sssd-devel June 2016

sssd-devel@lists.fedorahosted.org

11 participants
64 discussions

[PATCH] RESPONDERS: Negative caching of local users
by Petr Cech 10 Jun '16

10 Jun '16

Hello, this patch resolves [1]. This adds new behaviour of negative caching of locals, so it needs new tests. I will send patch with tests soon, but not today. It is applicable after RESPONDERS: Negcache in resp_ctx [2]. For clarity, there is branch with all negative cache's patches [3]. Links: [1] https://fedorahosted.org/sssd/ticket/2928 [2] https://www.mail-archive.com/sssd-devel@lists.fedorahosted.org/msg26580.html [3] https://github.com/celestian/sssd/commits/ncache_v2 Regards -- Petr^4 Čech

4 16

[PATCH] systemtap-based performance probes
by Jakub Hrozek 10 Jun '16

10 Jun '16

Hi, the attached patches are the first self-contained part of my performance work. Using them, I analyzed the performance of 'id' as the worst-case, then realized most of the issues are around processing and storing large groups. The results gathered using these scripts are in fact the base of the improvements documented at: https://fedorahosted.org/sssd/wiki/DesignDocs/OneFourteenPerformanceImprove… I tried to add descriptive commit messages to the patches so that hopefully all the info is in those commit messages. We will probably add more probes into different areas of code, but these are the ones that I already haven't modified for weeks, so I think it should be safe to merge them. The probes are enabled in our RPMs and I would encourage downstreams to enable them as well. There is virtually no cost of having the probes compiled in by default and the benefit would be that admins can run them to see what are the bottlenecks in their environment. I was also wondering if it makes sense to add a generic back-end-request tracking probes and an associated script, but since the data provider is being re-factored at the moment, I think it would be better to land the DP changes first. The reason I split the sysdb probes into several commits (unlike the LDAP probes) is that I think in future, we can use these commits as a reference for adding more probes to different areas of SSSD. CI: http://sssd-ci.duckdns.org/logs/job/42/99/summary.html (BTW, thanks to Lukas for helping me a lot with the build failures on #sssd last week)

2 8

[PATCH] RESPONDER: Fix error check in cache_req.c
by Jakub Hrozek 10 Jun '16

10 Jun '16

Hi, I found this little bug when reviewing Pavel's sudo patch.

3 8

[TESTS] FAIL: pam-srv-tests
by Lukas Slebodnik 10 Jun '16

10 Jun '16

ehlo, I took some time to find out why pam-srv-tests fails so often. https://fedorahosted.org/sssd/ticket/2994 It is caused by slow execution of function sysdb_cache_password_ex. (Thu Jun 9 22:13:36:771048 2016) [sssd] [sysdb_cache_password_ex] (0x0100): start. (Thu Jun 9 22:13:36:771317 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before s3crypt_gen_salt (Thu Jun 9 22:13:36:771678 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before s3crypt_sha512 (Thu Jun 9 22:13:38:022470 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_new_attrs (Thu Jun 9 22:13:38:023115 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_attrs_add_string (Thu Jun 9 22:13:38:023431 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_attrs_add_long (Thu Jun 9 22:13:38:023829 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_attrs_add_long v2 (Thu Jun 9 22:13:38:024156 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_attrs_add_long v3 (Thu Jun 9 22:13:38:024482 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_attrs_add_uint32 (Thu Jun 9 22:13:38:024816 2016) [sssd] [sysdb_cache_password_ex] (0x0100): Before sysdb_set_user_attr (Thu Jun 9 22:13:38:035319 2016) [sssd] [sysdb_cache_password_ex] (0x0100): return eok As you can see, the execution of function s3crypt_sha512 took almost two seconds. Is it caused by valgrind all low entropy? I can try to go deeper and find out which part of function sha512_crypt_r is very slow. But it's faster to write to mailing list rather than wait for results from CI. LS

3 6

[PATCHES] ipa: add support for certificate overrides
by Sumit Bose 09 Jun '16

09 Jun '16

Hi, this set of patches should resolve https://fedorahosted.org/sssd/ticket/2897 "Smart Cards: Certificate in the ID View" and cover all other use cases from https://fedorahosted.org/sssd/wiki/DesignDocs/LookupUsersByCertificatePart2 as well. So basically certificates can be read from IPA and local overrides and from AD with direct in indirect integration. The patches are all about lookups, so Smartcards and authentication is not needed to test them. All is needed is a certificate which can be added to an AD user object or an override object and then try to lookup the user with dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Users.FindByCertificate string:"BASE64_CERTIFICATE_STRING" from a IPA client, IPA server or AD client with AD provier. If the certificate is store in the AD user object and the lookup is started on an IPA client a patch for the IPA server is needed, because the request has to run via the extdom plugin. I'll send a patch to freeipa-devel which will use the sss_nss_getnamebycert() call added by one of the patches to allow the extdom plugin to do lookups by certificate. This means that SSSD on the IPA server must used the attached patches as well. bye, Sumit

3 16

[PATCH] PAM: add pam_sss option allow_missing_name
by Sumit Bose 09 Jun '16

09 Jun '16

Hi, that attached two patches would allow to use the Smartcard support in gdm with SSSD. To use it you should replace pam_pkcs11 in /etc/pam.d/smartcard-auth in the auth section by auth sufficient pam_sss.so allow_missing_name and drop the password section completely. To enable the Smartcard support in gdm the easiest way is to use dconf-editor: DCONF_PROFILE=gdm dconf-editor In the org/gnome/login-screen section you can switch the Smartcard support on and off. Additionally you might want to tune the removal action in org/gnome/settings-daemon/peripherals/smartcard . If now a Smartcard is inserted gdm should register it, call /etc/pam.d/gdm-smartcard which calls /etc/pam.d/smartcard-auth without a user name. With the new option from the first patch pam_sss will accept this and send it to the pam responder. The pam responder can handle this if Smartcard authentication is enabled, tries to read the certificate from the Smartcard, tries to find and matching user and if successful, returns the user name to pam_sss which puts it on the PAM stack and continues with the authentication. It would be nice if someone can review the code even without testing the functionality. In this case I will ask someone else with access to Smartcards and reader to do some functional testing. I think these patches are candidates for the pam wrapper based tests Jakub has for review on the list. I'll start reviewing those and add tests when they are in master. bye, Sumit

3 5

[PATCH] AD: use krb5_keytab for subdomain initialization
by Sumit Bose 09 Jun '16

09 Jun '16

Hi, this is a bit of a follow-up patch to "subdomains: inherit ldap_krb5_keytab". It turned out that if the default keytab contains some completely unrelated keys the SASL initialization might e.g. pick a wrong realm name because the alternative keytab was only added later during the initialization. bye, Sumit

3 6

Session Recording control options
by Nikolai Kondrashov 07 Jun '16

07 Jun '16

Hi everyone, After a little discussion with Dmitri and Sumit we decided that we'll need options for controlling session recording in sssd.conf, after all. The options should be something like this: record_sessions - string, one of: none/some/all, default is "none" record_sessions_users - string, space-separated list of users to record record_sessions_groups - string, space-separated list of groups to record I'm not sure where we should put them. They can't be put into "nss" or "pam" sections alone, as they concern both (nss fakes the shell, pam adds enviroment variables). I would rather put them into the global "sssd" section and have fully-qualified usernames listed there, but I see that there is very little options there otherwise, so I suspect they wouldn't be welcome. Otherwise, we can put them into domain sections, but that would mean duplicating the "record_sessions" option in every one of them, which is inconvenient. What do you think about any of the above? Thanks! Nick

4 8

[PATCH] AD_PROVIDER: Fix constant char *
by Petr Cech 07 Jun '16

07 Jun '16

Hello, there is simple patch attached. Please, look at commit message. Regards -- Petr^4 Čech

5 10

Design document - sssctl
by Pavel Reichl 07 Jun '16

07 Jun '16

Hello, Pavel Březina and I have prepared the 1st draft of design document. We mostly focused on summing up its future functionality and its interface. Please comment if you miss some essential functionality or if you would prefer some different interface. Thanks! https://fedorahosted.org/sssd/wiki/DesignDocs/sssctl

8 27

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel June 2016