Re: [SSSD] sssd and kerberos.
by Timo Aaltonen
On Tue, 10 Aug 2010, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 08/10/2010 10:29 AM, Timo Aaltonen wrote:
>> On Thu, 5 Aug 2010, Stephen Gallagher wrote:
>>
>>> Someone else just reported this same issue to me :(
>>>
>>> Can you attach the /var/log/sssd/sssd_<domain>.log and
>>> /var/log/sssd/ldap_child.log for this?
>>>
>>> I suspect you'll see the ldap_child.log report that it couldn't find a
>>> KDC for the realm.
>>
>> I can now enumerate the user, but auth fails because of this:
>>
>> /var/log/sssd/krb5_child.log:
>> (Tue Aug 10 16:54:10 2010) [[sssd[krb5_child[13472]]]] [get_and_save_tgt]
>> (1): 524: [-1765328230][Cannot find KDC for requested realm]
>> (Tue Aug 10 16:54:10 2010) [[sssd[krb5_child[13472]]]] [tgt_req_child]
>> (1): 756: [-1765328230][Cannot find KDC for requested realm]
>
> See: https://bugzilla.redhat.com/show_bug.cgi?id=621541
Yes, exactly the same errors with SSSD_KRB5_LOCATOR_DEBUG=1. I have the
KDC's in /etc/krb5.conf, btw.
>> also, I don't know what to use for searching the group information :) So
>> it cannot find the name for the default group. I checked from AD that the
>> values below should be correct.
>>
>> ldap_schema = rfc2307bis
>> ldap_search_base = dc=org,dc=aalto,dc=fi
>> ldap_user_object_class = person
>> ldap_user_home_directory = unixHomeDirectory
>> ldap_user_principal = userPrincipalName
>> ldap_group_search_base = ou=Users,dc=org,dc=aalto,dc=fi
>> ldap_group_object_class = group
>>
>
> I'm almost certain your value for ldap_group_search_base is wrong. In
> fact, you probably don't need ldap_group_search_base at all. The
> ldap_search_base is enough here.
hah, I'm pretty sure I tried without that, but yep that did the trick :)
nexus6 sssd # groups tjaalton
tjaalton : Domain Users
though I'm 'memberOf' several other groups as well, but if they don't
have gidNumber set they won't be shown here, right?
--
Timo Aaltonen
Systems Specialist, Aalto IT
13 years, 3 months
Re: [SSSD] sssd and kerberos.
by Timo Aaltonen
On Thu, 5 Aug 2010, Stephen Gallagher wrote:
> Someone else just reported this same issue to me :(
>
> Can you attach the /var/log/sssd/sssd_<domain>.log and
> /var/log/sssd/ldap_child.log for this?
>
> I suspect you'll see the ldap_child.log report that it couldn't find a
> KDC for the realm.
I can now enumerate the user, but auth fails because of this:
/var/log/sssd/krb5_child.log:
(Tue Aug 10 16:54:10 2010) [[sssd[krb5_child[13472]]]] [get_and_save_tgt]
(1): 524: [-1765328230][Cannot find KDC for requested realm]
(Tue Aug 10 16:54:10 2010) [[sssd[krb5_child[13472]]]] [tgt_req_child]
(1): 756: [-1765328230][Cannot find KDC for requested realm]
also, I don't know what to use for searching the group information :) So
it cannot find the name for the default group. I checked from AD that the
values below should be correct.
[domain/aalto]
description = LDAP domain with AD server
min_id = 1000
id_provider = ldap
auth_provider = krb5
krb5_kdcip = 130.233.251.4
krb5_realm = ORG.AALTO.FI
ldap_sasl_mech = gssapi
# meh
ldap_sasl_authid = NEXUS6$(a)ORG.AALTO.FI
ldap_uri = ldap://dc01.org.aalto.fi
ldap_force_upper_case_realm = True
ldap_schema = rfc2307bis
ldap_search_base = dc=org,dc=aalto,dc=fi
ldap_user_object_class = person
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_group_search_base = ou=Users,dc=org,dc=aalto,dc=fi
ldap_group_object_class = group
--
Timo Aaltonen
Systems Specialist, Aalto IT
13 years, 3 months
Re: [SSSD] sssd and kerberos.
by Timo Aaltonen
On Fri, 6 Aug 2010, Patrik Martinsson wrote:
> Ah, yes i do use kerberized NFS, and i also want to use sasl gssapi to
> authenticate the sssd.
>
> My understanding was that i needed upn=nfs/* to get nfsv4 krb, however
> with your patch (i applied it on nfs-utils-1.2.2-4.el6.x86_64) i dont
> need upn=nfs/* anymore as you say. Although i do need upn=host/*, but
> maybe that's how it supporse to be ? My knowledge to kerberos and AD is
> very limited unfortunately so when discussing this I'm on very thin ice.
No, with the patch you don't need to use 'upn=...' at all, gssd would then
use the default HOST$ principalname.
though the problem with sssd remains. Maybe I should begin using
'upn=host/..' too..
> Now with that nfs-utils-patch applied, and sssd 1.3 i got both sssd and
> nfsv4 working with upn=host/*.
>
> > Maybe a similar approach could be used with sssd, so there would be no
> > need to specify the authid (which is different for every hostname)?
>
> I think it do use that approach, however it gives you the possibility to
> change your authid if want to, that's
> how i understand anyways.
>
> Again, maybe this is not the correct mailinglist for this discussion.
>
> Btw,. if your patch is correct why isn't it accepted upstreams ?
It's making an already complicated function more unreadable, so it needs
to be cleaned up first and then add a revised patch on top.
--
Timo Aaltonen
Systems Specialist, Aalto IT
13 years, 3 months
sssd and weak crypto
by Marcus Moeller
Hi all,
does sssd support an option like:
allow_weak_crypto = true
As I am getting an error:
(Mon Aug 9 17:06:21 2010) [[sssd[ldap_child[4085]]]]
[ldap_child_get_tgt_sync] (0): Failed to init credentials: KDC has no
support for encryption type
while trying to connect with DES/CDC against an Windows 2003 server.
This option has been set in krb5.conf and manual kinit works fine.
--
Greets
Marcus
13 years, 3 months
Recommended settings.
by Patrik Martinsson
Hello again,
I was wondering about "recommending" settings about sssd. We have an AD
with around 1500 users.
Before sssd was introduced we used nss/ldap to query user-data from AD.
However i figured it would be nice to get sssd working and started to
configure that instead, got it working mostly as i want (posted some
issuers earlier on the mailing-list).
Question though,
With earlier setup it was possible to do, 'getent passwd' and get a list
of all users, right. With the new setup, i only get the users in the
passwd file when doing 'getent passwd', however if i do 'getent passwd
username', i get the info i want. Then i tried with the setting,
enumerate=true for current domain, and that seemed to fix the getent
problem as it would return all the users, however that really of slow,
having sssd running in debug-mode it produces thousands of lines with,
(Fri Aug 6 11:00:34 2010) [sssd[be[SMHI]]] [ldb] (9): tevent: Added
timed event "ltdb_timeout": 0x4257310
(Fri Aug 6 11:00:34 2010) [sssd[be[SMHI]]] [ldb] (9): tevent:
Destroying timer event 0x2ac70f0 "ltdb_timeout"
(Fri Aug 6 11:00:34 2010) [sssd[be[SMHI]]] [ldb] (9): tevent: Ending
timer event 0x425c200 "ltdb_callback"
Then it finishes kind of, then after a couple of minutes its doing the
same thing again.
So basically, what I'm wondering is, cant i have getent passwd returning
all my users without having enumerate = true in the config ?
Here's my config,
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = foo
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3
[pam]
reconnection_retries = 3
[domain/foo]
description = LDAP domain with AD server
enumerate = true/false
min_id = 0
id_provider = ldap
auth_provider = krb5
krb5_kdcip = 123
krb5_realm = foo
krb5_changepw_principle = kadmin/changepw
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
krb5_auth_timeout = 15
krb5_keytab = /etc/krb5.keytab
krb5_validate = true
ldap_sasl_mech = gssapi
ldap_krb5_keytab = /etc/krb5.keytab
ldap_uri = ldap://foo
ldap_schema = rfc2307bis
ldap_search_base = DC=xx,DC=xxxx,DC=xx
ldap_user_search_scope = sub
ldap_user_search_base = ou=People,dc=xx,dc=xxxx,dc=xx
ldap_group_search_base = ou=Groups,dc=xx,dc=smhi,dc=xx
ldap_user_object_class = person
ldap_user_name = cn
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = msSFUHomeDirectory
ldap_user_shell = loginShell
ldap_user_principal = userPrincipalName
ldap_user_gecos = mail
ldap_group_object_class = Group
ldap_group_name = cn
ldap_group_gid_number = msSFU30GidNumber
ldap_force_upper_case_realm = True
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/openldap/cacerts/CADOUBLE.cer
ldap_tls_cacertdir = /etc/openldap/cacerts
Best regards,
Patrik Martinsson, Sweden.
13 years, 4 months
getent passwd works with LDAP but *not* getent group
by Cochran, Wayne Owen
Hi all.
Just installed Fedora and I am trying to setup authentication
with our LDAP server. I followed the convenient authentication
installation instructions (I am using TLS / no SASL). Unfortunately authentication
was not working, so I decided to see if get first get nsswitch going and found
about your sssd daemon. Any way here are the pertinent lines from from nsswitch.conf
passwd: files sss
shadow: files sss
group: files sss
The command
getent passwd cochran
did not work until I tweaked the sssd.conf file (sort of guessing here);
Here are the tweeks
domains = LDAP
#domains = LOCAL,LDAP
[domain/LDAP]
id_provider = ldap
auth_provider = ldap
ldap_uri = ldap://encs-nexus.vancouver.wsu.edu
ldap_user_search_base = dc=encs,dc=vancouver,dc=wsu,dc=edu
ldap_tls_reqcert = demand
cache_credentials = true
enumerate = true
Now the following works (it gets the correct info from LDAP):
getent passwd cochran
cochran:*:10001:10099::/home/cochran:/bin/bash
but alas the command
getent group faculty
does *not* work
Running sssd in debug mode
usr/sbin/sssd -i -d 5
reveals the following
(Thu Aug 5 09:41:49 2010) [sssd[nss]] [accept_fd_handler] (4): Client connected!
(Thu Aug 5 09:41:49 2010) [sssd[nss]] [sss_cmd_get_version] (5): Received client version [1].
(Thu Aug 5 09:41:49 2010) [sssd[nss]] [sss_cmd_get_version] (5): Offered version [1].
(Thu Aug 5 09:41:49 2010) [sssd[nss]] [nss_cmd_getgrnam] (4): Requesting info for [faculty] from [<ALL>]
(Thu Aug 5 09:41:49 2010) [sssd[nss]] [nss_cmd_getgrnam] (4): Requesting info for [faculty@LDAP]
(Thu Aug 5 09:41:49 2010) [sssd[nss]] [sss_dp_send_acct_req_create] (4): Sending request for [LDAP][4098][1][name=faculty]
(Thu Aug 5 09:41:49 2010) [sssd[be[LDAP]]] [be_get_account_info] (4): Got request for [4098][1][name=faculty]
(Thu Aug 5 09:41:49 2010) [sssd[be[LDAP]]] [groups_get_delete] (2): Group (faculty) delete returned 2 (No such file or directory)
(Thu Aug 5 09:41:49 2010) [sssd[be[LDAP]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success
(Thu Aug 5 09:41:49 2010) [sssd[nss]] [sss_dp_get_reply] (4): Got reply (0, 0, Success) from Data Provider
(Thu Aug 5 09:41:49 2010) [sssd[nss]] [nss_cmd_getgrnam_callback] (2): No matching domain found for [faculty], fail!
(Thu Aug 5 09:41:49 2010) [sssd[nss]] [nss_cmd_getgrnam_callback] (2): No results for getgrnam call
(Thu Aug 5 09:41:49 2010) [sssd[nss]] [client_recv] (5): Client disconnected!
I have not clue what to change now.
Any help would be greatly appreciated.
I am not a hard core sysadmin (budget cuts have me setting this up myself).
--w
Wayne O. Cochran
Assistant Professor Computer Science
wcochran(a)vancouver.wsu.edu
13 years, 4 months
Re: [SSSD] sssd and kerberos.
by Timo Aaltonen
On Thu, 5 Aug 2010, Patrik Martinsson wrote:
> Hey,
>
> I got this working today with these settings,
>
> ldap_uri = ldap://foo.bar
> ldap_sasl_mech = gssapi
> ldap_krb5_keytab = /etc/krb5.keytab
> ldap_sasl_authid = nfs/xx.xxxx.xx
....
<snip>
Looks like you need kerberized NFS? See this patch that I made for
nfs-utils:
http://users.tkk.fi/~tjaalton/0001-Check-for-AD-style-machine-principal-n...
still not accepted upstream, but I'm hoping for the best. With this you
don't need to add "nfs/*" UPN:s, gssd will initialize and use HOSTNAME$
just fine.
Maybe a similar approach could be used with sssd, so there would be no
need to specify the authid (which is different for every hostname)?
ps. still fighting with the installation.. so can't test the above and
post logs just yet. Tomorrow, I promise :)
--
Timo Aaltonen
Systems Specialist, Aalto IT
13 years, 4 months
Re: [SSSD] sssd and kerberos.
by Timo Aaltonen
On Wed, 4 Aug 2010, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 08/04/2010 10:18 AM, Timo Aaltonen wrote:
>> On Mon, 2 Aug 2010, Patrik Martinsson wrote:
>>
>>> ldap_tls_reqcert = demand
>>> ldap_tls_cacert = /etc/openldap/cacerts/CADOUBLE.cer
>>> ldap_tls_cacertdir = /etc/openldap/cacerts
>>
>> I guess this doesn't work with GSSAPI SASL binding yet? Tried to force the
>> authid to FOO$@REALM, but it fails just the same.
>>
>> it's harder to automatically generate certificates for the clients, that's
>> why I'm interested in getting this working :)
>>
>>
>
>
> I'm not sure what you're asking for here.
>
> I think what you're talking about is using:
> ldap_sasl_mech = gssapi
> ldap_krb5_keytab = /path/to/ldap.keytab
I did that, but it doesn't seem to work, or somethings missing still. It
said something like "marking ldap server foo as broken" (sorry no logs,
reinstalling the machine).
--
Timo Aaltonen
Systems Specialist, Aalto IT
13 years, 4 months
Re: [SSSD] sssd and kerberos.
by Timo Aaltonen
On Mon, 2 Aug 2010, Patrik Martinsson wrote:
> ldap_tls_reqcert = demand
> ldap_tls_cacert = /etc/openldap/cacerts/CADOUBLE.cer
> ldap_tls_cacertdir = /etc/openldap/cacerts
I guess this doesn't work with GSSAPI SASL binding yet? Tried to force the
authid to FOO$@REALM, but it fails just the same.
it's harder to automatically generate certificates for the clients, that's
why I'm interested in getting this working :)
--
Timo Aaltonen
Systems Specialist, Aalto IT
13 years, 4 months
Announcing the release of SSSD 1.3.0
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The SSSD team is proud to announce the enhancement release 1.3.0 of the
System Security Services Daemon. As usual, it can be downloaded from
https://fedorahosted.org/sssd/
== Highlights ==
* Rewrote the internal LDB cache API. As a synchronous API it is now
faster to access and easier to work with
* Eugene Indenbom contributed a sizeable amount of code to the LDAP
provider
* We now handle failover situations much more reliably than we did
previously
* If a request fails partway through (due to a remote server ceasing
to function) we will now restart the conversation with the next server
in the failover list
* We also will now monitor the GSSAPI kerberos ticket and
automatically renew it when appropriate, instead of waiting for a
connection to fail
* Support for netlink now allows us to more quickly detect situations
where we may have come online
* New option {{{dns_discovery_domain}}} allows better configuration for
using SRV records for failover
* Fixes to the HBAC backend for obsolete or removed HBAC entries
* Improvements to log messages around TLS and GSSAPI for LDAP
* Support for building in environments using --as-needed LDFLAGS
* Vast performance improvement for initgroups on RFC2307 LDAP servers
* Long-running SSSD clients (e.g. GDM) will now reconnect properly to
the daemon if SSSD is restarted
== Detailed Changelog ==
Alexander Gordeev (1):
* Add explicit requests for several operational attrs
David O'Brien (1):
* Copy-edit and format review sssd.conf
Dmitri Pal (16):
* Adding metadata interface
* Adding content to the metadata
* Resolve paths for reporting purposes
* Acess control and config change checks
* Add ability to trace 64bit numbers
* Fixing spec file to match version.
* Fixing build
* Code restructuring
* Extending refarray interface
* Introducing a comment object
* Adding support for explicit 32/64 types (attempt 2).
* Addressing initialization issues.
* Fixing types in queue and stack interfaces
* Fixing memory leaks in the unit test.
* Fixing NULL dereferencing in ini_config
* Memory leak in case of empty value
Héctor Daniel Cabrera (3):
* Updating ES translation
* Updating es translation
* Updating es translation
Jakub Hrozek (37):
* Treat server names as case-insensitive in failover code
* Do not mark a request as failed twice
* Sort SRV replies according to RFC 2782
* Remove freed server_common entities from list
* Support SRV servers in failover
* Silence warnings with -O2
* Fix uninitialized variable
* Add a README file
* Use all available servers in LDAP provider
* Improve the offline authentication message
* Fix memory hierarchy in the ipa timerules
* Use service discovery in backends
* SSSDConfigAPI fixes
* Try all servers during Kerberos auth
* Remove dead code from the PAM responder
* Man page fixes
* Don't return uninitialized value in proxy provider
* Skip empty attributes with warning
* Fix realm_str dereference
* Fix potential NULL dereference in fail_over.c
* Fix Incorrect NULL check in get_server_common()
* Add missing break to switch statement
* get_uid_from_pid should use fstat rather than lstat
* Remove krb5_changepw_principal option
* Remove the -g option from useradd
* Fix potential resource leak in copy_tree_ctx()
* Potential memory leak in _nss_sss_*_r()
* Check closedir call in find_uid
* Print correct return code
* Resend SIGINT as SIGTERM in services
* Add dns_discovery_domain option
* Use netlink to detect going online
* Fix getting default realm in the ldap child
* Validate keytab at startup
* Fix two problems with --as-needed
* Fix check_time_rule() return value on failure
* Return proper error value when SRV lookup fails
Petter Reinholdtsen (2):
* Allow Debian/Ubuntu build to pass --install-layout=deb to setup.py
* Remove bash-isms from configure macros
Piotr Drąg (2):
* Update Polish translation
* Updating pl translation
Rui Gouveia (2):
* Updating pt translation
* Update pt translation
Simo Sorce (45):
* sysdb: start conversion from async to sync
* sysdb: use sysdb_delete_entry in recursive delete
* sysdb: convert sysdb_delete_custom
* sysdb: convert sysdb_search_entry and sysdb_delete_recursive
* sysdb: convert sysdb_search_user_by_name/uid
* sysdb: convert sysdb_search_group_by_name/gid
* sysdb: convert sysdb_set_entry/user/group_attr
* sysdb: convert sysdb_get_new_id
* sysdb: convert sysdb_store/add(_basic)_user
* sysdb: convert sysdb_store/add(_basic)_group
* sysdb: convert sysdb_mod/add/remove_group_member
* sysdb: convert sysdb_cache_password
* sysdb: convert sysdb_search_custom
* sysdb: convert sysdb_store_custom
* sysdb: convert sysdb_asq_search
* sysdb remove sldb_request_send, not used anymore
* sysdb: convert sysdb_search_users
* sysdb: convert sysdb_delete_user
* sysdb: delete sysdb_delete_group
* sysdb: convert sysdb_search_groups
* sysdb: convert sysdb_cache_auth
* sysdb: remove sysdb_check_handle
* tests: remove use of asynchronus transactions
* sysdb: add synchronous transaction functions
* proxy: complete conversion to synchronous sysdb
* Use the sysdb synchronous transaction functions
* Remove remaining use of sysdb_transaction_send
* sysdb: remove async transactions
* sysdb: add automatic transactions where needed
* sysdb: convert sysdb_getpwnam
* sysdb: convert sysdb_getpwuid
* sysdb: convert sysdb_getgrnam
* sysdb: convert sysdb_getgrgid
* sysdb: convert sysdb_get_user_attr
* sysdb: convert sysdb_enumpwent
* sysdb: convert sysdb_enumgrent
* Adjust fill_pwent and fill_grent
* sysdb: convert sysdb_initgroups
* sysdb: remove obsolete helpers from sysdb
* sysdb: remove remaining traces of sysdb_handle
* sysydb: Finally stop using a common event context
* Make groupshow synchronous.
* tools: remove creation of event_context
* Better handle sdap_handle memory from callers.
* Avoid freeing sdap_handle too early
Stephen Gallagher (81):
* Support docdir and abs_builddir
* sysdb: convert sysdb_delete_entry
* Bumping version on master to 1.2.90
* Update translations for master branch
* Fix merge error for sss_userdel.c
* Remove unused configure macro
* Fix warning in sysdb-tests.c
* Fix ini_config unit test
* Give information about ldap_schema in the sample config
* Make ID provider init functions clearer
* Remove the NSS_LIBS and KRB5_LIBS variables from sssd.spec
* Add dns_resolver_timeout option
* Fix segfault in GSSAPI reconnect code
* Make krb5_kpasswd available for any krb5 provider
* Clean up kdcinfo and kpasswdinfo files when exiting
* Add callback when the ID provider switches from offline to online
* Add dynamic DNS updates to FreeIPA
* Revert "Add dynamic DNS updates to FreeIPA"
* Properly set up SIGCHLD handlers
* Add dynamic DNS updates to FreeIPA
* Don't report a fatal error for an HBAC denial
* Add a better error message for TLS failures
* Add enumerate details to the manpage and examples
* Revert "Copy pam data from DBus message"
* Display name of PAM action in pam_print_data()
* Make data provider id_callback public
* Fix error reporting for be_pam_handler
* Proxy provider PAM handling in child process
* Support password changes in chpass_provider = proxy
* Add ldap_access_filter option
* Fix typo in Makefile
* Fix broken build against older versions of OpenLDAP
* Fix typo in Makefile.am
* Disable connection callbacks when going online
* Change default min_id to 1
* Allow ldap_access_filter values wrapped in parentheses
* Properly handle read() and write() throughout the SSSD
* Fix misuse of errno in find_uid.c
* Avoid potential NULL dereference
* Properly handle missing originalMemberOf entry in initgroups
* Don't leak directory access resources on errors in directory_list()
* Check the correct variable for NULL after creating timer
* Properly check that the timeout event was created for cleanup/enum
* Check return code of hash_delete in proxy_child_destructor
* Eliminate unused variable from pc_init_timeout()
* Make sure to close varargs before returning from a function
* Properly null-terminate socket path
* Add ldap_force_upper_case_realm to example AD config
* Don't segfault if ldap_access_filter is unspecified
* Handle (ignore) unknown options in get_domain() and get_service()
* Remove references to the DP service from the SSSDConfig API tests
* Standardize on correct spelling of "principal" for krb5
* Initialize len before looping to read the pidfile
* Ensure that all domains are checked for users/groups
* Refactor the negative cache
* Move setup of filter_users and filter_groups to negcache.c
* Honor filter_users in PAM
* Fix potential resource leak in remove_tree_with_ctx()
* Fix return value from remove_connection_callback() destructor
* Protect against segfault in remove_ldap_connection_callbacks
* Drop release requirement from versions
* Bump libini_config version to 0.6.0
* Replace %define with %global in example spec
* Make RootDSE optional
* Rename proxy_ctx to proxy_id_ctx for clarity
* Split proxy.c into smaller files
* Add try_inotify option
* Release SSSD 1.2.91 (1.3.0rc1)
* Add sss_log() function
* Add log notifications for startup and shutdown.
* Add syslog messages for LDAP GSSAPI bind
* Log TLS errors to syslog
* Require -ltalloc for tevent configure check
* be_pam_handler(): Fix potential NULL dereference
* Add sysdb_attrs_to_list() utility function
* Add diff_string_lists utility function
* Add sysdb_group_dn_name utility function
* Add dup_string_list() utility function
* Add sysdb_update_members function
* Clean up initgroups processing for RFC2307
* Releasing SSSD 1.3.0
Sumit Bose (52):
* Revert "Add better checks on PAM socket"
* Use SO_PEERCRED on the PAM socket
* Set LDAP_OPT_RESTART for all LDAP connections
* Fix a potential memory violation
* Make the handling of fd events opaque
* Unset authentication tokens if password change fails
* Display a message if a password reset by root fails
* Fix wrong return value
* Fix a wrong return value in IPA HBAC
* Split pam_data utilities into a separate file
* Create kdcinfo and kpasswdinfo file at startup
* Compare the full service name
* Add retry option to pam_sss
* Add more warnings about nearly expired passwords
* Make Kerberos authentication a tevent_req
* New version of IPA auth and password migration
* Add ldap_krb5_ticket_lifetime option
* Defer sbus_dispatch() for 30ms during reconnect
* Copy pam data from DBus message
* Do not modify IPA_DOMAIN when setting Kerberos realm
* Handle Krb5 password expiration warning
* Add support for delayed kinit if offline
* Fix handling of ccache file when going offline
* Move parse_args() to util
* Copy pam data from DBus message
* Revert "Create kdcinfo and kpasswdinfo file at startup"
* Refactor data provider callbacks
* Add offline callbacks
* Refactor krb5_finalize()
* Add run_callbacks flag
* Add callback to remove krb5 info files when going offline
* Krb5 locator plugin returns KRB5_PLUGIN_NO_HANDLE
* Refactor krb5 SIGTERM handler installation
* Add krb5 SIGTERM handler to ipa auth provider
* Add offline callback to disconnect global SDAP handle
* Reset run_online_cb flag even if there are no callbacks
* Fix check if LDAP id provider is already initialized
* Remove signal event if child was terminated by a signal
* Check ipaEnabledFlag
* Add sysdb_attrs_get_string_array()
* Use sysdb_attrs_get_string_array() instead of sysdb_attrs_get_el()
* Use new schema for HBAC service checks
* Remove service groups
* Compare full service name
* Unify sdap and sysdb data handling
* Initialize pam_data in Kerberos child.
* Avoid a potential double-free
* Add a missing initializer
* Add a missing free()
* Fix SASL authentication
* Do not treat missing HBAC rules as an error
* Allow sssd clients to reconnect
Yuri Chornoivan (2):
* Update Ukrainian translation
* Updating uk translation
eindenbom (15):
* Avoid accessing half-deallocated memory when using talloc_zfree macro.
* GSSAPI ticket expiry time is returned from ldap_child and stored in
sdap_handle for future reference.
* Added an interface to query number of configured (and currently
resolved through SRV records) failover servers.
* LDAP connection usage tracking, sharing and failover retry framework.
* Add an interface to try next fail-over server after connection to the
active server was unexpectedly dropped.
* Use new LDAP connection framework to get user account info from LDAP.
* Use new LDAP connection framework to get group account info from LDAP.
* Use new LDAP connection framework to get user account groups from LDAP.
* Use new LDAP connection framework for LDAP user and group enumeration.
* Use new LDAP connection framework in LDAP access backend.
* Use new LDAP connection framework in IPA access backend.
* Use new LDAP connection framework in IPA dynamic DNS forwarder.
* Remove remainder of now unused global LDAP connection handle.
* Eliminate delayed sdap_handle destruction after fail-over retry.
* Fix IPA access backend handling of obsolete and missing HBAC entries:
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkxYn3IACgkQeiVVYja6o6Pb5QCdHT2pmTYiBQteyPH/GBeRmNOz
mOcAn2myMyD1uMm4bMSvhv5h9aLPdplB
=FNJA
-----END PGP SIGNATURE-----
13 years, 4 months