[PATCH] AUTOFS: support for the IPA provider
by Jakub Hrozek
Hi,
I think it would be nice to include the attached patch in 1.8 beta. The
usability improvement in comparison with using autofs_provider=ldap is
the support for automounter "locations" in IPA (see ipa help automount).
The user would simply configure the autofs responder service to start and
then optionally select his location using the ipa_automounter_location
option. No need to fiddle with search bases manually.
The patch also fixes a copy-paste typo in data_provider_be.c
11 years, 4 months
sssd 1.7.x on Fedora 16 ?
by Marco Pizzoli
Hi again,
What if I wish to play with sssd 1.7 on Fedora 16?
Are rpms available somewhere? I only find those for Fedora 17 rawhide.
Thanks in advance, again
Marco
--
_________________________________________
Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi.
Jim Morrison
11 years, 4 months
Announcing SSSD 1.8.0 beta 1
by Stephen Gallagher
The SSSD is proud to announce the release of the first beta of SSSD
1.8.0, destined to become our next long-term maintenance (LTM) release.
As this is going to be a big release for us, we're looking for as much
help as we can get to regression-test and try out the new features
before our final release on February 28th.
For those looking for the source, it can be found at
https://fedorahosted.org/sssd
I've kicked off build of the Fedora packages and they will be available
in Rawhide tonight and in the Fedora 17 Alpha release coming soon.
As a note to the engineering team, we have now branched off the sssd-1-8
branch. All bugfixes for the 1.8.0 release must go to both master and
sssd-1-8. The master branch is now open to SSSD 1.9.0 development.
To interested translators: SSSD 1.8.0 is now in string freeze, so if you
speak a second (or third, or fourth...) language, please help us out
with translating our manpages and config options at
https://www.transifex.net/projects/p/sssd/
== Highlights ==
* Support for the service map in NSS
* Support for setting default SELinux user context from FreeIPA
* Support for retrieving SSH user and host keys from LDAP
(Experimental)
* Support for caching autofs LDAP requests (Experimental)
* Support for caching SUDO rules (Experimental)
== Detailed Changelog ==
Jakub Hrozek (42):
* sss_get_cased_name utility function
* Return user and group names lowercased in case insensitive domains
* Honor case sensitive flag when creating the ccname template
* HBAC: create empty groups with one NULL element
* Do not call krb5_child when changing passwords and provider went
offline
* IPA netgroups: Do not reuse loop iterator variable
* Add a configure switch to specify 3rd party app libraries location
* Export libsss_sudo as a separate package
* Add a new Makefile target to build RPMs with the experimental flag
* Do not use sudo symbols in LDAP provider unconditionally
* PAM: Fix reversed logic
* SUDO: include the sources in the IPA provider, too
* PAM: Do not overwrite ret
* DP: Refactor responder_dp_req so it's reusable by other responders
* SUDO: Provide a sudo DP request based on the internal_req
* Use the new SUDO request in DP and sudo responder
* Fix sudo compilation on RHEL5
* Include sudo manual pages only conditionally
* docs: Use absolute srcdir path
* SUDO: Provide documentation for the SUDO API
* SYSDB: index sudoUser
* Refactor nss_cmd_send_empty
* Use profiling Docbook XSLT only if available, fall back to normal
* RESPONDERS: Provide a common sss_cmd_send_error function
* NSS: Use sss_hash_create instead of destructor
* Fixes for sudo_timed
* ConfigAPI: add sudo to known services
* SUDO: introduce a new config option --with-sudo
* Move BUILD_SUDO outside the generic LDAP source files
* Fix configure with old autoconf versions
* BUILD: Introduce a --with-autofs config option
* SYSDB: Remove code duplication between member_add and member_del
* AUTOFS: sysdb interface
* AUTOFS: a client library
* AUTOFS: a command-line test client
* AUTOFS: Data Provider request
* RESPONDERS: Refactor setent_req_list
* Split the logic to check cache expiration into separate function
* AUTOFS: responder
* AUTOFS: LDAP provider
* Do not call sudo functions if built without-sudo
* Make sudo installation path configurable, install into libdir by
default
Jan Cholasta (10):
* UTIL: Provide base64 encoding and decoding functions
* BUILD: Introduce a --with-ssh config option
* LDAP: Add support for SSH user public keys
* DP: Add host info handler
* IPA: Add host info handler
* DP: Add support for hosts in sss_dp_get_account
* SSH: Responder
* SSH: Common client code
* SSH: OpenSSH authorized_keys client
* SSH: OpenSSH known_hosts client
Jan Zeleny (18):
* Add info about ipa_host_search_base to man page
* Support multiple search bases in HBAC
* Fixed wrong position of ldap_service_search_base
* Implemented support for multiple search bases in HBAC rules and
services
* Fixed minor memory-hierarchy-related issue in IPA HBAC
* Add support for generic IPA config retrieval
* Make password migration code use the IPA config retrieval code
* Renamed some sysdb constants for their wider usage
* Added some SELinux-related utility functions
* Added some SELinux-related sysdb routines
* SELinux support in PAM responder
* SELinux support in PAM module
* Separate the host-retrieval code from IPA HBAC to common IPA code
* Delete unused structure in IPA access code
* Add session target in data provider
* Session target in IPA provider
* Man pages for the session target and SELinux user maps fetching
* Update shadowLastChanged attribute during LDAP password change
Pavel Březina (15):
* SUDO Integration review issues
* SUDO Integration - wrap data provider with tevent_req
* sysdb_get_bool() and sysdb_get_bool() functions
* SUDO Integration - functions for manipulating with 'refreshed'
attribute
* SUDO Integration - periodical update of rules in data provider
* SUDO Integration - make sysdb_get_sudo_filter() more configurable
* SUDO Integration - prepare data provider for new responder commands
* SUDO Integration - responder command for cn=defaults
* SUDO Integration - SUDO API can request only cn=defaults record
* SUDO Integration - test client changed
* SUDO Integration - manual page
* SUDO Integration - in-memory cache in responder
* SUDO Integration - responder 'sudo_timed' option
* SUDO Integration - fix offline behaviour
* SUDO Integration - sysdb_sudo_check_time() fix
Simo Sorce (9):
* make dist fixes
* tests: fix test group of utf8 tests
* nsssrv: remove unused macro
* nsssrv: add string manipulation helper
* nsssrv: use sized_string in fill_pwent
* nsssrv: use sized_string in fill_grent
* util: add murmurhash3 hash function
* Add a random + identity test for murmurhash3
* util: Fix murmurhash3 on machines with old glibc
Stephen Gallagher (46):
* Bump version to 1.8.0
* Add compatibility layer for Heimdal Kerberos implementation
* Importing new translations for 1.7.0 release
* Log fixes for sdap_call_conn_cb
* LDAP: Copy URI instead of pointing at failover service record
* NSS: Validate input string lengths
* NSS: Improve DEBUG messages for netgroup cache
* Raise the debug level of two very noisy statements
* IPA: Detect nsupdate support for the realm directive
* NSS: Add sss_readrep_copy_string
* LDAP: Add option to disable paging control
* SYSDB: Redundant check is redundant.
* Fix invalid index in pidfile()
* RESPONDER: Extend sss_dp_account_send() to include extra data
* DP: Fix bugs in sss_dp_get_account_int
* LDAP: Improve debugging for sdap_parse_deref
* Move sized_string declaration to utils
* UTIL: Add strtouint16
* SYSDB: Move add_string and add_ulong to sysdb_private.h
* DP: Handle parsing extra results in be_get_account_info
* SYSDB: Add sysdb routines for manipulating service entries
* SYSDB: Add indexes for servicePort and serviceProtocol
* NSS: Add client support for services (non-enumeration)
* DP: Add support for services in dp requests
* NSS: Add negative cache routines for services
* NSS: Add getservbyname and getservbyport support to the NSS Responder
* PROXY: add support for service lookups (non-enumeration)
* NSS: Add client support for [set|get|end]servent()
* SYSDB: add support for enumerating services
* NSS: Add service enumeration support to NSS provider
* PROXY: add support for enumerating services
* Rename sss_dp_type to sss_dp_sudo_type
* SSSDConfigAPI: Move sssd.api.* to /usr/share/sssd
* SYSDB: extend sysdb_store_service() to accept additional attributes
* SYSDB: Add sysdb_attrs_get_uint16_t
* LDAP: Add support for service lookups (non-enum)
* LDAP: Add enumeration support for services
* IPA: Add support for services lookups (non-enum)
* LDAP: Add new options for service maps
* KRB5: Add syslog messages for Kerberos failures
* LDAP: Do not fail if RootDSE check cannot determine search bases
* LDAP: Fix incorrect search timeouts
* NSS: Add individual timeouts for entry types
* Build all experimental features during 'make distcheck'
* Set version to 1.7.91 for 1.8.0beta1
* Updating translatable strings for string freeze
11 years, 4 months
Help in decoding sssd output with ldap domain
by Marco Pizzoli
Hi,
this is part of my sssd output:
(Tue Feb 7 10:26:26 2012) [sssd] [service_send_ping] (0x0100): Pinging
my_ldap
(Tue Feb 7 10:26:26 2012) [sssd] [sbus_add_timeout] (0x2000):
0x7f9c93886cb0
(Tue Feb 7 10:26:26 2012) [sssd[be[my_ldap]]] [sbus_dispatch] (0x4000):
dbus conn: 7F0043099BF0
(Tue Feb 7 10:26:26 2012) [sssd[be[my_ldap]]] [sbus_dispatch] (0x4000):
Dispatching.
(Tue Feb 7 10:26:26 2012) [sssd[be[my_ldap]]] [sbus_message_handler]
(0x4000): Received SBUS method [ping]
(Tue Feb 7 10:26:26 2012) [sssd] [sbus_remove_timeout] (0x2000):
0x7f9c93886cb0
(Tue Feb 7 10:26:26 2012) [sssd] [sbus_dispatch] (0x4000): dbus conn:
7F9C93886EC0
(Tue Feb 7 10:26:26 2012) [sssd] [sbus_dispatch] (0x4000): Dispatching.
(Tue Feb 7 10:26:26 2012) [sssd] [ping_check] (0x0100): Service my_ldap
replied to ping
Could you confirm that this a check performed by the sssd monitor service
to verifiy the sssd ldap backend process is still alive?
Thanks
Marco
--
_________________________________________
Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi.
Jim Morrison
11 years, 4 months
Local ID provider and access_provider = permit
by Marco Pizzoli
Hi again,
I was trying to play with a test configuration of my sssd and I think I
found a discrepancy among documentation and implementation. In doubt, I ask
before :-)
This is the last part of my sssd startup output:
(Mon Feb 6 23:04:52:002347 2012) [sssd] [confdb_get_domain_internal]
(0x0010): Local ID provider does not support [permit] as an ACCESS provider.
(Mon Feb 6 23:04:52:002823 2012) [sssd] [confdb_get_domains] (0x0010):
Error (22 [Invalid argument]) retrieving domain [my_local], skipping!
And this is my configuration for the domain with id_provider = local:
[domain/my_local]
description = LOCAL Users domain
min_id = 5000
max_id = 30000
timeout = 10
enumerate = TRUE
entry_cache_timeout = 5400
cache_credentials = TRUE
account_cache_expiration = 0
id_provider = local
use_fully_qualified_names = FALSE
#auth_provider =
access_provider = permit
#chpass_provider =
lookup_family_order = ipv4_first
dns_resolver_timeout = 5
#dns_discovery_domain =
#override_gid =
case_sensitive = True
default_shell = /bin/bash
base_directory = /home
create_homedir = true
remove_homedir = false
homedir_umask = 077
skel_dir = /etc/skel
mail_dir = /var/mail
Actually, I don't think to have done something not intended by the
sssd.conf (and related) man pages.
In man sssd.conf it is not specified any restriction about the use of
id_provider = local, or better about access_provider if within a local
id_provider.
Am I wrong?
Thanks a lot as usual
Marco
11 years, 4 months