[PATCHES] Fix old ccache testing behavior
by Simo Sorce
Addresses #2053 and #2094
Check old ccaches only if needed, always precreate containing directory
if we are goign to proceed with authentication and always fallback to
old algorithm to check user presence on the system if systemd-login
fails or returns negative result.
(Patches as agreed on IRC after several discussions)
All tested and apparently working.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
10 years, 7 months
[PATCH] NSS: Set UID and GID to negative cache after searching all domains
by Jakub Hrozek
Hi,
the first patch fixes the bug that Jean-Baptiste Denis found earlier
today. In case the lookup was not done using a FQDN, the code would skip
setting the entries to the ncache.
The second patch is an incremental improvement. I don't think we should
abort the whole lookup if setting an entry in negcache would fail. The
negative cache is a performance optimization after all.
10 years, 7 months
[PATCHES] Include header file in implementation module.
by Lukas Slebodnik
ehlo,
I wondered how could it happen that prototype function was different than
definition of function "RESPONDER: Use right function prototype".
Reason: we don't have enable warnings Wmissing-declarations.
gcc manual pages says:
Warn if a global function is defined without a previous
declaration. Do so even if the definition itself provides a
prototype. Use this option to detect global functions that are not
declared in header files. In C, no warnings are issued for
functions with previous non-prototype declarations; use
-Wmissing-prototype to detect missing prototypes. In C++, no
warnings are issued for function templates, or for inline
functions, or for functions in anonymous namespaces.
Attached patches include existing header files into implementation files,
but I think we should file a ticket to fix remaining warnings.
(Function should be declared as static or declaration should be in header file.
2nd patch fix warning for following functions
Function | Implementation file without included header file
---------------------------------------------------------
murmurhash3 src/util/murmurhash3.c
ck_leak_check_setup src/tests/common_check.c
sss_base64_encode src/util/crypto/nss/nss_base64.c
sss_base64_decode src/util/crypto/nss/nss_base64.c
nspr_nss_init src/util/crypto/nss/nss_util.c
nspr_nss_cleanup src/util/crypto/nss/nss_util.c
sss_parse_name_for_domains src/util/usertools.c
sdap_dom_enum_send src/providers/ldap/sdap_async_enum.c
sdap_nested_group_send src/providers/ldap/sdap_async_nested_groups.c
sdap_nested_group_recv src/providers/ldap/sdap_async_nested_groups.c
sdap_dyndns_update_send src/providers/ldap/sdap_dyndns.c
sdap_dyndns_update_recv src/providers/ldap/sdap_dyndns.c
become_user src/providers/krb5/krb5_become_user.c
switch_creds src/providers/krb5/krb5_become_user.c
krb5_child_init src/providers/krb5/krb5_init_shared.c
get_uid_table src/util/find_uid.c
check_if_uid_is_active src/util/find_uid.c
sdap_pam_access_handler src/providers/ldap/ldap_access.c
pack_user_info_chpass_error src/util/user_info_msg.c
ipa_s2n_get_acct_info_send src/providers/ipa/ipa_s2n_exop.c
ipa_srv_plugin_ctx_init src/providers/ipa/ipa_srv.c
ipa_srv_plugin_send src/providers/ipa/ipa_srv.c
ad_srv_plugin_send src/providers/ad/ad_srv.c
ad_master_domain_send src/providers/ad/ad_domain_info.c
sss_dp_get_ssh_host_send src/responder/ssh/sshsrv_dp.c
sss_dp_get_ssh_host_recv src/responder/ssh/sshsrv_dp.c
LS
10 years, 7 months
Domain fallback, filter_users and uid
by Jean-Baptiste Denis
Hi,
I'm using a trick, suggested with CAUTION by Jakub, that allows me to
have all user using local home directory
and some honoring their ldap ones.
This is the spirit of my sssd.conf :
====================
[sssd]
config_file_version = 2
services = nss, pam
domains = local_home, ldap_home
[nss]
filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
override_shell = /bin/bash
[domain/local_home]
override_homedir = /home/%u
filter_users = john
id_provider = ldap
ldap_uri = ldap://ldap.example.com/
# same as above, without override_homedir and filter_users
[domain/ldap_home]
id_provider = ldap
ldap_uri = ldap://ldap.example.com/
====================
I think I've got a side effect from this setup when I'm dealing directly
with uid.
For example, if the filtered user has uid 4242, after a fresh restart of
sssd, I cannot perform an uid -> username resolution :
$ getent passwd 4242
$ # NOANSWER
But if try to get the john entry, everything is good after that
$ getent passwd john
john:*:4242:1010:John John:/ldap_home/john:/bin/bash
$ getent passwd 4242
john:*:4242:1010:John John:/ldap_home/john:/bin/bash
But, if I restart sssd, it doesn't work anymore :
# service sssd restart
# getent passwd 4242
# # NOANSWER
Here is the corresponding sssd_nss.log when I've got no answer after
sssd restart :
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [accept_fd_handler] (0x0400):
Client connected!
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_cmd_get_version] (0x0200):
Received client version [1].
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_cmd_get_version] (0x0200):
Offered version [1].
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_issue_request] (0x0400):
Issuing request for [0x4339e0:domains@local_home]
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_get_domains_msg]
(0x0400): Sending get domains request for [local_home][not forced][]
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_internal_get_send]
(0x0400): Entering request [0x4339e0:domains@local_home]
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_issue_request] (0x0400):
Issuing request for [0x4339e0:domains@ldap_home]
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_get_domains_msg]
(0x0400): Sending get domains request for [ldap_home][not forced][]
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_internal_get_send]
(0x0400): Entering request [0x4339e0:domains@ldap_home]
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_req_destructor] (0x0400):
Deleting request: [0x4339e0:domains@local_home]
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [nss_cmd_getpwuid_search]
(0x0100): Requesting info for [4242@local_home]
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [check_cache] (0x0400): Cached
entry is valid, returning..
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [nss_cmd_getpwuid_search]
(0x0400): Returning info for uid [4242@local_home]
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [fill_pwent] (0x0100): User
[john@local_home] filtered out! (negative cache)
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [sss_dp_req_destructor] (0x0400):
Deleting request: [0x4339e0:domains@ldap_home]
(Mon Sep 23 12:32:02 2013) [sssd[nss]] [client_recv] (0x0200): Client
disconnected!
The line that worries me is this one '[fill_pwent] (0x0100): User
[john@local_home] filtered out! (negative cache)'. My request does not
seem to go through my fallback domain "ldap_home".
What do you think ?
10 years, 7 months
[PATCH] mmap_cache: Use two chains for hash collision.
by Lukas Slebodnik
ehlo,
Two patches are attached.
The 1st patch reverts commit 4662725ffef62b3b2502481438effa7c8fef9f80.
"mmap_cache: Skip records which doesn't have same hash"
--next patch lokks nicer with recerted commit 4662725ffe
The 2nd patch changes behaviour of record chaining.
LS
10 years, 7 months
[PATCHES] Fix offline authentication for the AD provider
by Sumit Bose
Hi,
with the following two patches offline authentication in the AD provider
is working again and https://fedorahosted.org/sssd/ticket/2060 should be
fixed.
I started working on a unit test for find_or_guess_upn() but it is not
finished yet because of the number of internal structs needed which must
be created manually. Since the patches were working well in my tests I
decided to send the functional part first and send the tests later.
bye,
Sumit
10 years, 7 months