[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal
Please see the attached patches. I tried to split the patches logically
into manageable sets.
Unfortunately I made a minor mistake and I am afraid I will do something
wrong to fix it.
I merged two wrong patches. Fortunately it was three liner with 1 liner
so it is not a big of the deal but I am really scared that I will do
something wrong and loose the work I have done.
So I hope it is Ok to send it as is.
0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted
earlier that I merged by mistake. I was supposed to merge it with patch
25 but picked the wrong one instead.
Patch 25 addresses the real issue found by Coverity as mentioned in
Stephen's review mail but it did not apply cleanly since it relies on
some code from the patches in the middle.
0002--INI-Adding-missing-function-declararion.patch <- this is the
patch that was rejected from the second set sent earlier. Fixed
according to review comment.
0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing
per component
The following set of patches introduces the merging of sections during
the reading of the file:
0004--INI-New-error-codes-and-messages.patch
0005--INI-New-merge-flags.patch
0006--INI-Add-new-vars-to-parse-structure.patch
0007--INI-Add-save_error-function.patch
0008--INI-Change-parse_error-to-use-save_error.patch
0009--INI-Preparing-for-merging-sections.patch
0010--INI-Enhance-value-processing.patch
0011--INI-Use-section-line-number.patch
0012--INI-Refactor-section-processing.patch
0013--INI-Return-error-in-DETECT-mode.patch
0014--INI-New-test-files-for-section-merge.patch
0015--INI-Test-DETECT-mode-and-use-new-file.patch
0016--INI-Test-for-all-section-merge-modes.patch
Patches related porting of the meta data from old way of doing things to
the new way of doing things:
0017--INI-Separate-close-and-destroy.patch
0018--INI-Function-to-reopen-file.patch
0019--INI-Metadata-collection-is-gone.patch
0020--INI-Check-access-function.patch
0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check)
0022--INI-Function-to-check-for-changes.patch
0023--INI-Tests-for-access-and-changes.patch
0024--INI-Rename-error-print-function.patch <- rename error printing
function for consistency with new interface
0025--INI-Initialize-variables-in-loops.patch <- Coverity issue
addressed. Related to patch 0001.
0026--INI-Exposing-functions.patch <- Make some internal functions reusable
There is also patch 27. It is a piece of new functionality. It is a
preview. Please see the comment before reviewing it.
Do I need to split it into multiple patches or it is Ok as is? It is
pretty big but all changes are in one file and logically related.
The UNIT test is missing so I am not claiming it actually works as
expected.
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
11 years, 8 months
[PATCHES] Various ding-lib fixes
by Sumit Bose
Hi,
this series of patches fixes some issues in ding-libs. Patch 0003 should
fix Coverity issues 10035-10040 and 0004 and 0005 the remaining open
issues.
bye,
Sumit
12 years, 8 months
[PATCHES] Performance improvements for the LDAP cleanup task
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Patch 0001: I discovered that the cleanup task was not contained in a
transaction, so if there were multiple expired entries, it would take a
long time (and perform many disc writes) to remove them.
Patch 0002: While investigating the above, I also realized that the
dataExpireTimestamp attribute (which we use as the primary search
expression for expired entries) wasn't listed as an indexed attribute.
This means that searches over a large sysdb database (e.g. one with
enumerate = true) was significantly slower than it should be. This patch
adds dataExpireTimestamp as an indexed attribute.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1CuooACgkQeiVVYja6o6O3IgCfaJyKVwabr7mYZjt5tHH+bx/i
zroAoKptTdlTpYtQu4EZYUjWsQcn4ay9
=LRic
-----END PGP SIGNATURE-----
12 years, 10 months
Config problem or bug(?) with sssd and Windows AD 2008
by Patrick Grieshaber
Hello folks,
first let me say that the sssd project is great and I am lucky that this
project is available for CentOS/Redhat through the EPEL repo :-).
I've installed version sssd-1.2.1-27.el5.x86_64 and I want to be able to
fetch user infos plus enable login through AD 2008 - but I fail..
sssd.conf:
[domain/example.com]
enumerate = false
id_provider = ldap
chpass_provider = krb5
ldap_uri = ldap://dc1.example.com, ldap://dc2.example.com
ldap_search_base = dc=example,dc=com
tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
ldap_tls_cacertdir = /etc/pki/tls/certs
ldap_default_bind_dn = CN=serviceuser,DC=example,DC=com
ldap_default_authtok_type = password
ldap_default_authtok = serviceuserpassword
ldap_user_name = sAMAccountName
ldap_search_base = OU=IT,DC=example,DC=com
ldap_pwd_policy = none
ldap_user_object_class = person
ldap_schema = rfc2307bis
ldap_user_principal = userPrincipalName
ldap_user_uid_number = sAMAccountName
ldap_user_gid_number = sAMAccountName
ldap_user_uuid = sAMAccountName
ldap_user_fullname = displayName
# kerberos config
auth_provider = krb5
krb5_kdcip = dc1.example.com
krb5_realm = EXAMPLE.COM
krb5_changepw_principle = kadmin/changepw
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
krb5_auth_timeout = 15
For debugging reasons I run: sssd -d9
Here the output if I attempt: su - myuser(a)example.com
...snip...
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_generic_send]
(6): calling ldap_search_ext with
[(&(sAMAccountName=myuser)(objectclass=person))][OU=IT,DC=example,DC=com].
...snip...
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result]
(8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0]
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result]
(8): Trace: ldap_result found nothing!
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result]
(8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0]
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_parse_entry] (9):
OriginalDN: [CN=my,OU=IT,DC=example,DC=com].
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result]
(8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0]
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_generic_done]
(6): Search result: Success(0),
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_users_process]
(6): Search for users, returned 1 results.
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result]
(8): Trace: sh[0x8f876c0], connected[1], ops[(nil)], ldap[0x8f876f0]
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result]
(8): Trace: ldap_result found nothing!
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [ldb] (9): start ldb
transaction (nesting: 0)
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_user_send]
(9): Save user
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_user_send]
(1): no uid provided for [myuser] in domain [example.com].
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_users_process]
(2): Failed to store user 0. Ignoring.
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [ldb] (9): commit ldb
transaction (nesting: 0)
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_users_done]
(9): Saving 1 Users - Done
(Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [acctinfo_callback] (4):
Request processed. Returned 0,0,Success
And su outputs: su: user myuser(a)example.com does not exist
What is wrong? I do the mapping of a uid/gid... any help is appreciated!
Thank you,
pat
--
Patrick Grieshaber
Mobile: +41 (0)79 215 63 79
Xing: xing.com/profile/Patrick_Grieshaber
Skype: patrickgrieshaber
GPG Key Fingerprint
0252 0C05 410E C345
1AC7 7530 98ED B18E
62CB CF04
12 years, 10 months
[PATCH]Sanitize search filters for nested group lookups
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Marcus discovered while doing some AD testing that we were throwing
errors dealing with nested groups where the group name has parentheses
in it. It turned out that I missed two places where we needed to
sanitize search filters.
Attached patch fixes https://fedorahosted.org/sssd/ticket/785
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1G+bMACgkQeiVVYja6o6NYOgCdFpDIFZuDM9SHYL5bVPZwGMrJ
kDEAn1H0wp1pAV7CW+mqup4hDOgAFPZp
=CsJY
-----END PGP SIGNATURE-----
12 years, 10 months
[PATCH] Fix handling of translated man pages in spec file
by Sumit Bose
Hi,
this patch fixes a minor issue with the example spec file. Another way
to fix the issue is to put po4a into the BuildRequires of the spec file,
but we prefer not to do this in the example spec file, because there are
platforms where po4a is not available.
bye,
Sumit
12 years, 10 months
[PATCH] Remove LDAP_DEPRECATED
by Sumit Bose
Hi,
by change I found out that we still set LDAP_DEPRECATED in sdap.c .
IIRC this came from a time where we tried to support OpenLDAP and
MozLDAP client libraries. Luckily we do not use any deprecated calls
from the OpenLDAP client libraries and I think we should not start to
use any of them in the future. So this patch will remove it.
bye,
Sumit
12 years, 10 months
Re: [SSSD] SOLVED: Problem with authentication via KDE
by Andy Kannberg
OK...Problem is solved ! It works !!
I've switched to KDE as displaymanager and as desktop(as I figured it didn't
make sense to run GDM as displaymanager and KDE as desktop) and rebooted the
system. At first, when I tried to login, it didn't work, as sssd daemon
didn't run. After restarting it, it worked !
cheers and thanks a lot for helping me through the PAM-swamp !
Andy
2011/1/28 Stephen Gallagher <sgallagh(a)redhat.com>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 01/28/2011 09:23 AM, Andy Kannberg wrote:
> > Hi Stephen,
> >
> > errors are getting fewer, but still the same problem:
> >
> > Jan 28 15:09:45 hpdw0001 gdm[3744]: pam_unix(gdm:auth): check pass; user
> > unknown
> > Jan 28 15:09:45 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication
> > failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=
> > Jan 28 15:09:45 hpdw0001 gdm[3744]: pam_succeed_if(gdm:auth): error
> > retrieving information about user nxp21358
> >
> >
> > system-auth now looks like :
> >
> > #%PAM-1.0
> > # This file is auto-generated.
> > # User changes will be destroyed the next time authconfig is run.
> > auth required pam_env.so
> > auth sufficient pam_unix.so likeauth nullok
> > auth requisite pam_succeed_if.so uid >= 500 quiet
> > auth sufficient pam_sss.so use_first_pass
> > auth required pam_deny.so
> >
> > account required pam_unix.so broken_shadow
> > account sufficient pam_localuser.so
> > account sufficient pam_succeed_if.so uid < 500 quiet
> > account [default=bad success=ok user_unknown=ignore] pam_sss.so
> > account required pam_permit.so
> > #account required pam_access.so
> > accessfile=/etc/security/access.netgroup.conf
> >
> > password requisite pam_cracklib.so try_first_pass retry=3
> > password sufficient pam_unix.so nullok use_authtok md5 shadow
> > password sufficient pam_sss.so use_authtok
> > password required pam_deny.so
> >
> > #session required pam_limits.so
> > session required pam_unix.so
> > session required pam_keyinit.so revoke
> > session optional pam_sss.so
> >
>
>
>
> Sorry, I didn't realize before that you were using gdm, not kdm. GDM
> also requires that you make the same changes you made to system-auth
> into password-auth. (It's a long story, but it has to do with GDM's
> parallel PAM stack solution to multiple authentication methods)
>
>
> - --
> Stephen Gallagher
> RHCE 804006346421761
>
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk1C3KcACgkQeiVVYja6o6PEygCeP06ucGluHktONkl0x/tDmge3
> ozAAn0/amqV84rSqla/if+iEYpA2AEVn
> =/Ccf
> -----END PGP SIGNATURE-----
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
>
12 years, 10 months
Problem with authentication via KDE
by Andy Kannberg
Hi,
I've got the SSSD packages from RHEL 5.6 installed on a RHEL 5.4 system.
SSSD works fine on the command line and when logging in via KDE. Also
logging on with cached credentials (when network is off) works like a charm,
on the command line.
When I want to login with cached credentials via KDE (network disabled.), it
goes wrong. KDE throws me a new login prompt, saying I used te wrong userid
or password.
When I check the /var/log/secure file, I see the following happens:
Jan 27 15:59:49 hpdw0001 su: pam_unix(su-l:session): session closed for user
root
Jan 27 16:00:01 hpdw0001 crond[21924]: pam_unix(crond:session): session
opened for user root by (uid=0)
Jan 27 16:00:01 hpdw0001 crond[21924]: pam_unix(crond:session): session
closed for user root
Jan 27 16:00:20 hpdw0001 gdm[3744]: pam_unix(gdm:session): session closed
for user nxp21358
Jan 27 16:00:20 hpdw0001 gdm[3744]: pam_console(gdm:session): getpwnam
failed for nxp21358
Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_unix(gdm:auth): check pass; user
unknown
Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication
failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=
Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_sss(gdm:auth): User info message:
Authenticated with cached credentials.
Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_sss(gdm:auth): authentication
success; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358
Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_succeed_if(gdm:account): error
retrieving information about user nxp21358
Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_unix(gdm:account): could not
identify user (from getpwnam(nxp21358))
Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_unix(gdm:auth): check pass; user
unknown
Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication
failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=
Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_sss(gdm:auth): User info message:
Authenticated with cached credentials.
Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_sss(gdm:auth): authentication
success; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358
Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_succeed_if(gdm:account): error
retrieving information about user nxp21358
Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_unix(gdm:account): could not
identify user (from getpwnam(nxp21358))
Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_unix(gdm:auth): check pass; user
unknown
Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication
failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=
Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_sss(gdm:auth): User info message:
Authenticated with cached credentials.
Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_sss(gdm:auth): authentication
success; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358
Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_succeed_if(gdm:account): error
retrieving information about user nxp21358
Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_unix(gdm:account): could not
identify user (from getpwnam(nxp21358))
Jan 27 16:01:01 hpdw0001 crond[21958]: pam_unix(crond:session): session
opened for user root by (uid=0)
Jan 27 16:01:11 hpdw0001 crond[21958]: pam_unix(crond:session): session
closed for user root
Jan 27 16:01:39 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication
failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358
Jan 27 16:01:39 hpdw0001 gdm[3744]: pam_sss(gdm:auth): authentication
success; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358
Jan 27 16:01:39 hpdw0001 gdm[3744]: pam_unix(gdm:session): session opened
for user nxp21358 by (uid=0)
Jan 27 16:01:50 hpdw0001 su: pam_unix(su-l:auth): authentication failure;
logname=nxp21358 uid=3396 euid=0 tty=pts/8 ruser=nxp21358 rhost= user=root
Jan 27 16:01:56 hpdw0001 su: pam_unix(su-l:session): session opened for user
root by nxp21358(uid=3396)
I'm not a PAM expert, but what I get from this, is that the pam_succeed
module triggers a fail because pam_unix cannot find the user. How can I
solve this ??
cheers,
Andy
12 years, 10 months