September 2011 - sssd-devel - Fedora Mailing-Lists

by GOLLSCHEWSKY, Tim

Hi guys, We've been experimenting with putty v0.61 and windows SSO authentication. e.g. You log into windows with username "tim" and when then load up putty and try and connect to a RHEL6 machine, it passes along my Windows GSSAPI credentials and automatically logs me in to the RHEL6 box. SSSD has been configured to talk to Active Directory like so: [domain/KRB5DOMAIN] enumerate = True ldap_id_use_start_tls = False cache_credentials = True id_provider = ldap auth_provider = krb5 chpass_provider = krb5 debug_level = 1 ldap_schema = rfc2307bis ldap_force_upper_case_realm = True ldap_user_object_class = user ldap_group_object_class = group ldap_user_home_directory = unixHomeDirectory ldap_user_name = msSFU30Name ldap_user_member_of = msSFU30PosixMemberOf ldap_group_member = msSFU30PosixMember access_provider = ldap ldap_uri = ldap://xxxx/ ldap_search_base = xxx ldap_user_search_base = xxx ldap_group_search_base = xxx ldap_sasl_mech = gssapi ldap_sasl_authid = xxx ldap_krb5_keytab = xxx ldap_krb5_init_creds = true ldap_tls_cacertdir = /etc/openldap/cacerts krb5_realm = xxx krb5_kpasswd = xxx krb5_server = xxx What we're finding is Windows for some reason stores the username in UPPERCASE and passes the uppercase value in the GSSAPI credentials. However the username attribute in AD (msSFU30Name) stores the username in lowercase, which is the standard for Unix usernames and something we are very comfortable with. Because the username comparison is case-sensitive, the user is denied access. If we hard-code the login name in putty to be lowercase it works, so I'm pretty sure the GSSAPI auth is working. So, my question is: Is there a way to make the username comparison to LDAP case-insensitive? Or do we need to update our AD/LDAP to uppercase all the msSFU30Name attributes? Or is there another option? I understand usernames should be compared case-sensitive to be POSIX compliant. I've just been asked to see if I can get this to work. BTW I've been browsing trac and it looks like you were considering a "force_lowercase_names" config option at one point. Is this still under consideration? https://fedorahosted.org/sssd/ticket/246 Best regards, Tim Gollschewsky. This e-mail is sent by Suncorp Group Limited ABN 66 145 290 124 or one of its related entities "Suncorp". Suncorp may be contacted at Level 18, 36 Wickham Terrace, Brisbane or on 13 11 55 or at suncorp.com.au. The content of this e-mail is the view of the sender or stated author and does not necessarily reflect the view of Suncorp. The content, including attachments, is a confidential communication between Suncorp and the intended recipient. If you are not the intended recipient, any use, interference with, disclosure or copying of this e-mail, including attachments, is unauthorised and expressly prohibited. If you have received this e-mail in error please contact the sender immediately and delete the e-mail and any attachments from your system.

12 years, 7 months

6
14
0 / 0

SSSD netgroup issue

by Francisco Javier Marín Murillo

Hello, I have this nsswitch configuration: passwd: compat passwd_compat: sss #shadow: files ldap #group: files ldap #passwd: files sss #passwd: compat sss shadow: files sss group: files sss hosts: files dns bootparams: files ethers: files netmasks: files networks: files protocols: files rpc: files services: files netgroup: sss publickey: nisplus automount: files ldap aliases: files sudoers: files ldap Currently I am having problems with sssd handling netgroup changes. when I add or remove a user from a netgroup , those changes are not replicated automatically to clients . Should be something wrong with my sssd.conf configuration ? If you can give me a hand I would really appreciate it. Thanks, Francisco Marin

12 years, 7 months

5
13
0 / 0

sssd & services

by Ondrej Valousek

Any plans to support services, too? :-)

12 years, 7 months

2
1
0 / 0

[PATCH] Enable the midpoint cache update by default

by Stephen Gallagher

Sets the default value of the midpoint cache to 50%. Fixes: https://fedorahosted.org/sssd/ticket/918

12 years, 7 months

2
2
0 / 0

[PATCH] Added quiet option to pam_sss

by Pavel Březina

https://fedorahosted.org/sssd/ticket/894

12 years, 7 months

2
2
0 / 0

[PATCH] MAN: Add more information about internal credential storage

by Stephen Gallagher

Fixes https://fedorahosted.org/sssd/ticket/988

12 years, 7 months

2
2
0 / 0

[PATCH] Add vetoed_shells to sssd.api.conf

by Marko Myllynen

Hi, while testing vetoed_shells I happened to notice it is missing from sssd.api.conf, the attached patch fixes this. However, there seems to be also ~dozen other configuration options missing, not sure should those all be added, too. The list of missing configuration options after this patch is: localhost:~/sssd.git> for t in `grep -Eo '<term>[a-z_]*' src/man/sssd.conf.5.xml | sed -e 's,<term>,,g'`; do grep -q $t src/config/etc/sssd.api.conf || echo $t ; done config_file_version try_inotify entry_cache_nowait_percentage proxy_pam_target proxy_lib_name default_shell base_directory create_homedir remove_homedir homedir_umask skel_dir mail_dir userdel_cmd Cheers, -- Marko Myllynen

12 years, 7 months

3
3
0 / 0

[PATCH] Fix uninitialized pointer read in sdap_gssapi_get_default_realm()

by Jakub Hrozek

https://fedorahosted.org/sssd/ticket/1003 This bug affects 1.5, 1.6 and master

12 years, 7 months

2
2
0 / 0

[PATCH] Fix wrong buffer size in has_phy_80211_subdir()

by Jakub Hrozek

https://fedorahosted.org/sssd/ticket/1002

12 years, 7 months

2
2
0 / 0

Announcing ding-libs 0.1.3

by Stephen Gallagher

The SSSD team is proud to announce the 0.1.3 bugfix release of SSSD. It can be downloaded from https://fedorahosted.org/sssd/wiki/Releases#DING-LIBSReleases == Highlights == * Fixes a serious bug in libdhash with very large (> 1024 slots) initial size * Minor bugfixes == Detailed Changelog == Dmitri Pal (2): * Initializing variables in test * Freeing memory used for source dir John Dennis (1): * Resolves: RHBZ #735464 Fix the loop limit used to initialize the table di Stephen Gallagher (6): * Fix license text for several files that should be LGPLv3+ * Fix incorrect allocation check * Eliminate memory leak on error * Bump version for 0.1.3 release * Update spec file for newer library versions * Update version numbers for ding-libs 0.1.3 release Sumit Bose (2): * Fix typo which makes make prerelease-srpm fail * Ensure error_string() never returns NULL

12 years, 7 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2011