Looks like some LDAP servers are able to store empty attribute values.
For some servers it results in syntax error, so it is probably a rare
case (if not an error) to have such values. LDB seems to be unable to
handle such values too, so in this patch we skip empty values and do not
store them to local cache.
Patch is attached.
the attached patch might seem simple, but it touches a delicate and
low-level part of the SSSD, so I'd like to request a detailed review.
I was notified by Bruce Aiesi of the Red Hat QE team that the sssd_nss
process grew its memory footprint when stress-tested by logging in many
users in parallel. I ran a couple of tests and then found out that the
responder context grew because we never freed the internal Data Provider
request. Attached is a patch that simple frees the "side request" after
all the callbacks have been invoked.
I didn't see the memory growth anymore during my testing and I didn't
see any other issues, either during my tests or with valgrind.
I hope I didn't miss any detail and the patch is OK.
I noticed that if offline auth failed for any reason including mistyped
password, we would always print System Error. This makes auditing the
logs hard as it sounds like an internal error occured.
I don't like the header with a single inline function myself, but I
didn't want to clutter util.h with that function either. And we don't
have any shared header for that purpose at the moment..suggestions are
The current way we handle with auth token is manual and very error prone.
The semanthics are also confusing and do not make clear how tokens are stored
such that manipulating them is difficult. For example it was unclar in the
code whether password tokens where 0 terminated and whether the length would
incliude the null termination byte or not.
This code creates a standard structure called sss_auth_token that has a full
set of getters and setters.
Note: I wanted to make this structure completely opaque but it would have
required a lot more allocations and pointers, and made the patchset larger.
Simo Sorce (4):
Code can only check for cached passwords
Add function to safely wipe memory.
Add authtok utility functions.
Change pam data auth tokens.
Makefile.am | 4 +
src/db/sysdb.h | 3 +-
src/db/sysdb_ops.c | 13 +-
src/providers/data_provider.h | 9 +-
src/providers/dp_auth_util.c | 77 ++++++----
src/providers/dp_pam_data_util.c | 113 ++++++++-------
src/providers/ipa/ipa_auth.c | 6 +-
src/providers/krb5/krb5_auth.c | 45 +++---
src/providers/krb5/krb5_child.c | 148 ++++++++++---------
src/providers/krb5/krb5_child_handler.c | 59 ++++++--
.../krb5/krb5_delayed_online_authentication.c | 50 ++++---
src/providers/krb5/krb5_renew_tgt.c | 18 +--
src/providers/ldap/ldap_auth.c | 90 +++++-------
src/providers/ldap/sdap_async.c | 4 +-
src/providers/ldap/sdap_async.h | 7 +-
src/providers/ldap/sdap_async_connection.c | 85 ++++++-----
src/providers/proxy/proxy.h | 7 +-
src/providers/proxy/proxy_auth.c | 14 +-
src/providers/proxy/proxy_child.c | 51 ++++---
src/responder/pam/pam_LOCAL_domain.c | 52 +++----
src/responder/pam/pamsrv_cmd.c | 159 ++++++++++++---------
src/tests/krb5_child-test.c | 13 +-
src/tests/sysdb-tests.c | 6 +-
src/util/authtok.c | 146 +++++++++++++++++++
src/util/authtok.h | 137 ++++++++++++++++++
src/util/util.c | 9 ++
src/util/util.h | 10 ++
27 files changed, 856 insertions(+), 479 deletions(-)
create mode 100644 src/util/authtok.c
create mode 100644 src/util/authtok.h
even though RHEL-6.4 is still brewing, I think there might be some
interest in trying out the 1.9.x series of the SSSD on RHEL-6.3.
So I went ahead and built the SSSD 1.9.2 in a RHEL-6.3 buildroot:
The NVR of these test packages will be lower than those in 6.4 to keep
the upgrade path clean. The only missing functionality is the PAC
responder, which means this SSSD version won't be able to work with
an AD domain that is in a trust relationship with an IPA 3.x domain. I
had to disable the PAC responder as it requires Kerberos 1.10.
Because some new functionality required tweaking the SELinux policy, you
will encounter AVC denials when the new fast cache is accessed. That
said, my quick smoke testing went fine and we will be glad to hear test
results or bug reports.
Using the repository comes with a warning - this is NOT an official Red
Hat supported repository. The packages have NOT gone through formal QA. If
it breaks your RHEL-6.3 installation, you get to keep the pieces.
This is the repo configuration I used:
name=SSSD 1.9.x built for latest stable RHEL
name=SSSD 1.9.x built for latest stable RHEL - Source