I took a look into converting the simple access provider to use the new
error codes and I think a patch might not even be needed. The current
request returns errno on error and boolean for access granted/denied.
I think the boolean is actually nice in the case and converting to
ERR_ACCESS_DENIED instead of false doesn't make much sense.
The attached patch just makes the top-level request called by the DP
handler return ERR_ACCOUNT_UNKNOWN in case the user passed via struct
pam_data does not exist in sysdb and ERR_INTERNAL instead of EIO for
internal errors. It would make the error reporting somewhat nicer, I
think, but even if we drop the patch I would like to close
One peculiarity of the sysdb_attrs_get_el interface is that if the
attribute does not exist, then the attrs array is reallocated and the
element is created. But in case other pointers are already pointing
into the array, the realloc might invalidate them.
One such case was in the sdap_process_ghost_members function where if
the group had no members, the "gh" pointer requested earlier might have
been invalidated by the realloc in order to create the member element
I'm actually pondering the idea of renaming the interface to make it
clear that if you request a nonexistent attr, the pointer already
pointing there might become invalid.
I am using the leak check to make sure the dyndns requests do not leak,
but the leak checks were only usable in conjunction with check. This
patch does the following:
* Remove check-specific failure reporting from common_check.c
* Add check-specific abstraction over memleak checks
* Rename common_check.c to leak_check.c
I'm about to develop new provider for RADIUS protocol. I just made some stub and wanted to ask you guys to check the coding style.
My work is available at github repo https://github.com/hujon/sssd.git in branch rad.
So far it's just a really preliminary review which lacks support for RADIUS. I just wanted to know if I'm heading the right way.
1.9.4 on openSUSE 12.3 with Samba4 AD
Everything is fine apart from that we'd like for getent passwd to throw
out all users. At the moment it only returns single user information and
even then only if we specify the user:
<loadsa local users>
<nothing from AD>
getent passwd steve2
We've tried enumerate = TRUE an waited for 30 minute on a test domain
with only 2 users and 2 groups but still getent passwd returns a blank
for domain users.
Everything else is fine. Authentication, group membership. . . Any ideas
on the getent?
(This is my first post here and I've only had time for a quick look
through the archive so please accept my apologies if this is OT.)
passwd: compat sss
group: compat sss
services = nss, pam
config_file_version = 2
domains = default
ldap_schema = rfc2307bis
access_provider = simple
enumerate = FALSE
cache_credentials = true
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
krb5_realm = HH3.SITE
krb5_server = hh16.hh3.site
krb5_kpasswd = hh16.hh3.site
ldap_uri = ldap://hh16.hh3.site/
ldap_search_base = dc=hh3,dc=site
#ldap_tls_cacertdir = /usr/local/samba/private/tls
#ldap_id_use_start_tls = true
ldap_user_object_class = user
ldap_user_name = samAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = loginShell
ldap_group_object_class = group
ldap_group_search_base = dc=hh3,dc=site
ldap_group_name = cn
ldap_group_member = member
ldap_sasl_mech = gssapi
ldap_sasl_authid = HH16$
ldap_krb5_keytab = /etc/krb5.keytab
ldap_krb5_init_creds = true
In the simple access provider, we need to only canonicalize user names when
comparing with values in the ACL, not when searching the cache. The sysdb
searches might do a base search with a DN constructed with the username
which fails if the username is lower case.