New AD provider howto
by Jakub Hrozek
Hi,
our current HOWTO[1] on connecting SSSD to an AD DC is outdated,
mostly because the page still only introduces the LDAP provider. Recently, me,
Sumit and Jeremy Agee wrote a new page that specifically advises to use
the AD provider and also use realmd for setup:
https://fedorahosted.org/sssd/wiki/Configuring_sssd_with_ad_server
We started a new page and kept the old one around mostly because pre-1.9
versions still need the LDAP provider info.
I'd like to get some review and feedback from our community so we can
link the wiki page from the front page or the documentation section. In
addition to the lists, I also CC-ed the individual contributors to the
original page directly..I hope that's fine.
Thank you for your comments.
[1]
https://fedorahosted.org/sssd/wiki/Configuring%20sssd%20to%20authenticate...
9 years, 11 months
Build Fixes
by Benjamin Franzke
Hi,
These two patches add missing CFLAGS/LIBS to Makefile.am:
[PATCH 1/2] BUILD: Link libsss_ad.so to sasl libs
[PATCH 2/2] BUILD: Use OPENLDAP_CFLAGS instead of LDAP_CFLAGS
This underlinking was noticed in make check (dlopen-test).
Note:
It failed for me since my openldap build had no sasl support,
which would otherwise have pulled in libsasl2.so.
Of course, that support should be in place, but the linking should still be
fixed.
BTW: It would propably be nice to have a configure check whether
openldap has sasl support, but it seems that would need a check if
ldap_sasl_interactive_bind returns LDAP_NOT_SUPPORTED.
Regards, Ben
9 years, 11 months
[PATCH] BUILD: Make samba4 libraries optional
by Lukas Slebodnik
ehlo,
Samba 4 libraries are necessary for building {ad, ipa} provider,
but samba4 needn't be available on older distributions.
This patch add possibility to build SSSD without {ad, ipa} provider
and thus without Samba 4 libraries.
The script configure have new argument --with-samba with default value yes.
How to test this patch on fedora >=19 ?
--remove package samba-devel
--run configure script with argument "--with-samba"
The other option is to build srpm with mock/koji with small change in spec.
--sssd should be build without libsss_{ipa,ad}.so and pac plugin
--all test shoudl pass
--there will be error athe end of mock build with
RPM build errors:
File not found: ....
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 9292451..88f5994 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -126,11 +126,6 @@ BuildRequires: libnl3-devel
BuildRequires: libnl-devel
%endif
-# RHEL 5 is too old to support samba4 and the PAC responder
-%if !0%{?is_rhel5}
-BuildRequires: samba4-devel
-%endif
-
%description
Provides a set of daemons to manage access to remote directories and
authentication mechanisms. It provides an NSS and PAM interface toward
@@ -402,6 +397,7 @@ autoreconf -ivf
--with-pipe-path=%{pipepath} \
--with-pubconf-path=%{pubconfpath} \
--with-init-dir=%{_initrddir} \
+ --without-samba \
--with-krb5-rcache-dir=%{_localstatedir}/cache/krb5rcache \
--enable-nsslibdir=/%{_lib} \
--enable-pammoddir=/%{_lib}/security \
Attached are patches for master and 1.11 branch. There was conflict in
conf_macros.m4 and configure.ac
LS
9 years, 11 months
[PATCH] SPEC: Add libsss_ad_common.so to the package sssd-ad
by Lukas Slebodnik
ehlo,
RPM build errors:
error: Installed (but unpackaged) file(s) found:
/usr/lib64/sssd/libsss_ad_common.so
I did not catch it earlier, because I built just a src.rpm from gpo patch
for static analysers.
patch is attached
LS
9 years, 11 months
[PATCH] sss_config: alter configuration file
by Pavel Březina
Hi,
I'm sending some patches that I'll use for OpenLMI provider. It supports
few modifications of sssd.conf through augeas.
For the moment, I think we should not bound to any particular API so
even though I made it a separate object, I don't have any intentions to
make it publicly usable library.
This code will be used from D-Bus responder. I may extend the API if needed.
Unit tests are attached.
9 years, 11 months
[PATCH] SBUS: Allow registering paths with fallback
by Jakub Hrozek
Hi,
Some interfaces we support, such as domain might not be bound to a single
path, but rather anything under a path 'directory'. This patch allows the
SBUS to register a fallback path that would route any messages under a
given anchor to a handler of an interface.
Pavel Brezina had an idea of making the handler interface-driven instead
of path-driven and I would like to match the paths based on object that
were really found and exist, but I believe this patch is good enough to
allow further development on master and we can improve on it later on.
9 years, 11 months
[PATCH] AD: LDAP component of GPO-based access control
by Yassir Elley
Hi,
The attached patch implements the LDAP component of the GPO-based access control project. For more details on the project, see https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration. The project is not yet complete, since the SMB component still needs to be implemented. However, this seems like a useful milestone to allow others to review the code. This is my first patch submission to the list, so any feedback is appreciated.
In order to exercise the code in your AD environment, you will need to link a GPO to the site, domain, or OUs, associated with the policy target (i.e. domain member computer). Since we are not yet retrieving any policy files (over SMB), there is no access control taking place yet, meaning that any policy settings can be used in the GPOs. The only way to determine what is going on is by examining the logs.
In summary, the code currently does the following:
1. Determines the DN of the policy target (e.g. "cn=f20-laptop,OU=West,OU=Sales,DC=foo,DC=com")
2. Calculates the list of SOM DNs (Site, Domain and OUs) associated with the policy target DN
3. Retrieves various LDAP attributes from each SOM DN in order to populate a list of GPLinks (i.e. GPO DN plus GPO Options)
4. Creates a prioritized list of GPO DNs based on SOM Priority, Link Order, and GPO Options
5. Retrieves various LDAP attributes from each GPO DN in order to populate a list of candidate GPOs
6. Converts the candidate list to a filtered list, by removing any GPO that has a DACL which denies the policy target permission to apply the GPO
7. It is this filtered list that will be sent to the Short-Lived GPO Child process, which will make the necessary blocking SMB calls
Regards,
Yassir.
9 years, 11 months