This patch depends on my other AD enumeration patches.
Some AD or AD-like servers do not contain the netlogon attribute in the
master domain name. Instead of failing completely, we should just abort
the master domain request and carry on. The only functionality we miss
would get getting users by domain flat name.
Protype of function sss_ncache_check_netgr was different than
definition of function sss_ncache_check_netgr. We did not catch it,
because header file "responder/common/negcache.h" was not included in
implementation file "responder/common/negcache.c"
Simple patch is attached.
I found these minor issues in our man pages, when triaging support
issues with Red Hat GSS earlier today.
The first patch changes the subtitle of the man pages. I wasn't
completely sure if the title is set to "SSSD config file" on purpose
(after all they do describe the config file, just per-provider), but I
think that at least the Kerberos locator man page should be fixed.
The second patch fixes indentation of programlisting. The programlisting
element makes the text in the element formatted verbatim, so it would
have appeared too much to the right.
I've got an sssd configuration with two ldap domains. The nss part of
the configuration is this one :
filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd
override_shell = /bin/bash
entry_negative_timeout = 15
debug_level = 0x02F0
I've got a program that crawl a filesystem. For some reason, a bunch of
files have an uid which do not "resolve" to anything. My ldap backend
are hammered with requests like this one :
slapd: conn=361745 op=1712 SRCH base="ou=users,dc=example,dc=com"
scope=2 deref=0 filter="(&(uidNumber=1047)(objectClass=posixAccount))
In /var/log/sssd/sssd_nss.log, it correspond to a lot of :
[sssd[nss]] [nss_cmd_getpwuid_search] (0x0040): No matching domain found
for , fail!
I thought that the "entry_negative_timeout" in the nss part of the
configuration would prevent this kind of behaviour, but I obviously
didn't guess right.
Any advice ?
attached are patches that improve how we enumerate AD domains. The
problem is that currently the domain info (subdomain and master domain)
is downloaded when a responder queries the DP for domain info. But when
enumeration is enabled, the responder might not contact the DP at all as
the enumeration task runs on its own. I think the best solution is to
extend the enumeration task so that it also downloads the domain data
About the implementation, I was considering two options. One is the way
I took where the enumeration request is simply extended with downloading
master domain data. The other approach I was considering was extending
the generic enumeration request with downloading domain data which the
generic request would just shortcut. While this might seem like a better
approach, it also seemed like a complete overkill..but I'd like to hear
[PATCH 1/3] AD: async request to retrieve master domain info
Adds a reusable async request to download the master domain info.
This patch just splits the master domain request from the subdomain
[PATCH 2/3] LDAP: sdap_id_setup_tasks accepts a custom enum request
AD provider will override the default with its own.
[PATCH 3/3] AD: Download master domain info when enumerating
Adds the master domain download task before the enumeration.
attached are two small patches I wrote when I was checking whether
Fedora's move to journald affects us or not. Patch #1 adds a new
configure option, that, if enabled, routes logging via journald's API.
No change in logging format is present in this patch. You need to have
systemd-devel installed -- if the patches are accepted I'll amend the
specfile as well, but I didn't want to waste time now.
Patch #2 adds acts as kind of a demonstration of journald's extended
capabilities. The patch adds a new field that contains SSSD domain name
and makes it easy to distinguish log messages coming from different
# journalctl SSSD_DOMAIN=foo.example.com