another smaller issue I found when working on other patches. I quickly
scanned the rest of the code and I think we have a similar issue
elsewhere, so we can either accept this patch or file a ticket and fix
the attached patches address ticket
There are some things I'm still not satisfied with and one of them is
refreshing subdomains. Currently the subdomain refresh happens after
startup and then only if a direct lookup for a user or group happens and
the timeout for subdomain refresh is over. So in theory it's possible
that the user and group objects will be refreshed by the enumeration
task only and there would be no lookup to trigger the subdomain refresh.
With master domain enumeration we've solved this problem by
re-downloading master domain info before the enumeration request. We
could do something similar with subdomains (although a little more
involved becase there is always precisely one subdomain), but I didn't
like doing all the changes in 1.11.3. I can code up additional patch
only for master, though.
Something similar is with fallback from GC to LDAP. Although here I'm
not convinced we need to perform the fallback at all, since there are
already patches on the list that implement the option to disable GC
lookups and there will also be a patch to autodetect POSIX attributes in
These patches must be applied on top of my previous patches.
This mail contains all the patches that I have so far in my git.
The following set of patches is related to comments and unchanged
from the previous submission.
I replied to the comments about them in another mail.
I do not think there is anything to address.
If there is please let me know.
The following set of patches addresses comments and fixes
bugs in Unicode/UTF8 conversion
Thanks for review Lukas. I reworked the code significantly.
I think I addressed everything except the initialization comment.
I agree with you that it would have been better to
initialize things outside the loop but I need to read the first buffer
to be able to determine the encoding. This is what causes this logic.
I do not see a way to avoid it so left that part as is.
The following one liner fixes a trace text
The following patches are related to the problem I noticed earlier
and recorded in the ticket https://fedorahosted.org/sssd/ticket/2119
But in reality the cause was bug in the Unicode conversion
and a bug with space processing.
The following patch adds more unit test for both Unicode conversion
and folding by combining the tests together. The unit tests written
for each of them individually are not sufficient to catch corner cases.
This test does. And I played with different constants before checking
in to make sure that all sorts of combinations are caught.
I decided to settle on these numbers because they provide
sufficient amount of testing but do not extend the time too much.
Right now all make check tests take about 7-8 seconds on my laptop.
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
Looking to carve out IT costs?
I have created the patch and attached it with this mail. Kindly review it.
I have commented some of the test as it fails(gives segmentation fault)
when authtoken is NULL. I think we should test tok for NULL before
accessing its elements. Please correct me if am wrong.
for example :
uint8_t *sss_authtok_get_data(struct sss_auth_token *tok)
This should be written as:
uint8_t *sss_authtok_get_data(struct sss_auth_token *tok)
FAST auth is broken for OTP case at least for FreeIPA because krb5_child
returns an empty SSS_OTP message as the last one in the buffer. This message
never got processed by the krb5_child_handler due to the fact that message
size (8 bytes) was triggering the check for buffer length and prematurely
claiming that the whole buffer is malformed.
Fixes https://fedorahosted.org/sssd/ticket/2186 and now I have working ssh logons
with two-factor authentication using native FreeIPA OTP implementation and FreeOTP Android app.
Additionally this patch makes clear how ccache name is passed. It avoids looking into anything
but SSS_PAM_ENV_ITEM message.
/ Alexander Bokovoy
Please find attached the third version of the DEBUG macro refactoring
patchset. The second version was lost to the maillist message size limit, so
I'll list the changes from the first one:
* level limiting condition moved to the macro as requested by Simo,
* macro definition update is separated from the invocation update,
* automatic macro invocation update is separated from the following manual
* invocations using the old debug level (number literals) are updated to
use the new bitmask macros,
* the level conversion function "debug_get_level" is removed.
Please feel free to pick and squash commits as necessary.
Allow me to introduce myself and the suggested contribution to the SSSD
project. PrimaryData Inc. is a startup company in the field of distributed
NAS. As such, we would like to contribute to the SSSD project by developing
support for rpc.idmapd.
Below is our proposed design for this new feature.
*SSS NFS Client (rpc.idmapd plugin) - Design*
We named the client "sss_nfs" (althogh "sss_idmap" or "idmap" might have
been better names, the term "idmap" is already occupied in the SSSD world).
*rpc.idmapd - background*
rpc.idmapd runs on NFSv4 servers as a userspace daemon (part of nfs-utils).
It's role is to assist knfsd by providing the following 6 mapping functions:
1. (user) name to uid
2. (group) name to gid
3. uid to (user) name
4. gid to (group) name
5. principal (user) name to ids (uid + gid)
6. principal (user) name to grouplist (groups which user are member of)
rpc.idmapd provides API for developing plugins (loaded by dlopen(3)) which
implements the actual mapping process.
* note: 5 + 6 are relevant only for kerberised NFSv4 servers. At the first
stage we only purpose a design without kerberos support.
* note2: On the kernel level, there's a caching mechanism for the responses
from the userspace daemon.
*SSSD - Responder*
The functionality required from the Responder side is a subset of the
functionality provided by existing NSS Responder's commands.
As you can see below (on the client part of the design) - no changes are
needed in the NSS Responder.
*SSSD - NFS Client*
*Responder-Facing Interactions (existing NSS Responder commands)*
SSS_NSS_GETPWNAM - map (user) name to uid requests
SSS_NSS_GETGRNAM - map (group) name to gid requests
SSS_NSS_GETPWUID - map uid to (user) name requests
SSS_NSS_GETGRGID - map gid to (group) name requests
The request & reply sent to & from the responder is "standard" in terms of
the NSS Responder.
The client only needs a portion of the reply. Only this portion will be
extracted from the packet (i.e. uid/gid/user name/group name).
The optimisation techniques used for the NSS client will be used here as
well. i.e. Fast Cache (memcache) & negative-cache.
It will be possible for the user to disable Fast Cache from the
configuration file. (see below)
The configuration of the client will be part of rpc.idmap config file
*Linux Software Engineer*
P.O. Box 12650, Herzliya Pituach 4673300
9 Hamenofim St. Akerstein Towers, Tower A, 5th fl. Herzliya
Office: +972-77-8981888 | Fax: +972-3-7617140 | Mobile: +972-54-5873843