[PATCH] sdap: improve filtering of multiple results in GC lookups
by Sumit Bose
Hi,
this patch fixes and issue during initgroups in AD forests. Please see
the commit message for details.
To reproduce this you can create a new user outside of CN=Users on the
forest root. The new user can be created in an existing container or in
a new OU container. Most important is that it is not a child of
CN=Users. In a child domain (it must be a child, domains with a
different base won't trigger the issue) create a user with the same
name. With this setup 'id user(a)forest.root' will not return the complete
list of group the user is a member of and the patch should fix this.
bye,
Sumit
6 years, 11 months
[PATCH] systemtap-based performance probes
by Jakub Hrozek
Hi,
the attached patches are the first self-contained part of my performance
work. Using them, I analyzed the performance of 'id' as the worst-case,
then realized most of the issues are around processing and storing large
groups. The results gathered using these scripts are in fact the base of
the improvements documented at:
https://fedorahosted.org/sssd/wiki/DesignDocs/OneFourteenPerformanceImpro...
I tried to add descriptive commit messages to the patches so that hopefully
all the info is in those commit messages. We will probably add more probes
into different areas of code, but these are the ones that I already haven't
modified for weeks, so I think it should be safe to merge them.
The probes are enabled in our RPMs and I would encourage downstreams to
enable them as well. There is virtually no cost of having the probes
compiled in by default and the benefit would be that admins can run them
to see what are the bottlenecks in their environment. I was also
wondering if it makes sense to add a generic back-end-request tracking
probes and an associated script, but since the data provider is being
re-factored at the moment, I think it would be better to land the DP
changes first.
The reason I split the sysdb probes into several commits (unlike the LDAP
probes) is that I think in future, we can use these commits as a
reference for adding more probes to different areas of SSSD.
CI: http://sssd-ci.duckdns.org/logs/job/42/99/summary.html
(BTW, thanks to Lukas for helping me a lot with the build failures on
#sssd last week)
6 years, 11 months
[PATCHES] ipa: add support for certificate overrides
by Sumit Bose
Hi,
this set of patches should resolve
https://fedorahosted.org/sssd/ticket/2897 "Smart Cards: Certificate in
the ID View" and cover all other use cases from
https://fedorahosted.org/sssd/wiki/DesignDocs/LookupUsersByCertificatePart2
as well. So basically certificates can be read from IPA and local
overrides and from AD with direct in indirect integration.
The patches are all about lookups, so Smartcards and authentication is
not needed to test them. All is needed is a certificate which can be
added to an AD user object or an override object and then try to lookup
the user with
dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe \
/org/freedesktop/sssd/infopipe/Users \
org.freedesktop.sssd.infopipe.Users.FindByCertificate
string:"BASE64_CERTIFICATE_STRING"
from a IPA client, IPA server or AD client with AD provier.
If the certificate is store in the AD user object and the lookup is
started on an IPA client a patch for the IPA server is needed, because
the request has to run via the extdom plugin. I'll send a patch to
freeipa-devel which will use the sss_nss_getnamebycert() call added by
one of the patches to allow the extdom plugin to do lookups by
certificate. This means that SSSD on the IPA server must used the
attached patches as well.
bye,
Sumit
6 years, 11 months
[PATCH] AD: use krb5_keytab for subdomain initialization
by Sumit Bose
Hi,
this is a bit of a follow-up patch to "subdomains: inherit
ldap_krb5_keytab". It turned out that if the default keytab contains
some completely unrelated keys the SASL initialization might e.g. pick a
wrong realm name because the alternative keytab was only added later
during the initialization.
bye,
Sumit
6 years, 11 months
[PATCHES] Support starting SSSD from a default configuration
by Stephen Gallagher
These patches provide support for shipping a default configuration file that the
monitor will automatically copy to /etc/sssd/sssd.conf if none already exists.
The idea is for distributions to be able to provide a default (and resettable)
configuration for out-of-the-box behavior.
I considered writing the patch to check /etc/sssd and then check /usr/lib*/sssd
in turn, but I realized that this would be too complicated with the infopipe
interactions (which would need to be updated to do a copy-on-write the first
time they changed something). It was simpler to just always create the /etc
version and use that.
Patch 0001: Create a secure copy function that can be used to duplicate the
default configuration
Patch 0002: Cosmetic patch; changes the name of an internal macro variable to
make it clear that it's the active configuration file, not the default one.
Patch 0003: Add the logic to confdb_setup.c to copy over the default
configuration if and only if our attempt to load the configuration came up with
ERR_MISSING_CONF. It will then try to load it again and proceed or fail from there.
The default configuration provided here is to load the SSSD with a single proxy
provider that reads from nss_files (and supports authentication through
pam_unix). This does not have to be shipped with any downstream package; the
idea is that downstreams would be expected to modify this configuration to their
own needs. This would need to be called out in the release announcement for
whatever version of SSSD incorporates this change.
These patches will require a change to the SELinux policy, since the monitor
needs to be able to write to the /etc/sssd directory.
type=AVC msg=audit(1461088081.353:550): avc: denied { write } for pid=3721
comm="sssd" name="sssd" dev="dm-0" ino=4600013
scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:sssd_conf_t:s0
tclass=dir permissive=0
Was caused by:
Missing type enforcement (TE) allow rule.
You can use audit2allow to generate a loadable module to allow this access.
6 years, 11 months
[PATCH] LDAP: Try also the AD access control for IPA users
by Jakub Hrozek
Hi,
the attached patch implements Sumit's idea to solve
https://fedorahosted.org/sssd/ticket/2927
The user who reported the bug confirmed that the patch works. As an
additional improvement, they requested that these results should not be
considered when the cache expires, but immediatelly. But honestly I
don't know if and how this could be solved (we would need to fetch this
attribute always on initgroups on both client and server..) so I would
prefer additional ticket and merge this patch first.
6 years, 11 months