sssd-devel December 2014

sssd-devel@lists.fedorahosted.org

18 participants
73 discussions

Start a nNew thread

[PATCH] tests: be_ptask fix timer issue
by Pavel Březina 11 Dec '14

11 Dec '14

https://fedorahosted.org/sssd/ticket/2521

3 8

[PATCH] krb5: add wrapper for krb5_kt_have_content()
by Sumit Bose 11 Dec '14

11 Dec '14

Hi, with the copy_keytab patch I added a call to krb5_kt_have_content() which is only available in MIT Kerberos 1.11 and newer. This patch adds a wrapper call. bye, Sumit

3 4

planning the 1.11.8 release
by Jakub Hrozek 10 Dec '14

10 Dec '14

Hi, since we released the last 1.9.x release today, I think it would be prudent to also relase the 1.11.8 tarball so that 1.9.x users can migrate to 1.11.x without being hit by known and fixed issues. Are there any fixes we'd like to see in the 1.11.8 release? I propose these two: * 6a3ec7b LDAP: Do not clobber return value when multiple controls are returned * fc8d98c SDAP: Deref needn't be treated as critical Any others?

2 5

[PATCH] LDAP: Do not clobber return value when multiple controls are returned
by Jakub Hrozek 09 Dec '14

09 Dec '14

Hi, please see the attached patch and its commit message. An alternative might be to use a different variable for the result (as we did in 1.9) before the new error codes.

2 3

Design discussion: Pin an AD client to a particular AD site
by Jakub Hrozek 09 Dec '14

09 Dec '14

Hi, I wrote up a design page for ticket #2486: https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryFixedDNSSite For your convenience, the text is also copied inline. I think the most important part of implementing the feature is actually to work a bit with the user who requested the feature to make sure they are not actually tripping over authentication of users from trusted AD domains. = Fix DNS site a client is using = Related ticket(s): * https://fedorahosted.org/sssd/ticket/2486 === Problem statement === Even though the Active Directory provider is able to leverage DNS sites, the site discovery is always automatic. There is now way to `pin` a particular client into a particular site. This design document describes a way to do so. === Use cases === The site discovery relies on client being part of subnet. It is not always practical or even possible to assign Linux machines to the right subnet. Still, these clients should be able to leverage the nearest AD site, even at the expense of manual configuration in `sssd.conf`. === Overview of the solution === The SSSD will gain a new AD provider option that would, if AD sites are enabled, override any dynamically discovered sites. This option would pin the client to a particular site not only for primary domain but also for subdomains. The discovery search would only be used to find the forest we are enrolled with. For Global Catalog service discovery of the primary and secondary domains would then be defined as follows: * primary domain - `$HARDCODED_SITE._sites.$FOREST` * backup domain - `$FOREST` For pure LDAP searches, the domains would then be defined as: * primary domain - `$HARDCODED_SITE._sites.$DOMAIN` * backup domain - `$DOMAIN` Above, $FOREST is auto-discovered and $DOMAIN is either the SSSD domain name as defined in the config file (for the main SSSD domain) or autodiscovered from object of class `trustedDomain`. In both cases, the full DNS search consists of `_$service._$port.$domain`. Especially for trusted domains, the overriden search domain might not return anything, but the DNS resolver code is built such that it iterates over search domains until the search yields some result. === Authentication against trusted domains === For trusted domains, we currently always talk to a local DC which gives libkrb5 a referral to a trusted-domain specific DC that handles authentication against a KDC from the trusted domain. This process is completely opaque to SSSD, which means that Kerberos authentication doesn't take the sites into account at all. === Implementation details === The SSSD AD provider would gain a new option called `ad_site_override`. This option would be unset by default. The SRV initialization function `ad_srv_plugin_ctx_init()` needs to be adjusted to accept a site override as a `const char *site_override` since the site name is just a string. In the default case, where the option is unset, this option would be set to NULL. In any case, the `ad_get_client_site_send()/recv()` request would run to completion since we need to learn the forest name anyway. If the new option is set, then the caller of `ad_get_client_site_recv()` would still read the forest value, but ignore the site value and use the value of the `ad_site_override` option instead. === Configuration changes === A new option `ad_site_override` as described above. The option would be both described in man pages and implemented in the configAPI. === How To Test === The best testing would be performed using an AD test environment consisting of at least two servers in the same domain. To test, join both DCs to the same domain. Create two sites such that the IP address of your SSSD client would set you in one of them. Make sure that, by default, SSSD creates the kdcinfo file using the DC in the autodetected site and authenticates you against the DCs from the autodetected site. The latter can be verified using i.e. tcpdump and krb5_child log files. Set the `ad_site_override` option to a non-default site. Verify, using tcpdump, kdcinfo file contents and SSSD debug logs that SSSD redirects communication to DCs in the non-default site. === Authors === * Jakub Hrozek <jhrozek(a)redhat.com>

1 0

[PATCH] MAKE: Fix linking of test_child_common
by Lukas Slebodnik 08 Dec '14

08 Dec '14

ehlo, Compilation of test_child_common failed with linker flag --as-needned due to cyclic dependencies between libsss_child.so and libsss_util.so CCLD test_child_common ./.libs/libsss_child.so: undefined reference to `sss_hash_create' ./.libs/libsss_child.so: undefined reference to `hash_lookup' ./.libs/libsss_child.so: undefined reference to `BlockSignals' ./.libs/libsss_child.so: undefined reference to `hash_delete' ./.libs/libsss_child.so: undefined reference to `hash_enter' ./.libs/libsss_child.so: undefined reference to `hash_error_string' ./.libs/libsss_child.so: undefined reference to `sss_atomic_io_s' ./.libs/libsss_child.so: undefined reference to `sss_strerror' collect2: error: ld returned 1 exit status The ideal solution would be to link test_child_common with libsss_child. It is not possible due to cyclic dependencies. The 2nd patch partially fix dependencies for sss internal libraries but there are still 4 functions used in libsss_child.so which are defined in libsss_util.so ./.libs/libsss_child.so: undefined reference to `sss_hash_create' ./.libs/libsss_child.so: undefined reference to `BlockSignals' ./.libs/libsss_child.so: undefined reference to `sss_atomic_io_s' ./.libs/libsss_child.so: undefined reference to `sss_strerror' Thi is a reason why dlopen-test have to contain libsss_util.so as a dependecy for libsss_child.so LS

2 2

[PATCH] sss_client: Return a different error when sssd is not running
by Lukas Slebodnik 08 Dec '14

08 Dec '14

ehlo, The sss nss plugin is present in nsswitch by default due to glibc caching and problem with long living applications (e.g. GNOME). The SSSD nss plugin should behave as if it was functioning but had no data even thought sssd is not running. The errors have to be passed from nss plugin up to the user with minimal moidiffication. Resolves: https://fedorahosted.org/sssd/ticket/2439 How to test: * minimal installation of fedora/rhel7 should already contain sss in /etc/nsswitch. * grep sss /etc/nsswitch * package sssd-client should be installed on machine * test glibc functions whether ther return 0 for nonexisting group. (there is attached file sssd_error_code_test.c for lazy people :-) * the same return code should be with and without sss in /etc/nsswitch.conf authconfig --disablesssd --update authconfig --enablesssd --update NOTE: I just patched functions which returned non-zero return code with stopped sssd, because initgroups, getservent_r, getnetgrent_r returned 0 even with sss in nsswitch. There is also alternative solution from Stephen Gallagher which I found after writing my patch :-) https://bugzilla.redhat.com/attachment.cgi?id=788567 LS

5 22

[PATCH] simple access provider - don't fail on non-existing objects
by Pavel Reichl 08 Dec '14

08 Dec '14

Hello, I noticed that if using simple access provider and having non-existing group or user in access/deny list then access will be denied and "su: System error" will be printed. I think it's OK to simply skip non-existing objects on allow_list. I'm not so sure what to do in case of deny lists. Should we also just skip them or should we deny the user and print more appropriate message ("su: Permission denied")? Thanks, PR

6 15

[PATCH] IFP: Return group names with the right case
by Jakub Hrozek 08 Dec '14

08 Dec '14

Hi, the attached patch fixes an issue found by Jan P. in the IFP code.

2 4

[PATCH] IPA: Do not append domain name to fq name
by Lukas Slebodnik 08 Dec '14

08 Dec '14

ehlo, With attached patch, selinuxusermap should apply to ipa user and ad user. It should work with enabled and disabled use_fully_qualified_names. I was testing with IPA in server mode. It is good to remove sssd generated entries from "semanage login" after each test. LS

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel December 2014