[PATCHES][PRELIMINARY] Add support for Active Directory objectSID mappings
by Stephen Gallagher
First of all, these patches are definitely preliminary. I'm mainly
looking for input on whether I'm headed in the right direction.
Patch 0001: Add safe copy functions for 8-bit integers
Patch 0002: LDAP: Add objectSID config option
This patch is not complete (it needs manpages). This patch adds an
option to specify the objectSID attribute on the LDAP server, for use
when performing ID-mapping
Patch 0003: Add function to convert binary LDAP blob to a dom_sid
Does what it says on the box. It is designed to safely convert the
binary objectSID representation in LDAP into a struct dom_sid, with
alignment addressed.
Patch 0004: Add function to convert a dom_sid to its string
representation
I considered making the functions of patch 0003 and 0004 into a single
function, but I think it's possible we might want to use just one or the
other at some point. This function takes the dom_sid representation and
converts it to the "S-1-5-21-..." representation of a SID. It has one
limitation: the id_auths array can result in a 96-bit integer value, but
we can only support writing up to a 64-bit value without using
arbitrary-precision routines. That said, the IPA code makes the same
assumption I do that the upper bits aren't being used.
Patch 0005: Add option to enable id-mapping.
This patch is preliminary and requires a manpage to explain (among other
things) that enabling ID mapping disables support for explicit IDs (to
avoid collision issues).
Patch 0006: The meat of the work. This patch will almost certainly be
broken up into multiple patches before formal review, but right now it's
late and I'm tired.
This patch initializes the idmap context, reading the LDB for existing
mappings so that we guarantee that they end up in the same slice. It
also implements the logic for adding a new domain to the context, using
an algorithmic approach to pick the slice to use. This algorithm is
based on murmurhash3 + modulus to limit the result to the available
number of slices. If the hashing ends up colliding with an existing
entry, it will take the next available slice.
This is somewhat improved over the basic autorid algorithm in the common
case, because autorid simply always assigns the next slice in order to
each domain that is added. With this algorithm, a significant portion of
the time (when two domains don't hash to the same slice), we have a
simple and repeatable algorithm. The worst-case situation would be for
every domain in the network to hash to the same value, in which case it
becomes identical to autorid.
This patch does not USE the automatic creation yet. I used
sdap_save_user() as a test example and pre-loaded my cache file with a
domain mapping to prove that it is working. If my above algorithm is
approved, I will move on to implementing that (and group support)
immediately.
The catch with using this new algorithm is that we will most likely end
up needing to propose it as a winbind idmap plugin as well, so as to
minimize differences on systems in the network using winbind instead of
SSSD. I don't think this is a sufficient negative to give up on this
algorithm, however.
I'd like to hear some feedback on the algorithm and approach, please.
11 years, 11 months
[PATCH] NSS: Only return data from initgroups once
by Jakub Hrozek
This bug was revealed with the recent subdomains patches where we would
return initgroups results (and free client context at the same time) both
inside nss_cmd_initgroups_search and in its caller.
11 years, 11 months
[PATCH] murmurhash: Relax inline requirement
by Stephen Gallagher
Building SSSD on GCC 4.7 produces a new warning:
"../src/util/murmurhash3.c:47:17: error: always_inline function might
not be inlinable [-Werror=attributes]"
This patch removes always_inline and replaces it with simply
'inline' (which GCC may remove if it deems it appropriate).
Simo, can you confirm that there's no problem with this? I think it
should be safe.
11 years, 11 months
[PATCH] Subdomain related fixes in responder code
by Jan Zelený
The first part caused problems when using more domains if one of them was
without subdomains.
The second part isn't causing any issues yet but a rare scenario might occur
where this would be a problem.
Thanks
Jan
11 years, 11 months
Support for subdomains - stage 1
by Jan Zelený
Hi guys,
it took me and Sumit some time but we finally have completed the first stage
of support for subdomains. I'm sending all patches in attachment.
This stage has basic support for subdomains but some pieces like PAC support
are left out. We agreed that those can wait for the second stage which depends
on some server side changes that are not ready yet. We'll keep you posted.
Please note that patches depend on Sumit's previous idmap library patch. I'll
get that reviewed either today or tomorrow.
#0001
All sysdby routines that are used in later patches
#0002
Responder routines for asking provider for a list of supported subdomains
#0003
The routine responder_get_domain is modified to look for subdomains as well
when looking for the correct domain descriptor
#0004
If a request for fully qualified entity (user/group) comes to the responder
and its domain has not been found, it updates its list of domains and
supported subdomains in each domain. To update the list, a get_domains call is
sent to each provider.
#0005
Create a list of all domains and subdomains when the first request after start
comes in. To create the list, a get_domains call is sent to each provider.
#0006
Check sub-domains in nss_cmd_get{pwuid|grgid}_search()
#0007
Basic infrastructure for handling get_subdomains requests in providers.
#0008
Add the infrastructure in IPA provider which fetches a list of handled
subdomains from server and stores in in sysdb.
#0009
Currently the connections to the data provider use the same name as the
domain. With sub-domains the name of the sub-domain cannot be used to find the
right data provider connection, hence we store the name of the connection in a
new member.
#0010
Support for subdomain name given to provider when calling get_account_info
#0011
New ID-related config options for subdomains, these have to be present because
IPA provider doesn't provide these values and defaults need to be implemented.
Having defaults on the responder level didn't seem right since the policy
might differ for each domain.
#0012
The routine expand_homedir_template is now used on more place, therefore it
was convenient to move it to util code.
#0013
s2n extended LDAP operation - this is used to ask IPA server for entities from
supported subdomains
#0014
Extend IPA ID provider toi support fetching information for entities within
subdomains
#0015
Support for routing PAM request from reponder to the right provider. Similar
case as patches #3-#6 in NSS responder but much more simple.
#0016
Basic support (or rather un-support) for subdomains in auth providers.
Basically it's designed to acknowledge that the request is not for the main
domain but for subdomain and in that case it supports only SSS_PAM_ACCT_MGMT
and returns error otherwise. Note that similar thing as the IPA backend change
in last hunk is probably not necessary for krb5 backend since when using it,
there will be no subdomains for that domain.
#0017
Support providing sysdb context and domain info per request, not per backend
context. This is necessary for the next patches.
#0018
Accept be_req instead of be_ctx in access providers. Together with the
previous patch, this is needed for the next one.
#0019
Detect if the authorization request came for a user in subdomain and if yes,
replace the original backend-wide sysdb context and domain info with their
subdomain specific replacements.
#0020
Use request-wide sysdb context and domain info instead of their backend-wide
counterparts in HBAC.
That's all folks, have fun reviewing :)
Thanks and bye,
Jan and Sumit
11 years, 11 months