August 2016 - sssd-devel - Fedora mailing-lists

Tlog integration and packages
by Nikolai Kondrashov 10 Mar '17

10 Mar '17

Hi everyone, I'd like to continue the discussion of tlog integration, and also present you the first release of tlog - a development preview, which has the configuration interface necessary to implement the integration: https://github.com/spbnick/tlog/releases/tag/v1 You're more than welcome to download RPMs, install, read tlog-rec(8) and tlog-rec.conf(5), and experiment! Building from the Git tree and the tarball works as well, if you're so inclined. I'm also attaching those manpages for convenience. Here are the integration plans so far, as discussed with Jakub on our devconf.cz trip meetings and before on the list. Jakub, please correct me or add details. * We follow the route similar to that taken by SELinux rule control implementation [1][2]. I.e. store the configuration in LDAP HBAC rules, write to files on the client side and then specify them to tlog upon user login. However, I'm also rather fond of the idea of specifying the whole configuration through an environment variable instead of through a file referenced by an environment variable - it's not big at all, and we'll avoid the hassle of managing the files. I implemented support for both in tlog (was easy). * We'll have to make nss_sss report user's shell as tlog-rec (how?) and specify the actual shell to tlog-rec via an environment variable, through pam_sss (with SSS_PAM_ENV_ITEM messages). I.e.: * Nss_sss would always report tlog-rec as the user's shell. * During login (e.g. through "login" or "sshd") pam_sss would add a variable to the user environment, containing, or pointing at, a tlog-rec configuration (TLOG_REC_CONF_TEXT or TLOG_REC_CONF_FILE). That configuration would contain the user's actual shell. I can also implement support for a separate variable just for the shell (TLOG_REC_SHELL?) to simplify the implementation for the start. * Tlog-rec would read the system-wide configuration and overlay it with the one specified in the environment, adding the specific user shell, and then would spawn it. Please also see the draft integration design page [3] for reference. I hope to refine and extend it in the coming weeks to match FreeIPA standards. Please chime in and suggest, object, discuss! Also, please report tlog bugs at https://github.com/spbnick/tlog/issues Thank you! Nick [1]: http://www.freeipa.org/page/SELinux_user_mapping [2]: http://www.freeipa.org/images/b/b9/Freeipa30_SELinuxUserMap.pdf [3]: http://www.freeipa.org/page/Session_Recording

5 22

[PATCH] Create pidfile after responders have started
by Victor Tapia 09 Jan '17

09 Jan '17

Hi list, The attached patch covers ticket #3080 (https://fedorahosted.org/sssd/ticket/3080) It's based on the following commit: https://git.fedorahosted.org/cgit/sssd.git/commit/?id=d19c4785215305e6eb5f2… Currently, systemd and upstart set the service as 'started' before the responders are available, making service dependencies (with autofs, for instance) unreliable due to a race condition with such dependent services. Creating the pidfile after the responders are up, and monitoring it's creation in the systemd service fixes this race condition. Thanks in advance, Victor

3 23

[RFC] NSS tlog integration
by Nikolai Kondrashov 09 Dec '16

09 Dec '16

Hi everyone, Please find attached proof-of-concept patches for a part of NSS integration with tlog. Namely, addition of shell substitution for getpwnam requests. The code is supposed to replace a user's shell with /usr/bin/tlog-rec, if session recording is enabled for all users, if it is enabled for that particular user, or for a group that it belongs to. The configuration is done in a dedicated section of sssd.conf named "session_recording", which can contain three options "scope", "users", and "groups". Those correspond to the scope of session recording: "none", "some", and "all", corresponding in order to: disabled session recording, session recording enabled for the specified users/groups, and session recording enabled for all users handled by SSSD. An example of a configuration can be: [session_recording] ; Disabled scope = none or [session_recording] ; Enabled for everyone scope = all or [session_recording] ; Enabled for some users and groups scope = some users = user1, user2 groups = group1, group2 The parts to be done still are adding support for getpwuid and getpwent requests, exporting of the original shell in pam_sss, and of course cleaning it up and doing it according to your comments and requirements. The code has some documentation in doxygen format, which I can change later if we decide on some other format, or no documentation at all. Please, tell me if I'm doing anything wrong this far already, or suggest better ways to do it. Thank you! Nick P.S. I'm on PTO for two weeks starting next week, so might not be able to answer quickly.

3 15

[PATCH] Unit tests for pam_sss using pam_wrapper (need help with CI..)
by Jakub Hrozek 08 Dec '16

08 Dec '16

Hi, the attached patches implement unit tests for the pam_sss module using pam_wrapper and libpamtest. In my testing, the coverage is around 75% with mostly the parts that require running as root being untested. I worked on this patchset even though the features for 1.14 are in full swing because there are several tickets that will require us to patch pam_sss, so it's important to have the code that changes tested. In addition, when we merge Dan's patches to use TLS with integration tests, then we'll be able to also test authentication in integration tests easily using libpamtest-python. However, our CI fails for me constantly: http://sssd-ci.duckdns.org/logs/job/42/75/fedora_rawhide/ci.html The strange thing is that running CI locally works fine and so does make check. Can anyone help point me in the right direction as to what should I check next? I suspect some of the environment variables might not be set correctly, but I don't see why..

2 8

[PATCH SET] SYSDB: Adding message to inform about cache
by Petr Cech 08 Nov '16

08 Nov '16

Hello list, I am solving ticket [1] now. There are three points mentioned. A have prepared patches for the first two. I would like to ask anybody it is right or if I miss something. The third point is about full LDIFF in special debug level. What does it mean 'special debug level'? Is it new option, for example? [1] https://fedorahosted.org/sssd/ticket/3060 Regards -- Petr^4 Čech

4 45

[PATCHES] views: properly override group member names
by Sumit Bose 08 Nov '16

08 Nov '16

Hi, this is my suggestion to solve https://fedorahosted.org/sssd/ticket/2948 "Handle overriden name of members in the memberUid attribute". The first two patches are for the IPA provider and make sure that all ghost members in a group get resolved because otherwise we cannot determine if the name is overridden or not. This adds an overhead to group lookups, especially for larger groups but I think it is an requirement which cannot be skipped. The third patch adds a sysdb call to recursively resolve all user-members of a group. Since the groups in SSSD's cache are hierarchically organized the member attribute only contains direct user and group members. To get all users the group members must be resolved recursively. Finally the forth patch applies the code-path which is already used for non-default views to the default case as well and adds a new list of members, with correctly overridden names (hopefully :-) which is then used in fill_grmem(). This adds some overhead to the overall group processing in the NSS responder (as can be seen in the test changes because the members are returned in different order in some cases). But I think because the of memory cache this is acceptable and might even help to remove the memberuid attribute in future and make the memberof plugin simpler. I worked on an alternative approach as well which tried to make the memberof plugin aware of the defaultOverrideName attribute. My wip tree is at https://fedorapeople.org/cgit/sbose/public_git/sssd.git/log/?h=memberof_def… but so far it does not work properly. Additionally I would prefer to not touch the memberof plugin. bye, Sumit

3 20

[PATCH] SYSDB: Fix error handling in sysdb_get_user_members_recursively
by Lukas Slebodnik 07 Nov '16

07 Nov '16

ehlo, We should not ignore return values of functions. LS

3 4

[PATCHES] Fix warnings Wsign-compare
by Lukas Slebodnik 17 Oct '16

17 Oct '16

ehlo, I found few warnings on rawhide when I build sssd-1.13.2 https://kojipkgs.fedoraproject.org//work/tasks/8618/11918618/build.log LS

2 6

RFC: github PR workflow
by Jakub Hrozek 03 Oct '16

03 Oct '16

Hi, I documented workflow that we could use for submitting PRs: https://fedorahosted.org/sssd/wiki/GithubWorkflow It's quite similar to what the FreeIPA team uses (although I don't think they publicly document it yet). Comments or edits welcome. If there are none, I'll link the page from the Contribute page later.

3 7

[RFC] Use GNULIB's compiler warning code
by Fabiano Fidêncio 29 Sep '16

29 Sep '16

Howdy! I've suggested, a long time ago, that we could start making use of GNULIB's compiler warnings from 'manywarnings' module. This is basically what we have been doing in a few projects that I (used to and still) maintain (like spice-gtk and libosinfo, for instance). For now I didn't try to fix any of the warnings that we cannot cope with, mainly because I'm not sure whether you guys will agree on using it or not. Here is an experimental patch that works properly on Fedora 24. I still have to make some tests on RHEL-6, RHEL-7 and a few other systems (Debian, at least) in order to make sure that we won't break the build because of the patch. If you are okay with the change, I'll start going through the warnings that we cannot cope with and slowly start fixing them. Although, I have the feeling that fixing some of them would cause a lot of undesired changes, which will just bring troubles for ourselves when backporting fixes downstream (and here I'm talking about -Wformat-signedess, -Wsign-compare, -Wunused-parameter, ... for instance). I'm looking forward to hear some feedback! Best Regards, -- Fabiano Fidêncio

3 10

[PATCH] config_schema: Add ldap_user_email to schema
by Lukas Slebodnik 26 Sep '16

26 Sep '16

ehlo, yet another oneliner. It reminds me that we should generate either schema or data for python test. LS

3 5

[PATCH] sss_override: improve --debug description
by Pavel Březina 24 Sep '16

24 Sep '16

https://fedorahosted.org/sssd/ticket/2813 I wanted to split include/debug_levels.xml into more files so we don't duplicate information, but I didn't figure out how to use xi:include in files that are already beeing included. I always managed to fail on dtd validation. Maybe someone more familiar with docbook may chime in.

4 12

[PATCH] SPEC: Rename python packages using macro %python_provide
by Lukas Slebodnik 22 Sep '16

22 Sep '16

ehlo, SSSD python packages were renamed in fedora few months ago. python-* -> python2-* But we didn't rename packages in upstream spec file and therefore upgrade from fedora 24 -> sssd master is not possible. Attached patch shoudl fix the issue. BTW here are provides and obsoletes for current master sh$ rpm -qp --provides python-libipa_hbac-1.13.92-0.fc24.x86_64.rpm libipa_hbac-python = 1.13.92-0.fc24 python-libipa_hbac = 1.13.92-0.fc24 python-libipa_hbac(x86-64) = 1.13.92-0.fc24 sh$ rpm -qp --obsoletes python-libipa_hbac-1.13.92-0.fc24.x86_64.rpm libipa_hbac-python < 1.12.90 and after renaming sh$ rpm -qp --provides python2-libipa_hbac-1.13.92-0.el6.x86_64.rpm libipa_hbac-python = 1.13.92-0.el6 python-libipa_hbac = 1.13.92-0.el6 python2-libipa_hbac = 1.13.92-0.el6 python2-libipa_hbac(x86-64) = 1.13.92-0.el6 sh$ rpm -qp --obsoletes python2-libipa_hbac-1.13.92-0.el6.x86_64.rpm libipa_hbac-python < 1.12.90 python-libipa_hbac < 1.13.92-0.el6 LS

2 6

[PATCH] ssh: skip invalid certificates
by Sumit Bose 22 Sep '16

22 Sep '16

Hi, currently the code which generates ssh key from the public keys in the user certificates fails if one certificate cannot be validated and terminates the whole request. It is of course valid that the user entry might contain certificates which SSSD cannot validate and since we just won't generate a ssh-key in this case SSSD should just skip those entires and return ssh-keys for every valid certificate. You can test the patch even without a real certificate by e.g. adding a ssh-key to an IPA user object. Then 'sss_ssh_authorizedkeys username' should return this key. If you now add some random data the the userCertificate object of the same user, call 'sss_cache -E' and call 'sss_ssh_authorizedkeys username' again, you get nothing because the random data cannot be validated and hence the whole request is aborted. With the attached patch sss_ssh_authorizedkeys should return the ssh-key again. bye, Sumit

3 7

[PATCH] Fix offline resolution of autofs maps and netgroups
by Jakub Hrozek 21 Sep '16

21 Sep '16

Hi, to reproduce the netgroups failure: * getent netgroup testngr # to verify the netgroup is there * sss_cache -E * pkill -USR1 sssd # make sssd go offline * getent netgroup testngr to reproduce the autofs maps failure: * automount -m # to verify the maps are there * pkill -USR1 sssd # make sssd go offline * automount -m # to verify the maps are there Before the patches, neither offline lookup would return the expected results. Both lookups should return results with the patches.

3 7

[PATCHES] p11: add no_verification option
by Sumit Bose 19 Sep '16

19 Sep '16

Hi, the following 3 patches are related to the Smartcard authentication feature but imo can be tested even without having one. The first patch just adds some missing pieces. The second adds a new 'no_verification' switch to the 'certificate_verification' option, which is already tested by the unit tests. The third adds two new OCSP related switches. With OCSP a certificate can be validates online by talking to a server which is listed in the certificate. Of course it might not always be possible to directly talk to this server. We already have the 'no_ocsp' switch to disable OCSP completely. The two new switches allow SSSD to talk to a different server or a proxy. To see how it is working you can do to following: - call 'make check' to build and rung all the tests - call './pam-srv-tests' to run the PAM responder tests but do not let it complete but stop it with CTRL-C. This is needed to create the test nss database in /dev/shm/tp_pam_srv_tests-test_pam_srv/, it can be created differently but this way it is most easy :-) - add a OCSP signing cert with echo "MIIDaTCCAlGgAwIBAgIBAjANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlJUEEuREVWRUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNTA5MjMxMTI2MjBaFw0xNzA5MTIxMTI2MjBaMC0xEjAQBgNVBAoMCUlQQS5ERVZFTDEXMBUGA1UEAwwOT0NTUCBTdWJzeXN0ZW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDEXVzkTN9R03+hvAbkiCYqdKKe7Nr0YDlchny+IsJl5cYiFBtWqiVJK5N0L6uCS9bVBtuG7y9Vv1TJrv2U8hqjXYZFM6HzYwwmbE2tv1Yyx0dQyYiYTT0nVyXPrXDJe0PFdYTsAlw7C54wZuBsdDADUTA1ThAP22Z6Zy+UyQFtlqEfCErvHK+VolCfkTJ4dYlQb5x7Gs6fEmLbnaGpJXW1JnRzMZ4hM+/mV3xSsjFuYwwoFCHG6GQu/LJgosBX9M+OMavMOO/AzeUlHfUoyMUNn0iNeiDqeYPBCNf4czK0CpeJdE4qBBgu0vSfC0mzjKRuFQEAUuBGxGE+2BP09uXAgMBAAGjgYwwgYkwHwYDVR0jBBgwFoAU0aLh2me2OKzMbu3zckJNNu3Hd1swDgYDVR0PAQH/BAQDAgHGMEEGCCsGAQUFBwEBBDUwMzAxBggrBgEFBQcwAYYlaHR0cDovL2lwYS1kZXZlbC5pcGEuZGV2ZWw6ODAvY2Evb2NzcDATBgNVHSUEDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAQEAAJzUjm39nsMlxc0ivEm77PN9ZFFWIfY6fOteNpJnOADlOatkXKq6PTFS0lRo/53HjYvmvrjnUTYHK3hmRlDvwr+49UqhSkKai8v6PSS4jYJplETME032OwGL17qCjoX2yU55Ovm3CIamUNNOSIvMBbS7HB0EBe/KHMhme5+Uhtfgjql9B9ihuwT1U3vXQP+cavxe37PJOCUuuATLyd0GX+Islkq2v1pEKX0dsXhMpDwLOYLqckBZHOoAKEo2VYZN0P1KZZkJd4kQHGsADYfuIrLACwzLxlEWmCIq4AOwpYtkMSx85DgT6lW3ECgfbFYVVUzqHUuTiogEsgJ0kouCJw==" | base64 -d | certutil -A -d sql:/dev/shm/tp_pam_srv_tests-test_pam_srv -t TC,TC,TC -n ocsp_cert the NSS library call check this certificate first before trying to connect to the OCSP responder, so a valid one with the right key usage must be added to make NSS try to reach the new OCSP responder - call strace -s 128 -f -esend .libs/lt-p11_child --debug-microseconds=1 --debug-timestamps=1 --debug-to-stderr --debug-level=10 --pre --nssdb sql:/dev/shm/tp_pam_srv_tests-test_pam_srv where you should see lines like send(7, "\313D\1\0\0\1\0\0\0\0\0\0\6ipa-ca\3ipa\5devel\0\0\1\0\1", 34, MSG_NOSIGNAL) = 34 from the DNS lookups for ipa-ca.ipa.devel which is the OCSP server from the ticket - call strace -s 128 -f -esend ./p11_child --debug-microseconds=1 --debug-timestamps=1 --debug-to-stderr --debug-level=10 --pre --nssdb sql:/dev/shm/tp_pam_srv_tests-test_pam_srv --verify 'ocsp_default_responder=http://oooo.cccc.ssss.pppp:80,ocsp_default_responder_signing_cert=ocsp_cert' where you should now see lines like send(7, "yO\1\0\0\1\0\0\0\0\0\0\4oooo\4cccc\4ssss\4pppp\0\0\1\0\1", 37, MSG_NOSIGNAL) = 37 from the DNS lookups for the OCSP responder from the command line. Of course all the validations will fail with "Certificate [SSSD Test Token:Server-Cert][CN=ipa-devel.ipa.devel,O=IPA.DEVEL] not valid [-8071], skipping" because none of the OCSP responders are available but I think this test is sufficient to see that the patch is working as expected. bye, Sumit

3 11

[PATCH] Failover to next server if authentication fails
by Pavel Březina 19 Sep '16

19 Sep '16

We can fail in sasl_bind_send() with ERR_AUTH_FAILED for basically unspecified reason but we do not failover to next server. This patch should fix it. As said on the meeting, I didn't reproduce it and I'm not sure if it will fix the customer issue unless they confirm it, but it seems to be a valid patch anyway.

2 6

Re: [PATCH SET] AD_PROVIDER: ad_enabled_domains
by Petr Cech 19 Sep '16

19 Sep '16

Sorry, I experienced some issue with mailing list. So I send it again. -------- Forwarded Message -------- Subject: Re: [SSSD] Re: [PATCH SET] AD_PROVIDER: ad_enabled_domains Date: Tue, 9 Aug 2016 17:29:38 +0200 From: Petr Cech <pcech(a)redhat.com> To: sssd-devel(a)lists.fedorahosted.org On 08/09/2016 11:07 AM, Jakub Hrozek wrote: > On Mon, Jul 25, 2016 at 06:18:28PM +0200, Petr Cech wrote: >> > Hello, >> > >> > there is fixed patch set attached. >> > >> > Segmentation fault was caused by wrong pointer :-(, sorry. >> > >> > This new patch set has new debug message. I am open to dissccus the >> > debug_level and content of message. Any improving idea? >> > >> > I hit one issue during testing -- sometimes if I am connected to subdomain >> > and I enable only sibling subdomain (the master is added automaticaly) and >> > forest root is not enabled -- I see only master and sibling not. But if I >> > added sleep for cycle (for using dbg) to function ad_subdomains_init() >> > everythink is OK. >> > Any idea? > Can you test that case with valgrind? This sounds like some uninitilized > variable condition. I didn't run valgrind but I have new information. If you clear the cache and reset sssd, first attempt to obtain information about user from sibling domain fails. The second and the other attempts runs correctly. I see that the sibling domain is enabled. But if I look more carefully there is message in log (gamma.domain.bootes is sibling domain): [sssd[be[beta.domain.bootes]]] [dp_req_new] (0x0020): Unknown domain: gamma.domain.bootes First attempt should works too but you should wait nearly exactly 6 seconds after restart sssd. New patch set is attached. >> > Anyway, I would like to ask you for testing. >> > >> > Regards >> > >> > -- >> > Petr^4 Čech >> > From 7fd9ad8f42f274463c1d107b195d21290fd0b0f2 Mon Sep 17 00:00:00 2001 >> > From: Petr Cech <pcech(a)redhat.com> >> > Date: Fri, 13 May 2016 05:21:07 -0400 >> > Subject: [PATCH 1/5] AD_PROVIDER: Add ad_enabled_domains option > ACK Thanks. >> > From dfa6e063d3ef4850a7809e2f5a6d3826ea061b27 Mon Sep 17 00:00:00 2001 >> > From: Petr Cech <pcech(a)redhat.com> >> > Date: Tue, 21 Jun 2016 08:34:15 +0200 >> > Subject: [PATCH 2/5] AD_PROVIDER: Initializing of ad_enabled_domains >> > >> > We add ad_enabled_domains into ad_subdomains_ctx. >> > >> > Resolves: >> > https://fedorahosted.org/sssd/ticket/2828 >> > --- >> > src/providers/ad/ad_subdomains.c | 82 ++++++++++++++++++++++++++++++++++++++++ >> > 1 file changed, 82 insertions(+) >> > >> > diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c >> > index e9da04e384e598927f9c8c203a751bcccd29e895..9c0afb19418e44a3e3daa661baf1c7a82439d60d 100644 >> > --- a/src/providers/ad/ad_subdomains.c >> > +++ b/src/providers/ad/ad_subdomains.c >> > @@ -57,6 +57,79 @@ >> > /* do not refresh more often than every 5 seconds for now */ >> > #define AD_SUBDOMAIN_REFRESH_LIMIT 5 >> > >> > +static errno_t ad_get_enabled_domains(TALLOC_CTX *mem_ctx, >> > + struct ad_id_ctx *ad_id_ctx, >> > + const char *ad_domain, >> > + const char ***_ad_enabled_domains) >> > +{ >> > + int ret; >> > + const char *str; >> > + const char *option_name; >> > + const char **domains = NULL; >> > + int count; >> > + bool is_ad_in_domains; >> > + TALLOC_CTX *tmp_ctx = NULL; >> > + >> > + tmp_ctx = talloc_new(NULL); >> > + if (tmp_ctx == NULL) { >> > + return ENOMEM; >> > + } >> > + >> > + str = dp_opt_get_cstring(ad_id_ctx->ad_options->basic, AD_ENABLED_DOMAINS); >> > + if (str == NULL) { >> > + _ad_enabled_domains = NULL; > I think you wanted to dereference the pointer here? (it might also be a > good idea to return EINVAL if the caller passed NULL as the output pointer) Right, thanks, addressed. >> > + ret = EOK; >> > + goto done; >> > + } >> > + >> > From 4cd5c77f09750f9eb20c91eadc4759c3e4166093 Mon Sep 17 00:00:00 2001 >> > From: Petr Cech <pcech(a)redhat.com> >> > Date: Tue, 21 Jun 2016 09:48:52 +0200 >> > Subject: [PATCH 3/5] AD_PROVIDER: ad_enabled_domains - only master >> > >> > We can skip looking up other domains if option ad_enabled_domains >> > contains only master domain. >> > >> > Resolves: >> > https://fedorahosted.org/sssd/ticket/2828 >> > --- >> > src/providers/ad/ad_subdomains.c | 16 ++++++++++++++++ >> > 1 file changed, 16 insertions(+) >> > >> > diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c >> > index 9c0afb19418e44a3e3daa661baf1c7a82439d60d..eaa85f802dbb4022dc632cc4c05d89685eccd901 100644 >> > --- a/src/providers/ad/ad_subdomains.c >> > +++ b/src/providers/ad/ad_subdomains.c >> > @@ -1163,6 +1163,7 @@ static void ad_subdomains_refresh_connect_done(struct tevent_req *subreq) >> > return; >> > } >> > >> > + /* connect to the DC we are a member of */ >> > subreq = ad_master_domain_send(state, state->ev, state->id_ctx->conn, >> > state->sdap_op, state->sd_ctx->domain_name); >> > if (subreq == NULL) { >> > @@ -1211,6 +1212,21 @@ static void ad_subdomains_refresh_master_done(struct tevent_req *subreq) >> > goto done; >> > } >> > >> > + /* >> > + * If ad_enabled_domains contains only master domain >> > + * we shouldn't lookup other domains. >> > + */ >> > + if (state->sd_ctx->ad_enabled_domains != NULL) { >> > + if (talloc_array_length(state->sd_ctx->ad_enabled_domains) == 2) { >> > + if (strcmp(state->sd_ctx->ad_enabled_domains[0], >> > + state->be_ctx->domain->name) == 0) { > I only notices this now, but IIRC the domains are case insensitive, > shouldn't we use strcasecmp here? I see strcasecmp in other places. So I fixed it. >> > + DEBUG(SSSDBG_TRACE_FUNC, >> > + "No other enabled domain than master.\n"); >> > + goto done; >> > + } >> > + } >> > + } >> > + >> > subreq = ad_get_root_domain_send(state, state->ev, forest, >> > sdap_id_op_handle(state->sdap_op), >> > state->sd_ctx); >> > -- >> > 2.7.4 >> > >> > From 0d2b0c67875663d0e614b8361152ec7edc14c37e Mon Sep 17 00:00:00 2001 >> > From: Petr Cech <pcech(a)redhat.com> >> > Date: Mon, 27 Jun 2016 11:51:30 +0200 >> > Subject: [PATCH 4/5] AD_PROVIDER: ad_enabled_domains - other then master >> > >> > We can skip looking up other domains if >> > option ad_enabled_domains doesn't contain them. >> > >> > Resolves: >> > https://fedorahosted.org/sssd/ticket/2828 >> > --- >> > src/providers/ad/ad_subdomains.c | 49 ++++++++++++++++++++++++++++++++++++---- >> > 1 file changed, 45 insertions(+), 4 deletions(-) >> > >> > diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c >> > index eaa85f802dbb4022dc632cc4c05d89685eccd901..32f7d7b3b2c4917d15d516c5e8beac159ffe164f 100644 >> > --- a/src/providers/ad/ad_subdomains.c >> > +++ b/src/providers/ad/ad_subdomains.c >> > @@ -130,6 +130,23 @@ done: >> > return ret; >> > } >> > >> > +static bool is_domain_enabled (const char *domain, >> > + const char **enabled_doms) > ^ > We don't put a space between function name and the argument list. Addressed. >> > +{ >> > + bool ret; >> > + >> > + if (enabled_doms == NULL) { >> > + ret = true; >> > + goto done; > Do we really need to use jump labels instead of just returning true? Addressed. >> > + } >> > + >> > + ret = string_in_list(domain, discard_const_p(char *, enabled_doms), true) ? >> > + true : false; > Can you also fix the indentation here? We could also just return the > function return value and get rid of the 'ret' variable completely. Addressed. >> > + >> > +done: >> > + return ret; >> > +} >> > + >> > static errno_t >> > ad_subdom_ad_ctx_new(struct be_ctx *be_ctx, >> > struct ad_id_ctx *id_ctx, >> > @@ -485,6 +502,7 @@ done: >> > >> > From 92af52a3b4d8fa138282030a72122d6cbe9c5413 Mon Sep 17 00:00:00 2001 >> > From: Petr Cech <pcech(a)redhat.com> >> > Date: Mon, 27 Jun 2016 11:53:19 +0200 >> > Subject: [PATCH 5/5] TESTS: Adding tests for ad_enabled_domains option > ACK Thanks. Regards -- Petr^4 Čech

4 23

[PATCH] sudo man page: say that we support IPA schema
by Pavel Březina 16 Sep '16

16 Sep '16

SSIA

5 12

[PATCH] WIP: PROXY: Adding proxy_max_children option
by Petr Cech 14 Sep '16

14 Sep '16

Hello, I am fighting with adding new option to sssd.conf. I slowly running out of breath. I know proxy could be id, auth or chpass provider. I don't know where is the right place for my option. And the second issue is it breaks test for SSSD config. :-( Is there anyone who would like to join to the fight? Please, see attached patch. Regards -- Petr^4 Čech

5 23

[PATCH] SECRETS: Search by the right type when checking containers
by Fabiano Fidêncio 13 Sep '16

13 Sep '16

We've been searching for the wrong type ("simple") in local_db_check_containers(), which always gives us a NULL result. Let's introduce the new LOCAL_CONTAINER_FILTER and do the search for the right type ("container") from now on. Resolves: https://fedorahosted.org/sssd/ticket/3137 Best Regards, -- Fabiano Fidêncio

2 2

[PATCH] SDAP: Fix settig paging attribute in sdap_get_generic_ext_send
by Lukas Slebodnik 13 Sep '16

13 Sep '16

ehlo, We should set pagging flag in state and not in local variable which is not read anywhere in the function. Found by clang static analyzer. Do we need this patch also to stable branch? LS

3 4

MONITOR: Add disable_netlink sssd.conf option
by Justin Stephenson 12 Sep '16

12 Sep '16

Hello, The attached patches resolve https://fedorahosted.org/sssd/ticket/3142 However, I am having difficult with the man page addition to 'src/man/sssd.conf.5.xml' for this new option. I have stared at the open and close xml tags(for far too long) and it looks correct but when I build sssd I never see the sssd.conf man page inclusion. Could anyone tell me what I am missing here? If you feel there is better wording for the description please let me know. Kind regards, Justin Stephenson

4 17

Getting overridden shell in pam_sss
by Nikolai Kondrashov 07 Sep '16

07 Sep '16

Hi Sumit, Now I'm again approaching the implementation of tlog integration in pam_sss, and as planned, I need to get the actual user shell to put it into TLOG_REC_SHELL environment variable upon opening of the session. However, the get_shell_override, which does all the hops and tricks to get it, requires nss_ctx, which belongs to NSS responder, specifically various shell-related configuration settings (override_shell/allowed_shells/vetoed_shells/etc_shells). I.e. essentially the PAM responder needs to be an NSS responder to get it. To me it seems that there is no exit but to finally put that override machinery into a library, instead of having it directly in the NSS responder. Am I wrong? Is there perhaps another way? Do you have any suggestion how to best do it? Thanks a lot! Nick

3 6

[PATCH SYSDB: Fix handling of version in sysdb_cache_connect_helper
by Lukas Slebodnik 02 Sep '16

02 Sep '16

ehlo, Clang static analyzer assume that ldb_search can found 0 entries in the tree "cn=sysdb". Thenvariable version could be used uninitialized. We cannot get to such state in sssd but we already handle a case for more then one entry. LS

3 7

[RFC] Cleaning up the IFP responder (mainly) and socket-activatable responders
by Fabiano Fidêncio 01 Sep '16

01 Sep '16

Howdy! Taking a look on https://fedorahosted.org/sssd/ticket/2395 seems that there are a few ways to achieve what's proposed by Simo and I'd like to discuss one of those before start implementing it. As far as I understand the bug, SSSD cannot be run as a non-root user because of IFP responder, which needs to be run as root in order to write to sssd.conf file. Simo's suggestion was to create a new service, which should be socket-activated, to handle this writing to sssd.conf part and Jakub's suggested to completely get rid of this part. However, Dmitri pointed out that we must have some service playing with sssd.conf as it's the way that cockpit and ansible can remotely manage the SSSD configuration. Okay, in order to actually start solving the issue I'd like to propose the follow steps: 1) Create a new service, still explicitly enabled in sssd.conf, that would take care of the managing the SSSD configuration. 2) Get rid of the code dealing with the SSSD configuration from the IFP responder. 3) Get rid of the OpenLMI specific code from the IFP responder Till this point the problem wasn't solved at all, but those seem to be the logical steps in order to make our own lives easier for working in the next two steps. 4) Make the new service (created in 1) socket-activated/bus-activated. 5) Make the IFP responder also bus-activated/socket-activated. So, does it sound like a reasonable way to approach the problem? If yes, I'd like to ask a few questions, mainly about items 4 and 5, as it eems that in order to achieve what we want, https://fedorahosted.org/sssd/ticket/2243 and https://fedorahosted.org/sssd/ticket/3129 have to be solved together, which seems to be a not so small task. So, do we have to care about systems that don't have systemd support? IOW, do we have to keep the current code and also add socket-activation? If yes, would it be explicitly enabled/disabled on configure time? Maybe a lame question, but what are the advantages of the socket-activation over the bus-activation approach (I still didn't look at any of those :-\)? Thanks in advance, -- Fabiano Fidêncio

4 3

[sssd PR#9] SYSDB: Removing of unused parametr (opened)
by fidencio 01 Sep '16

01 Sep '16

celestian's pull request #9: "SYSDB: Removing of unused parametr" was opened PR body: """ There were unused parameter struct ldb_message *cached_group in sysdb_store_group_attrs(). This parameter was introduced by 40de79d69860ec7f04bf7795bd88b641ec42fd23 SYSDB: Check if group attributes differ before saving a group """ See the full pull-request at https://github.com/SSSD/sssd/pull/9 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/9/head:pr9 git checkout pr9

1 5

[sssd PR#8] MAN: Document the ldap_user_gid_number option (opened)
by fidencio 01 Sep '16

01 Sep '16

jhrozek's pull request #8: "MAN: Document the ldap_user_gid_number option" was opened PR body: """ Some users, mostly those who cannot join the Linux machines to their AD domain resort to using the LDAP provider with ID mapping. But in order for that to work correctly, the ldap_user_gid_number option must be set correctly, otherwise SSSD complains about not finding the primary GID: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Cannot get the GID for [someuser] in domain [extdev]. """ See the full pull-request at https://github.com/SSSD/sssd/pull/8 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/8/head:pr8 git checkout pr8

1 5

[PATCH] GPO: Cat vals with same key from different GPOs
by Michal Židek 01 Sep '16

01 Sep '16

Hi, here is patch for ticket #3161. See more in the ticket description. I was thinking why we originally replaced the lists and I think it comes from confusion on how we handle the same keys in single GPO ini file, however that is handled by libini not by SSSD. Michal

6 7

[sssd PR#7] Fix initgroups with nested groups (comment)
by fidencio 31 Aug '16

31 Aug '16

lslebodn commented on a pull request """ On (31/08/16 01:47), sumit-bose wrote: >On Wed, Aug 31, 2016 at 01:30:12AM -0700, Jakub Hrozek wrote: >> On Wed, Aug 31, 2016 at 12:36:37AM -0700, sumit-bose wrote: >> > On Tue, Aug 30, 2016 at 12:36:20PM -0700, Jakub Hrozek wrote: >> > > On Tue, Aug 30, 2016 at 11:47:09AM -0700, lslebodn wrote: >> > > >> > > About the discussion I saw on #sssd in backscroll, the rfc2307bis schema >> > > only uses the member attribute because IIRC the RFC doesn't talk about >> > > memberof at all. But in IPA, we know the specifics on the schema, so we >> > > are able to dereference the memberof attribute to get a complete list of >> > > all groups with one call. >> > >> > Unfortunately it is more complicated with IPA because memberOf only >> > contains the direct memberships, there is a second attribute >> > memberofindirect which hold the indirect memberships. >> >> This is only how IPA UI displays indirect memberships, if you check the >> memberships with ldapsearch, you'll see it's really only memberof. > >bummer, you are right, I thought the --raw option of ipa user-show really >means 'raw' but it looks some of the values are still processed. > >Sorry for the noise. > I haven't found any regression caused by this patch. So at least; issues in ipa-trust test are not caused by this bug. LS """ See the full comment at https://github.com/SSSD/sssd/pull/7#issuecomment-243777706

1 0

[sssd PR#7] Fix initgroups with nested groups (comment)
by fidencio 31 Aug '16

31 Aug '16

sumit-bose commented on a pull request """ On Wed, Aug 31, 2016 at 01:30:12AM -0700, Jakub Hrozek wrote: > On Wed, Aug 31, 2016 at 12:36:37AM -0700, sumit-bose wrote: > > On Tue, Aug 30, 2016 at 12:36:20PM -0700, Jakub Hrozek wrote: > > > On Tue, Aug 30, 2016 at 11:47:09AM -0700, lslebodn wrote: > > > > > > About the discussion I saw on #sssd in backscroll, the rfc2307bis schema > > > only uses the member attribute because IIRC the RFC doesn't talk about > > > memberof at all. But in IPA, we know the specifics on the schema, so we > > > are able to dereference the memberof attribute to get a complete list of > > > all groups with one call. > > > > Unfortunately it is more complicated with IPA because memberOf only > > contains the direct memberships, there is a second attribute > > memberofindirect which hold the indirect memberships. > > This is only how IPA UI displays indirect memberships, if you check the > memberships with ldapsearch, you'll see it's really only memberof. bummer, you are right, I thought the --raw option of ipa user-show really means 'raw' but it looks some of the values are still processed. Sorry for the noise. bye, Sumit """ See the full comment at https://github.com/SSSD/sssd/pull/7#issuecomment-243699385

1 0

[PATCH] knownhostsproxy: use all of the getaddrinfo()
by Jakub Hrozek 31 Aug '16

31 Aug '16

Hi, I'm sending this patch on behalf of Nalin, who attached it to https://bugzilla.redhat.com/show_bug.cgi?id=1063278#c9

3 6

[sssd PR#7] Fix initgroups with nested groups (comment)
by fidencio 31 Aug '16

31 Aug '16

jhrozek commented on a pull request """ On Wed, Aug 31, 2016 at 12:36:37AM -0700, sumit-bose wrote: > On Tue, Aug 30, 2016 at 12:36:20PM -0700, Jakub Hrozek wrote: > > On Tue, Aug 30, 2016 at 11:47:09AM -0700, lslebodn wrote: > > > > About the discussion I saw on #sssd in backscroll, the rfc2307bis schema > > only uses the member attribute because IIRC the RFC doesn't talk about > > memberof at all. But in IPA, we know the specifics on the schema, so we > > are able to dereference the memberof attribute to get a complete list of > > all groups with one call. > > Unfortunately it is more complicated with IPA because memberOf only > contains the direct memberships, there is a second attribute > memberofindirect which hold the indirect memberships. This is only how IPA UI displays indirect memberships, if you check the memberships with ldapsearch, you'll see it's really only memberof. """ See the full comment at https://github.com/SSSD/sssd/pull/7#issuecomment-243695325

1 0

[PATCH] LDAP: Improving debug message
by Petr Cech 31 Aug '16

31 Aug '16

Hello list, in my opinion we might refer to user by their name and not by 'for loop' variable. This patch fixes this issue. I hit the issue during some debugging. Regards -- Petr^4 Čech

4 9

[sssd PR#7] Fix initgroups with nested groups (comment)
by fidencio 31 Aug '16

31 Aug '16

sumit-bose commented on a pull request """ On Tue, Aug 30, 2016 at 12:36:20PM -0700, Jakub Hrozek wrote: > On Tue, Aug 30, 2016 at 11:47:09AM -0700, lslebodn wrote: > > About the discussion I saw on #sssd in backscroll, the rfc2307bis schema > only uses the member attribute because IIRC the RFC doesn't talk about > memberof at all. But in IPA, we know the specifics on the schema, so we > are able to dereference the memberof attribute to get a complete list of > all groups with one call. Unfortunately it is more complicated with IPA because memberOf only contains the direct memberships, there is a second attribute memberofindirect which hold the indirect memberships. bye, Sumit > > """ See the full comment at https://github.com/SSSD/sssd/pull/7#issuecomment-243683146

1 0

[PATCHES] Remove leftovers from diag_cmd and force_timeout
by Fabiano Fidêncio 31 Aug '16

31 Aug '16

Seems that when I sent the v2 of 7579cf99 and ac35fe74 I attached the wrong patches that ended up being pushed. Those patches were incomplete as there are still some leftovers. My bad, sorry :-\ See these 2 attached patches Best Regards, -- Fabiano Fidêncio

3 3

[sssd PR#7] Fix initgroups with nested groups (+ack)
by fidencio 30 Aug '16

30 Aug '16

sumit-bose's pull request #7: "Fix initgroups with nested groups" label *ack* has been added See the full pull-request at https://github.com/SSSD/sssd/pull/7

1 0

[sssd PR#7] Fix initgroups with nested groups (comment)
by fidencio 30 Aug '16

30 Aug '16

jhrozek commented on a pull request """ OK, also looking at gdb confirms this is the right fix of course: (gdb) frame 0 #0 sdap_initgr_nested_get_membership_diff (mem_ctx=0x1176190, sysdb=0x1120040, opts=0x1134d90, dom=0x110b610, group=0x1184b80, all_groups=0x1184a80, groups_count=5, _mdiff=0x7ffe14f1ed38) at /sssd/src/providers/ldap/sdap_async_initgroups.c:1420 1420 opts->group_map[SDAP_AT_GROUP_NAME].name, (gdb) list 1415 1416 if (parents_count > 0) { 1417 ret = sysdb_attrs_primary_fqdn_list(dom, tmp_ctx, 1418 ldap_parentlist, 1419 parents_count, 1420 opts->group_map[SDAP_AT_GROUP_NAME].name, 1421 &ldap_parent_names_list); 1422 if (ret != EOK) { 1423 DEBUG(SSSDBG_CRIT_FAILURE, 1424 "sysdb_attrs_primary_name_list failed [%d]: %s\n", (gdb) p *ldap_parentlist[0] $4 = { <struct sysdb_attrs> num = 8 { <struct ldb_message_element> flags = 0, name = 0x1182b20 "originalDN", num_values = 1 { <struct ldb_val> data = 0x1183370 "cn=group20,cn=groups,cn=accounts,dc=ipa,dc=test", length = 47 } } { <struct ldb_message_element> flags = 0, name = 0x116d0e0 "name", num_values = 1 { <struct ldb_val> data = 0x11808e0 "group20", length = 7 } } { <struct ldb_message_element> flags = 0, name = 0x115db10 "gidNumber", num_values = 1 { <struct ldb_val> data = 0x1183c20 "935600011", length = 9 } } { <struct ldb_message_element> flags = 0, name = 0x115dbc0 "member", num_values = 2 { <struct ldb_val> data = 0x1183e00 "cn=group10,cn=groups,cn=accounts,dc=ipa,dc=test", length = 47 } { <struct ldb_val> data = 0x1183ea0 "cn=group11,cn=groups,cn=accounts,dc=ipa,dc=test", length = 47 } } { <struct ldb_message_element> flags = 0, name = 0x1183d10 "uniqueID", num_values = 1 { <struct ldb_val> data = 0x11841c0 "1f9a98ba-5961-11e6-a51b-525400f71478", length = 36 } } { <struct ldb_message_element> flags = 0, name = 0x1184030 "objectSIDString", num_values = 1 { <struct ldb_val> data = 0x1184400 "S-1-5-21-925249755-300578800-2979754137-1011", length = 44 } } { <struct ldb_message_element> flags = 0, name = 0x11842d0 "originalModifyTimestamp", num_values = 1 { <struct ldb_val> data = 0x1175780 "20160803100057Z", length = 15 } } { <struct ldb_message_element> flags = 0, name = 0x1175880 "entryUSN", num_values = 1 { <struct ldb_val> data = 0x1183f40 "17299", length = 5 } } } (gdb) name is unqualified and should be qualified. ACK, but I won't push for now in case @lslebodn wants to run some tests before pushing.. """ See the full comment at https://github.com/SSSD/sssd/pull/7#issuecomment-243555414

1 0

[sssd PR#7] Fix initgroups with nested groups (comment)
by fidencio 30 Aug '16

30 Aug '16

jhrozek commented on a pull request """ On Tue, Aug 30, 2016 at 11:47:09AM -0700, lslebodn wrote: > Please provide a test-case (probably a hierarchy of groups) I was able to reproduce with: $ ipa group-show group20 Group name: group20 GID: 935600011 Member groups: group10, group11 Indirect Member users: user1 $ ipa group-show group10 Group name: group10 GID: 935600008 Member users: user1 Member of groups: group20 $ ipa group-show group11 Group name: group11 GID: 935600009 Member users: user1 Member of groups: group20 Before the patch, group20 wasn't resolved, after the patch it was. btw I had this group hierarhcy pre-created on my test IPA server which makes me wonder a bit how we didn't see this bug before, I'm sure I created it for some reason. Also I'm surprised a lot none of the downstream tests we were running caught the bug. About the discussion I saw on #sssd in backscroll, the rfc2307bis schema only uses the member attribute because IIRC the RFC doesn't talk about memberof at all. But in IPA, we know the specifics on the schema, so we are able to dereference the memberof attribute to get a complete list of all groups with one call. """ See the full comment at https://github.com/SSSD/sssd/pull/7#issuecomment-243553980

1 0

[sssd PR#7] Fix initgroups with nested groups (comment)
by fidencio 30 Aug '16

30 Aug '16

lslebodn commented on a pull request """ Please provide a test-case (probably a hierarchy of groups) """ See the full comment at https://github.com/SSSD/sssd/pull/7#issuecomment-243540136

1 0

[sssd PR#7] Fix initgroups with nested groups (opened)
by fidencio 30 Aug '16

30 Aug '16

sumit-bose's pull request #7: "Fix initgroups with nested groups" was opened PR body: """ I think this is a leftover from the change to use fully-qualified names in sysdb. To verify this you can create a nested group in IPA. Without this patch the id command will only show the groups the user is a direct member of. With the patch the indirect groups memberships should be shown as well. """ See the full pull-request at https://github.com/SSSD/sssd/pull/7 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/7/head:pr7 git checkout pr7

1 0

[sssd PR#6] Applications should never define _USE_GNU themselves, but rely on _GNU_SOURCE (+pushed)
by fidencio 30 Aug '16

30 Aug '16

jhrozek's pull request #6: "Applications should never define _USE_GNU themselves, but rely on _GNU_SOURCE" label *pushed* has been added See the full pull-request at https://github.com/SSSD/sssd/pull/6

1 0

[sssd PR#6] Applications should never define _USE_GNU themselves, but rely on _GNU_SOURCE (-ack)
by fidencio 30 Aug '16

30 Aug '16

jhrozek's pull request #6: "Applications should never define _USE_GNU themselves, but rely on _GNU_SOURCE" label *ack* has been removed See the full pull-request at https://github.com/SSSD/sssd/pull/6

1 0

[sssd PR#6] Applications should never define _USE_GNU themselves, but rely on _GNU_SOURCE (closed)
by fidencio 30 Aug '16

30 Aug '16

jhrozek's pull request #6: "Applications should never define _USE_GNU themselves, but rely on _GNU_SOURCE" was closed See the full pull-request at https://github.com/SSSD/sssd/pull/6 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/6/head:pr6 git checkout pr6

1 0

[sssd PR#6] Applications should never define _USE_GNU themselves, but rely on _GNU_SOURCE (comment)
by fidencio 30 Aug '16

30 Aug '16

jhrozek commented on a pull request """ * master: 1384d0ce6ea741aefb56b0006b6268d76e6cc2c2 """ See the full comment at https://github.com/SSSD/sssd/pull/6#issuecomment-243453157

1 0

[sssd PR#6] Applications should never define _USE_GNU themselves, but rely on _GNU_SOURCE (+ack)
by fidencio 30 Aug '16

30 Aug '16

jhrozek's pull request #6: "Applications should never define _USE_GNU themselves, but rely on _GNU_SOURCE" label *ack* has been added See the full pull-request at https://github.com/SSSD/sssd/pull/6

1 0

[sssd PR#6] Applications should never define _USE_GNU themselves, but rely on _GNU_SOURCE (opened)
by fidencio 30 Aug '16

30 Aug '16

jhrozek's pull request #6: "Applications should never define _USE_GNU themselves, but rely on _GNU_SOURCE" was opened PR body: """ None """ See the full pull-request at https://github.com/SSSD/sssd/pull/6 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/6/head:pr6 git checkout pr6

1 0

[PATCH] Fix typo
by Pavel Březina 30 Aug '16

30 Aug '16

Simple one liner attached.

3 5

[sssd PR#5] Miscellanous patches for the sssd-secrets responder (closed)
by fidencio 30 Aug '16

30 Aug '16

jhrozek's pull request #5: "Miscellanous patches for the sssd-secrets responder" was closed See the full pull-request at https://github.com/SSSD/sssd/pull/5 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5/head:pr5 git checkout pr5

1 0

[sssd PR#5] Miscellanous patches for the sssd-secrets responder (+pushed)
by fidencio 30 Aug '16

30 Aug '16

jhrozek's pull request #5: "Miscellanous patches for the sssd-secrets responder" label *pushed* has been added See the full pull-request at https://github.com/SSSD/sssd/pull/5

1 0

[sssd PR#5] Miscellanous patches for the sssd-secrets responder (-ack)
by fidencio 30 Aug '16

30 Aug '16

jhrozek's pull request #5: "Miscellanous patches for the sssd-secrets responder" label *ack* has been removed See the full pull-request at https://github.com/SSSD/sssd/pull/5

1 0

[sssd PR#5] Miscellanous patches for the sssd-secrets responder (comment)
by fidencio 30 Aug '16

30 Aug '16

jhrozek commented on a pull request """ @pbrezina can you add the ack label (at least we'd try if you have the permissions to do so..) """ See the full comment at https://github.com/SSSD/sssd/pull/5#issuecomment-243407276

1 0

[sssd PR#5] Miscellanous patches for the sssd-secrets responder (comment)
by fidencio 30 Aug '16

30 Aug '16

pbrezina commented on a pull request """ Ack. """ See the full comment at https://github.com/SSSD/sssd/pull/5#issuecomment-243402484

1 0

[PATCH] PROXY: Use right name in ldap filter
by Lukas Slebodnik 30 Aug '16

30 Aug '16

ehlo, We used internal fq name in ldap filter with id_provider proxy to files and auth provider ldap [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=testuser1@ldap)(objectclass=posixAccount))][dc=example,dc=com]. How to reproduce: * create local user "useradd testuser1" * add user to ldap with password dn: uid=testuser1,$DS_BASE_DN objectClass: account objectClass: posixAccount cn: testuser1 uidNumber: 112211 gidNumber: 112211 homeDirectory: /home/testuser1 userPassword: Secret123 * use id_provider proxy to files and auth_provider ldap [sssd] config_file_version = 2 services = nss, pam domains = LDAP [domain/LDAP] id_provider = proxy proxy_lib_name = files auth_provider = ldap ldap_uri = ldap://$SERVER ldap_search_base = $DS_BASE_DN ldap_tls_cacert = /etc/openldap/certs/cacert.asc * change a pam stack little bit (the default fedora pam stack is not friendly for such setup) auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass use_first_pass auth required pam_deny.so * try to authenticate LS

2 2

[SSSD} [PATCH] Remove no longer used code
by Fabiano Fidêncio 30 Aug '16

30 Aug '16

Those 3 patches are from Jakub and I've just done some minor adjustments and add myself as co-author of the first 2 patches. CI has passed: http://sssd-ci.duckdns.org/logs/job/51/55/summary.html Best Regards, -- Fabiano Fidêncio

4 7

[PATCH] BUILD: Break the intgcheck target into 5 smaller targets: intgcheck-{prepare,configure,build,run,clean}
by Fabiano Fidêncio 29 Aug '16

29 Aug '16

This patch is a first attempt to make "make intgcheck" less painful/time consuming than it is now. Although the patch provides a good improvement on having 5 new targets, I know it's still not ideal. The ideal case, IMO, would be being able to select which subset of tests would be run, but that's an improvement that can be done later on. Tips are welcome. Best Regards, -- Fabiano Fidêncio

3 18

[PATCH] BUILD: Remove leftover after sysdb refactoring
by Lukas Slebodnik 29 Aug '16

29 Aug '16

ehlo, simple patch is attached. LS

2 2

[PATCHSET] BUILD: Improve a little bit the "prerelease-*" targets
by Fabiano Fidêncio 29 Aug '16

29 Aug '16

Howdy! I've been using a lot the "make prerelease-rpms" command and I've found out the fact that all the resulting rpms of 2 (or more builds) are put in the same buildroot/RPMS/{x86_64,noarch}/ directory a bit unfortunate. It's not exactly handy to find out which are the packages I want to copy to my guest and deleting the buildroot before doing the build is also not so cool, as I may want to check stuff from two different builds. With this problem in mind, I came with this patchset that generates the rpms/srpm in a specific folder for each build, which makes my life way easier when I want to copy those rpms to my guest and do my tests there. Please, see the attached patches. Best Regards, -- Fabiano Fidêncio

2 6

'no primary group ID provided' when using AD in ldap mode
by Daniel Hermans 29 Aug '16

29 Aug '16

Hi, i'd like to use sssd in ldap mode: id_provider = ldap auth_provider = ldap against an Active Directory domain. Yes krb5 would be better but i only have a BIND account and cannot add computer objects. Reading guides here: https://wiki.ubuntu.com/Enterprise/Authentication/sssd it says i don't need Posix attributes (which I don't have), so I have enabled: ldap_id_mapping = true fallback_homedir = /home/%d/%u default_shell = /bin/bash I can bind with LDAPS and can seem to get user info from the domain: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_ENTRY] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_entry] (0x1000): OriginalDN: [CN=Some User,OU=Admin Accounts,DC=dev,DC=somedomain,DC=com]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [displayName] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [memberOf] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [userAccountControl] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [primaryGroupID] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectSid] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [accountExpires] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [sAMAccountName] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [userPrincipalName] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_parse_range] (0x2000): No sub-attributes for [modifyTimeStamp] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_result] (0x2000): Trace: sh[0x7f5d15fbc030], connected[1], ops[0x7f5d1639d140], ldap[0x7f5d15fb5cd0] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_op_destructor] (0x2000): Operation 3 finished (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x0400): Search for users, returned 1 results. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_search_user_process] (0x4000): Retrieved total 1 users The UID mapping seems to succeed: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [ldb] (0x4000): start ldb transaction (nesting: 0) (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Save user (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x4000): Failed to retrieve UUID [2][No such file or directory]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): SID S-1-5-21-3970895924-989261097-3267629119-1443 does not belong to any known domain (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_primary_name] (0x0400): Processing object someuser (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0400): Processing user someuser (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x1000): Mapping user [someuser] objectSID [S-1-5-21-3970895924-989261097-3267629119-1443] to unix ID But it gets no further with this message: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_get_idmap_primary_gid] (0x0080): no primary group ID provided (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Cannot get the GID for [someuser] in domain [extdev]. (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Failed to save user [someuser] (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring. Any ideas what I'm doing wrong? Is this possible? Various (old) posts suggests it is. Have tried against two different domains with identical result ( one a cleanly installed 2012R2 domain ). Thanks in advance!!

2 5

tasks for newcomers or non-developers
by Jakub Hrozek 29 Aug '16

29 Aug '16

Hi, Over the last couple of weeks, I've talked to several people, mostly engineers with not too much development experience, who said they would like to start contributing little fixes to SSSD. I would like to find some tasks that they can easily handle without making their had spin from looking at harder stuff like asynchronous tevent code :-) In the past, we used the 'easyfix' tag in the sssd tickets. We still had some, but not enough. I tagged quite a few today, but if anyone knows about more easy fixes, please tag them as well. https://fedorahosted.org/sssd/report/34 Can anybody think of more tasks to ask newcomes to do? I know adding tests would be great, tests don't require C knowledge, but only Python. But we would have to document how to write new tests, currently the process is very convoluted. We also need to improve and fix documentation on the wiki. Anything else?

3 9

[PATCH] SYSDB: Fix uninitialized scalar variable
by Lukas Slebodnik 29 Aug '16

29 Aug '16

ehlo, simple patch is attached. LS

2 2

[PATCHSET] PROXY: Refactoring save_{user,group}() functions
by Fabiano Fidêncio 27 Aug '16

27 Aug '16

This small series contain some really small refactoring work in the save_user() and save_group() functions, as suggested by Lukaš Slebodnik[0]. CI has not passed[1], but the failure occurred just in RHEL-7 in a test that, AFAIR, is failing quite often. So, I'm not completely sure whether it's related or not. [0]: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.… [1]: http://sssd-ci.duckdns.org/logs/job/52/33/summary.html Best Regards, -- Fabiano Fidêncio

2 4

[PATCH] SPEC: Fix typo in Summary
by Lukas Slebodnik 27 Aug '16

27 Aug '16

ehlo, I found a typo when packagein 1.14.1 in fedora. Actually, It was already fixed. I just forgot to sent patch into upstream. LS

2 2

[PATCH] BUILD: Allow to read private pipes for root
by Lukas Slebodnik 27 Aug '16

27 Aug '16

ehlo, Root can read anything from any directory even with permissions 000. However SELinux checks discretionary access control (DAC) and deny access if access is not allowed for root by DAC. The pam_sss use different unix socket /var/lib/sss/pipes/private/pam for user with uid 0. Therefore root need to be able read content of directory with private pipes. type=AVC msg=audit(08/19/2016 10:58:34.081:3369) : avc: denied { dac_read_search } for pid=20257 comm=vsftpd capability=dac_read_search scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability type=AVC msg=audit(08/19/2016 10:58:34.081:3369) : avc: denied { dac_override } for pid=20257 comm=vsftpd capability=dac_override scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability LS

2 5

[PATCH] IPA: Parse qualified names when guessing AD user principal
by Jakub Hrozek 26 Aug '16

26 Aug '16

The attached patch fixes issues with logging in as users without an explicit UPN in a trust scenario. The simplest reproducer is to log in as Administrator or configure sssd to not look up the principal attribute by adding this to the server's sssd.conf subdomain_inherit = ldap_user_principal ldap_user_principal = nosuchatt Please see the commit message for more details.

3 2

[PATCH] Check whether a secret exists before trying to delete it
by Fabiano Fidêncio 26 Aug '16

26 Aug '16

The attached patch for #3125 [0]is based on Jakub's "secrets" branch on github [1], as there are (at least) a few issues with the current secrets code. [0]: https://fedorahosted.org/sssd/ticket/312 [1]: https://github.com/jhrozek/sssd/tree/secrets Although I didn't fire a CI build, the local "make intgcheck" passes without issues. Best Regards, -- Fabiano Fidêncio

3 7

[PATCHSET] Throw away the timestamp cache if re-initializing the persistent cache
by Fabiano Fidêncio 26 Aug '16

26 Aug '16

This patchset resolves https://fedorahosted.org/sssd/ticket/3128 CI has passed: http://sssd-ci.duckdns.org/logs/job/51/84/summary.html Best Regards, -- Fabiano Fidêncio

2 4

[PATCH] watchdog: cope with time shift
by Pavel Březina 26 Aug '16

26 Aug '16

scratch build was tested and fix confirmed. I think we should also reschedule all existing tevent timers, we don't have an infrastructure to do it though.

4 7

[PATCH SET] WIP: INTG: Tests for ldap nested netgroups
by Petr Cech 24 Aug '16

24 Aug '16

Hello list, there is attached patch set for intg. testing of ldap nested netgroups. I used last version of Lukas patch 'sssd_netgroup.py: Resolve nested netgroups'. I don't know if it is on list. It is still WIP. It is in state that it is possible to run it. But there are comments in code what is needed to fix. If I remove some netgroups (in test), it is updated on LDAP and in cache, but sssd_netgroup.get_sssd_netgroups() returns nothing. Please, see test_reproducer_t2841() in the second patch for more details. I debug it with run_shell() and there are some notes from LDAP server and LDB cache attached [1]. [1] ldap_ldb_content.txt Regards -- Petr^4 Čech

2 9

[PATCH] sssd_netgroup.py: Resolve nested netgroups
by Lukas Slebodnik 24 Aug '16

24 Aug '16

ehlo, python wrapper for retrieving netgroups was push to early. Attached patch fixes it. LS

2 9

PROXY: Use the fqname when converting to lowercase
by Fabiano Fidêncio 24 Aug '16

24 Aug '16

When saving the user there is a comparison between the "cased alias" and the "lowercase password name". However, the first doesn't use fully qualified name while the second does, resulting in a not expected override of the "nameAlias" attribute of a stored user when trying to authenticate more than once using an alias. Resolves: https://fedorahosted.org/sssd/ticket/3134 CI has passed: http://sssd-ci.duckdns.org/logs/job/52/26/summary.html Best Regards, -- Fabiano Fidêncio

3 6

[PATCH] Add selinux_provider to validator, remove session provider from validator
by Jakub Hrozek 23 Aug '16

23 Aug '16

Hi, I got pinged on IRC about sssd warning users when selinux_provider is set explicitly. I also noticed we still had session_provider in the config API, even though the provider itself doesn't exist for a long time now.

3 2

[SSSD/sssd #5] Miscellanous patches for the sssd-secrets responder (opened)
by fidencio 19 Aug '16

19 Aug '16

jhrozek's pull request #5: "Miscellanous patches for the sssd-secrets responder" was opened PR body: The first patch just makes an internal function static. The other just makes the use of a config section more uniform. We could go one way or the other, I don't really mind which, but we shouldn't use two ways to access the same data. See the full pull-request at https://github.com/SSSD/sssd/pull/5

4 7

Announcing SSSD 1.14.1
by Jakub Hrozek 19 Aug '16

19 Aug '16

=== SSSD 1.14.1 === The SSSD team is proud to announce the release of version 1.14.1 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * The IPA provider now supports logins with enterprise principals (also known as additional UPN suffixes). This functionality also enabled Active Directory users from trusted AD domains who use an additional UPN suffix to log in. Please note that this feature requires a recent IPA server. * When a user name is overriden in an IPA domain, resolving a group these users are a member of now returns the overriden user names * Users can be looked up by and log in with their e-mail address as an identifier. In order to do so, an attribute that represents the user's e-mail address is fetched by default. This attribute can by customized by setting the ldap_user_email configuration option. * A new ad_enabled_domains option was added. This option lets the administrator select domains that SSSD should attempt to reach in the AD forest SSSD is joined to. This option is useful for deployments where not all domains are reachable on the network level, yet the administrator needs to access some trusted domains and therefore disabling the subdomains provider completely is not desirable. * The sssctl tool has two new commands active-server and servers that allow the administrator to observe the server that SSSD is bound to and the servers that SSSD autodiscovered * SSSD used to fail to start when an attribute name is present in both the default SSSD attribute map and the custom ldap_user_extra_attrs map * GPO policy procesing no longer fails if the gPCMachineExtensionNames attribute only contains whitespaces * Several commits fix regressions related to switching all user and group names to fully qualified format, such as running initgroups for a user who is only a member of a primary group * Several patches fix regressions caused by splitting the database into two ldb files, such as when user attributes change without increasing the modifyTimestamp attribute value * systemd unit files are now shipped for the sssd-secrets responder, allowing the responder to be socket-activated. To do so, administrators should enable the sssd-secrets.socket and sssd-secrets.service systemd units. * The sssd binary has a new switch --disable-netlink that lets sssd skip messages from the kernel's netlink interface. * A crash when entries with special characters such as '(' were requested was fixed * The ldap_rfc_2307_fallback_to_local_users option was broken in the previous version. This release fixes the functionality. == Packaging Changes == * The NFS ID-mapping plugin was moved to its own subpackage == Documentation Changes == * A new option ad_enabled_domains was added * A new LDAP attribute mapping for e-mail addresses called ldap_user_email was added == Tickets Fixed == https://fedorahosted.org/sssd/ticket/2789 Warn if ad_server contains IP address https://fedorahosted.org/sssd/ticket/2828 Add an option to disable checking for trusted domains in the subdomains provider https://fedorahosted.org/sssd/ticket/2856 [RFE] Allow users to authenticate with alternative names https://fedorahosted.org/sssd/ticket/2860 Add support for disabling netlink use https://fedorahosted.org/sssd/ticket/2948 Handle overriden name of members in the memberUid attribute https://fedorahosted.org/sssd/ticket/2958 Support multiple principals for IPA users https://fedorahosted.org/sssd/ticket/2978 pid file name decalration is duplicated https://fedorahosted.org/sssd/ticket/2987 Improve information about krb5_keytab & ldap_krb5_keytab option in sssd man pages https://fedorahosted.org/sssd/ticket/3009 sssd fails to mark a connection as bad on searches that time out https://fedorahosted.org/sssd/ticket/3018 Detect of IPA server can handle enterprise principals https://fedorahosted.org/sssd/ticket/3024 sssd-common brings in nfs-utils https://fedorahosted.org/sssd/ticket/3064 incorrect dataExpireTimestamp setting in the timestamps cache https://fedorahosted.org/sssd/ticket/3068 fixes to the initial config schema implementation https://fedorahosted.org/sssd/ticket/3069 The sssctl tool should provide information about active and available servers https://fedorahosted.org/sssd/ticket/3072 task: Add a 1.14 upstream repo https://fedorahosted.org/sssd/ticket/3077 sssd does not work under non-root user https://fedorahosted.org/sssd/ticket/3084 DP: Don't pass empty string, but NULL to providers https://fedorahosted.org/sssd/ticket/3086 tools: sssctl config-check and sssctl cache ignore --help https://fedorahosted.org/sssd/ticket/3087 tools: make sssctl command names consistent https://fedorahosted.org/sssd/ticket/3088 Review and update SSSD's wiki pages for 1.14.1 release https://fedorahosted.org/sssd/ticket/3089 Error message "Failed to retrieve users" is sometimes misleading https://fedorahosted.org/sssd/ticket/3090 Don't print message about trust direction on clients https://fedorahosted.org/sssd/ticket/3091 remove DEBUG(SSSDBG_TRACE_INTERNAL, "Trace: ldap_result found nothing!\n"); https://fedorahosted.org/sssd/ticket/3093 Missing nested groups in user groups https://fedorahosted.org/sssd/ticket/3094 SELINUX_getpeercon failed [-1][Unknown error -1]. https://fedorahosted.org/sssd/ticket/3096 sssctl: Time stamps without time zone information https://fedorahosted.org/sssd/ticket/3101 sssd does not start if sub-domain user is used with simple access provider https://fedorahosted.org/sssd/ticket/3109 Wrong pam error code returned for password change in offline mode https://fedorahosted.org/sssd/ticket/3110 Access denied after activating user in 389ds https://fedorahosted.org/sssd/ticket/3111 sssd doesn't start on IPA client if IPA server VM is paused https://fedorahosted.org/sssd/ticket/3120 SSSD fails to start when ldap_user_extra_attrs contains mail https://fedorahosted.org/sssd/ticket/3121 [abrt] [faf] sssd: unknown function(): /usr/libexec/sssd/sssd_nss killed by 11 https://fedorahosted.org/sssd/ticket/3122 Do not check local users with disabled local_negative_timeout https://fedorahosted.org/sssd/ticket/3130 Better error message if sssctl is ran w/o activating the IFP responder https://fedorahosted.org/sssd/ticket/3132 check return value of sysdb_search_user_by_upn() == Detailed Changelog == Dan Lavu (1): * MAN: Update description of sssctl Fabiano Fidêncio (5): * sssctl: Use localtime for time stamps * RESPONDERS: Decrease debug level for failures in SELINUX_getpeercon() * RESPONDERS: Show a bit more info in case of SELINUX_getpeercon() failure * RESPONDERS: Pass errno to strerror() when SELINUX_getpeercon() fails * SDAP: Don't log an op failure when no users are found Jakub Hrozek (18): * Updating the version for the 1.14.1 release * FO: Set port to NOT_WORKING when trying a next server * LDAP: Fix storing initgroups for users with no supplementary groups * LDAP: Use FQDN when linking parent LDAP groups * SYSDB: Fix setting dataExpireTimestamp if sysdb is supposed to set the current time * PAM: Do not act on ldb_message in case of a failure * IPA: Check the return value of sss_parse_internal_fqname * SIMPLE: Do not parse names on startup * SIMPLE: Fail on any error parsing the access control list * SIMPLE: Make the DP handlers testable * TESTS: Use the DP handlers in simple provider tests, add more tests * CONFIG: full_name_format is an allowed option for all domains * CONFIG: re_expression is an allowed option for all domains * SPEC: Own the secrets DB path * UTIL: Use sss_atomic_read_s in generate_csprng_buffer * SECRETS: Use sss_atomic_read/write for better readability * BUILD: Ship systemd service file for sssd-secrets * Updating the translations for the 1.14.1 release Justin Stephenson (4): * Make resolv_is_address() function public and create some basic tests * Warn if IP address is used as option for ipa_server/ad_server * Monitor: Add support for disabling netlink * SSSCTL: More helpful error message when InfoPipe? is disabled Lukas Slebodnik (37): * sssctl: Fix error handling after memory allocation failure * sssctl: Fix format string for size_t * doxygen: Fix path to header file ipa_hbac.h * ipa_hbac: Fix documentation for hbac_enable_debug * sssctl: Fix warning maybe-uninitialized * nss-srv-tests: Fix prototype of wrapped ncache functions * TOOLS: Prevent dereference of null pointer * sysdb-tests: Fix cast from pointer to integer * SPEC: Move nfsidmap plugin to separate package * test_utils: Clean files after sss_write_krb5_conf_snippet * CI: Use /bin/sh as a CONFIG SHELL * SECRETS: Log message for failures with removing file * Amend debug messages after failure of unlink * SYSDB: Do not try to modify ts cache for unsupported DNs * SDAP: sanitize member name before using in filter * SDAP: sysdb_search_users does not set users_count for failures * SYSDB: Sanitize dn in sysdb_get_user_members_recursively * LDAP: Fix Dereference after NULL check * NSS: Do not check local users with disabled local_negative_timeout * config_schema: Add ldap_user_email to schema * intg: Make location of sssd nss module configurable * intg: Allow to test netgroups * NSS: Use correct name for invalidating memory cache * SYSDB: Avoid optimisation with modifyTimestamp for users * dyndns-tests: Fix false positive failures * LDAP: Log autofs rfc2307 config changes only with enabled responder * DP: Add log message for get account info * ds.py: Do not call teardown in destructor * test_local_domain: Restore correct env variable * intg: rename test with enumeration * test_enumeration: Remove test without enumeration * intg: create ldap test without enumeration * sssd_id.py: Primary group should be returned for initgroups * intg: Fix pep8 warnings * test_ldap: test nested membership with rfc2307bis * test_ldap: test resolving of names with special characters * intg: Test extra attributes duplicate Michal Židek (13): * sssctl: config-check access check report * config: override_space is monitor's option * config: Fix user_attributes * config: Allow timeout for all sevices * config: Add config_file_version to schema * dyndns: Add checks for NULL * sdap: Fix ldap_rfc_2307_fallback_to_local_users * sss_ini: Change debug level of config error msgs * sssctl: Consistent commands naming * tools: Add missing gettext macro * sssctl: Generic help for cache-upgrade and config-check * gpo: gPCMachineExtensionNames with just whitespaces * sdap: Skip exact duplicates when extending maps Pavel Březina (17): * sssctl: move filter creation to separate function * sssctl: improve readability of a condition * DP: rename be_acct_req to dp_id_data * DP: Initialize D-Bus as soon as possible * utils: add remove_subtree * sssctl: use internal API to remove files * rdp: add ability to forward reply to the client request * sbus: add sbus_request_reply_error() * sbus: add utility function to simplify message and reply handling * sssctl: use talloc with sifp * failover: mark subdomain service with sd_ prefix * sssctl: print active server and server list * sifp: fix coverity warning * sbus: allow freeing msg through dbus api when using talloc * PROXY: Do not abuse data provider interface * DP: Remove old data provider interface * NSS: Remove unused functions Petr Cech (18): * SYSDB: Fixing DB update * PROVIDERS: Setting right {u,g}id if unprivileged * SYSDB: Removing of duplication of sysdb_ts_cache_attrs * test_utils: Fixing assignment discards 'const' qualifier * LDAP: Changing of confusing debug message * IPA: Changing of confusing debug message * Revert "LDAP: Lookup services by all protocols unless a protocol is specified" * PROVIDER: Conversion empty string from D-Bus to NULL * LDAP: Fixing wrong pam error code for passwd * UTILS: Fixing duplication of pid file declaration * AD_PROVIDER: Add ad_enabled_domains option * AD_PROVIDER: Initializing of ad_enabled_domains * AD_PROVIDER: ad_enabled_domains - only master * AD_PROVIDER: ad_enabled_domains - other then master * TESTS: Adding tests for ad_enabled_domains option * LDAP: Adding support for SIGTERM signal * LDAP: Adding SIGTERM signal before SIGKILL * LDAP: Adding SIGCHLD callback Sumit Bose (33): * views: allow override added for non-default views at runtime * IPA: read ipaNTAdditionalSuffixes for master and trusted domains * sysdb: add UPN suffix support for the master domain * sysdb: make subdomain calls aware of upn_suffixes * DP: add dp_get_module_data() * IPA: add ipa_init_get_krb5_auth_ctx() * IPA: enable enterprise principals if server supports them * IPA: fix [capaths] output * UTIL: make domain mapping content testable * tests: add tests for sss_get_domain_mappings_content() * AD: avoid memory leak in netlogon_get_domain_info() and make it public * AD: netlogon_get_domain_info() allow missing arguments and empty results * tests: add tests for netlogon_get_domain_info * AD: replace ad_get_client_site_parse_ndr() with netlogon_get_domain_info() * sysdb_master_domain_add_info: properly set do_update * IPA: make ipa_resolve_user_list_{send|recv} public and allow AD users * IPA: expand ghost members of AD groups in server-mode * sysdb: add sysdb_get_user_members_recursively() * views: properly override group member names * IPA: fix lookup by UPN for subdomains * LDAP: allow multiple user principals * LDAP: new attribute option ldap_user_email * sysdb: include email in UPN searches * LDAP: include email in UPN searches * NSS: add user email to fill_orig() * utils: add is_email_from_domain() * LDAP/IPA: add local email address to aliases * NSS: continue with UPN/email search if name was not found * PAM: continue with UPN/email search if name was not found * NSS: use different neg cache name for UPN searches * PAM: Fix domain for UPN based lookups * SDAP: add special handling for IPA Kerberos enterprise principal strings * SDAP: add enterprise principal strings for user searches Thorsten Scherf (1): * Fixed some typos in man pages

1 0

RFC: SSSD 1.14.1 release notes
by Jakub Hrozek 19 Aug '16

19 Aug '16

Hi, I'd like to tag and release 1.14.1 today, so I prepared the release notes: https://fedorahosted.org/sssd/wiki/Releases/Notes-1.14.1 please comment or edit the notes on the wiki.

2 2

RFC: Use github's pull requests for tracking submissions
by Jakub Hrozek 19 Aug '16

19 Aug '16

Hi, sorry for the long mail..the tl;dr is that I would like to propose we use github pull-requests as the preferred way of submitting patches instead of sending e-mail attachments to the list. You might already have noticed a pull-request notification arrived to the list: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.… I'm aware of the reservations people have against github being non-free, but in my opinon it's still worth it. The goals are: - use PRs to track what needs review and who is working on the review. Right now it's not clear if someone adding a comment to a patch means the person will do the whole review or just has a single comment. And it's not easy to see what are the pending reviews..patchwork helps quite a bit, but it's just not polished and easy to use. (Also, it runs under Simo's desk :-)) The core developers should be added as 'collaborators' to be able to edit tags and close PRs. For notifications, I think collaborators already receive notifications automatically. Others can just 'watch' the sssd repo on github. Opening a pull request triggers a mail notification to the sssd-devel list. The e-mail notifications plug to the fedmsg bus which plugs to github and are just one-way, sorry. To reply to a PR, either the github web UI can be used or, if you subscribe to github directly, it's possible to reply to notifications that originate at github. - plug in hosted CentOS CI to run our pre-push CI tests automatically and not worry about forgetting to run CI for some patchset or sending the wrong patchset to CI. We will still run our internal CI post-push or could even do pre-push with a user whitelist. We already have the CI accounts at centos.org set up, we 'just' need to plug the CI to github. - use the github diff viewer to comment on code in pull requests inline - use the available tools that have been developed around github (such as hub) to be able to easily apply patches from a PR (example: hub am https://github.com/SSSD/sssd/pull/5) - make it easier for non-core developers to submit patches. Many developers are more familiar with the github workflow than submitting patches and have accounts on github already. Submitting a trivial patch would no longer require subscribing to the list. Explicit non-goals are: - we should not move the repo to github. I think keeping the code at fedorahosted.org gives us more control in case the same thing that happened to sourceforge happens to github. The mailing list notifications give us history in case we ever move away from github for one reason or another. - we should not merge the pull requests. While we can't disable the 'merge' button on the PR page, even merging the PR wouldn't have a permanent effect because the code is kept on fedorahosted and force-pushed to the github mirror - we should not use github issues. As a matter of fact, I disabled the issues on github. We should IMO add a note to README.md telling people to file bugs at fedorahosted. The primary reason is that we have a ton of tooling around Trac already. If some developers have reservations about github, either technical or philosophical, the mailing list is here to stay. But I really think the benefits outweight the dangers of github. Does anyone explicitly disagree with SSSD using github pull requests?

2 2

[PATCH] Fix Japanese translation bug
by Muneyuki Noguchi 19 Aug '16

19 Aug '16

Hi, The attached patch fixes Japanese translation bug by replacing "kiken", which means danger in Japanese, with "kigen". This bug was introduced on 19 Jul 2012.

4 8

[PATCH] LDAP: Fixing of removing netgroup from cache
by Petr Cech 19 Aug '16

19 Aug '16

Hi list, there is patch solving [1] attached. It is possible that we will have similiar problem with other local keys, so I wrote special function for adding key to list of missing with condition if it is needed or not. [1] https://fedorahosted.org/sssd/ticket/2841 Regards -- Petr^4 Čech

4 12

[PATCH 2/2] sdap: Skip exact duplicates when extending maps
by Michal Židek 19 Aug '16

19 Aug '16

Hi, see the attached patch. I modified the detection of duplicates when extending the maps (sysdb_attr:ldap_attr). When we try to add entry to the map that already exists in the map, then without this patch we will fail. With this patch, we only fail if the newly added extension would redefine already existing entry in the map. Otherwise it is just skipped without a failure (we just skip adding what is already there). I created simple CI test for this (first patch). Michal

3 15

[SSSD/sssd #3] Two trivial man page fixes (closed)
by fidencio 19 Aug '16

19 Aug '16

jhrozek's pull request #3: "Two trivial man page fixes" was closed See the full pull-request at https://github.com/SSSD/sssd/pull/3

1 0

[SSSD/sssd #3] Two trivial man page fixes (comment)
by fidencio 19 Aug '16

19 Aug '16

jhrozek commented on a pull request This PR is no longer valid. See the full comment at https://github.com/SSSD/sssd/pull/3#issuecomment-240958847

1 0

[SSSD/sssd #1] Dummy pull request (closed)
by fidencio 19 Aug '16

19 Aug '16

spbnick's pull request #1: "Dummy pull request" was closed See the full pull-request at https://github.com/SSSD/sssd/pull/1

1 0

[SSSD/sssd #1] Dummy pull request (comment)
by fidencio 19 Aug '16

19 Aug '16

jhrozek commented on a pull request Closing, this was just a dummy pull request to test integration with tools. See the full comment at https://github.com/SSSD/sssd/pull/1#issuecomment-240958755

1 0

[PATCH] intg: test nested membership
by Lukas Slebodnik 18 Aug '16

18 Aug '16

ehlo, attched patch is an integration test for regression #3093. I prepared a test and I let someone else to fix it :-) I will try to find more bugs in downstream tests. BTW we might move test from test_ts_cache somewhere else. But it was the fastest way how to write a test without enumeration. LS

2 11

[PATCH] Better error message if sssctl is ran w/o activating the IFP responder
by Justin Stephenson 18 Aug '16

18 Aug '16

Simple error message patch, resolves https://fedorahosted.org/sssd/ticket/3130 Kind regards, Justin Stephenson

5 13

[PATCH] Added more meaningful error message when the IFP responder is disabled.
by Thorsten Scherf 18 Aug '16

18 Aug '16

2 2

[PATCH] Add support for disabling netlink use
by Justin Stephenson 17 Aug '16

17 Aug '16

Hello, The attached patch fixes: https://fedorahosted.org/sssd/ticket/2860 This provides an option to allow sssd testing to ignore network status changes from the netlink interface(remaining in offline mode, for example) Kind regards, Justin Stephenson

4 11

[PATCH] DP: Add log message for get account info
by Lukas Slebodnik 17 Aug '16

17 Aug '16

ehlo, Petr improved debug messages in https://git.fedorahosted.org/cgit/sssd.git/commit/?id=376eaf187c13c2a1eaea0… but it was removed as part of DP refactoring. LS

3 4

[PATCH] LDAP: Log autofs rfc2307 config changes only with enabled responder
by Lukas Slebodnik 17 Aug '16

17 Aug '16

ehlo, attached patch should fix annoying message with disabled autofs responder. LS

2 3

[PATCH] sssd-secrets systemd service and small fixes
by Jakub Hrozek 17 Aug '16

17 Aug '16

Hi, attached are three small but important patches related to sssd-secrets. The context is that I started to write tests and manpage for sssd-secrets and noticed some issues. I hope the patches themselves offer a nice commit message. To test the socket activation, you can just install the RPMs built with these patches and call the socket responder, for example: curl -H "Content-Type: application/json" \ --unix-socket /var/run/secrets.socket \ -XGET http://localhost/secrets/ (You can see more examples in the WIP manpage at: https://github.com/jhrozek/sssd/commit/508c9eec040cada06bc6a61fe200f2db20a0…) If these patches are accepted, I'll also amend the manpage to list the service and the socket. btw it occured to me we might want to support service self-termination, but I would prefer to do that in another patchset and tracked with a ticket.

4 12

[PATCH 1/2] LDAP: Adding support for SIGTERM signal
by Petr Cech 17 Aug '16

17 Aug '16

Hi list, there is the first version of patch for [1]. I need to investigate if we have the same issue in other *_childs. I tested it with sleep() added into ldap_child code. [1] https://fedorahosted.org/sssd/ticket/3106 Regards -- Petr^4 Čech

4 20

[PATCH] SPEC: Own the secrets DB path
by Jakub Hrozek 17 Aug '16

17 Aug '16

To test, run: rpm -qf /var/lib/sss/secrets/ the directory was unowned before and should be owned by sssd-common now.

3 8

[PATCH] Warn if ad_server contains IP address
by Justin Stephenson 16 Aug '16

16 Aug '16

First patch, see attached. This is for easy fix from ticket https://fedorahosted.org/sssd/ticket/2789 I am going on the assumption that if the first 2 characters of ad_server are digits then it is likely an IP address and not hostname. If you have a better idea for this please let me know. Kind regards, Justin Stephenson

4 11

[PATCH] Remove old DP interface
by Pavel Březina 16 Aug '16

16 Aug '16

CI: http://sssd-ci.duckdns.org/logs/job/50/01/summary.html The failure is about missing dependencies, unrelated to these patches. It depends on the sssctl failover patches due to changes in attaching dbus message to a talloc context. Now it is possible to also free the message with both dbus_message_unref() and talloc_free(). Since the sssctl patches are already in late review process I didn't want to change them.

2 9

[PATCHES] sssctl: print active server and server list
by Pavel Březina 16 Aug '16

16 Aug '16

Failover patches for the sssctl tool. The output looks like: [master.ipa.pb: ~]$ sudo sssctl domain-status ad.pb Online status: Online Active servers: AD Global Catalog: root-dc.ad.pb AD Domain Controller: root-dc.ad.pb IPA: master.ipa.pb Discovered AD Global Catalog servers: - root-dc.ad.pb - invalid.ad.pb - root-dc.ad.pb Discovered AD Domain Controller servers: - root-dc.ad.pb Discovered IPA servers: - master.ipa.pb This is the best output format I could thing of so far, but I'm opened for suggestions.

3 21

[PATCH] CONFIG: full_name_format is an allowed option for all domains
by Jakub Hrozek 12 Aug '16

12 Aug '16

Hi, a simple one-liner is attached.

3 8

[PATCH] gpo: gPCMachineExtensionNames with just whitespaces
by Michal Židek 11 Aug '16

11 Aug '16

Hi, the attached patch fixes: https://fedorahosted.org/sssd/ticket/3114 We have a user that can not login with enforced GPO because of this. I do not think it is a common issue, I could not create groupPolicyContainer with gPCMachineExtensionNames containing only whitespaces, but you can create it with a script and the blank value is not an error so we should handle it properly (and maybe thre is a way in the GUI maze to create such GPOs as well, I just could not find it). I was able to reproduce the same "sssd log path" the user has and this patch fixed the issue. Thanks. Michal

4 10

[PATCH] Fixed some typos in man pages
by Thorsten Scherf 10 Aug '16

10 Aug '16

4 3

[PATCH] Handle unparseable names in the simple access list correctly
by Jakub Hrozek 10 Aug '16

10 Aug '16

Hi, please see the attached patches. I'm not sure how this bug got in, because in the patch that broke the functionality (eef359b508b898ae99d2bf292a43f0f295a2ba5e) I said in the commit message that I did the change that is only implemented in the first attached patch. My guess is that the rebasing after the DP patches were merged went wrong. To make sure we don't regress, I added more tests and switched the tests to calling the DP handler.

2 7

(no subject)
by Lukas Slebodnik 10 Aug '16

10 Aug '16

ehlo, yesterdat, I build a sssd in copr for various distributions and the dyndns-tests failed for me few time. We had a similar failures also in CI http://sssd-ci.duckdns.org/logs/job/50/54/fedora_rawhide/ci-build-coverage/… Attached patch should fix it. LS

2 5

[PATCH] SYSDB: Check changed virtual attributes before modified timestamp
by Lukas Slebodnik 10 Aug '16

10 Aug '16

ehlo, attached patch fixes acces denied after activating user in 389ds. Jakub had some comments/ideas in ticket but I think it's better to discuss about virtual attributes and timestamp cache on mailing list. LS

3 37

[PATCH] NSS: Use correct name for invalidating memory cache
by Lukas Slebodnik 10 Aug '16

10 Aug '16

ehlo, yet another patch which fixes issues caused by sysdb refactoring. reproducer: a) add user with two groups b) call id user c) add another group to user d) authenticate e) check tha id -G return 3 groups. I am looking forward to the pam_wrapper So we can test it in upstream. LS

3 7

The sorry state of code documentation
by Nikolai Kondrashov 10 Aug '16

10 Aug '16

Hi everyone, I've been acquainting myself with SSSD code the last few weeks. Particularly, the NSS responder, and what it uses down the stack. The SSSD code is sure complex and its asynchronous nature doesn't help. However, what struck me, and frustrated me the most, as a new reader of the code, was the meager amount of code documentation. In the absence of documentation, a piece of logic, such as processing a getpwnam request, requires traversing many functions, modules, and several programs. Sure, you can guess what a function does, based on its name and somewhat on arguments, but you can't be sure without reading it and the functions it calls, and often the functions those call in turn. Same goes with data structures: to understand them you need to read the code that creates and operates them. To the author code often seems obvious, but a new reader has a dozen questions: which state the passed object should be in, how does the function modify the object, where does it put its output, what else it affects, exactly what string should be that, what status codes the function can return and what will they mean, etc. Documentation cements the author's intention in the mind of the reader, freeing the memory and precious attention for understanding the code at hand, as opposed to requiring going deeper and deeper into the underlying code, where the reader eventually forgets why he or she is looking at it. Reading such complicated code as can be seen in SSSD without documentation is an exercise in frustration. We often speak about cooperation and getting more external contributors. However, we're not going to get many if they have such a mountain of code to climb without our help. We ourselves will be (and are) struggling to understand our own code, and will pay with lost time again and again when trying to modify or extend it. In short: it is NOT OK that SSSD code has no documentation. Put bluntly, it is sloppy engineering. I'm sure we can do better. If you have just a sentence describing each function and each of its arguments, understanding the code becomes considerably easier. You don't have to guess that much, and you don't have to verify your guesses and read so much more. Function documentation would often make reading its code unnecessary. A sentence for a data structure and each of its fields makes understanding the code operating it much easier. I suggest several measures which could be taken. 1. Require *every* new module/function/argument/structure/field to be documented. It must be at least a sentence for each. A module or a bigger data structure could warrant more. Describe module/function/structure overall, and each of its declarations/arguments/return values/fields. 2. Next level, documentation tax: if you touch anything, document it. Modified a module header? Add a short module description. Added or removed a field in a structure? Add structure and field descriptions. Changed a function? Document it. 3. Third level, documentation duty: document a whole existing module header of your choosing, say once a month. The format of documentation doesn't matter, as long as it's legible and agreed upon. I suggest Doxygen, but it can be anything else. We don't have to actually run the documentation extraction tool (such as "doxygen") on our code and use perfectly correct syntax (although that could be the next step). What matters is that documentation is there, it's uniform, and you don't have to think about the format when writing it. For example of how it can look see the attached patch where I tried to document some things (likely misunderstanding some) as I read the code. For more examples of what I mean see the tlog header files: https://github.com/Scribery/tlog/tree/master/include/tlog They are not the best example and there are many ways they can be improved (tell me please!), but if SSSD had just that it would be already awesome. Please tell me what you think, object, or suggest your own solutions! Thank you. Nick

4 13

[PATCH] intg: Allow to test netgroups
by Lukas Slebodnik 10 Aug '16

10 Aug '16

ehlo, attcheck patch is a python wrapper for netgroup lookups in sssd. LS

2 2

[PATCH] Add support for disabling netlink use
by Justin Stephenson 09 Aug '16

09 Aug '16

Hello, The attached patch fixes: https://fedorahosted.org/sssd/ticket/2860 This provides an option used primarily for testing purpose to ignore network status changes from the netlink interface(helpful when sssd should remaining in offline/online mode) =================================== Before the patch, restarting the network triggers sssd to go back online (Mon Aug 8 15:50:18 2016) [sssd] [route_msg_debug_print] (0x1000): route idx 1 flags 0 family 10 addr 2002:ac10::/28 (Mon Aug 8 15:50:18 2016) [sssd] [network_status_change_cb] (0x2000): A networking status change detected signaling providers to reset offline status (Mon Aug 8 15:50:18 2016) [sssd] [sbus_add_timeout] (0x2000): 0x21af1a0 (Mon Aug 8 15:50:18 2016) [sssd] [sbus_remove_timeout] (0x2000): 0x21af1a0 (Mon Aug 8 15:50:18 2016) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x21ba170 (Mon Aug 8 15:50:18 2016) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Mon Aug 8 15:50:18 2016) [sssd] [message_type] (0x0200): netlink Message type: 24 (Mon Aug 8 15:50:18 2016) [sssd] [route_msg_debug_print] (0x1000): route idx 1 flags 0 family 10 addr 2002:c0a8::/32 (Mon Aug 8 15:50:18 2016) [sssd] [network_status_change_cb] (0x2000): A networking status change detected signaling providers to reset offline status (Mon Aug 8 15:50:18 2016) [sssd] [sbus_add_timeout] (0x2000): 0x21bd2a0 (Mon Aug 8 15:50:18 2016) [sssd] [sbus_remove_timeout] (0x2000): 0x21bd2a0 (Mon Aug 8 15:50:18 2016) [sssd] [sbus_dispatch] (0x4000): dbus conn: 0x21ba170 (Mon Aug 8 15:50:18 2016) [sssd] [sbus_dispatch] (0x4000): Dispatching. (Mon Aug 8 15:50:18 2016) [sssd] [message_type] (0x0200): netlink Message type: 24 After the patch, # pkill -USR1 sssd Restart the network, sssd remains offline # service network restart Test backend lookup with no cache shows backend is still offline # id aduser(a)ad.domain (Mon Aug 8 16:44:17 2016) [sssd[be[AD.JSTEPHEN]]] [sbus_dispatch] (0x4000): dbus conn: 0x1853d60 (Mon Aug 8 16:44:17 2016) [sssd[be[AD.JSTEPHEN]]] [sbus_dispatch] (0x4000): Dispatching. (Mon Aug 8 16:44:17 2016) [sssd[be[AD.JSTEPHEN]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider (Mon Aug 8 16:44:17 2016) [sssd[be[AD.JSTEPHEN]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Mon Aug 8 16:44:17 2016) [sssd[be[AD.JSTEPHEN]]] [dp_attach_req] (0x0400): DP Request [Account #2]: New request. Flags [0x0001]. (Mon Aug 8 16:44:17 2016) [sssd[be[AD.JSTEPHEN]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Mon Aug 8 16:44:17 2016) [sssd[be[AD.JSTEPHEN]]] [_dp_req_recv] (0x0400): DP Request [Account #2]: Receiving request data. (Mon Aug 8 16:44:17 2016) [sssd[be[AD.JSTEPHEN]]] [dp_req_reply_gen_error] (0x0080): DP Request [Account #2]: Finished. Backend is currently offline. (Mon Aug 8 16:44:17 2016) [sssd[be[AD.JSTEPHEN]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1:1::AD.JSTEPHEN:name=myaduser@ad.jstephen] from reply table (Mon Aug 8 16:44:17 2016) [sssd[be[AD.JSTEPHEN]]] [dp_req_destructor] (0x0400): DP Request [Account #2]: Request removed. (Mon Aug 8 16:44:17 2016) [sssd[be[AD.JSTEPHEN]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Mon Aug 8 16:44:17 2016) [sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline] Kind regards, Justin Stephenson

1 1

[PATCH] sssctl: use internal API to remove files
by Pavel Březina 09 Aug '16

09 Aug '16

3 6

which tickets do we need to close before releasing 1.14.1?
by Jakub Hrozek 09 Aug '16

09 Aug '16

I would say we want to include: https://fedorahosted.org/sssd/ticket/3110 - Access denied after activating user in 389ds https://fedorahosted.org/sssd/ticket/3120 - SSSD fails to start when ldap_user_extra_attrs contains mail https://fedorahosted.org/sssd/ticket/3101 - sssd does not start if sub-domain user is used with simple access provider When these are included, I would like to tag 1.14.1. Any other opinions?

2 1

[PATCH] UTILS: Fixing duplication of pid file declaration
by Petr Cech 09 Aug '16

09 Aug '16

Hello list, attached patch fixes duplication of pid file declaration. I hope that the util/util.h is the right place for it. Another opinion are welcome. Regards -- Petr^4 Čech

3 6

[PATCH] NSS: Do not check local users with disabled local_negative_timeout
by Lukas Slebodnik 09 Aug '16

09 Aug '16

ehlo, The simple reproducer is to use getent passwd,group with non-existing entry. Without the patch you will see that "/var/lib/sss/mc/passwd" is opened twice. Onece with mode "rw" opened by sssd_nss and the 2nd time with "r-" opened by sssd-client (getpwnam, getpwuid, getgrnam, getgrgid) LS

3 6

[PATCH] DP: Initialize D-Bus as soon as possible
by Pavel Březina 09 Aug '16

09 Aug '16

https://fedorahosted.org/sssd/ticket/3111

3 10

[PATCH SET] AD_PROVIDER: ad_enabled_domains
by Petr Cech 09 Aug '16

09 Aug '16

Hello list, there is patch set attached resolving: https://fedorahosted.org/sssd/ticket/2828 You can also see: https://github.com/celestian/sssd/commits/subdomains_v2 This patch set is without tests yet. I will send tests after Pavel B. refactor of AD provider. I would like to remark couple of things: 1) Option ad_enabled_domains disabled by default. 2) We use labels master domain and root domain in code. Master domain belongs to one that SSSD is connected to. Root domain means AD forest root. 3) There is a lot of different environment setup. So this option has slightly different meaning in each of them. 4) There is secret feature if you forget fill in master domain to the option it will be added automatically. What is this option good for? Let's imagine environment like: A (forest root) | |-- S1 (SSSD client) | |-- B (AD client) | | | |-- S2 (SSSD client) | |-- C (AD client) | |-- D (AD client) A ... forest root B, C, D ... AD clients S1 ... SSSD client connected to A S2 ... SSSD client connected to B We could write: * on S1: ad_enabled_domain = A, B, C and then S1 will not attempt to connect D. * on S1: ad_enabled_domain = B, C the same as above because A is automagically filled in. * on S2: ad_enabled_domain = A, C and then B is filled in automatically and S2 will not attempt to connect D. * on S2: ad_enabled_domain = C and then B is filled in automatically and S2 will not attempt to connect D and A. (I am wondering that it is possible but it happened during manual testing.) Regards -- Petr^4 Čech

4 14

[PATCH] sssctl: Generic help for cache-upgrade and config-check
by Michal Židek 09 Aug '16

09 Aug '16

Hi! Attached is patch for ticket: https://fedorahosted.org/sssd/ticket/3086 This patch applies on top of the patches from thread: [SSSD] [PATCH] sssctl: Consistent commands naming Michal

3 4

[PATCH] PROVIDERS: Default values in debug
by Petr Cech 09 Aug '16

09 Aug '16

Hi list, I was debug code very deeply and I found nitpick. There is simple patch attached. Regards -- Petr^4 Čech

3 10

[PATCH] Two code-hardening patches
by Jakub Hrozek 08 Aug '16

08 Aug '16

Hi, these two patches add error handling to the code. The first prevents operating on ldb_message if retrieving the message fails. I only tested an SSH login with a UPN to make sure we actually hit this codepath. I don't like the deep indendation nesting, so I welcome suggestions how to fix the code better. The second just checks a return value.

2 4

[PATCH] LDAP: Fixing wrong pam error code for passwd
by Petr Cech 08 Aug '16

08 Aug '16

Hello list, the attached patch fixes: https://fedorahosted.org/sssd/ticket/3109 There was missing condition for offline state of sssd at ldap code for password changing. If sssd is offline it returns PAM_AUTHINFO_UNAVAIL now and not PAM_PERM_DENIED. Regards -- Petr^4 Čech

3 5

[PATCH] LDAP: Fix Dereference after NULL check
by Lukas Slebodnik 08 Aug '16

08 Aug '16

ehlo, attached is a oneliner for bug introduced in dc30c60f166ad9adc63a47a1013508a71624ac87 I would push the patch with oneliner rule but there were objection in past for such behaviour. It was recommended to to use only in "critical" situation before release. LS

2 3

SDAP: Don't log an op failure when no users are found
by Fabiano Fidêncio 05 Aug '16

05 Aug '16

Please, see the attached patch. It passed CI: http://sssd-ci.duckdns.org/logs/job/50/66/summary.html Best Regards, -- Fabiano Fidêncio

3 2

[PATCH] tools: Add missing gettext macro
by Michal Židek 05 Aug '16

05 Aug '16

Hi, see the attached simple patch. I sent it as part of the commands renaming patchset, but forgot to include it in the last iteration. Michal

3 2

[PATCH] sssctl: print a message when managing sssd
by Pavel Březina 05 Aug '16

05 Aug '16

3 5

[PATCH] PROVIDER: Conversion empty string from D-Bus to NULL
by Petr Cech 05 Aug '16

05 Aug '16

Hi list, there is patch for [1] attached. [1] https://fedorahosted.org/sssd/ticket/3084 If you prefer two commits--one for reverting and second with the patch--don't hesitate to tell me it. :-) Regards -- Petr^4 Čech

4 6

[PATCH] IPA: Removing of confusing debug message
by Petr Cech 05 Aug '16

05 Aug '16

Hello list, there is simple patch for [1]. I prepared two version: a) the first is for changing the message, b) the second is for removing. I looked at the code -- I think it could be useful to know what type of direction we have. But I agree that it could be really confusing if we see 'trust direction not set'. So I vote for removing. Please do you have any other opinion? [1] https://fedorahosted.org/sssd/ticket/3090 Regards -- Petr^4 Čech

4 7

[PATCH] SYSDB: Fix setting dataExpireTimestamp if sysdb is supposed to set the current time
by Jakub Hrozek 05 Aug '16

05 Aug '16

Hi, please see the attached patch and the test. They should fix https://fedorahosted.org/sssd/ticket/3064. I don't think more explanation than what is in the ticket and in the commit message is needed :)

3 2

[PATCH] SYSDB: Sanitize dn in sysdb_get_user_members_recursively
by Lukas Slebodnik 05 Aug '16

05 Aug '16

ehlo, attached two patches fix a crash in nss responder, which was caused by recent Sumit's patches. The 1st patch cannot be applied to master because I plan do do some changes in ldap integration tests in different thread. But the patch with test is attached. So there will not be a such regressions in future LS

2 4

[PATCH] sssctl: Consistent commands naming
by Michal Židek 05 Aug '16

05 Aug '16

Hi, this patches makes the sssctl commands more similar to ipa tool commands. I also think this pattern makes it easier to remember the commands. Note that in the future, there will be more user-* group-* and netgroup-* commands (like seed for user, list of all etc.) Comments are welcome. Michal

5 32

[PATCH] Change debug level of config error msgs
by Michal Židek 04 Aug '16

04 Aug '16

Hi, I believe that this patch makes pinpointing of config errors a little easier. Especially when using sssctl tool that currently refuses to start a command when there are syntax errors in sssd.conf, but by default it does not print problematic line number. Compare: ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header (Wed Jul 27 14:05:39:185114 2016) [sssd] [sss_ini_get_config] (0x0010): Failed to parse configuration. Error 5. (Wed Jul 27 14:05:39:185192 2016) [sssd] [sss_ini_get_config] (0x0010): Errors detected while parsing: /etc/sssd/sssd.conf (Wed Jul 27 14:05:39:185229 2016) [sssd] [confdb_init_db] (0x0010): Failed to load configuration (Wed Jul 27 14:05:39:185255 2016) [sssd] [confdb_setup] (0x0010): ConfDB initialization has failed [5]: Input/output error (Wed Jul 27 14:05:39:185288 2016) [sssd] [sss_tool_confdb_init] (0x0010): Unable to setup ConfDB [5]: Input/output error and: ldb: unable to dlopen /usr/lib64/ldb/modules/ldb/memberof.la : /usr/lib64/ldb/modules/ldb/memberof.la: invalid ELF header (Wed Jul 27 14:22:51:096949 2016) [sssd] [sss_ini_get_config] (0x0010): Failed to parse configuration. Error 5. (Wed Jul 27 14:22:51:097173 2016) [sssd] [sss_ini_get_config] (0x0010): Errors detected while parsing: /etc/sssd/sssd.conf (Wed Jul 27 14:22:51:097490 2016) [sssd] [sss_ini_config_print_errors] (0x0010): Error (2) on line 10: No closing bracket. (Wed Jul 27 14:22:51:097946 2016) [sssd] [confdb_init_db] (0x0010): Failed to load configuration (Wed Jul 27 14:22:51:098452 2016) [sssd] [confdb_setup] (0x0010): ConfDB initialization has failed [5]: Input/output error (Wed Jul 27 14:22:51:098651 2016) [sssd] [sss_tool_confdb_init] (0x0010): Unable to setup ConfDB [5]: Input/output error Patch is attached. Michal

3 6

[PATCH] RESPONDER: Lower debug level for SELINUX_getpeercon() failure, be explicit that it may happen due to disabled SELinux and pass the proper parameter to strerror()
by Fabiano Fidêncio 04 Aug '16

04 Aug '16

So, sorry for the very long title and please, see the proposed patches for solving https://fedorahosted.org/sssd/ticket/3094 Best Regards, -- Fabiano Fidêncio

2 4

[PATCH] config: Some fixes to schema
by Michal Židek 04 Aug '16

04 Aug '16

Hi, attached is patch for ticket https://fedorahosted.org/sssd/ticket/3068 The ticket also talks about allowing options for negative cache timeouts in all responders, but I did not do that. We do indeed initialize negative cache in all responders, but we always read the timeouts from NSS section. Also in the man pages, we only document these options for NSS. So it is not problem with the schema. I do agree that this is not ideal, but should we fix it? I do not think it is worth the time, but if someone thinks otherwise, please open a ticket. Michal

3 17

[PATCH] LDAP: Use FQDN when linking parent LDAP groups
by Jakub Hrozek 04 Aug '16

04 Aug '16

Hi, see the attached patch. You can use Lukas' integration tests to help with review.

2 4

[PATCHES] AD: netlogon_get_domain_info() allow missing arguments
by Sumit Bose 03 Aug '16

03 Aug '16

Hi, it is possible that the CLAP/netlogon reply does not contain any site data. In this case we should not fail but just use what we can get. Especially when looking up the Global Catalog the forest name is needed. If the site name is missing we still can use the forest name to lookup the Global Catalog in DNS. The first patch is not strictly related to the issue but since it fixes a potential memory leak (we currently do not have it because only short-lived memory contexts are used so far) I think it is worth adding it here. bye, Sumit

3 8

[PATCH] ipa_netgroups: Lowercase key to htable
by Michal Židek 02 Aug '16

02 Aug '16

Hi! When reviewing Petr's netgroup patch I found some issues with netgroups when using IPA provider. Attached patch fixes one of them. I filed ticket for the other issue here: https://fedorahosted.org/sssd/ticket/3117 Reviewing this is not priority for this week, but I already had the patch and wanted to put the list. Thanks, Michal

3 6

[PATCH] LDAP: Removing of useless debug message
by Petr Cech 02 Aug '16

02 Aug '16

Hi list, how Jakub mentioned on internal list this debug message should be removed. So I attached simple patch for it. Regards -- Petr^4 Čech

4 7

[PATCH] LDAP: Fix storing initgroups for users with no supplementary
by Jakub Hrozek 02 Aug '16

02 Aug '16

Hi, I was looking into the remaining downstream test failures and found this bug caused by the FQDN patchset..

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2016