Separate minimum uid and gid filter?
by Petter Reinholdtsen
After some struggling, I was finally able to get sssd version 1.0.5
working here at the university. The problem was not related to SSL
certificates as I first suspected, but related to some surprising
uid/gid filtering.
My user have a gid value of 300, and users with this gid are silently
ignored by sssd. I tried to find some configuration setting to
configure the minimun gid, but found nothing in the manual page for
sssd.conf. I did on the other hand find the min_id value. But I
would really like to keep the uid limit at 1000, while I would like to
lower the gid limit to 1. Is this possible?
Happy hacking,
--
Petter Reinholdtsen
13 years, 11 months
questions about SSSD options
by David O'Brien
1. In the option "ldap_opt_timeout", where does the "opt" come from? Is
it just short for "option"?
2. A question arose today about how to determine which options are
mandatory and which are not in any given SSSD config. I've since found a
few cases where "optional" is included as part of the description in the
man page. Is this the determining factor? e.g.,
- ldap_group_search_base (string)
An optional base DN to restrict group searches to a specific subtree.
What about:
- ldap_user_home_directory (string)
The LDAP attribute that contains the name of the user´s home directory.
Does this mean all users always have a home dir? (This might be true
anyway, but it might be a case of "if not /home/davido then HOMEDIR=
/somewhere".)
That's it for this email.
Thanks
--
David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane
"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.
13 years, 11 months
Documenting the SSSD local domain, management tools, etc
by David O'Brien
Recently it was recommended that I not include the LOCAL domain, nested
groups, and related functionality in the end-user doc (limiting it to
the man pages). This raises the following issue:
There is a section in the draft doc at present, "Using the SSSD
Management Tools", which includes info on working with users, groups,
nested groups, examples, etc., all of which will disappear if we remove
LOCAL domains from the topic list. Is this what we want? I know we're
moving towards the "SSSD functions transparently in the b/g when needed"
approach, but I want to double-check before I remove this section (about
2 pages).
Thanks
--
David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane
"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.
13 years, 11 months
Announcing the System Security Services (SSSD) 1.1.92 Release
by Stephen Gallagher
The System Security Services Daemon team is proud to announce the 1.1.92
release. This is our second release candidate for the 1.2.0 release. As
usual, it is available for download at https://fedorahosted.org/sssd
Unfortunately, we had to break string freeze for the neq
ldap_access_filter and ldap_krb5_ticket_lifetime options. However, we
are now completely string-frozen until the SSSD 1.2.0 release, now
scheduled for Mon, May 24th.
== Highlights ==
* New LDAP access provider allows for filtering user access by LDAP
attribute
* Reduced default timeout for detecting offline status with LDAP
* For {{{enumerate=False}}}, reduced to five seconds
* For {{{enumerate=True}}}, reduced to thirty seconds
* GSSAPI ticket lifetime made configurable
* New default is 24 hours (or server maximum, whichever is lower)
* Better offline->online transition support in Kerberos
== Detailed Changelog ==
Petter Reinholdtsen (1):
* Allow Debian/Ubuntu build to pass --install-layout=deb to setup.py
Piotr Drąg (1):
* Update pl translation
Stephen Gallagher (6):
* Add ldap_access_filter option
* Don't report a fatal error for an HBAC denial
* Add ldap_access_filter option
* Remove unused ldap_offline_timeout option
* Set ldap_search_timeout default to 5 seconds
* Update version to 1.1.92
Sumit Bose (11):
* Add ldap_krb5_ticket_lifetime option
* Revert "Create kdcinfo and kpasswdinfo file at startup"
* Refactor data provider callbacks
* Add offline callbacks
* Refactor krb5_finalize()
* Add run_callbacks flag
* Add callback to remove krb5 info files when going offline
* Krb5 locator plugin returns KRB5_PLUGIN_NO_HANDLE
* Refactor krb5 SIGTERM handler installation
* Add krb5 SIGTERM handler to ipa auth provider
* Add offline callback to disconnect global SDAP handle
Yuri Chornoivan (1):
* Update uk translation
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
13 years, 11 months
[PATCH] Add offline callback and fix info file handling
by Sumit Bose
Hi,
this series of patches aims to fix the handling of the info file for the
locator plugin to allow a graceful fallback to the configuration from
krb5.conf is the sssd backend is offline.
0001-Revert-Create-kdcinfo-and-kpasswdinfo-file-at-startu.patch:
Remove the old commit
0002-Refactor-data-provider-callbacks.patch
Remove references to 'online' from the main callback code, move
callback code to a separate file to make life easier for potential
unit test.
0003-Add-offline-callbacks.patch
0004-Refactor-krb5_finalize.patch
Create a new subroutine which only unlinks the files.
0005-Add-callback-to-remove-krb5-info-files-when-going-of.patch
0006-Krb5-locator-plugin-returns-KRB5_PLUGIN_NO_HANDLE.patch
KRB5_PLUGIN_NO_HANDLE is the error code which instructs libkrb5 to
try the next plugin of use krb5.conf.
bye,
Sumit
13 years, 11 months
[PATCHES] Fix LDAP timeout values
by Stephen Gallagher
Patch 0001: The option ldap_offline_timeout is not used anywhere in the
source. This patch removes references to it.
Patch 0002: The manpage lists five seconds as the default for ldap
searches, but the source was setting the default to 60s. This was
causing long timeouts waiting to go offline.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
13 years, 11 months
[PATCH] Add ldap_access_filter option
by Stephen Gallagher
This option (applicable to access_provider=ldap) allows the admin
to set an additional LDAP search filter that must match in order
for a user to be granted access to the system.
Common examples for this would be limiting access to users by in a
particular group, for example:
ldap_access_filter = memberOf=cn=access_group,ou=Groups,dc=example,dc=com
Resolves https://bugzilla.redhat.com/show_bug.cgi?id=587743
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
13 years, 11 months
Re: [SSSD] [patch] Allow Debian/Ubuntu build to pass --install-layout=deb to setup.py
by Stephen Gallagher
On 05/05/2010 05:10 PM, Petter Reinholdtsen wrote:
>
> Hi. You get this email as one of the sssd developers. I failed to
> find any information in the tarball about where to email patches, so I
> ended up sending it to your individual email addresses.
Ah, you're right. We really should add a pointer to our devel list
(sssd-devel(a)lists.fedorahosted.org) and our wiki
(https://fedorahosted.org/sssd)
>
> I'm currently looking into building a Debian package, and based on the
> Ubuntu patches I see the need to pass --install-layout=deb to the
> setup.py script. The attached patch make it possible to do so without
> having to patch the source. Please include it in a future version of
> sssd.
>
> I assume you will leave the DISTSETUPOPTS variable empty in your
> version, but included its content in my patch to show what it would be
> set to in a Debian build. It is only needed for the install run of
> setup.py.
>
> Happy hacking,
Looking at the patch, I think it needs a little bit of rework. We don't
want to default to passing DISTSETUPOPTS = --install-layout=deb as it is
currently written.
Please take a look at sssd-1.1.1/src/external/platform.m4
You can add a Debian target there, and then have the Makefile.am set
DISTSETUPOPTS only when 'if HAVE_DEB' is true. I'm not familiar enough
with Debian to write these tests myself.
Please feel free to subscribe to the sssd-devel list at
https://fedorahosted.org/mailman/listinfo/sssd-devel for submitting
newer patches. I'm forwarding the current version there for posterity.
Thank you for your contributions!
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
13 years, 11 months