[PATCH] LDAP: Remove useless include
by Jakub Hrozek
Hi,
a trivial patch, but the include made me go searching through the
ldap_child code for a place where we might use some PAM-related code :-)
9 years, 4 months
[PATCH] Recreate FAST ccache as the sssd user
by Jakub Hrozek
Hi,
these patches depend on Sumit's "[PATCHES] ldap_child, krb5_child: copy
keytab and FAST ccache into memory".
When applied, the FAST ccache is created as the SSSD so that no Kerberos
networking code runs as the root user. In order to do that, the
krb5_child receives the SSSD user IDs as parameters.
I also have tests for the other functions in the child_common.c module
but I will send them separately to speed up the review.
9 years, 4 months
Request for review of the new INI interface
by Dmitri Pal
Hello,
I have been working on an interface to modify configuration file (yes
alternative to augeas) as promised.
INI supports multi valued keys so the interface needs to be able to
manage duplicates.
The attached header file contains the prototype of the interface.
I have implemented value management and about to do the section
management. That part would be quite simple.
Before I polish everything up, hook together and start sending patches I
wanted to make sure the interface is OK and is not missing anything.
I was not sure how much of the design page is needed.
I will probably create one based on this thread with a pointer to header
file.
The assumption is that:
- the caller will read an existing configuration object from a file or
create a configuration object himself. These calls are alreadyavailable
for some time.
- the caller will then add/updated/delete the configuration object as he
sees fit. This is this interface.
- the caller then will call already existing serialization function that
will return a simple buffer object that will contain a serialized
configuration ready to be stored in a file.
- the caller can use simple buffer methods to write content of the
buffer to a file descriptor or just create a file (FILE *), get the
serialized buffer and write to that file. It is up to the caller and
there is so far no plan to provide a specific "save function" as it is
unclear what would be a good function to have.
Let me know if any of these assumptions wrong.
Please take a look at the file, it has doxygen comments. It is a sanity
check exercise not a thorough review :-).
The comments refer to collection interface so I included it too for
easier reading.
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.
9 years, 4 months
KRB5CCNAME variable broken in second concurrent login shell - bug?
by Joschi Brauchle
We have a weird problem with the KRB5CCNAME environment variable that
seems to be an SSSD bug.
Configuration:
------------ /etc/sssd/sssd.conf ------------
...
# Set CCache to Kerberos default
krb5_ccachedir = /run/user/%U
krb5_ccname_template = DIR:%d/krb5cc
...
------------ /etc/sssd/sssd.conf ------------
Now, user "ne96soh" logs in to the machine for the FIRST time and does a
kerberized ldapsearch:
------------
ne96soh@tueilnt-student01:~$ echo $KRB5CCNAME
DIR:/run/user/3036404/krb5cc
ne96soh@tueilnt-student01:~$ klist
Ticket cache: DIR::/run/user/3036404/krb5cc/tktZoweZq
...
ne96soh@tueilnt-student01:~$ ldapsearch ...<using GSSAPI>
... <succeeds>
------------
but then logs into the machine a SECOND concurrent time (i.e. leaving
first session open):
------------
ne96soh@tueilnt-student01:~$ echo $KRB5CCNAME
DIR::/run/user/3036404/krb5cc/tktZoweZq
ne96soh@tueilnt-student01:~$ klist
Ticket cache: DIR::/run/user/3036404/krb5cc/tktZoweZq
...
ne96soh@tueilnt-student01:~$ ldapsearch ...<using GSSAPI>
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (No
Kerberos credentials available)
------------
For me, the format of 'DIR::/run/user/3036404/krb5cc/tktZoweZq' in the
second login seems strange! Is this a valid format?
When I manuelly reset the KRB5CCNAME variable in the second login shell
to its original value 'DIR:/run/user/3036404/krb5cc', then the
ldapsearch using GSSAPI succeeds.
The reason of all this seems to be that SSSD reuses existing ccaches for
already logged on users, but possibly mixes up formats there.
See
------------ /var/log/sssd_default.log ------------
(Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [krb5_auth_send]
(0x4000): Ccache_file is [DIR::/run/user/3036404/krb5cc/tktZoweZq] and
is active and TGT is valid.
...
(Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [krb5_find_ccache_step]
(0x0080): Saved ccache DIR::/run/user/3036404/krb5cc/tktZoweZq if of
different type than ccache in configuration file, reusing the old ccache
...
(Wed Oct 15 14:04:54 2014) [sssd[be[default]]]
[safe_remove_old_ccache_file] (0x0400): New and old ccache file are the
same, no one will be deleted.
(Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [krb5_mod_ccname]
(0x4000): Save ccname [DIR::/run/user/3036404/krb5cc/tktZoweZq] for user
[ne96soh].
------------ /var/log/sssd_default.log ------------
Best regards,
--
Dipl.-Ing. Joschi Brauchle, M.S.
Institute for Communications Engineering (LNT)
Technische Universitaet Muenchen (TUM)
80290 Munich, Germany
Tel (work): +49 89 289-23474
Fax (work): +49 89 289-23490
E-mail: joschi.brauchle(a)tum.de
Web: http://www.lnt.ei.tum.de/
9 years, 4 months
[PATCHES] ldap_child, krb5_child: copy keytab and FAST ccache into memory
by Sumit Bose
Hi,
this is the follow-up of the POC patches I send earlier in the
krb5_child thread. I added unit tests and reordered the code in
krb5_child and ldap_child a bit to make more clear until which point
they run as root and at which point they drop privileged completely.
The first patch is unrelated but I needed it to make sure that valgrind
doe not report any errors for the new unit tests.
bye,
Sumit
9 years, 4 months
[PATCHES] krb5: make krb5 provider view aware
by Sumit Bose
Hi,
this patchset makes the krb5 provider view-aware. All needed
functionality is in the 1st patch. 2nd makes sure the view data is only
update when there is a change and the 3rd makes a check in the
krb5_child more relaxed. This needed when the client gets a different
view and the UID of a user changes. In this case and old ccache cannot
be read by the user anymore and we should not fail in this case.
bye,
Sumit
9 years, 4 months
