the attached two patches are not strictly related to tokenGroups
processing, but it's very easy to reproduce the problem that way. The
issue is only confusing DEBUG messages, but it has already cost me
several hours in processing logs from an SSSD user, so I think a fix is
due, at least for master.
See the patches and the commit messages for more details.
please see attached patch.
This patch was previously written for BZ 1059423. But it now seems that
more detailed logging information is generally useful for issues that
are emerging from this area lately.
-----BEGIN PGP SIGNED MESSAGE-----
All of these patches require Nikolai's "DEBUG Macro Refactoring v3"
patches to be applied first.
Patch 0001: Allow debug_fn to process __FILE__ and __LINE__
In preparation for enabling journald support for the DEBUG logs, we
will need to be able to pass in certain additional arguments that will
be required, specifically the code file and line number.
We will be able to optionally enable this in the file-based logs as well
if we so choose, but for right now we will avoid breaking the log
format on disk.
Patch 0002: Enable sending structured debug logs to journald
We are now able to send structured debug logs to journald, tagged with
the code file, line number and domain that the log pertains to. To
enable this functionality, SSSD must be configured at build-time with
- --with-syslog=journald and must be launched without -f/--debug-to-files
This behavior is nearly identical to how SSSD will function today on a
systemd-based system if --debug-to-files is disabled, since it will
redirect stdout and stderr into journald. This patch merely enhances
the situation to send structured logs instead of simple string messages.
Patch 0003: BUILD: Build with journald support by default on Fedora
The journal provided by systemd gives us structured logging
capabilities that we should be taking advantage of.
Note: this patch explicitly does not change the systemd unit file for
SSSD. Right now, an administrator will need to manually remove the
'-f' from ExecStart in the unit file to send debug logs to journald. I
suspect we'll want to discuss this before we make it the default. This
patch DOES change the default for sss_log messages to use
sd_journal_send() instead of straight log() for those messages that we
traditionally sent to the syslog (such as login events). This is code
that has been in place for some time now, but has not been the default
because we hadn't build with --with-syslog=journald.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
-----END PGP SIGNATURE-----
this bug was reported on #sssd by a user. He was running some flavor of
IBM Tivoli where the entries only had an "ID", not separate "UID" and
"GID". But due to a bug in sssd he couldn't use the same value for both,
ldap_user_uid_number = idAttribute
ldap_user_gid_number = idAttribute
only saved the ID into UID and left GID empty. It appears we have a long
standing bug in sdap_parse where we only consider first match. If this
patch is accepted, I would also like to refactor sdap_parse in master
because currently it is a 250-lines long function with multiple
This is the last patch related to ticket
The warnings here are currently all false positives (refcount) or
the alignment is calculated during runtime with PADDING_SIZE macro
so this patch is just about silencing the compiler.
The patch is attached.
The attached patch adds support for gpo permissive mode. Specifically, if the ad_gpo_access_control option is set to "permissive" (which it is by default), and the gpo-based access control evaluation indicates that the user is denied access, then a syslog message is emitted indicating that the user would have been denied logon access if the option were set to "enforcing".
In order to simplify sending syslog messages to the security log (with or without journald), I have introduced a generic sss_log_ext function, which can be used with any syslog facility (including our standard "LOG_DAEMON" facility, as well as the security log "LOG_AUTHPRIV" facility).
This patch depends on a previously submitted patch ("Add initial gpo-smb implementation"), which has not yet been pushed to master.
The attached patch adds an initial gpo-smb implementation. It uses SMB to retrieve HBAC policy files, evaluate them, and enforce the whitelists and blacklists found in those policy files. This is an initial implementation and there are a few things that I am planning on implementing, but are not part of this patch.
This patch does not implement:
* the "permissive" mode, in which the policy files are evaluated, but not enforced
* a separate gpo_child process to make the blocking libsmbclient calls
* use of a cache
* few other things
As such, most of this patch will be moved to a separate gpo_child process in a subsequent patch.
Also note that some (but not all) of the changes that were pushed to master as part of my patch titled "add libsmbclient to makefiles" seem to have been deleted by subsequent pushes to master. As such, this patch reintroduces those changes (which only affect configure.ac and libsmbclient.m4).
Hello sssd-devel & linux-nfs,
This is v2 of the patch set. It is now sent to linux-nfs as weel, following
Steve Dickson request.
The code in the next 5 patches implements the design document:
The changes in the code (compared to v1) are following the review done in
I believe that there are still two items in dispute (no final verdict was given
in the sssd mailing list) but this new patch set will give a chance to have a
cleaner look on things.
Linux Software Engineer
P.O. Box 12650, Herzliya Pituach 4673300
9 Hamenofim St. Akerstein Towers, Tower A, 5th fl. Herzliya
Office: +972-77-8981888 | Fax: +972-3-7617140 | Mobile: +972-54-5873843
Noam Meltzer (5):
NEW CLIENT: plugin for NFSv4 rpc.idmapd
NFSv4 client: (private) headers from libnfsidmap
NFSv4 client: add to build system
NFSv4 client: man page
NFSv4 client: add to RPM spec
Makefile.am | 19 ++
configure.ac | 10 +
contrib/sssd.spec.in | 8 +
src/conf_macros.m4 | 30 ++
src/external/libnfsidmap.m4 | 17 +
src/man/Makefile.am | 4 +-
src/man/include/seealso.xml | 4 +
src/man/sss_rpcidmapd.5.xml | 97 ++++++
src/sss_client/common.c | 5 +
src/sss_client/nfs/nfsidmap_internal.h | 78 +++++
src/sss_client/nfs/sss_nfs_client.c | 569 +++++++++++++++++++++++++++++++++
src/sss_client/sss_cli.h | 2 +
12 files changed, 842 insertions(+), 1 deletion(-)
create mode 100644 src/external/libnfsidmap.m4
create mode 100644 src/man/sss_rpcidmapd.5.xml
create mode 100644 src/sss_client/nfs/nfsidmap_internal.h
create mode 100644 src/sss_client/nfs/sss_nfs_client.c