[PATCHES] Support for netgroups in the NSS client and responder
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
These patches were tested on the local domain (by manually editing the
sssd.ldb). I also ran them through valgrind.
Patch 0001: Add utility function sss_strnlen()
This is useful for guaranteeing the size of an input buffer. I'm using
this in the nss client portion of the netgroups support.
Patch 0002: Store entry_cache_timeout in sss_domain_info object
This is useful so that the NSS responder can identify an domain's
entry timeout for expiring the memory cache for a lookup such as
with netgroups.
Patch 0003: Require explicit setting of callback context for check_cache
Previously, it was implicitly using the nss_dom_ctx, but there are
situations where we would want to send a different private context.
Specifically, we need to be able to send a step_ctx for the netgroups
support in patch 0010.
Patch 0004-0005: Sysdb interfaces for netgroups (and associated tests)
These are identical to the last set I sent in the "Sysdb interface for
netgroups" thread. I am retiring that thread to use this one for the review.
Patch 0006: Rename group.c and passwd.c for clarity
Prefixing group.c and passwd.c with "nss_" similar to the way the
PAM client sources are prefixed with "pam_". This patch isn't strictly
necessary, but I wanted it to be more clear which files were associated
with NSS vs. PAM vs. common in the sss_client directory. Patch 0007 will
create nss_netgroup.c as well.
Patch 0007: Add support for netgroups to NSS sss_client
There's one peculiarity about this patch that I have to note. I need to
send back a true/false value to the setnetgrent call in order to
properly report that there were no entries. This differs from the other
set*ent functions because we are processing a specific requested entry
rather than enumerating all entries. Without doing this, we actually
return a netgroup containing no member triples, which is certainly not
what the client app expects.
Patch 0008: Add negative cache features for netgroups
This patch just updates the negative cache interface to allow including
netgroups in the negative cache like other entries.
Patch 0009: Split out some helper functions for the NSS responder
Create a new private header and make some functions available for
other object files. The nsssrv_cmd.c file is getting far too large to be
manageable. Patch 0010 will create a separate file (nsssrv_netgroup.c)
to hold all of the netgroup-related code, but we need access to this set
of functions in both places.
Patch 0010: Add netgroup support to the NSS responder
This is the big one. It borrows a lot of its design from the recently
rewritten enumeration code, but it has a few gotchas (notably that we
need to maintain state between setnetgrent and getnetgrent calls to
ensure that we are still answering requests for the same requested entry.
Remaining work on netgroups will be to add support for the LDAP backend
to store the netgroups in the cache appropriately. In the future
(https://fedorahosted.org/sssd/ticket/630) we will also add netgroups
support to the proxy provider. This proxy support is not planned for 1.4.0.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkyakSUACgkQeiVVYja6o6Or5ACgrYx+rlk4ux/MOCjqVQ9Ds8+6
BvQAn1KrVnr7J0HAreUTovg8B03WLp0R
=71HE
-----END PGP SIGNATURE-----
13 years, 7 months
Behaviour of getgrnam/getgrgid
by Ralf Haferkamp
Hi,
Is it really the intended behaviour of the sssd LDAP backend (I am
running the current code from the master branch) to only return the group
members that are already cached in sysdb and to silently ignore
everything else? E.g. when I start sssd with empty caches and do a
"getent group <random-ldap-group>" I will only get back the group without
any members. Somehow I think this can't be intended :)
I have started working on a patch to let sssd look up the non-cached
users via LDAP (and save them into the cache). Find it attached. Note:
That patch is not really complete (e.g. it doesn't handle rfc2307 groups
correctly). But before putting more effort into this I like to make sure
that I am not trying to fix a "feature" here.
--
regards,
Ralf
13 years, 7 months
Man pages should mention supported providers
by Jan Zelený
Supported providers are mentioned in Description section, because there was
already partial description present. Another possibility was to comment it as
configuration option (e.g. create access_provider=ldap record there). I like
this way more, but I'm not sure whether it is descriptive enough.
--
Jan
13 years, 7 months
[PATCH] Raise the required version of libdhash
by Sumit Bose
Hi,
this patch increase the required version number of libdhash. Older
version cannot update hash entries with hash_enter(). I think we
currently do not use hash_enter() to update entries (I had a netgroup
patch where it was used, but since we let glibc do all the unrolling and
loop-detection it is not needed anymore).
To avoid surprises we should check for the latest version of libdhash.
bye,
Sumit
13 years, 7 months
[PATCHES] Three minor cosmetic fixes
by Sumit Bose
Hi,
the three attached patches fixes some compiler warnings, which might
occur with a high warning level like -Wextra.
bye,
Sumit
13 years, 7 months
Announcing the release of ding-libs 0.1.2
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Sumit discovered and fixed a serious bug in libdhash. Specifically, the
hash_enter() function was incapable of updating an existing entry.
We are releasing ding-libs 0.1.2 immediately with a fix for this
incorrect behavior.
ding-libs-0.1.2 is available for source tarball download at
https://fedorahosted.org/sssd/wiki/Releases#DING-LIBSReleases
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAky0rN4ACgkQeiVVYja6o6Pd+wCgh7WJJhgoSYsuOACGV8fOpNee
Y+cAnRrQVWrD2Ma/CPAYY1MTJ7Hri3Cx
=/Pbk
-----END PGP SIGNATURE-----
13 years, 7 months
[PATCH] dhash: Allow hash_enter() to update entries
by Sumit Bose
Hi,
Patch 0003 add update capabilities to hash_enter(). The current
behaviour was to keep the old entry and return HASH_SUCCESS. I have
added an update test to the unit test. Maybe it make sense to update the
version number to make it easier to detect if updates are possible or
not.
Patch 0001 adds a missing include file and 0002 makes hash_example pass
valgrind without errors.
bye,
Sumit
13 years, 7 months
login is slow just after reboot
by Eric Doutreleau
hi
we re using sssd 1.3.0 with ldap authentication and as soon as we have
populated a lot of groups login just after reboot is very slow ( about
45 seconds ).
After the first initial login all the subsequent login are immediate.
I know that there were some performance problem with initgroup. Are they
solved now?
I 'm doing enumeration on my ldap server.
Should i upgrade to 1.3.1 version?
13 years, 7 months