sssd-devel June 2016

sssd-devel@lists.fedorahosted.org

11 participants
64 discussions

[PATCH] LDAP: Change the default rfc2307 autofs attribute mappings
by Jakub Hrozek 06 Jul '16

06 Jul '16

Hi, our rfc2307 attribute mappings are wrongs. Because we are close to releasing a major release, I think this is the time to change them. Attached is a patch that changes the attributes and warns users who use any of the changed attributes in default mappings. If we decide to accept this patch, we should also file a ticket to remove the warnings in the next release to avoid warning forever.

4 11

[PATCH] PAM/KRB5: optional otp and password prompting
by Sumit Bose 06 Jul '16

06 Jul '16

Hi, this patch is the SSSD part of the Authentication Indicator related changes in FreeIPA. The basic part is that now it is possible to authenticate at will with either password or 2FA as described on https://fedorahosted.org/sssd/wiki/DesignDocs/PromptingForMultipleAuthentic…. To test you need a FreeIPA server build from the FreeIPA master branch and optionally Nathaniel's '[PATCH 0093] Enable service authentication indicator management' which is currently under review for the kvno related test. Additionally you need MIT Kerberos packages which contain the fix for https://bugzilla.redhat.com//show_bug.cgi?id=1340304. Since this patch changes how libkrb5 gets the password for password authentication with newer version of MIT Kerberos it would be nice if someone can run some regression tests with the AD or plain KRB5 auth_provider. bye, Sumit

3 6

[PATCH] SSH: Do not print an error message if sss_ssh_authorizedkeys is asked for a local user
by Jakub Hrozek 01 Jul '16

01 Jul '16

Hi, please see the attached patch. I didn't find any information in the ssh man pages about the expected error codes from the AuthorizedKeysCommand, but I think we should at least suppress the error messages.. I tested with: $ sss_ssh_authorizedkeys root $ sss_ssh_authorizedkeys user-from-passwd $ sss_ssh_authorizedkeys user-from-ipa $ sss_ssh_authorizedkeys non-existing-user The first three should be silent, the last one still prints an error message. I think that's acceptable, because I would expect ssh to call getpwnam() on its own before calling the AuthorizedKeysCommand.

3 3

[PATCH] IPA: Handle requests for netgroups from trusted domains gracefully
by Jakub Hrozek 01 Jul '16

01 Jul '16

To reproduce, just run: getent netgroup some_name(a)trusted.domain Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the lookup is for anything else than a user or a group.

3 6

[PATCH] Changes to allow SSSD to be used for access control with a machine account belonging to a domain controller.
by Jakub Hrozek 01 Jul '16

01 Jul '16

Hi, I'm resending a patch for ticket #2870 on behalf of the original reporter who also kindly submitted a patch. The patch looks good to me, as soon as we fix CI, I'll submit it as well and I think we can push it..

3 5

Announcing SSSD 1.14 Beta
by Jakub Hrozek 29 Jun '16

29 Jun '16

== SSSD 1.14 Beta === The SSSD team is proud to announce the release of version 1.14 Beta of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * SSSD's cache performance was improved. SSSD now stores operational attributes of cache entries to a separate database with asynchronous writes mode, which results in substantially faster cache update times in most cases. Note that the performance of the initial cache write with an empty cache does not improve, only subsequent updates. * SSSD is able to merge configuration file snippets from an include directory. This functionality requires the latest libini release 1.3.0. * The GPO evaluator is able to skip malformed INI files. This feature is also only available with libini release 1.3.0 or newer. * A new command line tool, called sssctl was added. This tool allows the administrator to observe the status of SSSD. In this version, the tool is able to: * list SSSD domains and subdomains, including their online and offline status * print information about objects stored in the cache * backup or remove the local databases * help truncate SSSD logs * SSSD is able to validate configuration files against a built-in schema. To retain backwards-compatibility with configuration files that would otherwise not validate, the validator only warns about errors in the config file in this version. * An ID-mapping plugin for the winbind deamon was added. With this plugin, it's possible for winbind to use the same ID-mapping scheme as SSSD uses, producing consistent ID values * A new "secrets" responder was added. This responder allows an application to communicate with SSSD over a UNIX socket using the Custodia API. SSSD then stores the secrets either in its local database or proxies them to a remote Custodia server. == Packaging Changes == * SSSD stores ephemeral attributes in a new ldb database called timestamps_$domain.ldb stored in the same directory as the regular caches. * The winbind ID-mapping plugin is packages in its own subpackage called winbind-idmap * The SSSD configuration snippets are being read from a newly-owned directory /etc/sssd/conf.d. * SSSD ships a file with rules for the configuration validator. In Fedora, this file is located at /var/lib/sss/cfg_rules.ini == Tickets Fixed == #385 [RFE] Provide a Method to Display SSSD Status Information #1662 [RFE] Provide a force reload utility #1800 [RFE] create a generic sssdctl utility #1937 [RFE] Improve LDAP error logging #2028 sssd does not detail which line in configuration is invalid #2166 [RFE] SSSD cache database reporting #2247 [RFE] SSSD should be able to merge configuration from multiple files #2466 [RFE] Method for setting custom shells without Unix Attributes in AD account #2602 Optimize cache writes to sysdb #2671 RFE: sss_cache: Add an option to rm the database files #2735 Document best practices from security standpoint for OpenScap team #2751 SSSD can't process GPO from Active Directory when it contains lines with no equal sign #2913 Add a Secrets as a Service component #2918 Make cli_ctx more generic #2921 Replace the monitor ping with an in-process heartbeat #2957 Extend interface between DP and IFP #3070 Add infrastructure for socket-activated responders == Detailed Changelog == Christian Heimes (1): * Secrets: m4 macros for jansson and http-parser Jakub Hrozek (19): * Updating the version for the 1.14 beta release * SYSDB: Move sysdb initialization into a new module sysdb_init.c * UTIL: Add error codes for sysdb too old or too new * SYSDB: Refactor database connection * SYSDB: Add a second, timestamp-only ldb cache * SYSDB: Open a timestamps cache for caching domains * SYSDB: Wrap sysdb_store_group in a transaction and split it into smaller functions * SYSDB: Search the timestamp caches in addition to the sysdb cache * SYSDB: If modifyTimestamp is the same, only update the TS cache * SYSDB: Check if group attributes differ before saving a group * SYSDB: Refactor sysdb_store_user * SYSDB: Only update user attributes if needed * TESTS: Add a unit test for timestamps caches * TESTS: Add an integration test for the timestamps cache * LDAP: Shortcut looking up for group members sooner * Contrib: Add a gdbinit file * BUILD: Fall back to non-strict http parser, if strict is not available * MAN: Include idmap_sss.8.xml in the manpage sources * Updating the translations for the 1.14 beta release Lukas Slebodnik (6): * Prepare ini schema with rules for validation * UTIL: Fix debug message in sssd_async_connect_done * UTIL: Revent connection handling in sssd_async_connect_send * Downcast to errno_t after tevent_req_is_error * BUILD: Fix detection of systemd * BUILD: Detect libsystemd-daemon or libsystemd Michal Židek (3): * GPO: ignore non-KVP lines if possible * confdb: Make it possible to use config snippets * confdb: Check for config file errors on sssd startup Pavel Březina (25): * IFP: Add domain nodes * IFP: new header file that contains interface definitions * sss_sifp: make it compatible with latest version of the infopipe * sss_sifp: return context even on IO error * sss_sifp: bump version to 1:0:1 * sss_tools: add command description * sss_tools: add help commands to usage message * sss_tools: unify description of --debug * sss_tools: tell whether an option was provided * sss_tools: add commands delimiter * sss_tools: pad help message properly * sss_tools: return errno_t instead of system code * sss_tools: add test if sssd is running * sss_tools: create confdb if not exist * sss_override: return EXIT_SUCCESS even when no overrides are found * sss_override: return EXIT_FAILURE if file does not exist during import * ERRORS: Add errors to indicated whether SSSD is running or not * SBUS ERRORS: Add unknown domain * SBUS: Fix typo in comment * SBUS: Add string helper macros * DP: Add function to get be_ctx directly from dp_client * DP: Add org.freedesktop.sssd.DataProvider?.Backend * DP: Add org.freedesktop.sssd.DataProvider?.Failover * IFP: Provide domain and failover status * sssctl: new tool Simo Sorce (14): * Util: Add watchdog helper * Server: Enable Watchdog in all daemons * Monitor: Remove ping infrastructure * Responders: Make the client context more generic * Responders: Add support for socket activation * ConfDB: Add helper function to get "subsections" * Secrets: Add autoconf macros to build with secrets * Secrets: Add initial responder code for secrets service * Add initial providers infrastructure. * Secrets: Add encryption at rest * Secrets: Add Proxy backend * Local secrets provider Content-Type handling * Secrets: Add local container entries support * Monitor: Add mode to generate confdb only Sumit Bose (1): * Add winbind idmap plugin

1 0

[PATCH] BUILD: Fix detection of systemd
by Lukas Slebodnik 29 Jun '16

29 Jun '16

ehlo, @see commit message in attached patch. LS

2 7

[PATCH SET} A new Secrets service
by Simo Sorce 29 Jun '16

29 Jun '16

This patchset implements a new responder like service in SSSD called secrets. It uses the Custodia project API to offer a service where applications/users can store secrets in a way that makes requests remotizable and routable with a high degree of configurability (esp, in conjunction with a Custodia proxy). Included are also accessory patches to change the monitor and other aspects of service startup and monitoring necessary to have this new kind of service which is more independent than the pam/nss based services. There is no testsuite for the service yet. The work is also not complete in that the monitor does not start the service yet, I have an experimental unit file I am working on but it is not fully functional and not included yet.. I do not expect all patches to be accepted right away, but they all work individually (manually tested), but I think it is a good time to start review and bring in what works, as we are going to spread some of the remaining work across multiple people. HTH, Simo. -- Simo Sorce * Red Hat, Inc * New York

4 28

[PATCH] UTIL: Use errno_t in TEVENT_REQ_RETURN_ON_ERROR
by Lukas Slebodnik 29 Jun '16

29 Jun '16

ehlo, attached is a patch for TEVENT_REQ_RETURN_ON_ERROR which was discussed in dp_provider related thread. It "fixes" 6 clang warnings and 150 UNINIT from coverity (visible only in --agresive mode) BTW feel fre to prose different error code for result of down casting == 0. It should not happen but one never knows. LS

2 4

[PATCH 2/2] UTIL: Revent connection handling in sssd_async_connect_send
by Lukas Slebodnik 28 Jun '16

28 Jun '16

ehlo, Simo Did you have a special reason for changing connection handling in commit https://git.fedorahosted.org/cgit/sssd.git/commit/?id=e05d3f5872263aadfbc2f… Because with such change it takes mugh longer unit sssd go into offline mode. I added few debug messages into sssd_async_connect_done. But most important is time of operations. old behaviour with TEVENT_FD_READ | TEVENT_FD_WRITE --------------------------------------------------- (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [generic_ext_search_handler] (0x0040): sdap_get_generic_ext_recv failed [110]: Connection timed out (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sdap_id_op_done] (0x0200): communication error on cached connection, moving to next server (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP' (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sdap_uri_callback] (0x0400): Constructed uri 'ldaps://ibm-x3650m4-01-vm-07.example.com' (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_send] (0x4000): Using file descriptor [21] for the connection. (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Creating request (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Before connect (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): After connect ret:-1 (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Calling tevent_add_fd TEVENT_FD_READ | TEVENT_FD_WRITE (Sat Jun 18 11:47:03 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_connect_done] (0x0020): Before connect (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_connect_done] (0x0020): After connect ret:-1 errno:113 (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_connect_done] (0x0020): connect failed [113][No route to host]. (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_done] (0x0020): sdap_async_sys_connect request failed: [113]: No route to host. (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sssd_async_socket_state_destructor] (0x0400): closing socket [21] (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sss_ldap_init_sys_connect_done] (0x0020): sssd_async_socket_init request failed: [113]: No route to host. (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sdap_sys_connect_done] (0x0020): sdap_async_connect_call request failed: [113]: No route to host. (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [get_port_status] (0x1000): Port status of port 636 for server 'ibm-x3650m4-01-vm-07.example.com' is 'not working' (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0020): No available servers for service 'LDAP' (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [be_resolve_server_done] (0x1000): Server resolution failed: [5]: Input/output error (Sat Jun 18 11:47:04 2016) [sssd[be[LDAP]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error]) current behaviour with TEVENT_FD_WRITE -------------------------------------- (Sat Jun 18 12:04:27 2016) [sssd[be[LDAP]]] [generic_ext_search_handler] (0x0040): sdap_get_generic_ext_recv failed [110]: Connection timed out (Sat Jun 18 12:04:27 2016) [sssd[be[LDAP]]] [sdap_id_op_done] (0x0200): communication error on cached connection, moving to next server (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP' (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sdap_uri_callback] (0x0400): Constructed uri 'ldaps://ibm-x3650m4-01-vm-07.example.com' (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Creating request (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Before connect (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): After connect ret:-1 (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_connect_send] (0x0020): Calling tevent_add_fd (Sat Jun 18 12:04:28 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for connecting (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sssd_async_connect_timeout] (0x0100): The connection timed out (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sssd_async_socket_init_done] (0x0020): sdap_async_sys_connect request failed: [110]: Connection timed out. (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sss_ldap_init_sys_connect_done] (0x0020): sssd_async_socket_init request failed: [110]: Connection timed out. (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sdap_sys_connect_done] (0x0020): sdap_async_connect_call request failed: [110]: Connection timed out. (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sdap_handle_release] (0x2000): Trace: sh[0xfe49dc0], connected[0], ops[(nil)], ldap[(nil)], destructor_lock[0], release_memory[0] (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [get_port_status] (0x1000): Port status of port 636 for server 'ibm-x3650m4-01-vm-07.example.com' is 'not working' (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0020): No available servers for service 'LDAP' (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [be_resolve_server_done] (0x1000): Server resolution failed: [5]: Input/output error (Sat Jun 18 12:04:34 2016) [sssd[be[LDAP]]] [sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error]) If you did not have a special reason for this change then I would appreciate if we could change it back. Two patches attached. LS

3 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel June 2016