[PATCH] Allow more libldap debugging
by Jakub Hrozek
This patch should not be pushed to master, but I would like to get it
reviewed anyway.
It should be used to provide a custom build for users experiencing cases
where ldap_search_ext would block (c.f.
https://bugzilla.redhat.com/show_bug.cgi?id=728343)
For example:
export SSSD_DEBUG_LDAP_SEARCH="0xffff"
would set LDAP_DEBUG_ANY
The attached patch applies cleanly on the RHEL6.1 branch. I also have a
version that applies on master/1.5 if needed.
10 years, 6 months
[INI] Patches for ding-libs: Merging config sections, handling metadata, remaining Coverity issues...
by Dmitri Pal
Please see the attached patches. I tried to split the patches logically
into manageable sets.
Unfortunately I made a minor mistake and I am afraid I will do something
wrong to fix it.
I merged two wrong patches. Fortunately it was three liner with 1 liner
so it is not a big of the deal but I am really scared that I will do
something wrong and loose the work I have done.
So I hope it is Ok to send it as is.
0001--INI-Making-Coverity-happy.patch <- this is the patch I submitted
earlier that I merged by mistake. I was supposed to merge it with patch
25 but picked the wrong one instead.
Patch 25 addresses the real issue found by Coverity as mentioned in
Stephen's review mail but it did not apply cleanly since it relies on
some code from the patches in the middle.
0002--INI-Adding-missing-function-declararion.patch <- this is the
patch that was rejected from the second set sent earlier. Fixed
according to review comment.
0003--BUILD-Allow-trace-per-component.patch <- This patch allows tracing
per component
The following set of patches introduces the merging of sections during
the reading of the file:
0004--INI-New-error-codes-and-messages.patch
0005--INI-New-merge-flags.patch
0006--INI-Add-new-vars-to-parse-structure.patch
0007--INI-Add-save_error-function.patch
0008--INI-Change-parse_error-to-use-save_error.patch
0009--INI-Preparing-for-merging-sections.patch
0010--INI-Enhance-value-processing.patch
0011--INI-Use-section-line-number.patch
0012--INI-Refactor-section-processing.patch
0013--INI-Return-error-in-DETECT-mode.patch
0014--INI-New-test-files-for-section-merge.patch
0015--INI-Test-DETECT-mode-and-use-new-file.patch
0016--INI-Test-for-all-section-merge-modes.patch
Patches related porting of the meta data from old way of doing things to
the new way of doing things:
0017--INI-Separate-close-and-destroy.patch
0018--INI-Function-to-reopen-file.patch
0019--INI-Metadata-collection-is-gone.patch
0020--INI-Check-access-function.patch
0021--INI-Avoid-double-free.patch <- patch related to 17 (missed check)
0022--INI-Function-to-check-for-changes.patch
0023--INI-Tests-for-access-and-changes.patch
0024--INI-Rename-error-print-function.patch <- rename error printing
function for consistency with new interface
0025--INI-Initialize-variables-in-loops.patch <- Coverity issue
addressed. Related to patch 0001.
0026--INI-Exposing-functions.patch <- Make some internal functions reusable
There is also patch 27. It is a piece of new functionality. It is a
preview. Please see the comment before reviewing it.
Do I need to split it into multiple patches or it is Ok as is? It is
pretty big but all changes are in one file and logically related.
The UNIT test is missing so I am not claiming it actually works as
expected.
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
11 years, 1 month
IPA migration fixes
by Jakub Hrozek
https://fedorahosted.org/sssd/ticket/924 started as a segfault ticket
but we could never reproduce the crash afterwards.
As Sumit noted it might have been caused by setting the O_NONBLOCK flag
twice. However, the changes Sumit proposed in the ticket still make
sense because they provide much cleaner solution.
Attached are two patches:
[PATCH 1/2] Provide means of forcing TLS and GSSAPI enabled/disabled
for sdap connections
This will be used to force TLS on the auth connection only and allow
staying on GSSAPI-backed ID connection for the rest of the request.
[PATCH 2/2] IPA migration fixes
* use the id connection for looking up the migration flag
* force TLS on the password based authentication connection
11 years, 6 months
[PATCH] Allow using AD objectSid as uid source
by Marko Myllynen
Hi,
this simple patch allows using AD objectSid as uid source making it
possible to use SSSD against AD instances which do not have Identity
Management for Unix Role Service enabled. The mapping matches winbind's
idmap_rid(8) behaviour. If ldap_user_uid_number is not objectSid then
nothing changes.
https://fedorahosted.org/sssd/ticket/996
Cheers,
--
Marko Myllynen
11 years, 6 months
[PATCH] Use fake users for RFC2307bis nested group processing
by Jakub Hrozek
https://bugzilla.redhat.com/show_bug.cgi?id=742052
Attached are two patches that should be commited to 1.5. They are
already present in 1.6 and later branches.
Instead of downloading all user attributes and saving complete user data
during nested RFC2307bis group processing, download only the necessary
attributes (objectclass and name) and save the users as "fake".
This lowers the network traffic needed to download all the attributes, reduces
the cache size and provides a minor speedup.
The speedup really is minor compared to what dereference brings because
the RFC2307bis processing code still needs to perform at least N LDAP
lookups for N group members that are not cached.
11 years, 7 months
Fast reply - offline
by Ondrej Valousek
Hi List,
I experience sometimes sssd reports certain users as not existing - symptoms in log are the following:
(Tue Sep 27 15:30:17 2011) [sssd[nss]] [accept_fd_handler] (4): Client connected!
(Tue Sep 27 15:30:17 2011) [sssd[nss]] [sss_cmd_get_version] (5): Received client version [1].
(Tue Sep 27 15:30:17 2011) [sssd[nss]] [sss_cmd_get_version] (5): Offered version [1].
(Tue Sep 27 15:30:17 2011) [sssd[nss]] [nss_cmd_getpwnam] (4): Requesting info for [paulr] from [<ALL>]
(Tue Sep 27 15:30:17 2011) [sssd[nss]] [nss_cmd_getpwnam_search] (4): Requesting info for [paulr@default]
(Tue Sep 27 15:30:17 2011) [sssd[nss]] [sss_dp_send_acct_req_create] (4): Sending request for [default][4097][1][name=paulr]
(Tue Sep 27 15:30:17 2011) [sssd[nss]] [sss_dp_get_reply] (4): Got reply (1, 11, Fast reply - offline) from Data Provider
In this case sssd reports no such a user 'paulr'.
Also, the connection to the ldap server (AD, Windows Server 2008) seems to be quite unreliable:
(Tue Sep 27 14:26:40 2011) [sssd[be[default]]] [child_sig_handler] (4): child [20098] finished successfully.
(Tue Sep 27 14:26:40 2011) [sssd[be[default]]] [fo_set_port_status] (4): Marking port 389 of server 'dcpra1.dublin.ad.s3group.com' as 'working'
(Tue Sep 27 14:26:40 2011) [sssd[be[default]]] [set_server_common_status] (4): Marking server 'dcpra1.dublin.ad.s3group.com' as 'working'
(Tue Sep 27 14:41:51 2011) [sssd[be[default]]] [sdap_process_result] (4): ldap_result gave -1, something bad happend!
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [be_get_account_info] (4): Got request for [4099][1][name=postfix]
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [fo_resolve_service_send] (4): Trying to resolve service 'LDAP'
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [be_resolve_server_done] (4): Found address for server dcpra1.dublin.ad.s3group.com:
[192.168.60.203]
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [fo_resolve_service_send] (4): Trying to resolve service 'KERBEROS'
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [fo_set_port_status] (4): Marking port 389 of server 'dcpra1.dublin.ad.s3group.com' as 'not
working'
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [fo_resolve_service_send] (4): Trying to resolve service 'LDAP'
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [fo_resolve_service_send] (1): No available servers for service 'LDAP'
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [sdap_id_op_connect_done] (1): Failed to connect, going offline (5 [Input/output error])
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [be_run_offline_cb] (3): Going offline. Running callbacks.
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [acctinfo_callback] (4): Request processed. Returned 1,11,Offline
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [remove_krb5_info_files] (5): Could not remove
[/var/lib/sss/pubconf/kpasswdinfo.DUBLIN.AD.S3GROUP.COM], [2][No such file or directory]
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [remove_krb5_info_files] (5): Could not remove
[/var/lib/sss/pubconf/kdcinfo.DUBLIN.AD.S3GROUP.COM], [2][No such file or directory]
(Tue Sep 27 14:43:50 2011) [sssd[be[default]]] [remove_krb5_info_files] (5): Could not remove
[/var/lib/sss/pubconf/kpasswdinfo.DUBLIN.AD.S3GROUP.COM], [2][No such file or directory]
(Tue Sep 27 15:30:17 2011) [sssd[be[default]]] [be_get_account_info] (4): Got request for [4097][1][name=paulr]
(Tue Sep 27 15:30:17 2011) [sssd[be[default]]] [be_get_account_info] (4): Request processed. Returned 1,11,Fast reply - offline
(Tue Sep 27 15:30:17 2011) [sssd[be[default]]] [fo_resolve_service_send] (4): Trying to resolve service 'LDAP'
(Tue Sep 27 15:30:17 2011) [sssd[be[default]]] [get_port_status] (4): Reseting the status of port 389 for server 'dcpra1.dublin.ad.s3group.com'
(Tue Sep 27 15:30:17 2011) [sssd[be[default]]] [be_resolve_server_done] (4): Found address for server dcpra1.dublin.ad.s3group.com:
[192.168.60.203]
(Tue Sep 27 15:30:17 2011) [sssd[be[default]]] [fo_resolve_service_send] (4): Trying to resolve service 'KERBEROS'
(Tue Sep 27 15:30:17 2011) [sssd[be[default]]] [be_resolve_server_done] (4): Found address for server dcpra1.dublin.ad.s3group.com:
[192.168.60.203]
(Tue Sep 27 15:30:18 2011) [sssd[be[default]]] [sasl_bind_send] (4): Executing sasl bind mech: GSSAPI, user: draco$(a)DUBLIN.AD.S3GROUP.COM
(Tue Sep 27 15:30:18 2011) [sssd[be[default]]] [child_sig_handler] (4): child [20584] finished successfully.
(Tue Sep 27 15:30:18 2011) [sssd[be[default]]] [fo_set_port_status] (4): Marking port 389 of server 'dcpra1.dublin.ad.s3group.com' as 'working'
(Tue Sep 27 15:30:18 2011) [sssd[be[default]]] [set_server_common_status] (4): Marking server 'dcpra1.dublin.ad.s3group.com' as 'working'
(Tue Sep 27 15:38:40 2011) [sssd[be[default]]] [be_get_account_info] (4): Got request for [4098][1][idnumber=203]
(Tue Sep 27 15:38:40 2011) [sssd[be[default]]] [sysdb_attrs_primary_name] (1): Could not determine primary name: [22][Invalid argument]
(Tue Sep 27 15:38:40 2011) [sssd[be[default]]] [sdap_save_user] (1): Failed to save the user - entry has no name attribute
(Tue Sep 27 15:38:40 2011) [sssd[be[default]]] [sdap_save_user] (2): Failed to save user [Unknown]
Is there any help to this? The client is a RHEL-6 machine.
Thanks,
Ondrej
11 years, 7 months
[PATCH] The new memberof plugin
by Jan Zelený
Attached patch rewrites almost entire memberof plugin. It heavily utilizes
hash tables instead of lists and arrays and it introduces concept of reference
counting which should heavily optimize all operations when no loops are
present in the user/group tree.
I tested the patch by running sysdb test suite, all tests passed. I also
attach a document where basic concepts of the plugin are explained.
Please note that the patch is functional, although I don't consider it ready.
I just want to get pre-ACK or some comments about the patch design. I have yet
to implement the recompute task, I will work on that later.
Jan
11 years, 7 months
SSSD on RHEL6 problems
by Andy Kannberg
Hi all,
I'm running into problems on a RHEL6 machine with configuring sssd.
I keep getting errors like this:
Sep 30 14:11:26 tst0030 sshd[7512]: pam_unix(sshd:auth): authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=somehost.domain.com user=XXX
Sep 30 14:11:27 tst0030 sshd[7512]: Failed password for XXX21358 from
12.34.56.78 port 32950 ssh2
Sep 30 14:11:33 tst0030 sshd[7512]: Failed password for XXX21358
from 12.34.56.78 port 32950 ssh2
However, I can perform a ldapsearch succesfully. So LDAP is available.
I've copied the configuration from a working RHEL5 machine(which runs just
fine, I can login with the same credentials I try on the RHEL6 box), but it
appears to be a no-go for now. sssd.conf looks like this:
[sssd]
config_file_version = 2
# Number of times services should attempt to reconnect in the
# event of a crash or restart before they give up
reconnection_retries = 3
# If a back end is particularly slow you can raise this timeout here
sbus_timeout = 30
services = nss, pam
# SSSD will not start if you do not configure any domains.
# Add new domain configurations as [domain/<NAME>] sections, and
# then add the list of domains (in the order you want them to be
# queried) to the "domains" attribute below and uncomment it.
domains = default
[nss]
# The following prevents SSSD from searching for the root user/group in
# all domains (you can add here a comma-separated list of system accounts
that
# are always going to be /etc/passwd users, or that you want to filter out).
filter_groups = root
filter_users = root
reconnection_retries = 3
# The entry_cache_timeout indicates the number of seconds to retain an
# entry in cache before it is considered stale and must block to refresh.
# The entry_cache_nowait_timeout indicates the number of seconds to
# wait before updating the cache out-of-band. (NSS requests will still
# be returned from cache until the full entry_cache_timeout). Setting this
# value to 0 turns this feature off (default).
; entry_cache_timeout = 600
; entry_cache_nowait_timeout = 300
[pam]
reconnection_retries = 3
#offline_credentials_expiration = 0
#offline_failed_login_attempts = 5
#offline_failed_login_delays = 15
[domain/default]
ldap_id_use_start_tls = False
cache_credentials = True
ldap_search_base = ou=TST_EMEA_NL-TST01,ou=Locations,ou=NXDI,o=NXP
ldap_user_search_base = ou=People,ou=NXDI,o=NXP
ldap_user_object_class = NxpUserAuxClass
ldap_user_principal = krbForeignPrincipalName
ldap_force_upper_case_realm = True
ldap_user_fullname = fullName
ldap_user_member_of = groupMembership
ldap_group_search_base = ou=Group,ou=NXDI,o=NXP
ldap_group_object_class = NxpGroupAuxClass
ldap_group_gid_number = gidNumber
ldap_schema = rfc2307bis
enumerate = True
krb5_realm = WBI.NXP.COM
chpass_provider = krb5
krb5_kdcserver = wbi.nxp.com
id_provider = ldap
auth_provider = krb5
debug_level = 0
ldap_uri = ldap://dtc0001.dtq.nl-htc01.nxp.com,ldap://
dtc0002.dtq.nl-htc01.nxp.com
krb5_kpasswd = wbi.nxp.com
ldap_tls_cacertdir = /etc/openldap/cacerts
I've modified nsswitch.conf to use sss, and also the system-auth to use the
sssd-pam library. These look like:
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_sss.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
#account required pam_access.so
accessfile=/etc/security/access.netgroup.conf
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so nullok use_authtok md5 shadow
password sufficient pam_sss.so use_authtok
password required pam_deny.so
#session required pam_limits.so
session required pam_unix.so
session required pam_keyinit.so revoke
session optional pam_sss.so
Anyone who can help me out with this ? I'm kinda stuck. Google didn't show
up any useful results.
cheers,
Andy
11 years, 7 months