sssd-users June 2015

sssd-users@lists.fedorahosted.org

21 participants
21 discussions

Problem with automount
by Ondrej Valousek 23 Jun '15

23 Jun '15

Hi List, I am experiencing a strange issue with sssd not being able to deliver certain maps to the automounter from the AD backend. It can deliver keys to auto.home, auto.appli,... but not to auto.cadappl map: (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sss_autofs_cmd_setautomntent] (0x0400): Got request for automount map named auto.cadappl (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sss_parse_name_for_domains] (0x0200): name 'auto.cadappl' matched without domain, user is auto.cadappl (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sss_parse_name_for_domains] (0x0200): using default domain [(null)] (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [setautomntent_send] (0x0400): Requesting info for automount map [auto.cadappl] from [<ALL>] (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [setautomntent_send] (0x1000): Map auto.cadappl needs to be looked up (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [lookup_automntmap_step] (0x0400): Requesting info for [auto.cadappl@default] (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x2162510 (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x2188cd0 (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [ldb] (0x4000): Running timer event 0x2162510 "ltdb_callback" (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [ldb] (0x4000): Destroying timer event 0x2188cd0 "ltdb_timeout" (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [ldb] (0x4000): Ending timer event 0x2162510 "ltdb_callback" (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sysdb_get_map_byname] (0x0400): No such map (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [lookup_automntmap_step] (0x0080): No automount map [auto.cadappl] in cache for domain [default] (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sss_dp_issue_request] (0x0400): Issuing request for [0x406840:0:auto.cadappl@default] (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sss_dp_get_autofs_msg] (0x0400): Creating autofs request for [default][4105][mapname=auto.cadappl] (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sbus_add_timeout] (0x2000): 0x214ade0 (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sss_dp_internal_get_send] (0x0400): Entering request [0x406840:0:auto.cadappl@default] (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [lookup_automntmap_step] (0x2000): Looking up automount maps from the DP (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [setautomntent_send] (0x2000): lookup_automntmap_step is refreshing the cache, re-enterin g the mainloop (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sbus_remove_timeout] (0x2000): 0x214ade0 (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sbus_dispatch] (0x4000): dbus conn: 0x2124fc0 (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sbus_dispatch] (0x4000): Dispatching. (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 0 errno: 0 error message: Success (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [lookup_automntmap_step] (0x0400): Requesting info for [auto.cadappl@default] (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x2127cc0 (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x21852f0 (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [ldb] (0x4000): Running timer event 0x2127cc0 "ltdb_callback" (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [ldb] (0x4000): Destroying timer event 0x21852f0 "ltdb_timeout" (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [ldb] (0x4000): Ending timer event 0x2127cc0 "ltdb_callback" (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sysdb_get_map_byname] (0x0400): No such map (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [lookup_automntmap_step] (0x0080): No automount map [auto.cadappl] in cache for domain [default] (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [lookup_automntmap_step] (0x2000): Moving on to next domain (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sss_autofs_cmd_setautomntent_done] (0x2000): setautomntent done (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sss_autofs_cmd_setautomntent_done] (0x0400): setautomntent did not find requested map (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x406840:0:auto.cadappl@default] (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x2177ec0][18] (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [reset_idle_timer] (0x4000): Idle timer re-set for client [0x2177ec0][18] (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [client_recv] (0x0200): Client disconnected! (Tue Jun 23 08:54:04 2015) [sssd[autofs]] [client_destructor] (0x2000): Terminated client [0x2177ec0][18] Looks like sssd believes there is no such a map, but there is one: [root@pegasus Desktop]# ldapsearch -h dcpra2 -b cn=/cadappl,cn=auto.master,CN=prague,CN=NIS,DC=dublin,DC=ad,dc=s3group,DC=com "(objectclass=nisobject)" SASL/GSSAPI authentication started SASL username: PEGASUS$(a)DUBLIN.AD.S3GROUP.COM SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <cn=/cadappl,cn=auto.master,CN=prague,CN=NIS,DC=dublin,DC=ad,dc=s3group,DC=com> with scope subtree # filter: (objectclass=nisobject) # requesting: ALL # # /cadappl, auto.master, prague, NIS, dublin.ad.s3group.com dn: CN=/cadappl,CN=auto.master,CN=prague,CN=NIS,DC=dublin,DC=ad,DC=s3group,DC= com objectClass: top objectClass: nisObject cn: /cadappl distinguishedName: CN=/cadappl,CN=auto.master,CN=prague,CN=NIS,DC=dublin,DC=ad ,DC=s3group,DC=com instanceType: 4 whenCreated: 20101102110004.0Z whenChanged: 20130614112107.0Z uSNCreated: 21973 uSNChanged: 21973 showInAdvancedViewOnly: TRUE name: /cadappl objectGUID:: 6RJ0TIkWKk23qfwvj/RoWg== objectCategory: CN=NisObject,CN=Schema,CN=Configuration,DC=ad,DC=s3group,DC=co m dSCorePropagationData: 20150423074236.0Z dSCorePropagationData: 20140206113506.0Z dSCorePropagationData: 16010101000417.0Z msSFU30NisDomain: prague nisMapName: auto.master nisMapEntry: auto.cadappl # search result search: 5 result: 0 Success # numResponses: 2 # numEntries: 1 I am really lost here, could someone point me what could be wrong? Thanks, Ondrej ----- The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s). Please direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office: South County Business Park, Leopardstown, Dublin 18.

2 3

Announcing SSSD 1.13 Alpha
by Jakub Hrozek 22 Jun '15

22 Jun '15

=== SSSD 1.13 Alpha === The SSSD team is proud to announce the release of version 1.13 Alpha of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora rawhide shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * The Active Directory provider has changed the default value of the ad_gpo_access_control option from permissive to enforcing. As a consequence, the GPO access control now affects all clients that set access_provider to ad. In order to restore the previous behaviour, set ad_gpo_access_control to permissive or use a different access_provider type. * Group Policy objects defined in a different AD domain that the computer object is defined in are now supported. * Support for separate prompts when using two-factor authentication was added * Credential caching and Offline authentication are also available when using two-factor authentication * Added support for one-way trusts between an IPA and Active Directory environment. Please note that this SSSD functionality depends on IPA code that will be released in the IPA 4.2 version * Many enhancements to the InfoPipe D-Bus API. Notably, the SSSD users and groups are now exposed as first-class objects. The users and groups can also be marked as cached and would subsequently show up in the Introspection output * The DBus interface is now also able to look up User objects by certificate. This is a first part of work that will eventually allow smart-card authentication in SSSD. * The LDAP cleanup task is now disabled by default, unless enumeration is enabled. Please refer to the ldap_purge_cache_timeout option in case your environment requires the cleanup task * The Python bindings are now built for both Python2 and Python3 * The LDAP bind timeout, StartTLS timeout and password change timeout are now configurable using the ldap_opt_timeout option == Packaging Changes == * A new directory /var/lib/sss/keytabs is present and owned by the sssd-ipa subpackage. The SSSD stores keytabs for one-way trust relationships in this directory. Downstreams should make sure that the directory is only readable to the user who runs the SSSD service. * Several packaging changes are present in this release to support the Python3 bindings, notably new python-sss and python-sss-murmur subpackages are introduced in upstream RPM packaging * All python bindings now have a Python3 and a Python2 version in the upstream RPM packaging scheme * The OpenSSL development library such as openssl-devel on RHEL/Fedora or Debian/Ubuntu? libssl-dev is now required to support certificate operations * A new internal library libsss_cert.so is present in this release. == Documentation Changes == * The ad_gpo_access_control option default has changed from permissive to enforcing * The default value of ldap_purge_cache_timeout changed to 0, thus effectivelly disabling the cleanup task. * A new option cache_credentials_minimal_first_factor_length was added. This option sets constraints on the password length if One-Time passwords are used and credentials are to be cached. Please see the sssd.conf(5) man page for more details == Tickets Fixed == https://fedorahosted.org/sssd/ticket/897 sssd should pass -d to nsupdate when running with high log level https://fedorahosted.org/sssd/ticket/1501 Make the LDAP bind operation timeout configurable https://fedorahosted.org/sssd/ticket/2150 [RFE] Expose listing calls over D-BUS https://fedorahosted.org/sssd/ticket/2224 nsupdate stderr is not captured https://fedorahosted.org/sssd/ticket/2236 The cleanup task has no DEBUG statements https://fedorahosted.org/sssd/ticket/2326 SBUS: Flush the UID cache when we receive NameOwnerChanged https://fedorahosted.org/sssd/ticket/2338 [RFE] Implement object caching on the bus https://fedorahosted.org/sssd/ticket/2339 IFP: support multiple interfaces for object https://fedorahosted.org/sssd/ticket/2540 SSSD does not update Dynamic DNS records if the IPA domain differs from machine hostname's domain https://fedorahosted.org/sssd/ticket/2569 In ipa-ad trust, with 'default_domain_suffix' set to AD domain, IPA user are not able to log unless use_fully_qualified_names is set https://fedorahosted.org/sssd/ticket/2574 SSSD should be able to build python2 and python3 bindings in a one build https://fedorahosted.org/sssd/ticket/2583 [RFE] Homedir is always overwritten with subdomain_homedir value in server mode https://fedorahosted.org/sssd/ticket/2593 Does sssd-ad use the most suitable attribute for group name? https://fedorahosted.org/sssd/ticket/2603 Make SSSD's HBAC validation more permissive if deny rules are not used https://fedorahosted.org/sssd/ticket/2609 [bug] sssd always appends default_domain_suffix when checking for host keys https://fedorahosted.org/sssd/ticket/2618 Man sssd-ad(5) lists Group Policy Management Editor naming for some policies but not for all https://fedorahosted.org/sssd/ticket/2620 id_provider=proxy with auth_provider=ldap does not work reliably https://fedorahosted.org/sssd/ticket/2625 Sudo responder does not respect filter_users and filter_groups https://fedorahosted.org/sssd/ticket/2627 Disable the cleanup task by default https://fedorahosted.org/sssd/ticket/2636 RFE: Fetch keytabs for one-way trusts in IPA subdomain code https://fedorahosted.org/sssd/ticket/2638 RFE: Change ad_id_ctx instantiation in the IPA subdomain code to support one-way trusts https://fedorahosted.org/sssd/ticket/2645 [RFE] Support GPOs from different domain controllers https://fedorahosted.org/sssd/ticket/2661 RFE: Change AD GPO default to enforcing https://fedorahosted.org/sssd/ticket/2666 sssd with ldap backend throws error domain log == Detailed Changelog == Jakub Hrozek (68): * MAN: Fix a typo * SYSDB: Reduce code duplication in sysdb_gpo.c * UTIL: Make two child_common.c functions static * TESTS: Cover child_common.c with unit tests * LDAP: Use child_io_destructor instead of child_cleanup in a custom desctructor * UTIL: Remove child_cleanup * UTIL: Unify the fd_nonblocking implementation * RESOLV: Remove obsolete in-tree implementation of SRV and TXT parsing * PAM: print the pam status as string, too * KRB5: More debugging for create_ccache() * SDAP: Make simple bind timeout configurable * SDAP: Make password change timeout configurable with ldap_opt_timeout * SDAP: Make StartTLS bind configurable with ldap_opt_timeout * SDAP: Decorate the sdap_op functions with DEBUG messages * IPA: Remove the ipa_hbac_treat_deny_as option * MAN: Clarify debug_level a bit * SSH: Ignore the default_domain_suffix * LDAP: Set sdap handle as explicitly connected in LDAP auth * tests: Revert strcmp condition * ncache: Fix sss_ncache_reset_permanent * ncache: Silence critical error from filter_users when default_domain_suffix is set * ncache: Add sss_ncache_reset_repopulate_permanent * responders: reset ncache after domains are discovered during startup * NSS: Reset negcache after checking domains * MAN: Clarify how are GPO mappings called in GPO editor * UTIL: Add a simple function to get the fd of debug_file * dyndns: Log nsupdate stderr with a high debug level * nsupdate: Append -d/-D to nsupdate with a high debug level * subdom: Remove unused function get_flat_name_from_subdomain_name * nss: Use negcache for getbysid requests * tests: Add NSS responder tests for bysid requests * LDAP: disable the cleanup task by default * TESTS: Use the right testcase * TESTS: Add test for get_next_domain * LDAP: Do not print verbose DEBUG messages from providers that don't set UUID * SYSDB: Store trust direction for subdomains * UTIL/SYSDB: Move new_subdomain() to sysdb_subdomains.c and make it private * TESTS: Add a test for sysdb_subdomains.c * SYSDB: Add realm to sysdb_master_domain_add_info * SYSDB: Add a forest root attribute to sss_domain_info * IPA: Add ipa_subdomains_handler_get_{start,cont} wrappers * IPA: Check master domain record before subdomain records * IPA: Fold ipa_subdom_enumerates into ipa_subdom_store * IPA: Also update master domain when initializing subdom handler * IPA: Move server-mode functions to a separate module * IPA: Split two functions to new module ipa_subdomains_utils.c * IPA: Include ipaNTTrustDirection in the attribute set for trusted domains * IPA: Read forest name for trusted forest roots as well * IPA: Make constructing an IPA server mode context async * TESTS: Split off keytab creation into a common module * TESTS: Add a common mock_be_ctx function * TESTS: Add a common function to set up sdap_id_ctx * TESTS: Move krb5_try_kdcip to nested group test * TESTS: Add unit test for the subdomain_server.c module * IPA: Fetch keytab for 1way trusts * AD: Rename ad_set_ad_id_options to ad_set_sdap_options * AD: Rename ad_create_default_options to ad_create_2way_trust_options * AD: Split off ad_create_default_options * IPA/AD: Set up AD domain in ad_create_2way_trust_options * IPA: Do not set AD_KRB5_REALM twice * AD: Add ad_create_1way_trust_options * IPA: Utility function for setting up one-way trust context * LDAP: Do not set keytab through environment variable * LDAP: Consolidate SDAP_SASL_REALM/SDAP_KRB5_REALM behaviour * CONFIG: Add SSS_STATEDIR as VARDIR/lib/sss * BUILD: Store keytabs in /var/lib/sss/keytabs * Updating the translations for the 1.13 Alpha release * Updating the version.m4 file for the 1.13 Beta release John Dickerson (1): * MAN: Amend the description of ignore_group_members Lukas Slebodnik (59): * MAN: Remove indentation in element programlistening * Fix warning: for loop has empty body * Bump version to track 1.13 development * SPEC: Use libnl3 for epel6 * MAKE: Don't include autoconf generated file to tarball * TESTS: Mock return value of sdap_get_generic_recv * test_nested_groups: Additional unit tests * Fix warning: equality comparison with extraneous parentheses * LDAP: Conditional jump depends on uninitialised value * BUILD: Remove unused libraries for pysss.so * BUILD: Remove unused variables * BUILD: Remove detection of type Py_ssize_t * UTIL: Remove python wrapper sss_python_set_new * UTIL: Remove python wrapper sss_python_set_add * UTIL: Remove python wrapper sss_python_set_check * UTIL: Remove compatibility macro PyModule_AddIntMacro * UTIL: Remove python wrapper sss_python_unicode_from_string * BUILD: Use python-config for detection *FLAGS * SPEC: Use new convention for python packages * SPEC: Move python bindings to separate packages * BUILD: Add possibility to build python{2,3} bindings * TESTS: Run python tests with all supported python versions * SPEC: Replace python_ macros with python2_ * SPEC: Build python3 bindings on available platforms * BUILD: Uninstall also symbolic links to python bindings * Remove unused argument from be_nsupdate_create_fwd_msg * IPA: Remove unused argument from ipa_id_get_group_uuids * Remove useless assignment to function parameter * PAC: Fix memory leak * responder_cache: Fix warning may be used uninitialized * debug-tests: Fix test with new line in debug message * BUILD: Add missing header file to tarball * pam_client: fix casting to const pointer * test_expire: Use right assertion macro for standard functions * test_ldap_auth: Use right assertion for integer comparison * test_resolv_fake: Fix alignment warning * PAC: Remove unused function * KRB5: Unify prototype and definition * util-tests: Initialize boolean variable to default value * SPEC: Drop workaround for old libtool * SPEC: Drop workarounds for old rpmbuild * SPEC: Remove unused option * SPEC: Few cosmetic changes * simple_access-tests: Simplify assertion * sysdb-tests: Add missing assertions * sysdb-tests: test return value before output arguments * ad_opts: Use different default attribute for group name * BUILD: Write hints about optional python bindings * sss_client: Fix mixed enums * LDAP: Remove dead assignment * sss_client: Fix warning "_" redefined * SSSDConfigTest: Use unique temporary directory * util-tests: Add validation of internal error messages * SDAP: Check return value before using output arguments * SDAP: Log failure from sysdb_handle_original_uuid * test_ipa_subdomains_server: Run clean-up after success * IFP: Fix warnings with enabled optimisation * SDAP: Remove user from cache for missing user in LDAP * test_ipa_subdom_server: Add missing assert Michal Zidek (2): * Use FQDN if default domain was set * MAN: default_domain_suffix with use_fully_qualified_names. Nikolai Kondrashov (3): * BUILD: Add AM_PYTHON2_MODULE macro * Add integration tests * BUILD: Fix variable substitution in cwrap.m4 Pavel Březina (53): * tests: refactor create_dom_test_ctx() * tests: add create_multidom_test_ctx() * tests: add test_multidom_suite_cleanup() * tests: remove code duplication in single domain cleanup * responders: new interface for cache request * responders: enable views in cache request * IFP: use new cache interface * server-tests: use strtouint32 instead strtol * sbus: add new iface via sbus_conn_register_iface() * sbus: move iface and object path code to separate file * sbus: use 'path/*' to represent a D-Bus fallback * sbus: support multiple interfaces on single path * sbus: add object path to sbus request * sbus: add sbus_opath_hash_lookup_supported() * sbus: support org.freedesktop.DBus.Introspectable * sbus: support org.freedesktop.DBus.Properties * sbus: unify naming of handler data variable * sbus: move common opath functions from ifp to sbus code * sbus: add sbus_opath_get_object_name() * ifp: fix potential memory leak in check_and_get_component_from_path() * sbus: use hard coded getters instead of generated * sbus: remove unused 'reply as' functions * IFP: move interface definitions from ifpsrv.c into separate file * IFP: unify generated interfaces names * sbus codegen: do not prefix getters with iface name * IFP: simplify object path constant names * sbus: add constant to represent subtree * be_refresh: get rid of callback pointers * sysdb: use sysdb_user/group_dn * cache_req tests: rename test_user to test_user_by_name * cache_req tests: define user name constant * cache_req: preparations for different input type * cache_req: add support for user by uid * cache_req: add support for group by name * cache_req: remove default branch from switches * cache_req: add support for group by id * cmocka: include mock_parse_inp in header file * cache_req: parse input name if needed * cache_req: return ERR_INTERNAL if more than one entry is found * sbus: provide custom error names * sbus: add sbus_opath_decompose[_exact] * sbus: add a{sas} get invoker * IFP: add org.freedesktop.sssd.infopipe.Users * IFP: add org.freedesktop.sssd.infopipe.Users.User * IFP: add org.freedesktop.sssd.infopipe.Groups * IFP: add org.freedesktop.sssd.infopipe.Groups.Group * IFP: deprecate GetUserAttr? * IFP: Implement org.freedesktop.sssd.infopipe.Cache[.Object] * SBUS: Use default GetAll? invoker if none is set * SBUS: Add support for <node /> in introspection * IFP: Export nodes * sbus: add support for incoming signals * sbus: listen to NameOwnerChanged? Pavel Reichl (17): * add missing '\n' in debug messages * PROXY: add missing space in debug message * BUILD: fix chmake not to generate warning * SDAP: log expired accounts at lower severity level * KRB5: add debug hint * TESTS: test expiration * ldap: refactor check_pwexpire_kerberos to use util func * ldap: refactor nds_check_expired to use util func * Fix a few typos in comments * sbus: sbus_opath_hash_add_iface free tmp talloc ctx * krb5: remove field run_as_user * localauth plugin: fix coverity warning * dyndns: remove dupl declaration of ipa_dyndns_update * dyndns: don't pass zone directive to nsupdate * dyndns: ipa_dyndns.h missed declaration of used data * krb: remove duplicit decl. of write_krb5info_file * IPA: Don't override homedir with subdomain_homedir Stephen Gallagher (4): * LDAP: Support returning referral information * AD GPO: Support processing referrals * AD GPO: Change default to "enforcing" * Add Vagrant configuration for SSSD Sumit Bose (22): * Add leak check and command line option to test_authtok * utils: add sss_authtok_[gs]et_2fa * pam: handle 2FA authentication token in the responder * Add pre-auth request * krb5-child: add preauth and split 2fa token support * IPA: create preauth indicator file at startup * pam_sss: add pre-auth and 2fa support * Add cache_credentials_minimal_first_factor_length config option * sysdb: add sysdb_cache_password_ex() * krb5: save hash of the first authentication factor to the cache * krb5: try delayed online authentication only for single factor auth * 2FA offline auth * pam_sss: move message encoding into separate file * PAM: add PAM responder unit test * adding ldap_user_auth_type where missing * LDAP: add ldap_user_certificate option * certs: add PEM/DER conversion utilities * sysdb: add sysdb_search_user_by_cert() and sysdb_search_object_by_cert() * LDAP/IPA: add user lookup by certificate * ncache: add calls for certificate based searches * utils: add get_last_x_chars() * IFP: add FindByCertificate? method for User objects

4 3

get_and_save_tgt :Preauthentication failed on debian 7 + sssd 1.8.4 againts a samba 4 host
by thierry DeTheGeek 18 Jun '15

18 Jun '15

Hi I'm working on a centalized user accounts setup, thanks to samba 4 SSSD is setup on a Debian 7 host, version 1.8.4 as provided by the repository. This host will authenticate users agains several domains : INTRA.DOMAIN-A.COM and INTRA.DOMAIN-B.COM. The later domain is not set up yet because this work will be nearly a copy/paste from the first one. I need to make my users authenticate with a login in the form jdoe(a)domain-a.com . This will prevent a conflict if the user jdoe exists on both domains. Notice I want to drop the "intra." part in the login; making my users not bored with technical details. I built successfully a sssd.conf in a Debian Jessie host, but when reproducing the setup on Debian 7, user authentication fails. Here is the sssd.conf file, with password and domain not revealed, [sssd] config_file_version = 2 reconnection_retries = 3 sbus_timeout = 30 services = nss, pam domains = domain-a.com [nss] filter_groups = root filter_users = root reconnection_retries = 3 # entry_cache_nowait_percentage = 300 [pam] reconnection_retries = 3 # Example LOCAL domain that stores all users natively in the SSSD internal # directory. These local users and groups are not visible in /etc/passwd; it # now contains only root and system accounts. # [domain/LOCAL] # description = LOCAL Users domain # id_provider = local # enumerate = true # min_id = 500 # max_id = 999 [domain/domain-a.com] ; Using enumerate = true leads to high load and slow response enumerate = true cache_credentials = false entry_cache_timeout = 5400 # account_cache_expiration = 365 id_provider = ldap auth_provider = krb5 chpass_provider = krb5 ldap_uri = ldap://intra.domain-a.com ldap_tls_reqcert = demand ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt ldap_schema = rfc2307bis ldap_default_bind_dn = cn=ldap-deb7,cn=users,dc=intra,dc=domain-a,dc=com ldap_default_authok_type = password ldap_default_authtok = p@ssw0rd ldap_search_base = cn=users,cn=users,dc=intra,dc=domain-a,dc=com ldap_user_object_class = person #ldap_user_principal = userPrincipalName ldap_user_principal = sAMAccountname ldap_group_object_class = group ldap_user_home_directory = unixHomeDirectory ldap_force_upper_case_realm = true krb5_server = intra.domain-a.com krb5_realm = INTRA.DOMAIN-A.COM krb5_changepw_principle = kadmin/changepw krb5_auth_timeout = 15 use_fully_qualified_names = true # re_expression = ((intra\.(?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@$ # full_name_format = %1$s(a)intra.%2$s # not available on Wheezy - sssd < 1.9.0 # override_shell = /usr/sbin/nologin override_homedir = /media/homedrive/%d/users/%u - gentent passwd shows my users - kinit jdoe(a)INTRA.DOMAIN-A.COM asks for password and succeeds - If logged as root, su jdoe(a)intra.domain-a.com succeeds - ssh localhost -l jdoe(a)domain-a.com fails running sssd -i -d 0xFFF0 shows a huge amount of log, and it appears that kerberos authentication fails. (Sat Jun 13 20:16:10 2015) [sssd[be[domain-a.com]]] [become_user] (0x4000): Trying to become user [10000][10001]. (Sat Jun 13 20:16:10 2015) [sssd[be[domain-a.com]]] [child_handler_setup] (0x2000): Signal handler set up for pid [30421] (Sat Jun 13 20:16:10 2015) [sssd[be[domain-a.com]]] [write_pipe_handler] (0x0400): All data has been sent! (Sat Jun 13 20:16:10 2015) [[sssd[krb5_child[30421]]]] [main] (0x0400): krb5_child started. (Sat Jun 13 20:16:10 2015) [[sssd[krb5_child[30421]]]] [krb5_child_setup] (0x1000): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME] from environment. (Sat Jun 13 20:16:10 2015) [[sssd[krb5_child[30421]]]] [krb5_child_setup] (0x1000): Cannot read [SSSD_KRB5_LIFETIME] from environment. (Sat Jun 13 20:16:10 2015) [[sssd[krb5_child[30421]]]] [krb5_child_setup] (0x4000): Not using FAST. (Sat Jun 13 20:16:11 2015) [[sssd[krb5_child[30421]]]] [get_and_save_tgt] (0x0020): 682: [-1765328360][Preauthentication failed] (Sat Jun 13 20:16:11 2015) [[sssd[krb5_child[30421]]]] [tgt_req_child] (0x0020): 944: [-1765328360][Preauthentication failed] (Sat Jun 13 20:16:11 2015) [sssd[be[domain-a.com]]] [read_pipe_handler] (0x0400): EOF received, client finished (Sat Jun 13 20:16:11 2015) [sssd[be[domain-a.com]]] [krb5_child_done] (0x4000): child response [17][1][25]. (Sat Jun 13 20:16:11 2015) [sssd[be[domain-a.com]]] [check_wait_queue] (0x1000): Wait queue for user [jdoe] is empty. (Sat Jun 13 20:16:11 2015) [sssd[be[domain-a.com]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 17, <NULL>) [Success] (Sat Jun 13 20:16:11 2015) [sssd[be[domain-a.com]]] [be_pam_handler_callback] (0x0100): Sending result [17][domain-a.com] (Sat Jun 13 20:16:11 2015) [sssd[be[domain-a.com]]] [be_pam_handler_callback] (0x0100): Sent result [17][domain-a.com] I think my issue is here, but I don't know how to check the kerberos authenticationn. I'm suspecting sssd sends something with the wrong domain part. I got a LXC container running Debian 8, and this setup seems to work exactly as I'm expecting. Any idea on how to trouble shoot my issue ? Regards,

3 4

Re: [SSSD-users] sssd-ldap caching issue ?
by John Beranek 18 Jun '15

18 Jun '15

For what it's worth, in my environment at work, I am *not* able to reproduce this. Ran the test on a RHEL 6.7 Beta (sssd-1.12.4-31.el6.x86_64) VM, with SSSD configured for our corporate Active Directory. Cheers, John

3 4

Joining AD with SSSD on various operating systems
by Frank Pikelner 17 Jun '15

17 Jun '15

Hello, I'm new to SSSD and the mailing list. I've recently starting working with SSSD to learn about its capabilities and have been actively testing it in joining AD on various Linux distributions (Oracle/CentsOS 6.x , Fedora 22). Now focused on getting SUSE 11.3, Ubuntu 14.04 working. Ubuntu 14.04 - have been able to get to joining AD domain, but unable to authenticate users after join. SSSD appears to start, die, start, die.... Issue may be in correct DNS nameserver config as I am not sure if settings should be made in resolvconf, dnsmasq, Network Manager. Also not clear whether Winbind and Samba need to be removed. Lastly not sure on which package to use for automatic directory creation. For SSSD I'm using the same config on Ubuntu that works on CentOS/Fedora. Please let me know if you are running SSSD on Ubuntu 14.04. Frank

3 2

cache or return Problem
by Günther J. Niederwimmer 17 Jun '15

17 Jun '15

Hello, Is it possible to found out, what sssd have in the cache or send back to a program like dovecot from a IPA Server? My dovecot can't find the correct uid, gid to a mail address from Ipa? -- mit freundlichen Grüssen / best regards, Günther J. Niederwimmer

2 5

Announcing SSSD 1.12.5
by Jakub Hrozek 15 Jun '15

15 Jun '15

=== SSSD 1.12.5 === The SSSD team is proud to announce the release of version 1.12.5 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora 21, 22 and rawhide shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * This release adds several new enhancements and fixes many bugs * Notable new enhancements: * The background refresh tasks now supports refreshing users and groups as well. Please see the description of the `refresh_expired_interval` parameter in the `sssd.conf` man page. * A new option subdomain_inherit was added. Options included in the subdomain_inherit option also apply for trusted domains, if supported. This release supports inheriting ignore_group_members, ldap_purge_cache_timeout, ldap_use_tokengroups and ldap_user_principal. * When an expired account attempts to log in, a configurable error message can be displayed with sufficient pam_verbosity setting. Please see the description of the pam_account_expired_message option for more information. * OpenLDAP ppolicy can be honored even when an alternate login method (such as SSH key) is used. Please see the description of the new ppolicy value of the ldap_access_order option. * A new option krb5_map_user was added. This option allows the admin to map UNIX usernames to Kerberos principals. The option would be mostly useful for setups that wish to continue using UNIX file-based identities together with SSSD Kerberos authentication * The important bug fixes include: * Several AD-specific bugs that resulted in the incorrect set of groups being displayed after the initgroups operation were fixed * Many fixes related to the IPA ID views feature are included. Setups using the ID views feature should update the SSSD instance on both IPA servers and clients. * The AD provider now handles binary GUIDs correctly. This bug was manifested with an error message saying ldb_modify failed: Invalid attribute syntax. * The AD provider no longer downloads full group objects during initgroups request if POSIX attributes are used. This fix may speed up the login times significantly. * A bug that prevented the `ignore_group_members` parameter to be used with the AD provider was fixed * The fail over code now reads and honors TTL value for SRV queries as well. Previously, SRV queries used a hardcoded timeout * The SELinux context set up during login with an IPA provider is only called if the context had changed. This fixes a performance regression with the IPA provider. * Race condition between setting the timeout in the back ends and reading it in the front end during initgroup operation was fixed. This bug affected applications that perform the `initgroups(3)` operation in multiple processes simultaneously. * Setups that only want to use the domain SSSD is connected to, but not the autodiscovered trusted domains by setting `subdomains_provider=none` now work correctly as long as the domain SID is set manually in the config file * In case only allow rules are used, the simple access provider is now able to skip unresolvable groups. * The GPO access control code now handles situations where user and computer objects were in different domains. Previously, an attempt to log in as user from a different domain than computer always resulted in login failure. == Packaging Changes == * The cmocka unit tests now require cmocka version 1.0 or later * The libsss_krb5_common.so library had been moved to the sssd-common subpackage to avoid ordering issues between libsss_krb5_common and libsss_ldap_common * The proxy_child helper binary was marked as setuid in order for the proxy provider to work without root privileges. == Documentation Changes == * A new option subdomain_inherit was added. See the highlights section for more details. * A new option krb5_map_user was added. See the highlights section for more details. * The ldap_access_order option accepts new value ppolicy. * Account expiration message can be customized using a new option pam_account_expired_message == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1884 [RFE] Read and use the TTL value when resolving a SRV query https://fedorahosted.org/sssd/ticket/2050 ssh login reject is abrupt https://fedorahosted.org/sssd/ticket/2167 [RFE] Allow SSSD to issue shadow expiration warning even if alternate authentication method is used https://fedorahosted.org/sssd/ticket/2346 [RFE] Implement background refresh for users and groups https://fedorahosted.org/sssd/ticket/2444 extop request marks dp_req as failed when an entry is not found https://fedorahosted.org/sssd/ticket/2507 Cyclic dependencies between sssd-ldap and krb5-common https://fedorahosted.org/sssd/ticket/2509 RFE: Handle setups with id_provider=proxy and auth_provider=krb5 better https://fedorahosted.org/sssd/ticket/2513 Add a hint on using DEBUG levels to the troubleshooting page https://fedorahosted.org/sssd/ticket/2528 Document that that libkrb5 and sssd use different expansion templates for principals https://fedorahosted.org/sssd/ticket/2534 [RFE] Lock out ssh keys when account naturally expires https://fedorahosted.org/sssd/ticket/2587 With empty ipaselinuxusermapdefault security context on client is staff_u https://fedorahosted.org/sssd/ticket/2588 Properly handle AD's binary objectGUID https://fedorahosted.org/sssd/ticket/2591 sssd nss bug update vs create cache https://fedorahosted.org/sssd/ticket/2592 ccname_file_dummy is not unlinked on error https://fedorahosted.org/sssd/ticket/2598 sssd_nss segfaults if initgroups request is by UPN and doesn't find anything https://fedorahosted.org/sssd/ticket/2601 SSSD downloads too much information when fetching information about groups https://fedorahosted.org/sssd/ticket/2604 sssd_be segfault on IPA(when auth with AD trusted domain) client at src/providers/ipa/ipa_s2n_exop.c:1605 https://fedorahosted.org/sssd/ticket/2606 GPO access control looks for computer object in user's domain only https://fedorahosted.org/sssd/ticket/2608 sssd crashes intermittently https://fedorahosted.org/sssd/ticket/2611 sssd_be dumping core if enumeration times out https://fedorahosted.org/sssd/ticket/2612 ldap_access_order=ppolicy: Explicitly mention in manpage that unsupported time specification will lead to sssd denying access https://fedorahosted.org/sssd/ticket/2613 sysdb sudo search doesn't escape special characters https://fedorahosted.org/sssd/ticket/2614 id lookup resolves "Domain Local" group and errors appear in domain log https://fedorahosted.org/sssd/ticket/2624 Only set the selinux context if the context differs from the local one https://fedorahosted.org/sssd/ticket/2629 sssd_be segfault id_provider = ad src/providers/ad/ad_gpo.c:843 https://fedorahosted.org/sssd/ticket/2630 Overrides with --login work in second attempt https://fedorahosted.org/sssd/ticket/2631 idoverridegroup for ipa group with --group-name does not work https://fedorahosted.org/sssd/ticket/2632 Overridde with --login fails trusted adusers group membership resolution https://fedorahosted.org/sssd/ticket/2633 Group resolution is inconsistent with group overrides https://fedorahosted.org/sssd/ticket/2634 sssd nss responder gets wrong number of secondary groups https://fedorahosted.org/sssd/ticket/2635 ID mapping does not wotk with disabled subdomains https://fedorahosted.org/sssd/ticket/2642 Override for IPA users with login does not list user all groups https://fedorahosted.org/sssd/ticket/2643 autofs provider fails when default_domain_suffix and use_fully_qualified_names set https://fedorahosted.org/sssd/ticket/2644 ignore_group_members doesn't work for subdomains https://fedorahosted.org/sssd/ticket/2646 Disapeared groups with ad providers and enabled ignore_group_members https://fedorahosted.org/sssd/ticket/2647 external users do not resolve with "default_domain_suffix" set in IPA server sssd.conf https://fedorahosted.org/sssd/ticket/2649 /usr/libexec/sssd/selinux_child crashes and gets avc denial when ssh https://fedorahosted.org/sssd/ticket/2650 Unable to resolve group memberships for AD users when using sssd-1.12.2-58.el7_1.6.x86_64 client in combination with ipa-server-3.0.0-42.el6.x86_64 with AD Trust https://fedorahosted.org/sssd/ticket/2654 sssd_be crashed if initialisation of proxy_child failed https://fedorahosted.org/sssd/ticket/2655 proxy provider does not work in non-root mode https://fedorahosted.org/sssd/ticket/2659 IPA enumeration provider crashes https://fedorahosted.org/sssd/ticket/2663 id lookup for non-root domain users doesn't return all groups on first attempt == Detailed changelog == Adam Tkac (1): * Option filter_users had no effect for retrieving sudo rules Aron Parsons (2): * IPA: fix segfault in ipa_s2n_exop * autofs: fix 'Cannot allocate memory' with FQDNs Daniel Hjorth (1): * LDAP: unlink ccname_file_dummy if there is an error Jakub Hrozek (34): * Updating the version for the 1.12.5 release * resolv: Use the same default timeout for SRV queries as previously * FO: Use SRV TTL in fail over code * selinux: Delete existing user mapping on empty default * NSS: Handle ENOENT when doing initgroups by UPN * selinux: Handle setup with empty default and no configured rules * tests: convert all unit tests to cmocka 1.0 or later * RPM: BuildRequire libcmocka >= 1.0 * build: Only run cmocka tests if cmocka 1.0 or newer is available * Resolv: re-read SRV query every time if its TTL is 0 * IPA: Use custom error codes when validating HBAC rules * IPA: Drop useless sysdb parameter * IPA: Only treat malformed HBAC rules as fatal if deny rules are enabled * IPA: Deprecate the ipa_hbac_treat_deny_as option * selinux: Disconnect before closing the handle * selinux: Begin and end the transaction on the same nesting level * selinux: Only call semanage if the context actually changes * tests: Use cmocka-1.0+ API in test_sysdb_utils * sysdb: Add cache_expire to the default sysdb_search_object_by_str_attr set * SELINUX: Avoid disconnecting disconnected handle * LDAP: return after tevent_req_error * MAN: refresh_expired_interval also supports users and groups * tests: ncache_hit must be an int to test UPNs * tests: Add a getpwnam-by-UPN test * Add unit tests for initgroups * Download complete groups if ignore_group_members is set with tokengroups * DP: Set extra_value to NULL for enum requests * Skip enumeration requests in IPA and AD providers as well * confdb: Add new option subdomain_inherit * DP: Add a function to inherit DP options, if set * SDAP: Add sdap_copy_map_entry * UTIL: Inherit ignore_group_members * subdomains: Inherit cleanup period and tokengroup settings from parent domain * Updating translations for the 1.12.5 release Lukas Slebodnik (19): * Log reason in debug message why ldb_modify failed * ipa_selinux: Fix warning may be used uninitialized * memberof: Do not create request with 0 attribute values * CLIENT: Clear errno with enabled sss-default-nss-plugin * GPO: Check return value of ad_gpo_store_policy_settings * SDAP: Do not set gid 0 twice * SDAP: Extract filtering AD group to function * SDAP: Filter ad groups in initgroups * GPO: Do not ignore missing attrs for GPOs * sss_nss_idmap-tests: Use different prepared buffers for big endian * SDAP: Fix id mapping with disabled subdomains * SPEC: Fix cyclic dependencies between sssd-{krb5,}-common * negcache: Soften condition for expired entries * test_nss_srv: Use right function for storing time_t * nss: Do not ignore default vaue of SYSDB_INITGR_EXPIRE * SDAP: Set initgroups expire attribute at the end * SDAP: Remove unnecessary argument from sdap_save_user * PROXY: proxy_child should work in non-root mode * PROXY: Do not register signal with SA_SIGINFO Michal Zidek (2): * DEBUG: Add missing strings for error messages * test: Check ERR_LAST Pavel Březina (8): * be_refresh: refresh all domains in backend * sdap_handle_acct_req_send: remove be_req * be_refresh: refactor netgroups refresh * be_refresh: add sdap_refresh_init * be_refresh: support users * be_refresh: support groups * enumeration: fix talloc context * sudo: sanitize filter values Pavel Reichl (18): * PAM: do not reject abruptly * PAM: new option pam_account_expired_message * PAM: warn all services about account expiration * PAM: check return value of confdb_get_string * SDAP: refactor pwexpire policy * SDAP: enable change phase of pw expire policy check * UTIL: convert GeneralizedTime to unix time * SDAP: Lock out ssh keys when account naturally expires * SDAP: fix minor neglect in is_account_locked() * ldap_child: fix coverity warning * MAN: libkrb5 and SSSD use different expansions * IPA: set EINVAL if dn can't be linearized * LDAP: remove unused code * LDAP: fix a typo in debug message * MAN: Update ppolicy description * simple-access-provider: make user grp res more robust * LDAP: warn about lockout option being deprecated * krb5: new option krb5_map_user Stephen Gallagher (3): * AD: Clean up ad_access_gpo * AD: Always get domain-specific ID connection * AD GPO: Always look up GPOs from machine domain Sumit Bose (25): * ldap_child: initialized ccname_file_dummy * PAM: use the logon_name as the key for the PAM initgr cache * pam_initgr_check_timeout: add debug output * ipa: do not treat missing sub-domain users as error * ipa: make sure extdom expo data is available * LDAP/AD: do not resolve group members during tokenGroups request * IPA idviews: check if view name is set * IPA: make sure output variable is set * GPO: error out instead of leaving array element uninitialized * sdap: properly handle binary objectGuid attribute * IPA: do not try to save override data for the default view * IPA: use sysdb_attrs_add_string_safe to add group member * IPA: check ghosts in groups found by uuid as well * IPA: allow initgroups by SID for AD users * IPA: do initgroups if extdom exop supports it * IPA: update initgr expire timestamp conditionally * IPA: enhance ipa_initgr_get_overrides_send() * IPA: search for overrides during initgroups in sever mode * IPA: do not add domain name unconditionally * NSS: check for overrides before calling backend * IPA: allow initgroups by UUID for FreeIPA users * SDAP: use DN to update entry * IPA: do not fail if view name lookup failed on older versions * libwbclient-sssd: update interface to version 0.12 * ldap: use proper sysdb name in groups_by_user_done()

3 6

Build commands for Debian/Ubuntu
by Matt . 15 Jun '15

15 Jun '15

Hi Guys, Does anyone have the proper commands to build a SSSD package from a git clone ? Would be great as the README doens't contain it at all. Thanks! Matt

4 5

sssd with samba - Could not add domain to ID map
by Jonathan Hunter 13 Jun '15

13 Jun '15

Hi, I have what I believe is a minimal sssd.conf (running on CentOS 6.6) that has previously worked fine without the line "ldap_id_mapping = False". I recently had to add rfc2307 attributes to AD (long story), and therefore added the line "ldap_id_mapping = False" to my sssd.conf... at which point sssd will now no longer start (it's fine if I remove this line, but of course returns the wrong information). Relevant log messages (obtained using 'sssd -i -d 0x03f0') might be these ones: (Thu Jun 11 23:55:11 2015) [sssd[be[mydomain.my.tld]]] [sdap_idmap_init] (0x0100): Initializing [1] domains for ID-mapping (Thu Jun 11 23:55:11 2015) [sssd[be[mydomain.my.tld]]] [sdap_idmap_add_domain] (0x0020): Could not add domain [mydomain.my.tld] to the map: [11] (Thu Jun 11 23:55:11 2015) [sssd[be[mydomain.my.tld]]] [sdap_idmap_init] (0x0020): Could not add domain [mydomain.my.tld][S-1-5-21-xxxxxxxxxx-yyyyyyyyyy-zzzzzzzzzz][7091] to ID map: [Input/output error] (Thu Jun 11 23:55:11 2015) [sssd[be[mydomain.my.tld]]] [load_backend_module] (0x0010): Error (5) in module (ad) initialization (sssm_ad_id_init)! (Thu Jun 11 23:55:11 2015) [sssd[be[mydomain.my.tld]]] [be_process_init] (0x0010): fatal error initializing data providers (Thu Jun 11 23:55:11 2015) [sssd[be[mydomain.my.tld]]] [main] (0x0010): Could not initialize backend [5] (Thu Jun 11 23:55:11 2015) [sssd] [mt_svc_exit_handler] (0x0040): Child [mydomain.my.tld] exited with code [3] (Thu Jun 11 23:55:11 2015) [sssd] [mt_svc_exit_handler] (0x0010): Process [mydomain.my.tld], definitely stopped! My sssd.conf is: [sssd] config_file_version = 2 domains = mydomain.my.tld services = nss, pam [domain/mydomain.my.tld] id_provider = ad auth_provider = ad access_provider = ad ldap_id_mapping = False What are the best troubleshooting steps I can take next? Cheers, Jonathan -- "If we knew what it was we were doing, it would not be called research, would it?" - Albert Einstein

2 2

Using "chsh" or equivalent with SSSD
by Torgeir.Wulfsberg＠kongsberg.com 03 Jun '15

03 Jun '15

Hi! Could not find much information on this. But I was wondering if it is/or can be supported, that an user in Active Directory (system setup with SSSD), to change his/hers own "default shell" in AD (as in Attribute: loginShell). It looks like "chsh" only work for local (/etc/passwd) users. Does anyone have any information about this? --Torgeir ________________________________ CONFIDENTIALITY This e-mail and any attachment contain KONGSBERG information which may be proprietary, confidential or subject to export regulations, and is only meant for the intended recipient(s). Any disclosure, copying, distribution or use is prohibited, if not otherwise explicitly agreed with KONGSBERG. If received in error, please delete it immediately from your system and notify the sender properly.

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users June 2015