sssd-devel January 2011

sssd-devel@lists.fedorahosted.org

14 participants
57 discussions

[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal 06 Apr '12

06 Apr '12

Please see the attached patches. I tried to split the patches logically into manageable sets. Unfortunately I made a minor mistake and I am afraid I will do something wrong to fix it. I merged two wrong patches. Fortunately it was three liner with 1 liner so it is not a big of the deal but I am really scared that I will do something wrong and loose the work I have done. So I hope it is Ok to send it as is. 0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted earlier that I merged by mistake. I was supposed to merge it with patch 25 but picked the wrong one instead. Patch 25 addresses the real issue found by Coverity as mentioned in Stephen's review mail but it did not apply cleanly since it relies on some code from the patches in the middle. 0002--INI-Adding-missing-function-declararion.patch <- this is the patch that was rejected from the second set sent earlier. Fixed according to review comment. 0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing per component The following set of patches introduces the merging of sections during the reading of the file: 0004--INI-New-error-codes-and-messages.patch 0005--INI-New-merge-flags.patch 0006--INI-Add-new-vars-to-parse-structure.patch 0007--INI-Add-save_error-function.patch 0008--INI-Change-parse_error-to-use-save_error.patch 0009--INI-Preparing-for-merging-sections.patch 0010--INI-Enhance-value-processing.patch 0011--INI-Use-section-line-number.patch 0012--INI-Refactor-section-processing.patch 0013--INI-Return-error-in-DETECT-mode.patch 0014--INI-New-test-files-for-section-merge.patch 0015--INI-Test-DETECT-mode-and-use-new-file.patch 0016--INI-Test-for-all-section-merge-modes.patch Patches related porting of the meta data from old way of doing things to the new way of doing things: 0017--INI-Separate-close-and-destroy.patch 0018--INI-Function-to-reopen-file.patch 0019--INI-Metadata-collection-is-gone.patch 0020--INI-Check-access-function.patch 0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check) 0022--INI-Function-to-check-for-changes.patch 0023--INI-Tests-for-access-and-changes.patch 0024--INI-Rename-error-print-function.patch <- rename error printing function for consistency with new interface 0025--INI-Initialize-variables-in-loops.patch <- Coverity issue addressed. Related to patch 0001. 0026--INI-Exposing-functions.patch <- Make some internal functions reusable There is also patch 27. It is a piece of new functionality. It is a preview. Please see the comment before reviewing it. Do I need to split it into multiple patches or it is Ok as is? It is pretty big but all changes are in one file and logically related. The UNIT test is missing so I am not claiming it actually works as expected. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 30

[PATCHES] Various ding-lib fixes
by Sumit Bose 23 Mar '11

23 Mar '11

Hi, this series of patches fixes some issues in ding-libs. Patch 0003 should fix Coverity issues 10035-10040 and 0004 and 0005 the remaining open issues. bye, Sumit

3 6

[PATCHES] Performance improvements for the LDAP cleanup task
by Stephen Gallagher 03 Feb '11

03 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Patch 0001: I discovered that the cleanup task was not contained in a transaction, so if there were multiple expired entries, it would take a long time (and perform many disc writes) to remove them. Patch 0002: While investigating the above, I also realized that the dataExpireTimestamp attribute (which we use as the primary search expression for expired entries) wasn't listed as an indexed attribute. This means that searches over a large sysdb database (e.g. one with enumerate = true) was significantly slower than it should be. This patch adds dataExpireTimestamp as an indexed attribute. - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1CuooACgkQeiVVYja6o6O3IgCfaJyKVwabr7mYZjt5tHH+bx/i zroAoKptTdlTpYtQu4EZYUjWsQcn4ay9 =LRic -----END PGP SIGNATURE-----

2 4

Config problem or bug(?) with sssd and Windows AD 2008
by Patrick Grieshaber 02 Feb '11

02 Feb '11

Hello folks, first let me say that the sssd project is great and I am lucky that this project is available for CentOS/Redhat through the EPEL repo :-). I've installed version sssd-1.2.1-27.el5.x86_64 and I want to be able to fetch user infos plus enable login through AD 2008 - but I fail.. sssd.conf: [domain/example.com] enumerate = false id_provider = ldap chpass_provider = krb5 ldap_uri = ldap://dc1.example.com, ldap://dc2.example.com ldap_search_base = dc=example,dc=com tls_reqcert = demand ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt ldap_tls_cacertdir = /etc/pki/tls/certs ldap_default_bind_dn = CN=serviceuser,DC=example,DC=com ldap_default_authtok_type = password ldap_default_authtok = serviceuserpassword ldap_user_name = sAMAccountName ldap_search_base = OU=IT,DC=example,DC=com ldap_pwd_policy = none ldap_user_object_class = person ldap_schema = rfc2307bis ldap_user_principal = userPrincipalName ldap_user_uid_number = sAMAccountName ldap_user_gid_number = sAMAccountName ldap_user_uuid = sAMAccountName ldap_user_fullname = displayName # kerberos config auth_provider = krb5 krb5_kdcip = dc1.example.com krb5_realm = EXAMPLE.COM krb5_changepw_principle = kadmin/changepw krb5_ccachedir = /tmp krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX krb5_auth_timeout = 15 For debugging reasons I run: sssd -d9 Here the output if I attempt: su - myuser(a)example.com ...snip... (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(&(sAMAccountName=myuser)(objectclass=person))][OU=IT,DC=example,DC=com]. ...snip... (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_parse_entry] (9): OriginalDN: [CN=my,OU=IT,DC=example,DC=com]. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[0x8f87500], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_generic_done] (6): Search result: Success(0), (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_users_process] (6): Search for users, returned 1 results. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: sh[0x8f876c0], connected[1], ops[(nil)], ldap[0x8f876f0] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [ldb] (9): start ldb transaction (nesting: 0) (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_user_send] (9): Save user (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_user_send] (1): no uid provided for [myuser] in domain [example.com] (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_save_users_process] (2): Failed to store user 0. Ignoring. (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [ldb] (9): commit ldb transaction (nesting: 0) (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [sdap_get_users_done] (9): Saving 1 Users - Done (Tue Oct 5 09:16:45 2010) [sssd[be[example.com]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success And su outputs: su: user myuser(a)example.com does not exist What is wrong? I do the mapping of a uid/gid... any help is appreciated! Thank you, pat -- Patrick Grieshaber Mobile: +41 (0)79 215 63 79 Xing: xing.com/profile/Patrick_Grieshaber Skype: patrickgrieshaber GPG Key Fingerprint 0252 0C05 410E C345 1AC7 7530 98ED B18E 62CB CF04

4 11

[PATCH]Sanitize search filters for nested group lookups
by Stephen Gallagher 01 Feb '11

01 Feb '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Marcus discovered while doing some AD testing that we were throwing errors dealing with nested groups where the group name has parentheses in it. It turned out that I missed two places where we needed to sanitize search filters. Attached patch fixes https://fedorahosted.org/sssd/ticket/785 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk1G+bMACgkQeiVVYja6o6NYOgCdFpDIFZuDM9SHYL5bVPZwGMrJ kDEAn1H0wp1pAV7CW+mqup4hDOgAFPZp =CsJY -----END PGP SIGNATURE-----

2 2

[PATCH] Fix handling of translated man pages in spec file
by Sumit Bose 31 Jan '11

31 Jan '11

Hi, this patch fixes a minor issue with the example spec file. Another way to fix the issue is to put po4a into the BuildRequires of the spec file, but we prefer not to do this in the example spec file, because there are platforms where po4a is not available. bye, Sumit

2 2

[PATCH] Remove LDAP_DEPRECATED
by Sumit Bose 31 Jan '11

31 Jan '11

Hi, by change I found out that we still set LDAP_DEPRECATED in sdap.c . IIRC this came from a time where we tried to support OpenLDAP and MozLDAP client libraries. Luckily we do not use any deprecated calls from the OpenLDAP client libraries and I think we should not start to use any of them in the future. So this patch will remove it. bye, Sumit

2 2

[PATCH] Fixing traceback call messages for sss_obfuscate command.
by Gowrishankar Rajaiyan 31 Jan '11

31 Jan '11

Hi Traceback call messages were displayed while testing "sss_obfuscate" as a non-root user. Attached patch fixes this (https://bugzilla.redhat.com/show_bug.cgi?id=674141) -- regards /shanks

2 1

Re: [SSSD] SOLVED: Problem with authentication via KDE
by Andy Kannberg 28 Jan '11

28 Jan '11

OK...Problem is solved ! It works !! I've switched to KDE as displaymanager and as desktop(as I figured it didn't make sense to run GDM as displaymanager and KDE as desktop) and rebooted the system. At first, when I tried to login, it didn't work, as sssd daemon didn't run. After restarting it, it worked ! cheers and thanks a lot for helping me through the PAM-swamp ! Andy 2011/1/28 Stephen Gallagher <sgallagh(a)redhat.com> > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 01/28/2011 09:23 AM, Andy Kannberg wrote: > > Hi Stephen, > > > > errors are getting fewer, but still the same problem: > > > > Jan 28 15:09:45 hpdw0001 gdm[3744]: pam_unix(gdm:auth): check pass; user > > unknown > > Jan 28 15:09:45 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication > > failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= > > Jan 28 15:09:45 hpdw0001 gdm[3744]: pam_succeed_if(gdm:auth): error > > retrieving information about user nxp21358 > > > > > > system-auth now looks like : > > > > #%PAM-1.0 > > # This file is auto-generated. > > # User changes will be destroyed the next time authconfig is run. > > auth required pam_env.so > > auth sufficient pam_unix.so likeauth nullok > > auth requisite pam_succeed_if.so uid >= 500 quiet > > auth sufficient pam_sss.so use_first_pass > > auth required pam_deny.so > > > > account required pam_unix.so broken_shadow > > account sufficient pam_localuser.so > > account sufficient pam_succeed_if.so uid < 500 quiet > > account [default=bad success=ok user_unknown=ignore] pam_sss.so > > account required pam_permit.so > > #account required pam_access.so > > accessfile=/etc/security/access.netgroup.conf > > > > password requisite pam_cracklib.so try_first_pass retry=3 > > password sufficient pam_unix.so nullok use_authtok md5 shadow > > password sufficient pam_sss.so use_authtok > > password required pam_deny.so > > > > #session required pam_limits.so > > session required pam_unix.so > > session required pam_keyinit.so revoke > > session optional pam_sss.so > > > > > > Sorry, I didn't realize before that you were using gdm, not kdm. GDM > also requires that you make the same changes you made to system-auth > into password-auth. (It's a long story, but it has to do with GDM's > parallel PAM stack solution to multiple authentication methods) > > > - -- > Stephen Gallagher > RHCE 804006346421761 > > Delivering value year after year. > Red Hat ranks #1 in value among software vendors. > http://www.redhat.com/promo/vendor/ > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.11 (GNU/Linux) > Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ > > iEYEARECAAYFAk1C3KcACgkQeiVVYja6o6PEygCeP06ucGluHktONkl0x/tDmge3 > ozAAn0/amqV84rSqla/if+iEYpA2AEVn > =/Ccf > -----END PGP SIGNATURE----- > _______________________________________________ > sssd-devel mailing list > sssd-devel(a)lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/sssd-devel >

1 0

Problem with authentication via KDE
by Andy Kannberg 28 Jan '11

28 Jan '11

Hi, I've got the SSSD packages from RHEL 5.6 installed on a RHEL 5.4 system. SSSD works fine on the command line and when logging in via KDE. Also logging on with cached credentials (when network is off) works like a charm, on the command line. When I want to login with cached credentials via KDE (network disabled.), it goes wrong. KDE throws me a new login prompt, saying I used te wrong userid or password. When I check the /var/log/secure file, I see the following happens: Jan 27 15:59:49 hpdw0001 su: pam_unix(su-l:session): session closed for user root Jan 27 16:00:01 hpdw0001 crond[21924]: pam_unix(crond:session): session opened for user root by (uid=0) Jan 27 16:00:01 hpdw0001 crond[21924]: pam_unix(crond:session): session closed for user root Jan 27 16:00:20 hpdw0001 gdm[3744]: pam_unix(gdm:session): session closed for user nxp21358 Jan 27 16:00:20 hpdw0001 gdm[3744]: pam_console(gdm:session): getpwnam failed for nxp21358 Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_unix(gdm:auth): check pass; user unknown Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_sss(gdm:auth): User info message: Authenticated with cached credentials. Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_sss(gdm:auth): authentication success; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358 Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_succeed_if(gdm:account): error retrieving information about user nxp21358 Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_unix(gdm:account): could not identify user (from getpwnam(nxp21358)) Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_unix(gdm:auth): check pass; user unknown Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_sss(gdm:auth): User info message: Authenticated with cached credentials. Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_sss(gdm:auth): authentication success; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358 Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_succeed_if(gdm:account): error retrieving information about user nxp21358 Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_unix(gdm:account): could not identify user (from getpwnam(nxp21358)) Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_unix(gdm:auth): check pass; user unknown Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_sss(gdm:auth): User info message: Authenticated with cached credentials. Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_sss(gdm:auth): authentication success; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358 Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_succeed_if(gdm:account): error retrieving information about user nxp21358 Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_unix(gdm:account): could not identify user (from getpwnam(nxp21358)) Jan 27 16:01:01 hpdw0001 crond[21958]: pam_unix(crond:session): session opened for user root by (uid=0) Jan 27 16:01:11 hpdw0001 crond[21958]: pam_unix(crond:session): session closed for user root Jan 27 16:01:39 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358 Jan 27 16:01:39 hpdw0001 gdm[3744]: pam_sss(gdm:auth): authentication success; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358 Jan 27 16:01:39 hpdw0001 gdm[3744]: pam_unix(gdm:session): session opened for user nxp21358 by (uid=0) Jan 27 16:01:50 hpdw0001 su: pam_unix(su-l:auth): authentication failure; logname=nxp21358 uid=3396 euid=0 tty=pts/8 ruser=nxp21358 rhost= user=root Jan 27 16:01:56 hpdw0001 su: pam_unix(su-l:session): session opened for user root by nxp21358(uid=3396) I'm not a PAM expert, but what I get from this, is that the pam_succeed module triggers a fail because pam_unix cannot find the user. How can I solve this ?? cheers, Andy

2 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel January 2011