this is the first unit test for nested groups. It covers only the most
basic situation when we are trying to resolve one group with no members.
Even though it is only one test, the patch set is quite big. This is
because it creates the possibility to mock providers related modules.
Most of the patches are just a preparation for unit testing providers.
Moves the code around to reduce number of dependencies. (E.g. you do not
want to load fail over when you are testing nested groups.)
Mocks basic SDAP interface.
Mocks sysdb objects - currently user and rfc2307bis group. You can
decide what set of attributes the object should posses. For example,
creating a user requires only basedn and name parameter, to construct
originalDN and name attributes. The rest is provided by (attrname,
value) pairs via variadic function.
mock_sysdb_user(mem_ctx, basedn, name, SYSDB_UIDNUM, uid, ...)
get_attr_type() translates the sysdb attribute name to proper data type.
This should be extended as needed.
Adds provider tests related common object files and cflags in makefile
New macro sss_will_return_always(fn, value). This can be used to mock
function data in such way that any call of mock() will return the value.
It was just pushed also to cmocka upstream as will_return_always().
Removes a noisy debug message.
I would like to get this reviewed before I continue with more test
cases, so the framework is tuned enough.
I also created new macro called fail_msg, which will make the test fail
printing a message. I didn't use this macro in the end, but it made its
way to cmocka upstream.
Tested fix for #2051 and seem to work.
However it just occurred to me we may always want to check if pwd.pw_gid
is listed in the gids returned and add it if not ?
Simo Sorce * Red Hat, Inc * New York
I've pushed quite a couple of patches to the sssd-1-9 branch lately as
part of work on RHEL-6.5. I think it would be nice to use that as basis
of 1.9.6 upstream release.
Is there anything that the users or developers would like to include in the
1.9.6 ? There are some mmap patches on the list that need pushing to 1.9
but apart from them, I think this is pretty much it.
Here is a list of tickets 1.9.6 would fix in the 1.9 branch:
* Enabling enumeration causes sssd_be process to utilize 100% of the CPU
* SSSD doesn't display warning for last grace login.
* [RFE] support autoconfiguring SUDO with ipa provider and compat tree
* SUDO is not working for users from trusted AD domain
* getgrnam / getgrgid for large user groups is too slow due to range retrieval
* [RFE] Add support for suppressing group members
* If previous SRV query failed, the next try might not be retried in some cases
* [abrt] sssd-1.10.0-4.fc19.beta1: get_server_status: Process
/usr/libexec/sssd/sssd_be was killed by signal 11 (SIGSEGV)
* sssd_be goes to 99% CPU and causes significant login delays when client
is under load
* sudoHost mismatch response is incorrect sometimes
* sssd fails to resolve hosts/services once the network is up
* cyclic group memberships may not work depending on order of operations
* sssd fails instead of skipping when a sudo ldap filter returns entries
with multiple CNs
* sssd_be crashing with nested ldap groups contain a dangling member
* sss_cache -N/-n should invalidate the hash table in sssd_nss
* SSSD filter out ldap user/group if uid/gid is zero
* SSSD service randomly dies
* SYSV init script should use @sbindir@
* Enhance sssd init script so that it would source a configuration
* SSSD failover doesn't work if the first DNS server in resolv.conf is
* resolv-tests failing with memory leak
* sssd_nss terminated with segmentation fault
* unite periodic refresh API
* [RFE] Add a task to the SSSD to periodically refresh cached entries
* passwd returns "Authentication token manipulation error" when entering
wrong current password
* Cannot change expired password of an AD user
And here is a complete log of what's currently planned for 1.9.6 (git log
658e275 print hint about password complexity when new password is rejected
f4f0a4c ldap, krb5: More descriptive msg on chpass failure.
261bc18 providers: refresh expired netgroups
edbafc2 back end: add refresh expired records periodic task
f47934c back end: periodical refresh of expired records API
651ab87 back end: periodic task API
4fda997 mmap_cache: Check if slot and name_ptr are not invalid.
560e2b4 resolv-tests failing with memory leak
8d4485d Set default DNS resolution timeout to 6 seconds.
1e50573 Lower timeout to contact DNS server
7a45875 Add a commit template
230e4e4 init script: source /etc/sysconfig/sssd
60d3b25 Configure SYSV init scripts properly
4a3ad2f Handle too many results from getnetgr.
67771f6 Do not call sss_cmd_done in function check_cache.
5d762a9 MAN: Clarify the min_id/max_id limits further
3678074 NSS: Clear cached netgroups if a request comes in from the sss_cache
845deed NSS: allow removing entries from netgroup hash table
f081ea9 LDAP: Fix crash when processing nested groups
c487f42 sudo: print better debug message when a rule has multiple cn values
a810814 sudo: skip rule on error instead of failing completely
e4c8fd0 Every time use permissive control in function memberof_mod.
26df163 Always set port status to neutral when resetting service.
ec7fbcd sudo responder: use different callback for oob refresh
e7769aa IPA: Do not download or store the member attribute of host groups
ab4c050 failover: if expanded server is marked as neutral, invoke srv collapse
5ecdadb collapse_srv_lookup may free the server, make it clear from the API
5e0f0c4 failover: set state->out when meta server remains in SRV_RESOLVE_ERROR
868bf88 Add ignore_group_members option.
c13eb93 Adding option to disable retrieving large AD groups.
200d054 Removing unused functions.
2aaa41c sudo responder: use fully qualified name for subdomain users
96db69c SUDO: IPA provider
ac77faa Display the last grace warning, too
3896c82 Only try to relink ghost users if we're not enumerating
I tested some patches with old distro and I spotted warnings.
-- uninitialized variable (gcc 4.4.7)
-- macro AM_PROG_AR not found in library (automake 1.11.1)
I checked them and all warnings should be harmless, but anyway we don't like
Two patches are attached.
It would be great to have enabled printf format string checking in RHEL7.
Therefore I decided to send pateches for ticket
Patch 0001 -- Even if this patch is first, it should be applied in upstream as
Patch 0002 - 0006 -- trivial
Patch 0007 -- ssize_t is not defined in ANSI c99, IIRC it is defined in posix
as a signed type, therefore format should be used "zd"
Patch 0008 -- size_t is defined in ANSI c99 as unzigned type -> "zu"
Patch 0009 -- wrapper for inttypes.h and for future format macros.
Patch 0012 -- formating types defined in stdint.h uint_32_t ...
-- there are used macros defined in inttypes.h
Patches 0010 - 0015 fix formating for special variables (key_serial_t, rlim_t...)
and for some types I created macros in sss_format.h
Patch 0010 -- key_serial_t is typedef of int32_t, but it could be defined
differently in another (platforms/ implemantations of kerberos)
Patch 0011 -- it seems that rlim_t us the same as uint64_t, but it was defined
using conditional build an not a typedef of std types.
Patch 0013 -- time_t is defined as "long int" sizeof_i386(time_t) != sizeof_x86_64(time_t)
Patch 0014 -- ber_int and ber_tag are typedef for int and unsigned long
Patch 0015 -- gid_t and uid_t are typedef as unsigned
(I checked linux 32 bit, linu 64_bit and freebsd 64 bit)
Patch 0016 -- trivial
Attached patch adds sysdb routine to search users/groups by their SID,
which will be needed for ticket 1568.
I'm sending it now, because one of the patches I have in this working
branch (store group SID) was already written and posted on the list by
Sumit, so not to waste time again :)
Associate Software Engineer
Identity Management - SSSD
Red Hat Czech
Attached are three patches,
[PATCH 1/3] Make subdomain refresh period configurable
* Adds the ad_subdomain_refresh_period and ipa_subdomain_refresh_period
configuration options. This isn't needed to be pushed, but I think it
can be beneficial. Also, I needed to write this anyway to work with the
[PATCH 2/3] DP: Store list of back-end tevent requests
* Adds every created request to list, and removes every terminated. This
is to enable iteration through active requests, to fix the issue
addressed in https://fedorahosted.org/sssd/ticket/1968
[PATCH 3/3] Clean list of domain requests
* fixes https://fedorahosted.org/sssd/ticket/1968
* Goes through the list of tevent requests introduced in previous patch
an those, which match the vanished domain are terminated.
Associate Software Engineer
Identity Management - SSSD
Red Hat Czech