[PATCH] IPA: Use GC for group lookups in server mode
by Jakub Hrozek
Hi,
the attached patch enables cross-domain group lookups.
Even though AD trusts often work with POSIX attributes which are
normally not replicated to GC, our group lookups are smart since commit
008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using
the LDAP connection and only use the GC connection to look up the members.
I tested the patch with trusts that use ID-mapping, there the
cross-domain memberships are resolved fine.
For setups that use POSIX mapping, only the members from the domain that
the group belongs to is visible -- that is because the AD back end
currently tests if POSIX attributes are in use and if they are, GC
support is completely disabled. Perhaps this is something to work on in
1.13 when we refactor the group membership, but for now I'd like to keep
the patch (and associated risk) minimal.
9 years, 6 months
[PATCH] UTIL: Do not change SSSD domains in get_domains_head
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
When there was more than one SSSD domain configured, actions performed
against domains later in the list would be incorrectly told to use the
first domain as the base for locating subdomains. This was because we
were rewinding the ->prev list on the sss_domain_info object, which is
only intended to be used by confdb code. The correct approach was to
use only the parent linkage, which would take us up to the top-level
domain in this SSSD domain.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlQi3YEACgkQeiVVYja6o6PqAACgjb4ISPCELnMMBIoKKHX/tj8r
UdgAmQHRTCMC0BQo8oBlFy4ZKNj1gshs
=AaTR
-----END PGP SIGNATURE-----
9 years, 6 months
[PATCH] PAM: Add domains= option to pam_sss
by Daniel Gollub
Fixes:
https://fedorahosted.org/sssd/ticket/1021
Signed-off-by: Daniel Gollub <dgollub(a)brocade.com>
Reviewed-by: Sven-Thorsten Dietrich <sven(a)brocade.com>
---
src/providers/data_provider.h | 1 +
src/responder/pam/pamsrv_cmd.c | 44 +++++++++++++++++++++++++++++++++++++++++-
src/sss_client/pam_sss.c | 29 ++++++++++++++++++++++++++--
src/sss_client/sss_cli.h | 1 +
4 files changed, 72 insertions(+), 3 deletions(-)
diff --git a/src/providers/data_provider.h b/src/providers/data_provider.h
index ebb4fad..0abfd0f 100644
--- a/src/providers/data_provider.h
+++ b/src/providers/data_provider.h
@@ -170,6 +170,7 @@ struct pam_data {
char *tty;
char *ruser;
char *rhost;
+ char **requested_domains;
struct sss_auth_token *authtok;
struct sss_auth_token *newauthtok;
uint32_t cli_pid;
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index 140d541..c6539e5 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -44,6 +44,26 @@ enum pam_verbosity {
static void pam_reply(struct pam_auth_req *preq);
+static bool is_domain_requested(struct pam_data *pd, const char *domain_name)
+{
+ int i;
+
+ /* If none specific domains got requested via pam, all domains are allowed.
+ * Which mimics the default/original behaviour.
+ */
+ if (!pd->requested_domains)
+ return true;
+
+ for (i = 0; pd->requested_domains[i]; i++) {
+ if (strcmp(domain_name, pd->requested_domains[i]))
+ continue;
+
+ return true;
+ }
+
+ return false;
+}
+
static int extract_authtok_v2(struct sss_auth_token *tok,
size_t data_size, uint8_t *body, size_t blen,
size_t *c)
@@ -146,6 +166,7 @@ static int pam_parse_in_data_v2(struct sss_domain_info *domains,
int ret;
uint32_t start;
uint32_t terminator;
+ char *requested_domains;
if (blen < 4*sizeof(uint32_t)+2) {
DEBUG(SSSDBG_CRIT_FAILURE, "Received data is invalid.\n");
@@ -202,6 +223,16 @@ static int pam_parse_in_data_v2(struct sss_domain_info *domains,
ret = extract_string(&pd->rhost, size, body, blen, &c);
if (ret != EOK) return ret;
break;
+ case SSS_PAM_ITEM_REQUESTED_DOMAINS:
+ ret = extract_string(&requested_domains, size, body, blen, &c);
+ if (ret != EOK) return ret;
+ ret = split_on_separator(pd, requested_domains, ',', true, true,
+ &pd->requested_domains, NULL);
+ if (ret != EOK) {
+ DEBUG(1, ("Failed to parse requested_domains list!\n"));
+ return ret;
+ }
+ break;
case SSS_PAM_ITEM_CLI_PID:
ret = extract_uint32_t(&pd->cli_pid, size,
body, blen, &c);
@@ -836,12 +867,22 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
ret = ENOENT;
goto done;
}
+
+ /* skip this domain if not requested */
+ if (!is_domain_requested(pd, dom->name)) {
+ ret = ENOENT;
+ goto done;
+ }
} else {
for (dom = preq->cctx->rctx->domains;
dom;
dom = get_next_domain(dom, false)) {
if (dom->fqnames) continue;
+ /* skip this domain if not requested */
+ if (!is_domain_requested(pd, dom->name))
+ continue;
+
ncret = sss_ncache_check_user(pctx->ncache, pctx->neg_timeout,
dom, pd->user);
if (ncret == ENOENT) {
@@ -856,7 +897,8 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
"User [%s@%s] filtered out (negative cache). "
"Trying next domain.\n", pd->user, dom->name);
}
- if (!dom) {
+
+ if (!dom || !is_domain_requested(pd, dom->name)) {
ret = ENOENT;
goto done;
}
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
index d2502d1..4d76bd2 100644
--- a/src/sss_client/pam_sss.c
+++ b/src/sss_client/pam_sss.c
@@ -58,6 +58,7 @@
#define PW_RESET_MSG_MAX_SIZE 4096
#define OPT_RETRY_KEY "retry="
+#define OPT_DOMAINS_KEY "domains="
struct pam_items {
const char* pam_service;
@@ -81,6 +82,8 @@ struct pam_items {
pid_t cli_pid;
const char *login_name;
char *domain_name;
+ const char *requested_domains;
+ size_t requested_domains_size;
};
#define DEBUG_MGS_LEN 1024
@@ -246,6 +249,9 @@ static int pack_message_v3(struct pam_items *pi, size_t *size,
len += pi->pam_newauthtok != NULL ?
3*sizeof(uint32_t) + pi->pam_newauthtok_size : 0;
len += 3*sizeof(uint32_t); /* cli_pid */
+ len += *pi->requested_domains != '\0' ?
+ 2*sizeof(uint32_t) + pi->requested_domains_size : 0;
+
buf = malloc(len);
if (buf == NULL) {
@@ -271,6 +277,9 @@ static int pack_message_v3(struct pam_items *pi, size_t *size,
rp += add_string_item(SSS_PAM_ITEM_RHOST, pi->pam_rhost, pi->pam_rhost_size,
&buf[rp]);
+ rp += add_string_item(SSS_PAM_ITEM_REQUESTED_DOMAINS, pi->requested_domains, pi->requested_domains_size,
+ &buf[rp]);
+
rp += add_uint32_t_item(SSS_PAM_ITEM_CLI_PID, (uint32_t) pi->cli_pid,
&buf[rp]);
@@ -1061,6 +1070,9 @@ static int get_pam_items(pam_handle_t *pamh, struct pam_items *pi)
pi->domain_name = NULL;
+ if (pi->requested_domains == NULL) pi->requested_domains="";
+ pi->requested_domains_size=strlen(pi->requested_domains)+1;
+
return PAM_SUCCESS;
}
@@ -1080,6 +1092,7 @@ static void print_pam_items(struct pam_items *pi)
D(("Authtok: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_authtok)));
D(("Newauthtok: %s", CHECK_AND_RETURN_PI_STRING(pi->pam_newauthtok)));
D(("Cli_PID: %d", pi->cli_pid));
+ D(("Requested domains: %s", pi->requested_domains));
}
static int send_and_receive(pam_handle_t *pamh, struct pam_items *pi,
@@ -1271,7 +1284,8 @@ static int prompt_new_password(pam_handle_t *pamh, struct pam_items *pi)
}
static void eval_argv(pam_handle_t *pamh, int argc, const char **argv,
- uint32_t *flags, int *retries, bool *quiet_mode)
+ uint32_t *flags, int *retries, bool *quiet_mode,
+ const char **domains)
{
char *ep;
@@ -1284,6 +1298,14 @@ static void eval_argv(pam_handle_t *pamh, int argc, const char **argv,
*flags |= FLAGS_USE_FIRST_PASS;
} else if (strcmp(*argv, "use_authtok") == 0) {
*flags |= FLAGS_USE_AUTHTOK;
+ } else if (strncmp(*argv, OPT_DOMAINS_KEY, strlen(OPT_DOMAINS_KEY)) == 0) {
+ if (*(*argv+strlen(OPT_DOMAINS_KEY)) == '\0') {
+ logger(pamh, LOG_ERR, "Missing argument to option domains.");
+ *domains = '\0';
+ } else {
+ *domains = *argv+strlen(OPT_DOMAINS_KEY);
+ }
+
} else if (strncmp(*argv, OPT_RETRY_KEY, strlen(OPT_RETRY_KEY)) == 0) {
if (*(*argv+6) == '\0') {
logger(pamh, LOG_ERR, "Missing argument to option retry.");
@@ -1443,12 +1465,15 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
bool retry = false;
bool quiet_mode = false;
int retries = 0;
+ const char *domains = NULL;
bindtextdomain(PACKAGE, LOCALEDIR);
D(("Hello pam_sssd: %d", task));
- eval_argv(pamh, argc, argv, &flags, &retries, &quiet_mode);
+ eval_argv(pamh, argc, argv, &flags, &retries, &quiet_mode, &domains);
+
+ pi.requested_domains = domains;
ret = get_pam_items(pamh, &pi);
if (ret != PAM_SUCCESS) {
diff --git a/src/sss_client/sss_cli.h b/src/sss_client/sss_cli.h
index 16a08e1..15f8322 100644
--- a/src/sss_client/sss_cli.h
+++ b/src/sss_client/sss_cli.h
@@ -314,6 +314,7 @@ enum pam_item_type {
SSS_PAM_ITEM_NEWAUTHTOK,
SSS_PAM_ITEM_CLI_LOCALE,
SSS_PAM_ITEM_CLI_PID,
+ SSS_PAM_ITEM_REQUESTED_DOMAINS,
};
#define SSS_NSS_MAX_ENTRIES 256
--
1.9.1
9 years, 7 months
[PATCH] CI: Use default config for mock build
by Lukas Slebodnik
ehlo,
The mock config with name default is usually symbolic link
to the configuration file of local architecture. The side effect
of this patch is that we will not try to rebuild on old architectures
src.rpm for new architectures(fedora). It caused issues with mock tmpfs
plugin.
feel free to modify patch and add your signoff. I am goinng to be offline
today.
install-deps: success 00:00:21 ci-install-deps.log
autoreconf: success 00:00:23 ci-autoreconf.log
DEBUG BUILD: ci-build-debug
configure: success 00:00:24 ci-build-debug/ci-configure.log
make-tests: success 00:02:28 ci-build-debug/ci-make-tests.log
make-check-valgrind: failure 00:01:06 ci-build-debug/ci-make-check-valgrind.log
make-distcheck: success 00:06:19 ci-build-debug/ci-make-distcheck.log
make-srpm: success 00:00:06 ci-build-debug/ci-make-srpm.log
mock-build: success 00:02:48 ci-build-debug/ci-mock-build.log
COVERAGE BUILD: ci-build-coverage
configure: success 00:00:57 ci-build-coverage/ci-configure.log
scan-make-tests: success 00:10:19 ci-build-coverage/ci-scan-make-tests.log
scan report: ci-build-coverage/ci-report-scan/index.html
scan-check: failure 00:00:00 ci-build-coverage/ci-scan-check.log
lcov-pre: success 00:00:12 ci-build-coverage/ci-lcov-pre.log
make-check: success 00:00:14 ci-build-coverage/ci-make-check.log
lcov-post: success 00:00:16 ci-build-coverage/ci-lcov-post.log
lcov-merge: success 00:00:03 ci-build-coverage/ci-lcov-merge.log
lcov-clean: success 00:00:01 ci-build-coverage/ci-lcov-clean.log
genhtml: success 00:00:05 ci-build-coverage/ci-genhtml.log
coverage report: ci-build-coverage/ci-report-coverage/index.html
lcov-check: success 00:00:00 ci-build-coverage/ci-lcov-check.log
SUCCESS
As you can see mock-build is almost fast as make-tests with attached patch and
mock tmpfs plugin. Currently bottleneck is scan-make-tests and make-distcheck.
scan-make-tests can be removed/commented out, because results are ignored
anuway. (It would be -8 lines)
LS
9 years, 7 months
[BUG] SUDO: SSSD doesn't apply case-senstive=False to ldap sudo rules
by Michichael Folfsunè
Hello Everyone,
Sorry if this is the wrong place to send this. Tried figuring out how to
add a bug on the launchpad or the main site, but couldn't find anywhere to
actually submit a *new* bug. I searched through the bug tracker and it
doesn't look like this has been reported, so here you go:
Linux Version: Oracle Enterprise Linux 6.4 and 6.5 (RHEL)
SSSD Version: sssd-1.9.2-129.el6_5.4.x86_64 (No higher versions available
in yum)
Problem:
When case_sensitive = False is set, groups are returned lower-case
regardless of what the case of the group is in the directory. However,
sudoers rules aren't being detected as applicable unless the case of the
sudo rule in LDAP matches the case of the group. With just %test_admin, we
get a "User is not allowed to run sudo" error. But if we add %TEST_Admin to
the rule, sudo operates as expected.
Below is some sanitized data.
This is getent or id:
util: /home/michichael> getent -s sss group test_admin
test_admin:*:10004:michichael
util: /home/michichael> getent -s sss group TEST_Admin
test_admin:*:10004:michichael
util: /home/michichael> id
uid=10002(michichael) gid=10004(test_admin) groups=10004(test_admin)
context=system_u:system_r:unconfined_t:s0-s0:c0.c1023
The LDAP entries in question are:
dn: cn=TEST_Access,ou=sudoers,dc=domain,dc=local
sudouser: %test_admin
sudorunasuser: ALL
sudocommand: ALL
sudohost: ALL
objectclass: top
objectclass: sudoRole
cn: TEST_Access
dn: cn=test_admin,ou=security groups,dc=domain,dc=local
uniquemember: cn=michichael folfsune,ou=test_users,ou=people,dc=domain,dc=
local
orclsourceobjectdn: CN=TEST_Admin,OU=Security Groups,DC=DOMAIN,DC=LOCAL
orclsamaccountname: TEST_Admin
gidnumber: 10004
displayname: TEST_Admin
objectclass: orcladobject
objectclass: groupofuniquenames
objectclass: orcladgroup
objectclass: orclgroup
objectclass: top
objectclass: posixgroup
orclobjectguid: TJTtdC/I6UK6m3uwpo/UXA==
cn: TEST_Admin
description: TEST Administrators
And the SSSD Config is:
sudo cat /etc/sssd/sssd.conf
[sudo] password for michichael:
[domain/default]
ldap_schema = rfc2307bis
ldap_tls_cacertdir = /etc/oracle-certs/
ldap_tls_cacert = /etc/oracle-certs/InternalCA.pem
ldap_user_member_of = uniqueMember
ldap_group_object_class = posixGroup
ldap_group_name = cn
ldap_group_gid_number = gidNumber
ldap_group_member = uniqueMember
ldap_group_nesting_level = 6
ldap_default_bind_dn = cn=binduser,cn=Users,dc=domain,dc=local
ldap_default_authtok_type = password
ldap_default_authtok = bindpassword
ldap_id_use_start_tls = True
ldap_search_base = dc=domain,dc=local
ldap_group_search_base = dc=domain,dc=local
case_sensitive = False
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
sudo_provider = ldap
ldap_uri =
ldap://ldapserver.domain.local:389/,ldap://secondaryldap.domain.local:389/
ldap_sudo_search_base = ou=sudoers,dc=domain,dc=local
[sssd]
services = nss, pam, sudo
config_file_version = 2
domains = default
[nss]
[pam]
[sudo]
sudo_timed = true
[autofs]
[ssh]
[pac]
9 years, 7 months