sssd-devel May 2013

sssd-devel@lists.fedorahosted.org

28 participants
99 discussions

Start a nNew thread

[PATCH] Add ldap_autofs_map_master_name option
by C. S. 12 Nov '13

12 Nov '13

Add ldap_autofs_map_master_name option so that the auto master map name change be changed from the default auto.master.

3 17

[PATCH] Removing unused parameter type from sudosrv_get_sudorules_query_cache()
by Lukas Slebodnik 28 Aug '13

28 Aug '13

Hi, this patch should solve ticket https://fedorahosted.org/sssd/ticket/1825 LS

3 5

[PATCHES] SSH: When host is removed from LDAP remove it from the, cache as well
by Jan Cholasta 27 Jun '13

27 Jun '13

Hi, the attached patches fix <https://fedorahosted.org/sssd/ticket/1949>. Honza -- Jan Cholasta

3 4

[PATCH] Every time return directory for krb5 cache collection.
by Lukas Slebodnik 26 Jun '13

26 Jun '13

ehlo, Function krb5_cc_get_full_name is called only as a way to validate that, we have the right cache. Instead of returned name, location will be returned from function cc_dir_cache_for_princ. https://fedorahosted.org/sssd/ticket/1936 Patch is attached. LS

5 23

[PATCH] Don't use srcdir with tests
by Jakub Hrozek 21 Jun '13

21 Jun '13

Without this patch I can't build SSSD for rawhide as new autoconf versions error out when $(srcdir) is used in TESTS: Makefile.am:149: error: using '$(srcdir)' in TESTS is currently broken: '$(srcdir)/src/config/SSSDConfigTest.py' parallel-tests: installing 'build/test-driver' Makefile.am:149: error: using '$(srcdir)' in TESTS is currently broken: '$(srcdir)/src/tests/pyhbac-test.py' Makefile.am:149: error: using '$(srcdir)' in TESTS is currently broken: '$(srcdir)/src/tests/pysss_murmur-test.py' Not using srcdir is OK as the GNU manual states: "Automake ensures that each file listed in TESTS is built before it is run; you can list both source and derived programs (or scripts) in TESTS; the generated rule will look both in srcdir and .." This is an excerpt from: http://www.gnu.org/software/automake/manual/automake.html#Scripts_002dbased…

3 9

[PATCH] Removing BUILD.txt content
by Ariel Barria 20 Jun '13

20 Jun '13

Patch for remove BUILD.txt content.

5 11

I heard you were in a need for a logo?
by Tuomas Kuosmanen 20 Jun '13

20 Jun '13

Hello. And nice to meet you. I was being asked by Alexander Bokovoy to do a new logo to represent SSSD. I gave it some cycles. Here are two ideas that came to my mind, please let me know if you like them? http://www.tigert.com/designspace/sssd-logoideas.png The designs are more or less just the "metaphor" - focusing on the basic idea, not the actual representation yet. Let me know how you like them? :-) I know Garrett had some ideas too, I'll poke him about the discussion here as well, put him on Cc, if he has something to share. //Tuomas

9 21

[PATCH] Send error message from krb5_child to backend.
by Lukas Slebodnik 14 Jun '13

14 Jun '13

ehlo, Commit c6872e79e8496fd075e20aec0343ade99cca725c caused that password migration doesn't work using sssd. If pre authentication failed then we should send message to backend, so password migration could be detected. https://fedorahosted.org/sssd/ticket/1873 Patch is attached. LS

3 6

Design Discussion: IPA Server Mode
by Sumit Bose 13 Jun '13

13 Jun '13

Hi, I have created a design page for one of the next major features of SSSD at https://fedorahosted.org/sssd/wiki/DesignDocs/IPAServerMode . The basic idea is that if SSSD is running on a FreeIPA server it should help the FreeIPA server to look up users and groups from trusted domains. For your convenience the content can be found below as well. Comments are suggestions are welcome. bye, Sumit == IPA Server Mode == Related tickets: * [https://fedorahosted.org/sssd/ticket/1821 RFE Allow using UIDs and GIDs from AD in trust case] * [https://fedorahosted.org/sssd/ticket/1881 RFE Determine how to map SID to UID/GID based on IdM server configuration] * more to come === Problem Statement === FreeIPA is planning to make users and groups from trusted domains available to legacy systems, e.g. systems where only nss_ldap and pam_ldap are available. For this a new directory server plugin ([https://fedorahosted.org/freeipa/ticket/3567] will accept the LDAP search request from the legacy systems for the trusted users and groups, resolve the requested objects and send the result back to the legacy client. Since all trusted users and groups are resolvable on the IPA server via the SSSD IPA provider the idea is that the new plugin will just run getpwnam_r(), getgrnam_r() and related calls. The SSSD disk and memory cache will help to answer those request fast without the need of additional caching inside the directory server. To offer reliable group lookups to legacy systems it must be possible to lookup all the members of a group from a trusted domain and not only show members which already logged in once on the FreeIPA server, which is the current status on IPA clients with a recent version of SSSD. Additionally legacy systems tend to rely on user and group enumerations. Both requirements force an enumeration and caching of all trusted users and groups on the FreeIPA server. If the legacy systems used an algorithmic mapping scheme based on the RID of the AD object and an offset to find a POSIX ID for the trusted user or group the ''--base-id'' of the ''ipa trust-add'' command can be used to get the same ID mapping. For legacy systems which read the POSIX IDs directly from AD a new idrange type must be introduced on the FreeIPA server ([https://fedorahosted.org/freeipa/ticket/3647] to indicate that for those trusted users an groups the POSIX ID must be read from AD. All of the above can basically be solved with the current layout of the FreeIPA server where winbind is doing the lookups against AD and SSSD is using the extdom LDAP plugin to read this data via the directory server. But it was decided to enhance SSSD to do the lookup. Some of the reasons are: * resources, since SSSD has to run anyway on the FreeIPA server and is capable of the AD user and group lookups, winbind does not have to run anymore * avoid double caching, to work efficiently winbind has to do some caching on its own and as a result users and groups are cached twice on the FreeIPA server * configuration, winbind uses a separate configuration file while the IPA provider of SSSD can read e.g. the idranges directly from the FreeIPA server, this minimized to configuration effort and avoids conflicting configuration of different components === Overview of the solution === First sssd needs to know that it is running on an IPA server and should not look up trusted users and groups with the help of the extdom plugin but do the lookups on its own. For this a new boolean configuration option, e.g. ipa_server_mode, should be introduced ('''SSSD ticket#''') which defaults to ''false'' but is set to ''true'' during ipa-server-install or during updates of the FreeIPA server ([https://fedorahosted.org/freeipa/ticket/3652] if it is not already set. Since AD by default requires an authenticate LDAP bind to do searches SSSD needs credentials which are accepted by a trusted AD server. Because if the trust relationship this can even be credentials from the FreeIPA domain if Kerberos is user for authentication. So the easiest way is just to use the local keytab which requires no changes on the SSSD side, because the generic LDAP provider already knows how to handle SASL bind with the local keytab. But currently AD LDAP server does not accept the Kerberos ticket from a FreeIPA host, because the FreeIPA KDC does not attach a PAC to the TGTs of host/ principals ([https://fedorahosted.org/freeipa/ticket/3651] until this is fixed some dummy credentials, e.g. a keytab for a dummy user, can be used). Now the AD provider code can be used to lookup up the users and group of the trusted AD domain. Only the ID-mapping logic should be refactored so that the same code can be used in the standalone AD provider where the configuration is read form ssd.conf and as part of the IPA provider where the idrange objects read from the IPA server dictates the mapping. Maybe libsss_idmap can be extended to handle idranges for mappings in AD as well, e.g. a specific error code can be used to indicate to the caller that for this domain no algorithmic mapping is available and the value from the corresponding AD attribute should be use ('''SSSD ticket?'''). A task (or a separate process) must be created to handle enumerations efficiently without having to much impact on parallel running requests ('''SSSD ticket#'''). Maybe we can find a scheme which allows to read only a limited (configurable) number of users with their group memberships at a time. This way the cache might not be complete at once but always consistent with respect to group memberships of the caches users. If eventually all users are read, the task will periodically look for new users and update old entries. === Implementation details === ==== Add ipa_server_mode option ==== A new boolean option ipa_server_mode which defaults to false should be added to the IPA provider. ipa_get_subdom_acct_send() should only be called if ipa_server_mode is false. If ipa_server_mode is true ipa_account_info_handler() should return ENOSYS for subdomain requests. A suitable tevent request will be handled in a different ticket. ==== Enhance libsss_idmap ==== 1. Allow algorithmic mapping where the first RID is not 0 Currently it is implicitly assumed that the first POSIX ID of a range is mapped to the RID 0. To support multiple ranges for a single domain a different first RID must handled as well.[[BR]] Ticket: #1938 2. Add a range type to handle mappings in AD ==== Add plugin to LDAP provider to find new ranges ==== Currently the range management code is in the generic LDAP provider and can be used by the LDAP and AD provider. New ranges are allocated with the help of a hash value of the domain SID. If the IPA provider cannot find a range for a given domain it cannot allocate a new range on its own but has to look up the idrange objects on the FreeIPA server and use them accordingly. To allow the LDAP, AD and IPA provider to use as much common code as possible I think a plugin interface, similar to the one used to find the DNS site, to find a missing range would be useful. The default plugin will be used by the LDAP and the AD provider and the IPA provider will implement a plugin to read the data from the server. ==== Integrate AD provider lookup code into IPA subdomain user lookup ==== If the ipa_server_mode is selected IPA subdomain user and group lookups should not be done with the help of the extdom plugin but directly against AD with the help of LDAP of GC lookups. For this the IPA provider must be able to call the related functions from the AD provider. Since by default the POSIX attributes are not replicated to the global catalog and supporting them is a requirement, I think it would be sufficient make sure LDAP lookups are working as expected. Additionally FreeIPA currently supports only one trusted domain global catalog lookups for users and groups from the forest or different forests can be added later. Since the Kerberos hosts keys from the host keytab should be used as credentials to access AD no changes are expected here. It should be taken care that not accidentally the the AD SRV plugin is loaded, see next section as well. ==== Enhance IPA SRV plugin to do AD site lookups as well ==== >From the AD point of view trusted domains do not belong to a specific site. But recent version of AD return the next_closest_site for host which do not belong to a site. To make sure that SSSD is communication with an AD server which is network-wise reasonably near it would be useful if the IPA SRV plugin can be enhanced to do CLDAP pings and AD site lookups as well. Additionally the plugin must know when to use IPA style and when AD style lookups. This is a nice to have feature. ==== Implement or Improve enumeration ==== If enumeration is enable SSSD tries to update all users and groups at startup. As a result the startup time where SSSD is basically blocked and cannot serve requests even for data in the cache can be quite long. A new tevent_req task should be created which can read users and groups from the AD domain in smaller chunks so that other request can always slip in between. The task should make sure all users and groups are read after a while without reading objects twice in a single run. Maybe it is possible to add a special paged-search tevent request which returns after the first page is read to the caller (instead of doing the paging behind the scenes) which the results and a handle which would allow to continue the the search with the next page? If this is a way to go creating this new request would be another development subtask. Additionally it has to be considered how to handle large groups. But since we have to read all user as well it might be possible to just read the group memberships of the user and build up the groups in the SSSD cache and let the getgrp*() calls only return entries from the cache and never go to the server directly. === How to test === If the ipa_server_mode is enable on a FreeIPA server which trusts an AD server, ''getent passwd AD\username'' or ''id AD\username'' should return the expected results for users and groups. ''getent group AD\groupname'' should return results depending the state of enumeration. Immediately after startup with an empty cache e.g. the 'Domain User' group should only have a few members if any. After some time more and more members should be displayed until the enumeration is complete and all users and groups are in the SSSD cache. === Author(s) === Sumit Bose <sbose(a)redhat.com>

5 16

[PATCH] Split the providers into separate subpackages
by Jakub Hrozek 11 Jun '13

11 Jun '13

Hi, the attached patch splits the previously monolithic sssd package into sssd-common that contains the deamon and the responders and per-provider packages such as sssd-ldap or sssd-ipa. This split would benefit two parties: 1) security auditors who are often trying to find the smallest package set including dependencies needed for the package to function. They would be able to i.e. install sssd-ldap and not bother about sssd-ipa or sssd-ad pulling in more dependencies. 2) 3rd party programs such as realmd or authconfig that would only be able to require or install on demand the needed packages. The patch addresses https://fedorahosted.org/sssd/ticket/1510 and must b applied on the two specfile patches I sent earlier (the thread subject included libsss_sudo).

5 22

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel May 2013