[PATCH] Fixes for NSS getnamebysid requests
by Jakub Hrozek
Hi,
another problem I found while testing another patchset was that NSS
getnamebysid never consulted cache and went straight to BE. It was
because the cacheExpire attribute wasn't requested, so the default value
of 0 was used. Also negative cache wasn't consulted, but that's not so
much of a problem.
Attached are patches that fix both bugs and a unit test.
8 years, 11 months
Segmentation fault in 1.11.6 - error 6 in libsss_idmap.so.0.4.0
by Sterling Sahaydak
Consistently getting a segfault in libsss_idmap resulting in a core dump
in sssd 1.11.6
:Apr 22 13:25:50 ldap kernel: sssd_be[9236]: segfault at 10da000 ip 000=
07f785852b4f1 sp 00007fffbfbf6cf0 error 6 in libsss_idmap.so.0.4.0[7f78=
58528000+5000]
:Apr 22 13:25:50 ldap abrt[9244]: Saved core dump of pid 9236 (/usr/lib=
exec/sssd/sssd_be) to /var/spool/abrt/ccpp-2015-04-22-13:25:50-9236 (27=
68896 bytes)
Taking a look at it deeper in gdb revealing:
Loaded symbols for /lib64/libnss_dns-2.12.so
Core was generated by `/usr/libexec/sssd/sssd_be --domain LDAP'.
Program terminated with signal 11, Segmentation fault.
#0 sss_idmap_bin_sid_to_dom_sid (ctx=<value optimized out>,
bin_sid=<value optimized out>, length=<value optimized out>,
_dom_sid=0x7fffbfbf6d38) at src/lib/idmap/sss_id
map_conv.c:92
92 dom_sid->sub_auths[i] = le32toh(val);
Missing separate debuginfos, use: debuginfo-install
dbus-libs-1.2.24-8.el6_6.x86_64 popt-1.13-7.el6.x86_64
sqlite-3.6.20-1.el6.x86_64
(gdb) where
#0 sss_idmap_bin_sid_to_dom_sid (ctx=<value optimized out>,
bin_sid=<value optimized out>, length=<value optimized out>,
_dom_sid=0x7fffbfbf6d38) at src/lib/idmap/sss_id
map_conv.c:92
#1 0x00007f785852b648 in sss_idmap_bin_sid_to_sid (ctx=0xf84520,
bin_sid=<value optimized out>, length=<value optimized out>,
_sid=0x7fffbfbf6d60) at src/lib/idmap/sss_i
dmap_conv.c:371
#2 0x00007f7858745ded in sdap_attrs_get_sid_str (mem_ctx=0x105fc10,
idmap_ctx=0xf811e0, sysdb_attrs=<value optimized out>,
sid_attr=0x7f7858783789 "objectSID", _sid_str=
0x7fffbfbf6e28) at
src/providers/ldap/ldap_common.c:1857
#3 0x00007f785875e509 in sdap_add_incomplete_groups (sysdb=0xf63080,
domain=0xf63780, opts=0xf7eec0, groupnames=<value optimized out>,
ldap_groups=0x10b52b0, ldap_groups
_count=9) at
src/providers/ldap/sdap_async_initgroups.c:131
#4 0x00007f785875ea1b in sdap_nested_groups_store (sysdb=0xf63080,
domain=0xf63780, opts=0xf7eec0, groups=0x10b52b0, count=9) at
src/providers/ldap/sdap_async_initgroups
.c:617
#5 0x00007f7858763095 in save_rfc2307bis_groups (subreq=0x0) at
src/providers/ldap/sdap_async_initgroups.c:1878
#6 sdap_initgr_rfc2307bis_done (subreq=0x0) at
src/providers/ldap/sdap_async_initgroups.c:1783
#7 0x00007f785876275a in rfc2307bis_nested_groups_process (subreq=0x0)
at src/providers/ldap/sdap_async_initgroups.c:2554
#8 0x00007f785874f90f in sdap_get_generic_ext_done (op=<value optimized
out>, reply=<value optimized out>, error=<value optimized out>,
pvt=<value optimized out>) at src
/providers/ldap/sdap_async.c:1439
#9 0x00007f7858751e2a in sdap_process_message (ev=<value optimized
out>, pvt=<value optimized out>) at src/providers/ldap/sdap_async.c:374
#10 sdap_process_result (ev=<value optimized out>, pvt=<value optimized
out>) at src/providers/ldap/sdap_async.c:213
#11 0x00000039dda08ebe in epoll_event_loop (ev=<value optimized out>,
location=<value optimized out>) at ../tevent_epoll.c:736
#12 epoll_event_loop_once (ev=<value optimized out>, location=<value
optimized out>) at ../tevent_epoll.c:931
#13 0x00000039dda072e6 in std_event_loop_once (ev=0xf5b580,
location=0x39dea3d4f5 "src/util/server.c:602") at
../tevent_standard.c:112
#14 0x00000039dda0349d in _tevent_loop_once (ev=0xf5b580,
location=0x39dea3d4f5 "src/util/server.c:602") at ../tevent.c:530
#15 0x00000039dda0351b in tevent_common_loop_wait (ev=0xf5b580,
location=0x39dea3d4f5 "src/util/server.c:602") at ../tevent.c:634
#16 0x00000039dda07256 in std_event_loop_wait (ev=0xf5b580,
location=0x39dea3d4f5 "src/util/server.c:602") at
../tevent_standard.c:138
#17 0x00000039dea2b963 in server_loop (main_ctx=0xf5c880) at
src/util/server.c:602
#18 0x000000000040a286 in main (argc=3, argv=<value optimized out>) at
src/providers/data_provider_be.c:2856
(gdb) print i
$1 = <value optimized out>
(gdb) print val
$2 = 0
(gdb) print dom_sid
$3 = (struct sss_dom_sid *) 0x10b4300
(gdb) print dom_sid->sub_auths
$4 = {2927152313, 560816471, 256, 0, 113, 0, 0, 0, 0, 0, 17404592, 0,
17409264, 0, 0}
(gdb) quit
Above, you can see that "<value optimized out>" so not sure what I can
conclude from this futher.
This is a mirrored site being replicated that I have the same
configuration files setup on another sub domain.
I've recently run 'yum update' to verify and still end up with the same
segmentation fault.
I'm running the command 'getent passwd <username>' and noticing this is
occurring when running in "/usr/sbin/sssd -i" mode.
Environment: CentOS => OpenLDAP 2.4.39 with OpenLDAP Proxy => Active
Directory 2012 containing Users
Running the cmd: 'getent passwd <username>' is retrieving the correct
user information along with groups, etc.
I presume it's this: dom_sid->sub_auths[i] = le32toh(val);
Where "i" is out of bounds or "val" is not being checked properly or ???
Please let me know what other information is needed to assist, before
just dumping sssd.conf, nsswitch.conf, etc.
Any help is greatly appreciated,
Sterling
8 years, 11 months
Design discussion: Mapping user names of proxy users onto Kerberos principals
by Jakub Hrozek
Hi,
we talked about implementing ticket #2509 with Pavel in person, but it
would be nice to see if other other developers agree before all the code
is written :-)
The design page is here:
https://fedorahosted.org/sssd/wiki/DesignDocs/KerberosPrincipalMappingToP...
For your convenience, the text of the design page is also copied below:
= Mapping Proxy ID provider names to Kerberos principals =
Related ticket(s):
* https://fedorahosted.org/sssd/ticket/2509
=== Problem statement ===
Some users are migrating to SSSD from a legacy configuration that consisted
of a traditional UNIX user stored in `/etc/passwd` and managing their
Kerberos tickets either with the use of some GUI tool or just command-line
`kinit`. While these users can use SSSD by configuring the `id_provider`
proxy, very often the name of their UNIX user is different from the name
of their company-wide Kerberos credentials.
This feature helps the above use-case by mapping their UNIX user name to
the Kerberos principal name.
=== Use cases ===
Joe User has a company laptop where his UNIX user has been traditionally
named `joe`. At the same time, his company Kerberos principal is called
`juser(a)EXAMPLE.COM`. Joe would like to start using SSSD to leverage
features like offline kinit without having to rename his UNIX user and
chown all his local files to the corporate user ID.
=== Overview of the solution ===
The Kerberos provider will acquire a new option that describes how are the
user names from the ID provider mapped onto the user part of the Kerberos
principal. The user would then add the appropriate mapping to the `domain`
section of `sssd.conf`.
=== Implementation details ===
A new option `krb5_map_user` would be added to the Kerberos auth code. This
option would have form similar to how we map the LDAP extra attributes,
that is `local_name:krb5_name`. When mapping exists for the user who
is authenticating, the krb5_auth module would use that user name for
calls like `find_or_guess_upn` instead of `pd->name`. We should consider
whether to keep using `pd->name` or introduce another attribute to the
`krb5_child_req` structure.
=== Configuration changes ===
A new configuration option tentatively called `krb5_map_user` would be
added. This option is unset by default, which means whatever user name
the ID provider stores will be used.
=== How To Test ===
1. Prepare a Kerberos KDC, add a user principal (`juser(a)EXAMPLE.COM`)
1. Add a local user using `useradd` with name that differs from
Kerberos principal in the name portion. (`joe`)
1. Configure SSSD with `id_provider=proxy` with `proxy_lib_name=files`
and `auth_provider=krb5` pointing to our test KDC
1. Attempt to authenticate using a PAM service. The authentication
should fail and the logs would show authentication as `joe(a)EXAMPLE.COM`
1. Set `krb5_map_user` to `joe:juser` and restart SSSD.
1. Authenticate again. This time, authentication should succeed and the
user's klist output should list `juser(a)EXAMPLE.COM`. The `id(1)` output
should still list `joe`, though.
1. Test that Kerberos ticket renewals still work
1. Test that delayed kinit still works.
=== Authors ===
* Jakub Hrozek <jhrozek(a)redhat.com>
8 years, 11 months
planning the 1.12.5 release
by Jakub Hrozek
Hi,
as discussed on the phone with the other developers, I would like to release 1.12.5 soon, probably early next week (I'm travelling tomorrow).
If there is a patch you'd like to have cherry-picked for 1.12 or a fix that you believe should be holding up 1.12.5, please speak up!
8 years, 11 months