] [sss_dp_send_acct_req_create] (4): Sending request for [LDAP][4098][1][name=faculty] (Thu Aug 5 09:41:49 2010) [sssd[be[LDAP]]] [be_get_account_info] (4): Got request for [4098][1][name=faculty] (Thu Aug 5 09:41:49 2010) [sssd[be[LDAP]]] [groups_get_delete] (2): Group (faculty) delete returned 2 (No such file or directory) (Thu Aug 5 09:41:49 2010) [sssd[be[LDAP]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success (Thu Aug 5 09:41:49 2010) [sssd[nss]] [sss_dp_get_reply] (4): Got reply (0, 0, Success) from Data Provider (Thu Aug 5 09:41:49 2010) [sssd[nss]] [nss_cmd_getgrnam_callback] (2): No matching domain found for [faculty], fail! (Thu Aug 5 09:41:49 2010) [sssd[nss]] [nss_cmd_getgrnam_callback] (2): No results for getgrnam call (Thu Aug 5 09:41:49 2010) [sssd[nss]] [client_recv] (5): Client disconnected! I have not clue what to change now. Any help would be greatly appreciated. I am not a hard core sysadmin (budget cuts have me setting this up myself). --w Wayne O. Cochran Assistant Professor Computer Science wcochran(a)vancouver.wsu.edu

2 1

Re: [SSSD] sssd and kerberos.
by Timo Aaltonen 06 Aug '10

06 Aug '10

On Thu, 5 Aug 2010, Patrik Martinsson wrote: > Hey, > > I got this working today with these settings, > > ldap_uri = ldap://foo.bar > ldap_sasl_mech = gssapi > ldap_krb5_keytab = /etc/krb5.keytab > ldap_sasl_authid = nfs/xx.xxxx.xx .... <snip> Looks like you need kerberized NFS? See this patch that I made for nfs-utils: http://users.tkk.fi/~tjaalton/0001-Check-for-AD-style-machine-principal-nam… still not accepted upstream, but I'm hoping for the best. With this you don't need to add "nfs/*" UPN:s, gssd will initialize and use HOSTNAME$ just fine. Maybe a similar approach could be used with sssd, so there would be no need to specify the authid (which is different for every hostname)? ps. still fighting with the installation.. so can't test the above and post logs just yet. Tomorrow, I promise :) -- Timo Aaltonen Systems Specialist, Aalto IT

2 1

Re: [SSSD] sssd and kerberos.
by Timo Aaltonen 05 Aug '10

05 Aug '10

On Wed, 4 Aug 2010, Stephen Gallagher wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 08/04/2010 10:18 AM, Timo Aaltonen wrote: >> On Mon, 2 Aug 2010, Patrik Martinsson wrote: >> >>> ldap_tls_reqcert = demand >>> ldap_tls_cacert = /etc/openldap/cacerts/CADOUBLE.cer >>> ldap_tls_cacertdir = /etc/openldap/cacerts >> >> I guess this doesn't work with GSSAPI SASL binding yet? Tried to force the >> authid to FOO$@REALM, but it fails just the same. >> >> it's harder to automatically generate certificates for the clients, that's >> why I'm interested in getting this working :) >> >> > > > I'm not sure what you're asking for here. > > I think what you're talking about is using: > ldap_sasl_mech = gssapi > ldap_krb5_keytab = /path/to/ldap.keytab I did that, but it doesn't seem to work, or somethings missing still. It said something like "marking ldap server foo as broken" (sorry no logs, reinstalling the machine). -- Timo Aaltonen Systems Specialist, Aalto IT

3 8

Re: [SSSD] sssd and kerberos.
by Timo Aaltonen 04 Aug '10

04 Aug '10

On Mon, 2 Aug 2010, Patrik Martinsson wrote: > ldap_tls_reqcert = demand > ldap_tls_cacert = /etc/openldap/cacerts/CADOUBLE.cer > ldap_tls_cacertdir = /etc/openldap/cacerts I guess this doesn't work with GSSAPI SASL binding yet? Tried to force the authid to FOO$@REALM, but it fails just the same. it's harder to automatically generate certificates for the clients, that's why I'm interested in getting this working :) -- Timo Aaltonen Systems Specialist, Aalto IT

2 1

Announcing the release of SSSD 1.3.0
by Stephen Gallagher 03 Aug '10

03 Aug '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The SSSD team is proud to announce the enhancement release 1.3.0 of the System Security Services Daemon. As usual, it can be downloaded from https://fedorahosted.org/sssd/ == Highlights == * Rewrote the internal LDB cache API. As a synchronous API it is now faster to access and easier to work with * Eugene Indenbom contributed a sizeable amount of code to the LDAP provider * We now handle failover situations much more reliably than we did previously * If a request fails partway through (due to a remote server ceasing to function) we will now restart the conversation with the next server in the failover list * We also will now monitor the GSSAPI kerberos ticket and automatically renew it when appropriate, instead of waiting for a connection to fail * Support for netlink now allows us to more quickly detect situations where we may have come online * New option {{{dns_discovery_domain}}} allows better configuration for using SRV records for failover * Fixes to the HBAC backend for obsolete or removed HBAC entries * Improvements to log messages around TLS and GSSAPI for LDAP * Support for building in environments using --as-needed LDFLAGS * Vast performance improvement for initgroups on RFC2307 LDAP servers * Long-running SSSD clients (e.g. GDM) will now reconnect properly to the daemon if SSSD is restarted == Detailed Changelog == Alexander Gordeev (1): * Add explicit requests for several operational attrs David O'Brien (1): * Copy-edit and format review sssd.conf Dmitri Pal (16): * Adding metadata interface * Adding content to the metadata * Resolve paths for reporting purposes * Acess control and config change checks * Add ability to trace 64bit numbers * Fixing spec file to match version. * Fixing build * Code restructuring * Extending refarray interface * Introducing a comment object * Adding support for explicit 32/64 types (attempt 2). * Addressing initialization issues. * Fixing types in queue and stack interfaces * Fixing memory leaks in the unit test. * Fixing NULL dereferencing in ini_config * Memory leak in case of empty value Héctor Daniel Cabrera (3): * Updating ES translation * Updating es translation * Updating es translation Jakub Hrozek (37): * Treat server names as case-insensitive in failover code * Do not mark a request as failed twice * Sort SRV replies according to RFC 2782 * Remove freed server_common entities from list * Support SRV servers in failover * Silence warnings with -O2 * Fix uninitialized variable * Add a README file * Use all available servers in LDAP provider * Improve the offline authentication message * Fix memory hierarchy in the ipa timerules * Use service discovery in backends * SSSDConfigAPI fixes * Try all servers during Kerberos auth * Remove dead code from the PAM responder * Man page fixes * Don't return uninitialized value in proxy provider * Skip empty attributes with warning * Fix realm_str dereference * Fix potential NULL dereference in fail_over.c * Fix Incorrect NULL check in get_server_common() * Add missing break to switch statement * get_uid_from_pid should use fstat rather than lstat * Remove krb5_changepw_principal option * Remove the -g option from useradd * Fix potential resource leak in copy_tree_ctx() * Potential memory leak in _nss_sss_*_r() * Check closedir call in find_uid * Print correct return code * Resend SIGINT as SIGTERM in services * Add dns_discovery_domain option * Use netlink to detect going online * Fix getting default realm in the ldap child * Validate keytab at startup * Fix two problems with --as-needed * Fix check_time_rule() return value on failure * Return proper error value when SRV lookup fails Petter Reinholdtsen (2): * Allow Debian/Ubuntu build to pass --install-layout=deb to setup.py * Remove bash-isms from configure macros Piotr Drąg (2): * Update Polish translation * Updating pl translation Rui Gouveia (2): * Updating pt translation * Update pt translation Simo Sorce (45): * sysdb: start conversion from async to sync * sysdb: use sysdb_delete_entry in recursive delete * sysdb: convert sysdb_delete_custom * sysdb: convert sysdb_search_entry and sysdb_delete_recursive * sysdb: convert sysdb_search_user_by_name/uid * sysdb: convert sysdb_search_group_by_name/gid * sysdb: convert sysdb_set_entry/user/group_attr * sysdb: convert sysdb_get_new_id * sysdb: convert sysdb_store/add(_basic)_user * sysdb: convert sysdb_store/add(_basic)_group * sysdb: convert sysdb_mod/add/remove_group_member * sysdb: convert sysdb_cache_password * sysdb: convert sysdb_search_custom * sysdb: convert sysdb_store_custom * sysdb: convert sysdb_asq_search * sysdb remove sldb_request_send, not used anymore * sysdb: convert sysdb_search_users * sysdb: convert sysdb_delete_user * sysdb: delete sysdb_delete_group * sysdb: convert sysdb_search_groups * sysdb: convert sysdb_cache_auth * sysdb: remove sysdb_check_handle * tests: remove use of asynchronus transactions * sysdb: add synchronous transaction functions * proxy: complete conversion to synchronous sysdb * Use the sysdb synchronous transaction functions * Remove remaining use of sysdb_transaction_send * sysdb: remove async transactions * sysdb: add automatic transactions where needed * sysdb: convert sysdb_getpwnam * sysdb: convert sysdb_getpwuid * sysdb: convert sysdb_getgrnam * sysdb: convert sysdb_getgrgid * sysdb: convert sysdb_get_user_attr * sysdb: convert sysdb_enumpwent * sysdb: convert sysdb_enumgrent * Adjust fill_pwent and fill_grent * sysdb: convert sysdb_initgroups * sysdb: remove obsolete helpers from sysdb * sysdb: remove remaining traces of sysdb_handle * sysydb: Finally stop using a common event context * Make groupshow synchronous. * tools: remove creation of event_context * Better handle sdap_handle memory from callers. * Avoid freeing sdap_handle too early Stephen Gallagher (81): * Support docdir and abs_builddir * sysdb: convert sysdb_delete_entry * Bumping version on master to 1.2.90 * Update translations for master branch * Fix merge error for sss_userdel.c * Remove unused configure macro * Fix warning in sysdb-tests.c * Fix ini_config unit test * Give information about ldap_schema in the sample config * Make ID provider init functions clearer * Remove the NSS_LIBS and KRB5_LIBS variables from sssd.spec * Add dns_resolver_timeout option * Fix segfault in GSSAPI reconnect code * Make krb5_kpasswd available for any krb5 provider * Clean up kdcinfo and kpasswdinfo files when exiting * Add callback when the ID provider switches from offline to online * Add dynamic DNS updates to FreeIPA * Revert "Add dynamic DNS updates to FreeIPA" * Properly set up SIGCHLD handlers * Add dynamic DNS updates to FreeIPA * Don't report a fatal error for an HBAC denial * Add a better error message for TLS failures * Add enumerate details to the manpage and examples * Revert "Copy pam data from DBus message" * Display name of PAM action in pam_print_data() * Make data provider id_callback public * Fix error reporting for be_pam_handler * Proxy provider PAM handling in child process * Support password changes in chpass_provider = proxy * Add ldap_access_filter option * Fix typo in Makefile * Fix broken build against older versions of OpenLDAP * Fix typo in Makefile.am * Disable connection callbacks when going online * Change default min_id to 1 * Allow ldap_access_filter values wrapped in parentheses * Properly handle read() and write() throughout the SSSD * Fix misuse of errno in find_uid.c * Avoid potential NULL dereference * Properly handle missing originalMemberOf entry in initgroups * Don't leak directory access resources on errors in directory_list() * Check the correct variable for NULL after creating timer * Properly check that the timeout event was created for cleanup/enum * Check return code of hash_delete in proxy_child_destructor * Eliminate unused variable from pc_init_timeout() * Make sure to close varargs before returning from a function * Properly null-terminate socket path * Add ldap_force_upper_case_realm to example AD config * Don't segfault if ldap_access_filter is unspecified * Handle (ignore) unknown options in get_domain() and get_service() * Remove references to the DP service from the SSSDConfig API tests * Standardize on correct spelling of "principal" for krb5 * Initialize len before looping to read the pidfile * Ensure that all domains are checked for users/groups * Refactor the negative cache * Move setup of filter_users and filter_groups to negcache.c * Honor filter_users in PAM * Fix potential resource leak in remove_tree_with_ctx() * Fix return value from remove_connection_callback() destructor * Protect against segfault in remove_ldap_connection_callbacks * Drop release requirement from versions * Bump libini_config version to 0.6.0 * Replace %define with %global in example spec * Make RootDSE optional * Rename proxy_ctx to proxy_id_ctx for clarity * Split proxy.c into smaller files * Add try_inotify option * Release SSSD 1.2.91 (1.3.0rc1) * Add sss_log() function * Add log notifications for startup and shutdown. * Add syslog messages for LDAP GSSAPI bind * Log TLS errors to syslog * Require -ltalloc for tevent configure check * be_pam_handler(): Fix potential NULL dereference * Add sysdb_attrs_to_list() utility function * Add diff_string_lists utility function * Add sysdb_group_dn_name utility function * Add dup_string_list() utility function * Add sysdb_update_members function * Clean up initgroups processing for RFC2307 * Releasing SSSD 1.3.0 Sumit Bose (52): * Revert "Add better checks on PAM socket" * Use SO_PEERCRED on the PAM socket * Set LDAP_OPT_RESTART for all LDAP connections * Fix a potential memory violation * Make the handling of fd events opaque * Unset authentication tokens if password change fails * Display a message if a password reset by root fails * Fix wrong return value * Fix a wrong return value in IPA HBAC * Split pam_data utilities into a separate file * Create kdcinfo and kpasswdinfo file at startup * Compare the full service name * Add retry option to pam_sss * Add more warnings about nearly expired passwords * Make Kerberos authentication a tevent_req * New version of IPA auth and password migration * Add ldap_krb5_ticket_lifetime option * Defer sbus_dispatch() for 30ms during reconnect * Copy pam data from DBus message * Do not modify IPA_DOMAIN when setting Kerberos realm * Handle Krb5 password expiration warning * Add support for delayed kinit if offline * Fix handling of ccache file when going offline * Move parse_args() to util * Copy pam data from DBus message * Revert "Create kdcinfo and kpasswdinfo file at startup" * Refactor data provider callbacks * Add offline callbacks * Refactor krb5_finalize() * Add run_callbacks flag * Add callback to remove krb5 info files when going offline * Krb5 locator plugin returns KRB5_PLUGIN_NO_HANDLE * Refactor krb5 SIGTERM handler installation * Add krb5 SIGTERM handler to ipa auth provider * Add offline callback to disconnect global SDAP handle * Reset run_online_cb flag even if there are no callbacks * Fix check if LDAP id provider is already initialized * Remove signal event if child was terminated by a signal * Check ipaEnabledFlag * Add sysdb_attrs_get_string_array() * Use sysdb_attrs_get_string_array() instead of sysdb_attrs_get_el() * Use new schema for HBAC service checks * Remove service groups * Compare full service name * Unify sdap and sysdb data handling * Initialize pam_data in Kerberos child. * Avoid a potential double-free * Add a missing initializer * Add a missing free() * Fix SASL authentication * Do not treat missing HBAC rules as an error * Allow sssd clients to reconnect Yuri Chornoivan (2): * Update Ukrainian translation * Updating uk translation eindenbom (15): * Avoid accessing half-deallocated memory when using talloc_zfree macro. * GSSAPI ticket expiry time is returned from ldap_child and stored in sdap_handle for future reference. * Added an interface to query number of configured (and currently resolved through SRV records) failover servers. * LDAP connection usage tracking, sharing and failover retry framework. * Add an interface to try next fail-over server after connection to the active server was unexpectedly dropped. * Use new LDAP connection framework to get user account info from LDAP. * Use new LDAP connection framework to get group account info from LDAP. * Use new LDAP connection framework to get user account groups from LDAP. * Use new LDAP connection framework for LDAP user and group enumeration. * Use new LDAP connection framework in LDAP access backend. * Use new LDAP connection framework in IPA access backend. * Use new LDAP connection framework in IPA dynamic DNS forwarder. * Remove remainder of now unused global LDAP connection handle. * Eliminate delayed sdap_handle destruction after fail-over retry. * Fix IPA access backend handling of obsolete and missing HBAC entries: - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkxYn3IACgkQeiVVYja6o6Pb5QCdHT2pmTYiBQteyPH/GBeRmNOz mOcAn2myMyD1uMm4bMSvhv5h9aLPdplB =FNJA -----END PGP SIGNATURE-----

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2010