== SSSD 1.13.3 ===
The SSSD team is proud to announce the release of version 1.13.3 of
the System Security Services Daemon.
As always, the source is available from https://fedorahosted.org/sssd
RPM packages will be made available for Fedora shortly.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-develhttps://lists.fedorahosted.org/mailman/listinfo/sssd-users
== Highlights ==
* A bug that prevented user lookups and logins after migration from
winsync to IPA-AD trusts was fixed
* The OCSP certificate validation checks are enabled for smartcard logins
if SSSD was compiled with the NSS crypto library.
* A bug that prevented the ignore_group_members option from working
correctly in AD provider setups that use a dedicated primary group (as
opposed to a user-private group) was fixed
* Offline detection and offline login timeouts were improved for AD users
logging in from a domain trusted by an IPA server
* The AD provider supports setting up autofs_provider=ad
* Several usability improvements to our debug messages
== Packaging Changes ==
* The p11_child helper binary is able to run completely unprivileged and
no longer requires the setgid bit to be set
== Documentation Changes ==
* A new option certificate_verification was added. This option allows
the administrator to disable OCSP checks in case the OCSP server is
not reachable
== Tickets Fixed ==
https://fedorahosted.org/sssd/ticket/1632
[RFE] Unable to use AD provider for automount lookups
https://fedorahosted.org/sssd/ticket/1943
convert sudo timer to be_ptask
https://fedorahosted.org/sssd/ticket/2672
sudo: reload hostinfo when going online
https://fedorahosted.org/sssd/ticket/2732
Add Integration tests for local views feature
https://fedorahosted.org/sssd/ticket/2747
get_object_from_cache() does not handle services
https://fedorahosted.org/sssd/ticket/2755
Review p11_child hardening
https://fedorahosted.org/sssd/ticket/2787
We should mention SSS_NSS_USE_MEMCACHE in man sssd.conf(5) as well
https://fedorahosted.org/sssd/ticket/#2796
fix man page for sssd-ldap
https://fedorahosted.org/sssd/ticket/2801
Check next certificate on smart card if first is not valid
https://fedorahosted.org/sssd/ticket/2812
Smartcard login when certificate on the card is revoked and ocsp check enabled is not supported
https://fedorahosted.org/sssd/ticket/2830
Try to suppress "Could not parse domain SID from [(null)]" for IPA users
https://fedorahosted.org/sssd/ticket/2846
Inform about SSSD PAC timeout better
https://fedorahosted.org/sssd/ticket/2868
AD provider and ignore_group_members=True might cause flaky group memberships
https://fedorahosted.org/sssd/ticket/2874
sssd: [sysdb_add_user] (0x0400): Error: 17 (File exists)
== Detailed Changelog ==
Dan Lavu (1):
* Clarify that subdomains always use service discovery
Jakub Hrozek (7):
* Upgrading the version for the 1.13.3 release
* DP: Do not confuse static analysers with dead code
* BUILD: Only install polkit rules if the directory is available
* IPA: Use search timeout, not enum timeout for searching overrides
* AD: Add autofs provider
* MAN: Clarify when should TGs be disabled for group nesting restriction
* Update translations for the 1.13.3 release
Lukas Slebodnik (2):
* sbus_codegen_tests: Use portable definition of large constants
* DEBUG: Add missing new lines
Michal Židek (1):
* MAN: sssd.conf should mention SSS_NSS_USE_MEMCACHE
Pavel Březina (22):
* SYSDB: Add missing include to sysdb_services.h
* LDAP: Mark globals in ldap_opts.h as extern
* AD: Mark globals in ad_opts.h as extern
* IPA: Mark globals in ipa_opts.h as extern
* KRB5: Mark globals in krb5_opts.h as extern
* SUDO: convert periodical refreshes to be_ptask
* SUDO: move refreshes from sdap_sudo.c to sdap_sudo_refresh.c
* SUDO: move offline check to handler
* SUDO: simplify error handling
* SUDO: fix sdap_id_op logic
* SUDO: fix tevent style
* SUDO: fix sdap_sudo_smart_refresh_recv()
* SUDO: sdap_sudo_load_sudoers improve iterator
* SUDO: set USN inside sdap_sudo_refresh request
* SUDO: built host filter inside sdap_sudo_refresh request
* SUDO: do not imitate full refresh if usn is unknown in smart refresh
* SUDO: fix potential memory leak in sdap_sudo_init
* SUDO: obtain host information when going online
* SUDO: remove finalizer
* SUDO: make sdap_sudo_handler static
* SUDO: use size_t instead of int in for cycles
* SUDO: get srv_opts after we are connected
Pavel Reichl (1):
* sysdb-tests: Fix warning - incompatible pointer type
Petr Cech (2):
* IPA_PROVIDER: Explicit no handle of services
* KRB5_CHILD: Debug logs for PAC timeout
Sumit Bose (7):
* IPA: fix override with the same name
* p11: allow p11_child to run completely unprivileged
* p11: check if cert is valid before selecting it
* p11: enable ocsp checks
* ldap: skip sdap_save_grpmem() if ignore_group_members is set
* initgr: only search for primary group if it is not already cached
* LDAP: check early for missing SID in mapping check
Hi,
I'm sending some sudo provider patches. I wanted to fix/improve things
in the ldap sudo provider prior my work on ipa provider so I get
familiar with it again and avoid making the same mistakes.
It fixes tevent style, shuffles the code around a little bit, convert
periodic task to use be_ptask module, renew hostinfo when needed, fix
sdap_id_op logic, recude code duplication, remove dead code, simplify
error handling, etc.
Ticket fixed:
https://fedorahosted.org/sssd/ticket/1943https://fedorahosted.org/sssd/ticket/2672
I let Dan run downstream tests on those patches. We had to fix one test
that was prone to a race condition which my patches revealed, but
everything is green now.
This solves situation where you want to use those globals on other place
than in *_common.c.
I also created https://fedorahosted.org/sssd/ticket/2890 so we can avoid
order-dependency on header files such as sysdb_services.h which I had to
fix for AD patch.
Hi,
see the attached patches for ticket
https://fedorahosted.org/sssd/ticket/2676
Removing the user during cleanup task completely
removes that user from local database, so that
user is no longer part of any group in sysdb.
Such user may, or may not have been removed from
LDAP so the only way to figure out is check
on the next refresh otherwise we may get
inconsistent results.
The third patch adds integration test for this
Apply and run the intgcheck without the first 2
patches to see the failed test (you will also see that
all the tests after this failed one will end with
errors as well, that is probably due to incomplete
clean up after the ldap tests and I do not intend to
solve this as part of this patchset but will
investigate it later).
Thanks,
Michal
--
Senior Principal Intern
Hi,
this patch fixes an issue in the IPA override code described in
https://fedorahosted.org/sssd/ticket/2874. If the user name is
overridden with itself the name is written to the alias attribute twice
causing an ldb error.
bye,
Sumit
Hi,
this patch should suppress the
"sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse
domain SID from [(null)] ]]]" which e.g. is regularly seen with the IPA
provider when there is no trust support enabled on the IPA server.
bye,
Sumit
Hi,
please see the attached patch. I tested it by following:
https://ovalousek.wordpress.com/2015/08/03/autofs/
with the new patch, just adding:
autofs_provider = ad is enough.
I wrote the new provider because it's IMO the more systematic solution
to #2862 than any hacks in failover.
Hi,
I would like to release 1.13.3 tarball no later than Tuesday Dec-15. There
is a number of tickets that were not closed and I'm wondering whether to
move them to 1.13.4 or 1.14 Alpha. So far I'm thinking that:
- anything our downstream requires should stay in 1.13.4
- the rest, that's mostly tests and debug message improvements, like
setting the default debug level to 2 should go into 1.14 Alpha.
- #2751 should be deferred until we have the faulty GPO file
- the tickets with patch submitted can stay, we'll see how many
patches we review until the release
Are there other opinions?
On Fri, Dec 04, 2015 at 09:51:50AM -0500, Dan Lavu wrote:
> Go for it, wasn't aware that non R2 is supported upstream.
Unless anyone opposes, I will push the attached patch with Dan's
authorship and my RB later today.
Hi,
see the attached trivial patch. It was verified by a user on IRC that
decreasing the timeout helped quite a bit when a laptop with AD user
went offline and the AD user tried to unlock the screen.
Hi,
I was looking at options we have for setting up an automated way to
mirror our fedorahosted.org repo to github.com. Unfortunately, the
github mirror functionality seems to be discontinued[*], so the next
best thing to do is to set up a github deploy key:
https://developer.github.com/guides/managing-deploy-keys/#deploy-keys
The private key would be on the machine we'd mirror from, the public key
would be uploaded to github. My question is -- do we want to set up the
push job on fedorahosted.org or one of our machines?
1) fedorahosted.org
[+] We don't have to manage the machine, dedicated admins do
[-] We'd have to give read ACL to an identity that pushes /all/
fedorahosted.org projects.
2) Our own (CI?) machines
[+] We manage the machine with the private key. We keep control of the
key.
[-] We manage the machine with the private key. We're developers, not
admins.
I would personally prefer 1) because if the git user on fedorahosted is
compromised, all bets are off anyway and the concern about a push key to
our /mirror/ repo would not be the primary one. But at the same time, I
don't feel comfortable doing the decision without asking the
list.
So -- is anyone opposed to me asking fedorahosted.org to generate a keypair
and giving us the public key that I would upload to github?
Thanks!
[*] github has gained enough traction already, so they don't care about
this functionality anymore..
Hi,
in some cases when an IPA-AD trust client is offline, the libkrb5
functions in krb5_child would error out with KRB5_REALM_UNKNOWN, because
the client is completely autoconfigured.
I think we should handle this error code as ERR_NETWORK_IO internally
and I hope this change would fix bugs like
https://fedorahosted.org/sssd/ticket/2866 but I haven't heard from the
reporter yet.
Hi,
this is more or less a cosmetic issue, but it can be irritating
nonetheless. If the krb5_child process times out during preauth, we
would print an EINVAL error message. I think the error should be more
graceful (and I don't insist on PAM_CRED_UNAVAIL).
Hi,
it seems like https://fedorahosted.org/sssd/ticket/2492 was not fixed
completely. Attached are two patches that do the trick for me -- they
are not polished (at the very least, the first one needs a test..) but I
would like to get another opinion if they at least aim in the right
direction.
So my groups on IPA server are set like this:
[jhrozek@unidirect] sssd $ [(ext_mem)] ipa group-show topgr --all --raw
dn: cn=topgr,cn=groups,cn=accounts,dc=ipa,dc=test
cn: topgr
gidnumber: 240000024
member: cn=ext_ipa_gr,cn=groups,cn=accounts,dc=ipa,dc=test
ipaUniqueID: 193b7c04-91e9-11e5-bc59-5254005f7b59
objectClass: ipaobject
objectClass: top
objectClass: ipausergroup
objectClass: posixgroup
objectClass: groupofnames
objectClass: nestedgroup
[jhrozek@unidirect] sssd $ [(ext_mem)] ipa group-show ext_ipa_gr --all --raw
dn: cn=ext_ipa_gr,cn=groups,cn=accounts,dc=ipa,dc=test
cn: ext_ipa_gr
ipaexternalmember: S-1-5-21-1897531548-1940899517-361317264-500
ipaUniqueID: ad2bd978-91e8-11e5-9d52-5254005f7b59
memberof: cn=topgr,cn=groups,cn=accounts,dc=ipa,dc=test
objectClass: ipaobject
objectClass: top
objectClass: nestedgroup
objectClass: ipausergroup
objectClass: groupofnames
objectClass: ipaexternalgroup
The SID S-1-5-21-1897531548-1940899517-361317264-500 is an AD user
(administrator)
Now when I do:
sudo sss_cache -E
$ id -G administrator(a)win.trust.test
$ sudo sss_cache -G
$ getent group 240000024
Then the "topgr" group gets resolved and the code gets into sdap_save_grpmem:
908 /* This is a temporal solution until the IPA provider is able to
909 * resolve external group membership.
910 * https://fedorahosted.org/sssd/ticket/2522
911 */
912 if (opts->schema_type == SDAP_SCHEMA_IPA_V1) {
913 ret = sysdb_attrs_get_string(attrs, SYSDB_SID_STR, &group_sid);
914 if (ret != EOK) {
915 DEBUG(SSSDBG_TRACE_FUNC, "Failed to get group sid\n");
916 group_sid = NULL;
Here we set the group_sid variable to NULL, because topgr, being an IPA
group, doesn't have a SID...
917 }
918
919 if (group_sid != NULL) {
920 ret = retain_extern_members(memctx, dom, group_name, group_sid,
921 &userdns, &nuserdns);
Which means we don't call retain_extern_members at all.
922 if (ret != EOK) {
923 DEBUG(SSSDBG_TRACE_INTERNAL,
924 "retain_extern_members failed: %d:[%s].\n",
925 ret, sss_strerror(ret));
926 }
927 }
928 }
But since the whole block of code was added in the same commit, I guess
it must have some purpose..so is going on without a SID the right thing
to do? What was the use-case of the original code?
Hi,
At the moment, we plan for RHEL-6.8 to ship with SSSD 1.13. To get some
early testing, here is an automatically-updated COPR repo with the preview
packages:
https://copr.fedoraproject.org/coprs/jhrozek/SSSD-6.8-preview/
We will be glad for test results and/or bug reports, but please read the
repo description carefully before putting these packages on your systems,
especially the "NOT SUPPORTED by Red Hat" part.
For convenience, I copied the description below:
Q: What is the OS and release these packages are supposed to run with?
A: RHEL-6.7 or CentOS-6.7.
Q: How often are these packages updated?
A: When a new build happens in RHEL, except when the fix should not be
released in public yet (think CVE)
Q: Are all RHEL-6.8 features or bug fixes included?
A: Looking at 1.13.x Trac milestones might give a rough idea, but it's best
to contact Red Hat Support and ask about a particular feature/bug status.
Q: Can I update from these packages to RHEL-6.8 proper?
A: That is not supported and we won't do any special work towards making
the upgrade path smooth. These packages are meant to be tried in a test
VM or similar environment.
Q: I found a bug in these packages!
A: Thank you for trying them out! Please file a bug report in SSSD Trac
or ask for help on the sssd-users list
Hi,
there is little patch which adds clang-format support. More info is in
header of patch.
My previous patch set [PATCH SET] TEST_TOOLS_COLONDB: Add tests for
sss_colondb_* public API is formatted by clang-format.
Regards
Petr