[PATCH] SSS_CLIENT: Fix uninitialized value error
by Stephen Gallagher
This would cause a crash if we jump to the done: label before it
has been allocated.
Pushed to master under the one-liner rule. This same issue was also
addressed by Jan's patch "Provide service filter for SELinux context",
but only in the 1.8.x branch by mistake.
11 years, 10 months
[PATCH] Support DIR: credential caches
by Jakub Hrozek
[PATCH 01/11] Two small krb5_child fixes
ssia
[PATCH 02/11] Provide more debugging in krb5_child and ldap_child
I started this patch before Nick did, maybe it would still be useful, at
least the parts that get rid of level-9 DEBUG messages.
[PATCH 03/11] Allow redefining the KRB5_CHILD path
The krb5-child-test will want to run the child from the build directory.
[PATCH 04/11] Split parse_krb5_child_response so it can be reused
krb5-child-test will be another consumer. It also makes the code more
readable by splitting a huge function.
[PATCH 05/11] Add a krb5_child test tool
https://fedorahosted.org/sssd/ticket/1127
[PATCH 06/11] Residual util functions
Kerberos credential caches can be specified by TYPE:RESIDUAL. This pa
tch adds a couple of utilities to support parsing if ccache locations,
checking types etc.
[PATCH 07/11] Handle trailing slash in the ccname template
With the DIR cache support, it's perfectly legal to specify a ccname
directory that ends with a slash. The create_dir function did not han dle
that situation correctly. The unit test is included in the DIR: cache
patch, because it uses the cc_dir_create() function.
[PATCH 08/11] Add a credential cache back end structure
To be able to add support for new credential cache types easily, this
patch creates a new structure sss_krb5_cc_be that defines common with
a credential cache, such as create, check if used or remove.
[PATCH 09/11] Add support for storing credential caches in the DIR: back end
https://fedorahosted.org/sssd/ticket/974
Please note that only the TGTs acquired by the krb5_child have changed,
the ldap_child still puts its ccache into /var/lib/sss/db.
The cc_dir_remove() function is a little odd, I tried to use the krb5
API directly, but I think I found a bug in libkrb5. For a subsidiary
cache that does not exist (DIR::/no/such/path), the following code would
segfault:
krb5_cc_resolve(context, location, &ccache); // returns EOK
krberr = krb5_cc_destroy(context, ccache); // KRB5_FCC_NOFILE
if (krberr) {
if (ccache) krb5_cc_close(context, ccache); // SIGSEGV
}
[PATCH 10/11] Use Kerberos context in KRB5_DEBUG
Passing Kerberos context to sss_krb5_get_error_message will allow us to
get better error messages. This patch technically belong earlier, but
rebasing would be hard at this point.
[PATCH 11/11] Switch Kerberos cache default to DIR
Just switches the defaults.
11 years, 10 months
[PATCH] Fixed subdomain-related issue in re_expression matching
by Jan Zelený
One part of the matching was to check whether domain part of fully
qualified name is a name of a domain or any of its subdomains. The
problem is that at the time of first request we don't yet have lists of
subdomains.
One solution would be to issue a request to data provider, asking for a
list of subdomains but mixing subdomain logic with re_expression
matching doesn't seem right. Therefore this patch deletes the check for
specific domain name, leaving only check for a specific format.
Thanks
Jan
11 years, 10 months
[PATCH] Fix an issue in ghost users
by Jan Zelený
There was an issue with ghost members in nested groups. Consider a
scenario with two groups A and B, B being member of A and having some
ghost members. In such case SSSD stored both groups, then added
membership between them and then added ghost members to the group B.
The problem was that adding ghost members to group B didn't propagate
these ghost members to group A. This functionality could have been
solved by memberof plugin but the logic is far more complicated that
changes this patch introduces.
The change is simple: add ghost members at the same time as the group is
created, even if groups are supposed to be stored in two passes. That
way ghost members will be present at the time A -> B membership is
created and they will be propagated as expected.
I've tested this with plain RFC2307bis and IPA schema, more tests are
welcomed.
Thanks
Jan
11 years, 10 months
[PATCHES][PRELIMINARY] Add support for AD's chain matching filter
by Stephen Gallagher
This is the second set of patches. These aren't quite ready for a
complete review. They are functional, but they need some discussion.
These patches attempt to implement
https://fedorahosted.org/sssd/ticket/1367.
For details on the "magic" filters, see
http://msdn.microsoft.com/en-us/library/windows/desktop/aa746475%
28v=vs.85%29.aspx (http://goo.gl/Czjlf if that doesn't come through
email well).
Patch 0001: Add new option "ldap_use_matching_rule_in_chain". This patch
is very incomplete. It only adds the new option. It is missing
SSSDConfig API entries and manpages. It is included because it's
necessary to test the other two patches.
Patch 0002: Add support for the chain matching filter when performing
group lookups. This is the contentious patch. It works, but it does not
have the performance gain I might have expected. I need to do some
re-testing on beefier hardware, but this approach has two major
performance downsides compared to the existing approach.
1) The existing approach takes advantage of the ASQ lookup, which (by
accident or design on Microsoft's part) ignores the limits on page size
per lookup. As a result, we can do a single lookup for all of the users
at a particular nesting level. With the match filter, we have to use the
paging control and request additional pages (meaning additional
round-trips). Net result is that the existing approach is faster for the
common case (only one or two nestings).
2) This is the bigger issue, though it may be a flawed test (I'll
explain in a moment). In addition to multiple round-trips to the server,
each round-trip in my tests was taking between 2x and 3x the time to
return. I suspect that this may be due in part to the fact that my
target server was a fairly wimpy CPU-and-memory VM, but it does reveal
that lookups using this filter against very large groups causes a
significantly increased strain on the AD server.
With both of those downsides in mind, I'm considering scrapping this
portion of the solution. Additional input is welcome.
Patch 0003: Add support for the chain matching filter when performing
initgroups lookups. This patch is much more performant (due in large
part to the fact that in the average case, the set of groups a user
belongs to will almost always fall within a single paged search). With
this patch, I consistently see 'time id -G <username>' reduced by 50%.
That makes this patch a clear performance victory in my mind.
11 years, 10 months
[PATCHES] Some assorted bugfixes and helpers
by Stephen Gallagher
Sending patches in two parts. These first five are (I believe) ready for
a complete review. I will send three more in a [PRELIMINARY] thread as
well, since they require some discussion.
Patch 0001: Fix the debug levels for some sysdb user and group lookups.
Success was too noisy and failure was not noisy enough.
Patch 0002: Remove block of code that appears twice in the same
function. Looks like a copy-paste error.
Patch 0003: Fix incorrect switch statement in sdap_get_initgr_done()
SDAP_SCHEMA_AD needs to be calling sdap_initgr_rfc2307bis_recv(),
not sdap_initgr_nested_recv(). By coincidence both recv functions
happened to be identical, but if one or the other changed, this
would break unexpectedly.
Patch 0004: Add helper function to get list of a user's groups from
sysdb
This is being made into a function so it can be reused in one of the AD
patches I'll be sending shortly.
Patch 0005: Make sdap_initgr_common_store() non-static
Move it to a private header so it can be reused by other
initgroups C files. This is being made public so it can be reused in my
AD patches.
11 years, 10 months