[PATCH] SPEC: Drop rhel5 conditions in spec file.
by Lukas Slebodnik
ehlo,
In theory, it could be possible to build current master without samba
on rhel5, but the spec file would be very complicated.
It is better to simplify spec file.
Patch is attached.
1 file changed, 43 deletions(-) :-)
LS
8 years, 6 months
Patch to fix incorrect PAM return code when user enters invalid credentials
by John Koelndorfer
Hey folks,
Some quick background on this small patch I prepared. I run sssd on my
desktop (and servers) to authenticate against a Samba 4 DC. I found
that when I attempted to log in via KDM and misentered my password, I
got an error about the authentication system failing. Similarly, `su`
would return an error message I was not familar with: "Failure setting
user credentials".
After some inspection of the sssd sources, I found that per
http://pubs.opengroup.org/onlinepubs/8329799/pam_sm_authenticate.htm,
sssd's PAM module is returning the wrong error code when a user
entered bad credentials. PAM_CRED_ERR is being returned instead of
PAM_AUTH_ERR.
Applying the attached patch and recompliing sssd brought back the more
familiar "Authentication failure" when su'ing with a bad password. KDM
also doesn't freak out when I enter an incorrect password.
If you have any questions about the patch, please be sure to include
me in the reply as I'm not on the sssd-devel list.
Thanks for sssd, it has been awesome!
8 years, 6 months
[PATCH] Ignore referrals when ldap_referrals=false
by Jakub Hrozek
Hi,
with the current SSSD code, an LDAP search that results in a referral
fails completely with EIO and usually sends the whole backend to
offline mode. I think this is too strict and if the admin chose to
ignore referrals, we should just skip these results.
John Hodrien in particular was hit by us treating referrals as fatal in
environment where he needs to restrict the search scope by using custom
LDAP search bases.
Also, in cases where Global Catalog support is disabled or GC not available
and a group contains a user from a trusted domain, trying to search for
this DN yields a referral.
Attached is a patch that ignores referrals when the admin set
ldap_referrals=false in the config file.
Given the sdap async code is quite old and I don't remember all the
use-cases, I CC-ed Stephen directly to get some advice. Is there any
risk in ignoring referrals?
8 years, 6 months
[PATCH] libwbclient: SSSD implementation
by Sumit Bose
Hi,
this patch contains the libwbclient implementation for SSSD to allow
Samba file-servers and utilities to use SSSD instead of winbind to map
SIDs, names and POSIX IDs. The related ticket is
https://fedorahosted.org/sssd/ticket/1588.
The SSSD specific calls can be found in files with '_sssd' as part of
the name, the other files are mainly taken from the original Samba
sources because they contain API calls which are independent of the
backend. I have made some minor modification to meet the SSSD coding
style but tried to avoid major changes to make a diff to the original
version more easy. If major issue are found during review I think it
would be a good idea to try to bring the changes back to samba as well.
In wbc_pwd_sssd.c instead of linking in the related sources of the NSS
client I dlopen-ed libnss_sss.so.2 to have more flexibility about where
and how to build the library. I you think this is too much overhead I'd
be happy to change the code to use the NSS client call directly.
The patch does not contain unit test because the Samba source code
already contains some basic tests. I'll try to work with the samba
package maintainer to make this code in a samba-devel or samba-test
package available so that it can be used by SSSD as well.
Basic functional test can be run manually with wbinfo, e.g.:
$ /usr/bin/wbinfo -n 'AD18\Administrator'
S-1-5-21-3090815309-2627318493-3395719201-500 SID_USER (1)
$ /usr/bin/wbinfo -S S-1-5-21-3090815309-2627318493-3395719201-500
1670800500
bye,
Sumit
8 years, 6 months
[PATCH v3 0/4] NFSv4 rpc.idmapd plugin
by Noam Meltzer
Follow patches are the code implementing design document:
https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
Changes compared to v2 of this patch:
* rebase over rev. 8ca18752 (current master)
* remove man pages from the patch (will be sent separately)
* add new contact details for plugin author
* code style
* remove sss_nfs_make_request() wrapper
* fix typo in reply_to_name(): REPLY_ID_OFFSET -> REPLY_NAME_OFFSET
Noam Meltzer (4):
NEW CLIENT: plugin for NFSv4 rpc.idmapd
NFSv4 client: (private) headers from libnfsidmap
NFSv4 client: add to build system
NFSv4 client: add to RPM spec
Makefile.am | 24 ++
configure.ac | 10 +
contrib/sssd.spec.in | 7 +
src/conf_macros.m4 | 30 ++
src/external/libnfsidmap.m4 | 17 +
src/sss_client/nfs/nfsidmap_internal.h | 78 +++++
src/sss_client/nfs/sss_nfs_client.c | 571 +++++++++++++++++++++++++++++++++
7 files changed, 737 insertions(+)
create mode 100644 src/external/libnfsidmap.m4
create mode 100644 src/sss_client/nfs/nfsidmap_internal.h
create mode 100644 src/sss_client/nfs/sss_nfs_client.c
--
1.9.1
8 years, 6 months
[PATCH v5] Add basic support for CI test execution
by Nikolai Kondrashov
Hi everyone,
Here is the fifth version of the patch adding CI scripts.
The differences from the last version are:
* All supported Fedora and RHEL distros are building with Samba again.
* The extra dependencies yum repository [1] is expected to be in the host yum
configuration and is used in mock builds.
* Yum ignoring missing packages during dependency installation is now detected
and considered an error.
* A -n/--no-deps option is added, which disables dependency installation for
use with manual dependency management (e.g. building from source).
* contrib/ci/README.md added.
* The "full" test set is rebranded as "rigorous", selected with -r/--rigorous
to fit better with "essential" and "moderate", but -f/--full option is still
accepted.
Nick
[1] http://copr-fe.cloud.fedoraproject.org/coprs/lslebodn/sssd-deps/
8 years, 6 months
[PATCHES] Implement MIT Kerberos localauth plugin
by Sumit Bose
Hi,
these two patches implement the MIT Kerberos localauth plugin for SSSD.
Since it uses the new plugin style
(http://k5wiki.kerberos.org/wiki/Projects/Plugin_support_improvements)
it has to be activated explicitly. A section like
[plugins]
localauth = {
module = sssd:/path/to/plugin/sssd_krb5_localauth_plugin.so
enable_only = sssd
}
Should work. Please note that this example deactivates any other
mechanism, e.g. .k5login files. See krb5.conf man page of MIT Kerberos
1.12 how to active the mechanism as well.
One of the main use cases for this plugin is an IPA environment with
trust to AD. Currently AD user who want to use SSO with IPA client needed
a .k5login file in their home directory containing their Kerberos
principal. Alternatively krb5.conf has to be edited but here the names
user at the login prompt has to follow a fixed format and are case
sensitive. If the localauth plugin is activated the mapping of Kerberos
principal and user name is done by SSSD.
While I was testing the plugin with ssh I found that st least the Fedora
and RHEL versions of the sshd do not rely completely in the Kerberos
libraries here but do some checks on their own, especially they check
for the existence of the .k5login file in the default configuration.
This check can be disabled by setting KerberosUseKuserok to 'no' but
then sshd does not call krb5_userok() but the more restrictive
krb5_aname_to_localname() and does case sensitive checks on the related
names which won't help much in out case. As a result a .k5login file is
still needed when testing with ssh but it can be empty or contain random
content. I will investigate why OpenSSH is patched in this way on Fedora
and RHEL.
bye,
Sumit
8 years, 6 months
[PATCH] Replace space: add some checks
by Sumit Bose
Hi,
this patch adds some additional checks to the logic or replacing space
with a different character. The idea is to not replace the space if we
might run into trouble with the modified name and log an error.
As mentioned in the commit message if the original name already contains
the replacement character the original name is used and if the input for
the revers operation contains both space and the replacement character
the input is returned unmodified as well. As an alternative it would be
possible to return NULL and cause an error during the lookup. I think
returning the unmodified name is more user friendly. The admin might
wonder why the space is not replaced but at least the name is resolved.
With this patch a name like 'abc def_ghi' is return unmodified if the
replacement character is '_' . But without the check 'abc_def_ghi' is
returned which cannot be resolved back which might cause more trouble
than the space in the name.
bye,
Sumit
8 years, 6 months