[PATCHES] Support for multiple LDAP search bases
by Stephen Gallagher
These patches add support for multiple search bases for users and groups
in both direct-lookup and enumeration modes.
Addresses https://fedorahosted.org/sssd/ticket/868
Some notes: There is no patch adding multiple search base support for
group lookups in RFC2307bis because it's meaningless right now. Since
the group memberships are direct DNs, we do all of our searches as base
searches, ignoring group_search_base. There is a separate ticket,
https://fedorahosted.org/sssd/ticket/960 that will need to address this,
taking advantage of the multiple search base features.
Also, while working through this, I opened
https://fedorahosted.org/sssd/ticket/1006 as I noticed that we are using
far too many separate transactions while processing RFC2307bis (which is
likely the cause of the extreme slowdown that some of our users were
reporting with AD).
These patches don't really work separately, but they've been broken up
to make review much easier.
Patch 0001: Remove some unused options in a struct
Patch 0002: Fix size return for split_on_separator()
It was returning the size of the array, rather than the number of
elements. (The array was NULL-terminated). This argument was only
used in one place that was actually working around this odd return
value.
Patch 0003: Make sdap_get_id_specific_filter() more strict
Just makes it take const char * instead of char *.
Patch 0004: Add parser for multiple search bases
As discussed on the list, this will the ldap_*_search_base options in
the form of:
search_base[?scope?[filter][?search_base?scope?[filter]]*]
This is backwards-compatible (just use a search base)
Patch 0005: Add support for multiple search bases for users
Patch 0006: Add support for multiple search bases for netgroups
Patch 0007: Add support for multiple search bases for RFC2307 groups
Patch 0008: Add support for multiple search bases for initgroups (user
portion)
Patch 0009: Add support for multiple search bases for initgroups
(RFC2307 group portion)
Patch 0010: Add support for multiple search bases for initgroups
(RFC2307 group portion)
This patch I'm not 100% sure of. It may need more processing. With
RFC2307, it was safe to have duplicate groups in the list, because only
the group name is important (and we guarantee that the name list has
only unique values before saving it). With RFC2307bis, I'm not sure if
it's safe to add two groups that may have the same name. Comments
welcome.
Patch 0011: Update manpages with multiple search base information
Patch 0012: Convert ldap_*_search_filter
Instead of making this a global option for all user lookups, make it
only used if the search base is passed without an explicit filter. The
idea here is to deprecate the old separate ldap_user_search_filter and
ldap_group_search_filter options in favor of the new representation
(which is closer to the traditional nss_ldap representation).
Patch 0013: Add support for multiple search bases for user enumeration
Patch 0014: Add support for multiple search bases for group enumeration
This changes our behavior slightly with regard to handling direct
lookups that return more than one entry. In the old code, we had a bug
that would cause SSSD to treat this as an enumeration (instead of a
direct lookup). This was a bug and has been fixed incidentally as part
of this modification.
12 years, 5 months
[PATCH] Two deref fixes
by Jakub Hrozek
Simo was studying the dereference code lately and found two issues. #1
is an important bug, #2 is more of a cosmetic issue.
[PATCH 1/2] Use LDAPDerefSpec properly
ldap_create_deref_control_value expects an array of LDAPDerefSpec structures
with LDAPDerefSpec.derefAttr == NULL as a sentinel. We were passing a
single instance of a LDAPDerefSpec structure.
https://fedorahosted.org/sssd/ticket/1050
[PATCH 2/2] Remove confusing do-while loop
The deref processing would return a single control back. The do-while
loop was harmless but confusing.
12 years, 5 months
Authentication against AD
by Thomas Jagt
Hi Stephen,
We are using sssd to authenticate against AD with using Kerberos and LDAP.
The idea is to filter users who are allowed to login based on a LDAP filter.
In the AD there are computer objects created with the same name as the hostname of the Linux client.
The filter must be something like is;
If the computer object is a member of the group where the user is memberOf then allow the user to login.
So what we want is to authenticate linux clients based on computer objects in the AD. (We are not using winbind)
When using the ldap_access_filter it's not possible to create a LDAP query neither with the ldap_group_search_filter.
Is it possible with sssd to meet our requirements?
The following ldapsearch gives the right output;
ldapsearch -h test.local -s sub -x -b ",ou=Groups,dc=test,dc=local" "(&(member=cn=`hostname`,cn=Computers,dc=test,dc=local))"
Thanx and Regards
Thomas Jagt
12 years, 5 months
sss_debuglevel doesn't work for LDAP logs?
by Mark London
Hi - Is the sss_debuglevel command supposed to work with the sssd_be
logs? I'm using LDAP, and while the command change the debugging level
for the PAM and NSS logs, it didn't change the debug level for the my
sssd_be LDAP log (or at least it couldn't change it from 0). I also
tried to specify a different configuration file, that had debugging
enabled in the LDAP section, and that didn't seem to work either.
Thanks. - Mark
12 years, 6 months