Config problem or bug(?) with sssd and Windows AD 2008
by Patrick Grieshaber
Hello folks,
first let me say that the sssd project is great and I am lucky that this
project is available for CentOS/Redhat through the EPEL repo :-).
I've installed version sssd-1.2.1-27.el5.x86_64 and I want to be able to
fetch user infos plus enable login through AD 2008 - but I fail..
sssd.conf:
[domain/example.com]
enumerate = false
id_provider = ldap
chpass_provider = krb5
ldap_uri = ldap://dc1.example.com, ldap://dc2.example.com
ldap_search_base = dc=example,dc=com
tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
ldap_tls_cacertdir = /etc/pki/tls/certs
ldap_default_bind_dn = CN=serviceuser,DC=example,DC=com
ldap_default_authtok_type = password
ldap_default_authtok = serviceuserpassword
ldap_user_name = sAMAccountName
ldap_search_base = OU=IT,DC=example,DC=com
ldap_pwd_policy = none
ldap_user_object_class = person
ldap_schema = rfc2307bis
ldap_user_principal = userPrincipalName
ldap_user_uid_number = sAMAccountName
ldap_user_gid_number = sAMAccountName
ldap_user_uuid = sAMAccountName
ldap_user_fullname = displayName
# kerberos config
auth_provider = krb5
krb5_kdcip = dc1.example.com
krb5_realm = EXAMPLE.COM
krb5_changepw_principle = kadmin/changepw
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
krb5_auth_timeout = 15
For debugging reasons I run: sssd -d9
Here the output if I attempt: su - myuser(a)example.com
...snip...
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_generic_send]
(6): calling ldap_search_ext with
[(&(sAMAccountName=myuser)(objectclass=person))][OU=IT,DC=example,DC=com].
...snip...
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result]
(8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0]
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result]
(8): Trace: ldap_result found nothing!
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result]
(8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0]
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_parse_entry] (9):
OriginalDN: [CN=my,OU=IT,DC=example,DC=com].
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result]
(8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0]
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_generic_done]
(6): Search result: Success(0),
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_users_process]
(6): Search for users, returned 1 results.
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result]
(8): Trace: sh[0x8f876c0], connected[1], ops[(nil)], ldap[0x8f876f0]
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result]
(8): Trace: ldap_result found nothing!
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [ldb] (9): start ldb
transaction (nesting: 0)
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_user_send]
(9): Save user
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_user_send]
(1): no uid provided for [myuser] in domain [example.com].
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_users_process]
(2): Failed to store user 0. Ignoring.
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [ldb] (9): commit ldb
transaction (nesting: 0)
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_users_done]
(9): Saving 1 Users - Done
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [acctinfo_callback] (4):
Request processed. Returned 0,0,Success
And su outputs: su: user myuser(a)example.com does not exist
What is wrong? I do the mapping of a uid/gid... any help is appreciated!
Thank you,
pat
--
Patrick Grieshaber
Mobile: +41 (0)79 215 63 79
Xing: xing.com/profile/Patrick_Grieshaber
Skype: patrickgrieshaber
GPG Key Fingerprint
0252 0C05 410E C345
1AC7 7530 98ED B18E
62CB CF04
12 years, 3 months
[PATCH] Make manual pages translatable
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Utilizes PO4A to extract translatable strings from Docbook XML sources
and allows translators to submit ordinary .PO files. PO4A then generates
translated Docbook documents that can be used to generate translated end
user documentation.
https://fedorahosted.org/sssd/ticket/297
The second patch adds a skeleton of Czech translation I used for testing
- -- at least one man page is localized so the whole process is testable.
The general approach is based on what some of the Debian-based projects do.
I have two questions about the patch:
* the way the patch is written now, the localized manpages (and the
respective xlm sources) are generated during every "make" invocation --
so they are always in sync. I couldn't decide it makes more sense to add
a specialized "docs" and "docsinstall" targets or something
similar..which would be trivial to do, I'm just not sure whether it's
better or worse than keeping things done with "make all".
* the .po files are distributed, not the localized .xml sources. I
think it makes more sense since the localized .xml sources are generated
from the .po files and the original .xml sources anyway, but it would be
easy to change the distribution to .xml and only regenerate the .xml
sources when releasing a new upstream
tarball.
Thanks,
Jakub
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkz0nKwACgkQHsardTLnvCUhGQCg5AgH7VQ1NQNa5hVFaaQvf6KS
fwYAoLuLvQd52kmhlH5gFNlQbDM35VbM
=DFJj
-----END PGP SIGNATURE-----
12 years, 5 months
[PATCHES] Ding-libs patches.
by Dmitri Pal
Hello,
Thanksgiving was productive... ;-)
Please find attached 12 patches that I worked over the weekend.
Each patch has a thorough description inside the patch comment.
Some of them are independent but some rely on the previous patches so in
general it is better to apply them in order.
I tried to keep them small and readable.
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
12 years, 5 months
[PATCH] Generate ccache name at the beginning of auth process
by Jan Zelený
After some complications I finally made the patch solving ticket #533 (different
ccache files during multiple simultaneous logins of the same user). It is based
on Simo's idea to determine the ccache file name in advance and count
references to it.
Jan
12 years, 5 months
[PATCHES] Add support for FAST in krb5 provider
by Sumit Bose
Hi,
these two patches add support for FAST to the Kerberos provider as
requested in trac ticket #237. The first patch just modifies some helper
functions in krb5_child so that they can be used by the second patch.
We support FAST only with MIT Kerberos 1.8 or later, because with 1.7 it
is not possilbe to implement the 'try' option anthentication would fail
if the server does not support FAST.
bye,
Sumit
12 years, 5 months
[PATCHES] Use entry USN when available
by Simo Sorce
This set of patches allows SSSD to use the more reliable entryUSN
against FreeIPA (and USNchanged against AD) when performing
enumerations.
If entryUSN(USNchanged) is not detected as available by checking rootdse
for lastUSN(highestCommittedUSN) then we fall back to use
modifyTimestamp which is fine in non-multimaster setups.
This set comprises 4 patches.
1. pass sdap_id_ctx to sdap_id_op functions (needed later).
2. cleanup unused vars and functions about rootdse to avoid confusion
3. add connection checks to test if USNs are available.
4. Change the code around to use the best USN method available and
fallback to the previous modifyTimestamp if not.
These pacthes have been briefly tested against a FreeIPA server with
the entryUSN configuration patch (still unpushed upstream) and all seem
to working fine.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
12 years, 5 months
[PATCH] Add new account expired rule to LDAP access provider
by Sumit Bose
Hi,
these two patches aim to fix trac ticket #672. While the first patch
only makes a utility function public the second adds some new layers to
the LDAP access provider. I've tried to make the changes in a way to
make it easy to add new rules (#670) and new expire policies (#673,
#674, #690).
I would like to ask the reviewers to check if the new code is really as
flexible as I think and if it enough to evaluate the shadow expire
attribute here. TIA
bye,
Sumit
12 years, 5 months
[PATCH] Add ldap_chpass_uri config option
by Sumit Bose
Hi,
this patch adds a ldap_chpass_uri config option as requested in trac
ticket #680. The first patch just removes an unused struct member.
bye,
Sumit
12 years, 5 months
[PATCHES] Support automatic Kerberos ticket renewal
by Sumit Bose
Hi,
this series for patches add support for automatic Kerberos ticket
renewal, see also trac ticket #369.
There are several things I like to discuss:
- in the ticket a separate process which should handle the renewal was
mentioned. Currently the patches just create a timed task in the krb5
provider because I think most of the typically uses cases do not
justify to overhead we create with a separate process. But I'm open
for other arguments.
- I have added option to request TGT with a specific lifetime/renewal
time. The corresponding option in krb5.conf have a trailing letter
indicating the time unit. I have copied this behaviour to help
migrations although we typically use only seconds without a unit in
sssd.conf. Is this a good idea or shall I change it to seconds or do
we want to support both formats.
- Currently everything is held in RAM and after a restart nothing is
renewed automatically. I plan to send a new patch which checks all
ccfiles we have in the cache and if renewal is possible it adds them
to the list at startup. I think this approach makes more sense than
writing the list of renewable ticket to disk. Do you agree?
bye,
Sumit
From dd0b3d75426765c5c8d03852584a35a58c19d144 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose(a)redhat.com>
Date: Mon, 8 Nov 2010 14:24:05 +0100
Subject: [PATCH 2/8] Add a renew task to krb5_child
---
src/providers/krb5/krb5_child.c | 65 +++++++++++++++++++++++++++++++++++++++
src/sss_client/sss_cli.h | 8 ++++-
2 files changed, 72 insertions(+), 1 deletions(-)
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 5a5281a..0f729d8 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -863,6 +863,67 @@ static errno_t kuserok_child(int fd, struct krb5_req *kr)
return ret;
}
+static errno_t renew_tgt_child(int fd, struct krb5_req *kr)
+{
+ int ret;
+ int status = PAM_AUTHTOK_ERR;
+ int kerr;
+ char *ccname;
+ krb5_ccache ccache = NULL;
+
+ if (kr->pd->authtok_type != SSS_AUTHTOK_TYPE_CCFILE) {
+ DEBUG(1, ("Unsupported authtok type for TGT renewal [%d].\n",
+ kr->pd->authtok_type));
+ goto done;
+ }
+
+ ccname = talloc_strndup(kr, (char *) kr->pd->authtok, kr->pd->authtok_size);
+ if (ccname == NULL) {
+ DEBUG(1, ("talloc_strndup failed.\n"));
+ goto done;
+ }
+
+ kerr = krb5_cc_resolve(kr->ctx, ccname, &ccache);
+ if (kerr != 0) {
+ KRB5_DEBUG(1, kerr);
+ goto done;
+ }
+
+ kerr = krb5_get_renewed_creds(kr->ctx, kr->creds, kr->princ, ccache, NULL);
+ if (kerr != 0) {
+ KRB5_DEBUG(1, kerr);
+ goto done;
+ }
+
+ kerr = krb5_cc_initialize(kr->ctx, ccache, kr->princ);
+ if (kerr != 0) {
+ KRB5_DEBUG(1, kerr);
+ goto done;
+ }
+
+ kerr = krb5_cc_store_cred(kr->ctx, ccache, kr->creds);
+ if (kerr != 0) {
+ KRB5_DEBUG(1, kerr);
+ goto done;
+ }
+
+ status = PAM_SUCCESS;
+
+done:
+ krb5_free_cred_contents(kr->ctx, kr->creds);
+
+ if (ccache != NULL) {
+ krb5_cc_close(kr->ctx, ccache);
+ }
+
+ ret = sendresponse(fd, 0, status, kr);
+ if (ret != EOK) {
+ DEBUG(1, ("sendresponse failed.\n"));
+ }
+
+ return ret;
+}
+
static errno_t create_empty_ccache(int fd, struct krb5_req *kr)
{
int ret;
@@ -903,6 +964,7 @@ static errno_t unpack_buffer(uint8_t *buf, size_t size, struct pam_data *pd,
p += len;
if (pd->cmd == SSS_PAM_AUTHENTICATE ||
+ pd->cmd == SSS_CMD_RENEW ||
pd->cmd == SSS_PAM_CHAUTHTOK_PRELIM || pd->cmd == SSS_PAM_CHAUTHTOK) {
SAFEALIGN_COPY_UINT32_CHECK(&len, buf + p, size, &p);
if ((p + len ) > size) return EINVAL;
@@ -1017,6 +1079,9 @@ static int krb5_child_setup(struct krb5_req *kr, uint32_t offline)
case SSS_PAM_ACCT_MGMT:
kr->child_req = kuserok_child;
break;
+ case SSS_CMD_RENEW:
+ kr->child_req = renew_tgt_child;
+ break;
default:
DEBUG(1, ("PAM command [%d] not supported.\n", kr->pd->cmd));
kerr = EINVAL;
diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h
index f8ccb4f..223524e 100644
--- a/src/sss_client/sss_cli.h
+++ b/src/sss_client/sss_cli.h
@@ -181,7 +181,9 @@ enum sss_cli_command {
* operation where the PAM_PRELIM_CHECK
* flag is set, see pam_sm_chauthtok(3)
* for details */
-
+ SSS_CMD_RENEW = 0x00F8, /**< Renew a credential with a limited
+ * lifetime, e.g. a Kerberos Ticket
+ * Granting Ticket (TGT) */
};
/**
@@ -228,6 +230,10 @@ enum sss_authtok_type {
SSS_AUTHTOK_TYPE_PASSWORD = 0x0001, /**< Authentication token is a
* password, it may or may no contain
* a trailing \\0 */
+ SSS_AUTHTOK_TYPE_CCFILE = 0x0002, /**< Authentication token is a path to
+ * a Kerberos credential cache file,
+ * it may or may no contain
+ * a trailing \\0 */
};
/**
--
1.7.3.2
12 years, 5 months
[PATCH] Set up signal handlers before initializing sysdb
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
A temporary signal handler for SIGTERM is set up in server_setup()
that calls exit() from within a pure signal handler. This causes a
race condition where it's possible that if the SSSD is restarted
immediately while it is still initializing the sysdb caches for
the first time, it can leave the cache in a corrupt and unusable
state.
https://bugzilla.redhat.com/show_bug.cgi?id=658444
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkz1K/IACgkQeiVVYja6o6MC4ACcC4U1FUB/R4OaGdVXGHlFyk0v
0+oAnjPMJFC14pijWYDI9pg0r1dg2Fv0
=Zz8+
-----END PGP SIGNATURE-----
12 years, 5 months