sssd-devel June 2011

sssd-devel@lists.fedorahosted.org

10 participants
33 discussions

[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal 05 Apr '12

05 Apr '12

Please see the attached patches. I tried to split the patches logically into manageable sets. Unfortunately I made a minor mistake and I am afraid I will do something wrong to fix it. I merged two wrong patches. Fortunately it was three liner with 1 liner so it is not a big of the deal but I am really scared that I will do something wrong and loose the work I have done. So I hope it is Ok to send it as is. 0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted earlier that I merged by mistake. I was supposed to merge it with patch 25 but picked the wrong one instead. Patch 25 addresses the real issue found by Coverity as mentioned in Stephen's review mail but it did not apply cleanly since it relies on some code from the patches in the middle. 0002--INI-Adding-missing-function-declararion.patch <- this is the patch that was rejected from the second set sent earlier. Fixed according to review comment. 0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing per component The following set of patches introduces the merging of sections during the reading of the file: 0004--INI-New-error-codes-and-messages.patch 0005--INI-New-merge-flags.patch 0006--INI-Add-new-vars-to-parse-structure.patch 0007--INI-Add-save_error-function.patch 0008--INI-Change-parse_error-to-use-save_error.patch 0009--INI-Preparing-for-merging-sections.patch 0010--INI-Enhance-value-processing.patch 0011--INI-Use-section-line-number.patch 0012--INI-Refactor-section-processing.patch 0013--INI-Return-error-in-DETECT-mode.patch 0014--INI-New-test-files-for-section-merge.patch 0015--INI-Test-DETECT-mode-and-use-new-file.patch 0016--INI-Test-for-all-section-merge-modes.patch Patches related porting of the meta data from old way of doing things to the new way of doing things: 0017--INI-Separate-close-and-destroy.patch 0018--INI-Function-to-reopen-file.patch 0019--INI-Metadata-collection-is-gone.patch 0020--INI-Check-access-function.patch 0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check) 0022--INI-Function-to-check-for-changes.patch 0023--INI-Tests-for-access-and-changes.patch 0024--INI-Rename-error-print-function.patch <- rename error printing function for consistency with new interface 0025--INI-Initialize-variables-in-loops.patch <- Coverity issue addressed. Related to patch 0001. 0026--INI-Exposing-functions.patch <- Make some internal functions reusable There is also patch 27. It is a piece of new functionality. It is a preview. Please see the comment before reviewing it. Do I need to split it into multiple patches or it is Ok as is? It is pretty big but all changes are in one file and logically related. The UNIT test is missing so I am not claiming it actually works as expected. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 30

[PATCH] Add support for ADS pwdLastSet
by Pierre Carrier 06 Sep '11

06 Sep '11

Documented on http://msdn.microsoft.com/en-us/library/cc220785(v=prot.10).aspx Introduced in nss_ldap 208: * add support for native Active Directory password policy attributes (enabled if shadowLastChange is mapped to pwdLastSet) --- src/config/SSSDConfig.py | 1 + src/config/etc/sssd.api.d/sssd-ldap.conf | 1 + src/man/sssd-ldap.5.xml | 15 ++++++++++ src/providers/ldap/ldap_auth.c | 9 +++++- src/providers/ldap/ldap_common.c | 43 ++++++++++++++++++++++++++++++ src/providers/ldap/ldap_common.h | 1 + src/providers/ldap/sdap.h | 1 + 7 files changed, 70 insertions(+), 1 deletions(-) diff --git a/src/config/SSSDConfig.py b/src/config/SSSDConfig.py index 5135174..992e1f4 100644 --- a/src/config/SSSDConfig.py +++ b/src/config/SSSDConfig.py @@ -167,6 +167,7 @@ option_strings = { 'ldap_user_modify_timestamp' : _('Modification time attribute'), #replaced by ldap_entry_usn# 'ldap_user_entry_usn' : _('entryUSN attribute'), 'ldap_user_shadow_last_change' : _('shadowLastChange attribute'), + 'ldap_user_ads_last_change' : _('pwdLastSet attribute'), 'ldap_user_shadow_min' : _('shadowMin attribute'), 'ldap_user_shadow_max' : _('shadowMax attribute'), 'ldap_user_shadow_warning' : _('shadowWarning attribute'), diff --git a/src/config/etc/sssd.api.d/sssd-ldap.conf b/src/config/etc/sssd.api.d/sssd-ldap.conf index 5fd0cfb..6700df9 100644 --- a/src/config/etc/sssd.api.d/sssd-ldap.conf +++ b/src/config/etc/sssd.api.d/sssd-ldap.conf @@ -51,6 +51,7 @@ ldap_user_member_of = str, None, false ldap_user_modify_timestamp = str, None, false ldap_user_entry_usn = str, None, false ldap_user_shadow_last_change = str, None, false +ldap_user_ads_last_change = str, None, false ldap_user_shadow_min = str, None, false ldap_user_shadow_max = str, None, false ldap_user_shadow_warning = str, None, false diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml index 2a39732..0db3ce7 100644 --- a/src/man/sssd-ldap.5.xml +++ b/src/man/sssd-ldap.5.xml @@ -313,6 +313,21 @@ </varlistentry> <varlistentry> + <term>ldap_user_ads_last_change (string)</term> + <listitem> + <para> + When using ldap_pwd_policy=shadow, this parameter + contains the name of an LDAP attribute corresponding + to pwdLastSet in Active Directory server, fell back to + when ldap_user_shadow_last_change was not available. + </para> + <para> + Default: pwdLastSet + </para> + </listitem> + </varlistentry> + + <varlistentry> <term>ldap_user_shadow_min (string)</term> <listitem> <para> diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c index e45d5b3..5ebd72c 100644 --- a/src/providers/ldap/ldap_auth.c +++ b/src/providers/ldap/ldap_auth.c @@ -286,7 +286,8 @@ static errno_t find_password_expiration_attributes(TALLOC_CTX *mem_ctx, return EINVAL; } } else if (strcasecmp(pwd_policy, PWD_POL_OPT_SHADOW) == 0) { - mark = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_LASTCHANGE, NULL); + mark = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_LASTCHANGE, NULL) | + ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_ADS_LASTCHANGE, NULL); if (mark != NULL) { DEBUG(9, ("Found shadow password expiration attributes.\n")) spwd = talloc_zero(mem_ctx, struct spwd); @@ -297,6 +298,12 @@ static errno_t find_password_expiration_attributes(TALLOC_CTX *mem_ctx, val = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_LASTCHANGE, NULL); ret = string_to_shadowpw_days(val, &spwd->sp_lstchg); + + /* Fallback to pwdLastSet for ADS */ + if (ret != EOK) { + val = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_ADS_LASTCHANGE, NULL); + ret = ads_pwdlastset_to_shadowpw_days(val, &spwd->sp_lstchg); + } if (ret != EOK) goto shadow_fail; val = ldb_msg_find_attr_as_string(msg, SYSDB_SHADOWPW_MIN, NULL); diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c index 9eb9cc3..22c9bb7 100644 --- a/src/providers/ldap/ldap_common.c +++ b/src/providers/ldap/ldap_common.c @@ -163,6 +163,7 @@ struct sdap_attr_map rfc2307bis_user_map[] = { { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL }, { "ldap_user_entry_usn", NULL, SYSDB_USN, NULL }, { "ldap_user_shadow_last_change", "shadowLastChange", SYSDB_SHADOWPW_LASTCHANGE, NULL }, + { "ldap_user_ads_last_change", "pwdLastSet", SYSDB_SHADOWPW_ADS_LASTCHANGE, NULL }, { "ldap_user_shadow_min", "shadowMin", SYSDB_SHADOWPW_MIN, NULL }, { "ldap_user_shadow_max", "shadowMax", SYSDB_SHADOWPW_MAX, NULL }, { "ldap_user_shadow_warning", "shadowWarning", SYSDB_SHADOWPW_WARNING, NULL }, @@ -878,6 +879,48 @@ errno_t string_to_shadowpw_days(const char *s, long *d) return EOK; } +errno_t ads_pwdlastset_to_shadowpw_days(const char *s, long *d) +{ + long long ll; + long days; + char *endptr; + + if (s == NULL || *s == '\0') { + *d = -1; + return EOK; + } + + errno = 0; + ll = strtoll(s, &endptr, 10); + if (errno != 0) { + DEBUG(1, ("strtoll failed [%d][%s].\n", errno, strerror(errno))); + return errno; + } + + if (*endptr != '\0') { + DEBUG(1, ("Input string [%s] is invalid.\n", s)); + return EINVAL; + } + + /* Magic value for password reset */ + if (ll = 0LL) { + DEBUG(9, ("Magic pwdLastSet date 0, password change forced.\n")); + *d = 0L; + return EOK; + } + + days = ll / 864000000000LL - 134774LL; + + if (days < 0L) { + DEBUG(1, ("Date is before Jan 1, 1970 [%d].\n", ll)); + return EINVAL; + } + + *d = days; + + return EOK; +} + errno_t get_sysdb_attr_name(TALLOC_CTX *mem_ctx, struct sdap_attr_map *map, size_t map_size, diff --git a/src/providers/ldap/ldap_common.h b/src/providers/ldap/ldap_common.h index 9146da5..cf301de 100644 --- a/src/providers/ldap/ldap_common.h +++ b/src/providers/ldap/ldap_common.h @@ -146,6 +146,7 @@ int setup_child(struct sdap_id_ctx *ctx); errno_t string_to_shadowpw_days(const char *s, long *d); +errno_t ads_pwdlastset_to_shadowpw_days(const char *s, long *d); errno_t get_sysdb_attr_name(TALLOC_CTX *mem_ctx, struct sdap_attr_map *map, diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h index 32dc344..fdd5b7a 100644 --- a/src/providers/ldap/sdap.h +++ b/src/providers/ldap/sdap.h @@ -115,6 +115,7 @@ struct sdap_ppolicy_data { }; #define SYSDB_SHADOWPW_LASTCHANGE "shadowLastChange" +#define SYSDB_SHADOWPW_ADS_LASTCHANGE "pwdLastSet" #define SYSDB_SHADOWPW_MIN "shadowMin" #define SYSDB_SHADOWPW_MAX "shadowMax" #define SYSDB_SHADOWPW_WARNING "shadowWarning" -- 1.7.4.4

4 11

[PATCH 029-032] Refactoring of sdap_async_accounts
by Jan Zelený 15 Aug '11

15 Aug '11

So here it is, a set of patches splitting file sdap_async_accounts and making some subsequent changes. If anyone has other ideas what could be changed, let me know. I was in favor of splitting the file into 3, as Simo suggested: sdap_async_users.c sdap_async_groups.c sdap_async_initgroups.c This way three basic operations are separated, but they are not separated too much (otherwise a _common.c file would have to be present, since some routines are shared by code paths in different schemas). Thanks Jan

3 7

[PATCHES] HBAC access control rewrite
by Stephen Gallagher 01 Aug '11

01 Aug '11

While attempting to extract the SSSD's HBAC rule evaluation into a common library, I discovered several shortcomings. Some were related to extracting the library, others were related to the rule evaluation itself. Related to extracting the library, I needed for the code to be able to identify and resolve without having direct access to LDAP or the LDB. This meant I could not rely on the memberOf objects to be valid. As for the rule evaluation, I discovered that we were only caching for offline use those remote hosts that had previously attempted to log in. This meant that if the IPA server was unreachable, valid users would be unable to log in from some valid machines. After careful consideration (and a few false starts), I decided that a total rewrite was necessary. So here it is. The major changes are these: 1) We have moved to always performing a full enumeration of known IPA hosts and HBAC services. This actually results in a net reduction in round-trips to the LDAP server, which was a primary bottleneck. Additionally, this means that we also have a full understanding when offline as to whether a remote host is permitted access or not. 2) I've added a configurable timeout for hbac rule refreshes to the LDAP server. Previously, if we were online, EVERY pam_account() request would result in at least one LDAP round-trip. By default, we'll only refresh the HBAC rules every five seconds now. 3) I broke the acquisition and processing of the rules, hosts and services into separate C files, as ipa_access.c was getting to be much to large to manage. The overall view of the code (when online) is this: A request comes in, we call to LDAP to get, in order, the set of known hosts, the set of known PAM services and then finally the set of *enabled* rules with the current ipa_hostname as the targethost. And now, the patches: Patch 0001: The new standalone evaluator library. It's very simple at the moment (but it will become much more complex in the near future when timerule evaluation is added). Jakub, Rob and I agreed on the interface and Jakub is creating Python bindings for it. Patch 0002: This is the meat of the new IPA access backend. All of the helper functions necessary for looking up, storing and converting the hosts, rules and services are in this patch. Patch 0003: This is not really a patch as much as it is a trash can. I split this from Patch 0004 to make the latter more reviewable. Patch 0003 contains only the deletions of the old access provider implementation. Patch 0004: Adds the new IPA access provider, taking advantage of the helper functions from Patch 0002. Patch 0005: Adds a refresh timeout to reduce round-trips to IPA while online.

4 20

[PATCH] Provide python bindings for the HBAC evaluator library
by Jakub Hrozek 01 Aug '11

01 Aug '11

Hi, the attached patch provides a new python module "pyhbac" that implements python bindings for the HBAC evaluator library. The patch depends on Stephen's last patches which are on review as of now, but the test suite passed, so I think the bindings can be reviewed in parallel. "make check" loads the built python module from tree by doing some sys.path magic. If you'd like to experiment with the module yourself, you must either install it or set PYTHONPATH to $SSSD_BUILD_DIR/.libs

2 7

supportedControl and OpenLDAP
by Sumit Bose 13 Jul '11

13 Jul '11

Hi, by chance I realized that an OpenLDAP server does not list all controls it can handle in the rootDSE attribute supportedControl. Especially LDAP_CONTROL_PASSWORDPOLICY is not listed. According to the OpenLDAP developers this is because the related spec (http://tools.ietf.org/html/draft-behera-ldap-password-policy-10) is still a draft and not finalized (http://www.openldap.org/lists/openldap-software/200606/msg00220.html) Since sssd only uses controls which are in the supportedControl list we will not be able to give the user expiration warnings or information about grace logins for OpenLDAP servers with the password policy overlay enabled. I'm not sure if we need to do anything about it but at least I think it is good to be aware of. bye, Sumit

5 6

[PATCH] Add LDAP access control based on NDS attributes
by Sumit Bose 08 Jul '11

08 Jul '11

Hi, this patch adds support for the NDS/eDirectory access control attributes loginDisabled, loginExpirationTime and loginAllowedTimeMap. It is not fully tested because currently I do not have access to an eDirectory server. Since the impact on other parts of the code is minimal I didn't add a seperate configure option for it but only mark it in the man page as experimental. I you have a chance to test this feature please let me know the result. bye, Sumit

2 2

[PATCH] Add support for experimental features
by Sumit Bose 08 Jul '11

08 Jul '11

Hi, We will have some experimental features added in the near future and this patch tries to help to identify them. One part is a new configure option which enables all experimental features which check if the option is set. The second is a small include file for man pages to indicate that a certain feature is experimental. bye, Sumit

2 5

[PATCH] Excluding attributes from map
by Jan Zelený 05 Jul '11

05 Jul '11

This patch add the possibility to exclude attributes when building requested attribute list from a map. It also utilizes this new functionality by not loading memberuid of parent groups during initgroups in rfc2307 schema. Jan

2 1

Re: [SSSD] SSSD Local Auth and SELinux support
by Stephen Gallagher 05 Jul '11

05 Jul '11

On Wed, 2011-06-29 at 23:35 +0100, Matthew Ife wrote: > Hi Stephen, > > I am working on the SSSD policy for local db management and hit across > an alert that I believed should be fixed in code. > > The alert is because nscd.c called system() to request a flush command > to nscd if it exists. > > This is a problem policy wise because this calls /bin/sh to execute the > command which in turn forces policy to allow a much greater access to > sssd to execute stuff that exists in /usr/bin and friends. > > In the patch attached I replaced the system() request with a fork/execl > pair. This is much nicer in policy as I can change policy to call a > specific transition into the nscd_t domain directly without giving > access to sssd to the bin_t types in /usr/bin. > > Please check the patch. I'm not familiar with talloc (I dont really > consider myself a C programmer of any merit) and my workaround to create > a char** array to talloc memory might be a bit daft to do. If you can > alter the code to something more elegant please feel free! > > On Mon, 2011-06-27 at 07:13 -0400, Stephen Gallagher wrote: > > I happened to notice this email on the selinux list. This discussion > > would probably be best served cross-posted to > > sssd-devel(a)lists.fedorahosted.org, so we on the SSSD team can be > > involved if there are any code changes/improvements we need to make in > > order to further advance this proposal. > I took a look at the patch, and unfortunately it would need a fair amount of rework to get it to function properly. However, it brings up an interesting topic that I'd like to discuss with the SSSD list at large. The main reason for the nscd flush is because, for a time, we were attempting to allow the SSSD to operate alongside NSCD. These days, however, we've acknowledged that the two caches really don't interact well and we strongly advise that users disable user and group support in nscd while using SSSD. So I'd like to propose that, rather than fixing this code to work in the way Matthew is suggesting, we remove it entirely, acknowledging that nscd/sssd interaction is unlikely to ever be safe. Thoughts?

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel June 2011