[PATCH] SPEC: Rename python packages using macro %python_provide
by Lukas Slebodnik
ehlo,
SSSD python packages were renamed in fedora few months ago.
python-* -> python2-*
But we didn't rename packages in upstream spec file and therefore
upgrade from fedora 24 -> sssd master is not possible.
Attached patch shoudl fix the issue.
BTW here are provides and obsoletes for current master
sh$ rpm -qp --provides python-libipa_hbac-1.13.92-0.fc24.x86_64.rpm
libipa_hbac-python = 1.13.92-0.fc24
python-libipa_hbac = 1.13.92-0.fc24
python-libipa_hbac(x86-64) = 1.13.92-0.fc24
sh$ rpm -qp --obsoletes python-libipa_hbac-1.13.92-0.fc24.x86_64.rpm
libipa_hbac-python < 1.12.90
and after renaming
sh$ rpm -qp --provides python2-libipa_hbac-1.13.92-0.el6.x86_64.rpm
libipa_hbac-python = 1.13.92-0.el6
python-libipa_hbac = 1.13.92-0.el6
python2-libipa_hbac = 1.13.92-0.el6
python2-libipa_hbac(x86-64) = 1.13.92-0.el6
sh$ rpm -qp --obsoletes python2-libipa_hbac-1.13.92-0.el6.x86_64.rpm
libipa_hbac-python < 1.12.90
python-libipa_hbac < 1.13.92-0.el6
LS
7 years, 2 months
[PATCH] ssh: skip invalid certificates
by Sumit Bose
Hi,
currently the code which generates ssh key from the public keys in the
user certificates fails if one certificate cannot be validated and
terminates the whole request. It is of course valid that the user entry
might contain certificates which SSSD cannot validate and since we just
won't generate a ssh-key in this case SSSD should just skip those
entires and return ssh-keys for every valid certificate.
You can test the patch even without a real certificate by e.g. adding a
ssh-key to an IPA user object. Then 'sss_ssh_authorizedkeys username'
should return this key. If you now add some random data the the
userCertificate object of the same user, call 'sss_cache -E' and call
'sss_ssh_authorizedkeys username' again, you get nothing because the
random data cannot be validated and hence the whole request is aborted.
With the attached patch sss_ssh_authorizedkeys should return the ssh-key
again.
bye,
Sumit
7 years, 2 months
[PATCH] Fix offline resolution of autofs maps and netgroups
by Jakub Hrozek
Hi,
to reproduce the netgroups failure:
* getent netgroup testngr # to verify the netgroup is there
* sss_cache -E
* pkill -USR1 sssd # make sssd go offline
* getent netgroup testngr
to reproduce the autofs maps failure:
* automount -m # to verify the maps are there
* pkill -USR1 sssd # make sssd go offline
* automount -m # to verify the maps are there
Before the patches, neither offline lookup would return the expected
results. Both lookups should return results with the patches.
7 years, 2 months
[PATCHES] p11: add no_verification option
by Sumit Bose
Hi,
the following 3 patches are related to the Smartcard authentication
feature but imo can be tested even without having one.
The first patch just adds some missing pieces. The second adds a new
'no_verification' switch to the 'certificate_verification' option, which
is already tested by the unit tests.
The third adds two new OCSP related switches. With OCSP a certificate
can be validates online by talking to a server which is listed in the
certificate. Of course it might not always be possible to directly talk
to this server. We already have the 'no_ocsp' switch to disable OCSP
completely. The two new switches allow SSSD to talk to a different
server or a proxy. To see how it is working you can do to following:
- call 'make check' to build and rung all the tests
- call './pam-srv-tests' to run the PAM responder tests but do not let
it complete but stop it with CTRL-C. This is needed to create the test
nss database in /dev/shm/tp_pam_srv_tests-test_pam_srv/, it can be
created differently but this way it is most easy :-)
- add a OCSP signing cert with
echo "MIIDaTCCAlGgAwIBAgIBAjANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlJUEEuREVWRUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNTA5MjMxMTI2MjBaFw0xNzA5MTIxMTI2MjBaMC0xEjAQBgNVBAoMCUlQQS5ERVZFTDEXMBUGA1UEAwwOT0NTUCBTdWJzeXN0ZW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDEXVzkTN9R03+hvAbkiCYqdKKe7Nr0YDlchny+IsJl5cYiFBtWqiVJK5N0L6uCS9bVBtuG7y9Vv1TJrv2U8hqjXYZFM6HzYwwmbE2tv1Yyx0dQyYiYTT0nVyXPrXDJe0PFdYTsAlw7C54wZuBsdDADUTA1ThAP22Z6Zy+UyQFtlqEfCErvHK+VolCfkTJ4dYlQb5x7Gs6fEmLbnaGpJXW1JnRzMZ4hM+/mV3xSsjFuYwwoFCHG6GQu/LJgosBX9M+OMavMOO/AzeUlHfUoyMUNn0iNeiDqeYPBCNf4czK0CpeJdE4qBBgu0vSfC0mzjKRuFQEAUuBGxGE+2BP09uXAgMBAAGjgYwwgYkwHwYDVR0jBBgwFoAU0aLh2me2OKzMbu3zckJNNu3Hd1swDgYDVR0PAQH/BAQDAgHGMEEGCCsGAQUFBwEBBDUwMzAxBggrBgEFBQcwAYYlaHR0cDovL2lwYS1kZXZlbC5pcGEuZGV2ZWw6ODAvY2Evb2NzcDATBgNVHSUEDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAQEAAJzUjm39nsMlxc0ivEm77PN9ZFFWIfY6fOteNpJnOADlOatkXKq6PTFS0lRo/53HjYvmvrjnUTYHK3hmRlDvwr+49UqhSkKai8v6PSS4jYJplETME032OwGL17qCjoX2yU55Ovm3CIamUNNOSIvMBbS7HB0EBe/KHMhme5+Uhtfgjql9B9ihuwT1U3vXQP+cavxe37PJOCUuuATLyd0GX+Islkq2v1pEKX0dsXhMpDwLOYLqckBZHOoAKEo2VYZN0P1KZZkJd4kQHGsADYfuIrLACwzLxlEWmCIq4AOwpYtkMSx85DgT6lW3ECgfbFYVVUzqHUuTiogEsgJ0kouCJw==" | base64 -d | certutil -A -d sql:/dev/shm/tp_pam_srv_tests-test_pam_srv -t TC,TC,TC -n ocsp_cert
the NSS library call check this certificate first before trying to connect to
the OCSP responder, so a valid one with the right key usage must be added to
make NSS try to reach the new OCSP responder
- call
strace -s 128 -f -esend .libs/lt-p11_child --debug-microseconds=1 --debug-timestamps=1 --debug-to-stderr --debug-level=10 --pre --nssdb sql:/dev/shm/tp_pam_srv_tests-test_pam_srv
where you should see lines like
send(7, "\313D\1\0\0\1\0\0\0\0\0\0\6ipa-ca\3ipa\5devel\0\0\1\0\1", 34, MSG_NOSIGNAL) = 34
from the DNS lookups for ipa-ca.ipa.devel which is the OCSP server from the
ticket
- call
strace -s 128 -f -esend ./p11_child --debug-microseconds=1 --debug-timestamps=1 --debug-to-stderr --debug-level=10 --pre --nssdb sql:/dev/shm/tp_pam_srv_tests-test_pam_srv --verify 'ocsp_default_responder=http://oooo.cccc.ssss.pppp:80,ocsp_default_responder_signing_cert=ocsp_cert'
where you should now see lines like
send(7, "yO\1\0\0\1\0\0\0\0\0\0\4oooo\4cccc\4ssss\4pppp\0\0\1\0\1", 37, MSG_NOSIGNAL) = 37
from the DNS lookups for the OCSP responder from the command line.
Of course all the validations will fail with "Certificate [SSSD Test
Token:Server-Cert][CN=ipa-devel.ipa.devel,O=IPA.DEVEL] not valid [-8071],
skipping" because none of the OCSP responders are available but I think this
test is sufficient to see that the patch is working as expected.
bye,
Sumit
7 years, 2 months
[PATCH] Failover to next server if authentication fails
by Pavel Březina
We can fail in sasl_bind_send() with ERR_AUTH_FAILED for basically
unspecified reason but we do not failover to next server. This patch
should fix it.
As said on the meeting, I didn't reproduce it and I'm not sure if it
will fix the customer issue unless they confirm it, but it seems to be a
valid patch anyway.
7 years, 2 months
Re: [PATCH SET] AD_PROVIDER: ad_enabled_domains
by Petr Cech
Sorry, I experienced some issue with mailing list.
So I send it again.
-------- Forwarded Message --------
Subject: Re: [SSSD] Re: [PATCH SET] AD_PROVIDER: ad_enabled_domains
Date: Tue, 9 Aug 2016 17:29:38 +0200
From: Petr Cech <pcech(a)redhat.com>
To: sssd-devel(a)lists.fedorahosted.org
On 08/09/2016 11:07 AM, Jakub Hrozek wrote:
> On Mon, Jul 25, 2016 at 06:18:28PM +0200, Petr Cech wrote:
>> > Hello,
>> >
>> > there is fixed patch set attached.
>> >
>> > Segmentation fault was caused by wrong pointer :-(, sorry.
>> >
>> > This new patch set has new debug message. I am open to dissccus the
>> > debug_level and content of message. Any improving idea?
>> >
>> > I hit one issue during testing -- sometimes if I am connected to subdomain
>> > and I enable only sibling subdomain (the master is added automaticaly) and
>> > forest root is not enabled -- I see only master and sibling not. But if I
>> > added sleep for cycle (for using dbg) to function ad_subdomains_init()
>> > everythink is OK.
>> > Any idea?
> Can you test that case with valgrind? This sounds like some uninitilized
> variable condition.
I didn't run valgrind but I have new information.
If you clear the cache and reset sssd, first attempt to obtain
information about user from sibling domain fails. The second and the
other attempts runs correctly.
I see that the sibling domain is enabled. But if I look more carefully
there is message in log (gamma.domain.bootes is sibling domain):
[sssd[be[beta.domain.bootes]]] [dp_req_new] (0x0020): Unknown domain:
gamma.domain.bootes
First attempt should works too but you should wait nearly exactly 6
seconds after restart sssd.
New patch set is attached.
>> > Anyway, I would like to ask you for testing.
>> >
>> > Regards
>> >
>> > --
>> > Petr^4 Čech
>> > From 7fd9ad8f42f274463c1d107b195d21290fd0b0f2 Mon Sep 17 00:00:00 2001
>> > From: Petr Cech <pcech(a)redhat.com>
>> > Date: Fri, 13 May 2016 05:21:07 -0400
>> > Subject: [PATCH 1/5] AD_PROVIDER: Add ad_enabled_domains option
> ACK
Thanks.
>> > From dfa6e063d3ef4850a7809e2f5a6d3826ea061b27 Mon Sep 17 00:00:00 2001
>> > From: Petr Cech <pcech(a)redhat.com>
>> > Date: Tue, 21 Jun 2016 08:34:15 +0200
>> > Subject: [PATCH 2/5] AD_PROVIDER: Initializing of ad_enabled_domains
>> >
>> > We add ad_enabled_domains into ad_subdomains_ctx.
>> >
>> > Resolves:
>> > https://fedorahosted.org/sssd/ticket/2828
>> > ---
>> > src/providers/ad/ad_subdomains.c | 82 ++++++++++++++++++++++++++++++++++++++++
>> > 1 file changed, 82 insertions(+)
>> >
>> > diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
>> > index e9da04e384e598927f9c8c203a751bcccd29e895..9c0afb19418e44a3e3daa661baf1c7a82439d60d 100644
>> > --- a/src/providers/ad/ad_subdomains.c
>> > +++ b/src/providers/ad/ad_subdomains.c
>> > @@ -57,6 +57,79 @@
>> > /* do not refresh more often than every 5 seconds for now */
>> > #define AD_SUBDOMAIN_REFRESH_LIMIT 5
>> >
>> > +static errno_t ad_get_enabled_domains(TALLOC_CTX *mem_ctx,
>> > + struct ad_id_ctx *ad_id_ctx,
>> > + const char *ad_domain,
>> > + const char ***_ad_enabled_domains)
>> > +{
>> > + int ret;
>> > + const char *str;
>> > + const char *option_name;
>> > + const char **domains = NULL;
>> > + int count;
>> > + bool is_ad_in_domains;
>> > + TALLOC_CTX *tmp_ctx = NULL;
>> > +
>> > + tmp_ctx = talloc_new(NULL);
>> > + if (tmp_ctx == NULL) {
>> > + return ENOMEM;
>> > + }
>> > +
>> > + str = dp_opt_get_cstring(ad_id_ctx->ad_options->basic, AD_ENABLED_DOMAINS);
>> > + if (str == NULL) {
>> > + _ad_enabled_domains = NULL;
> I think you wanted to dereference the pointer here? (it might also be a
> good idea to return EINVAL if the caller passed NULL as the output pointer)
Right, thanks, addressed.
>> > + ret = EOK;
>> > + goto done;
>> > + }
>> > +
>> > From 4cd5c77f09750f9eb20c91eadc4759c3e4166093 Mon Sep 17 00:00:00 2001
>> > From: Petr Cech <pcech(a)redhat.com>
>> > Date: Tue, 21 Jun 2016 09:48:52 +0200
>> > Subject: [PATCH 3/5] AD_PROVIDER: ad_enabled_domains - only master
>> >
>> > We can skip looking up other domains if option ad_enabled_domains
>> > contains only master domain.
>> >
>> > Resolves:
>> > https://fedorahosted.org/sssd/ticket/2828
>> > ---
>> > src/providers/ad/ad_subdomains.c | 16 ++++++++++++++++
>> > 1 file changed, 16 insertions(+)
>> >
>> > diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
>> > index 9c0afb19418e44a3e3daa661baf1c7a82439d60d..eaa85f802dbb4022dc632cc4c05d89685eccd901 100644
>> > --- a/src/providers/ad/ad_subdomains.c
>> > +++ b/src/providers/ad/ad_subdomains.c
>> > @@ -1163,6 +1163,7 @@ static void ad_subdomains_refresh_connect_done(struct tevent_req *subreq)
>> > return;
>> > }
>> >
>> > + /* connect to the DC we are a member of */
>> > subreq = ad_master_domain_send(state, state->ev, state->id_ctx->conn,
>> > state->sdap_op, state->sd_ctx->domain_name);
>> > if (subreq == NULL) {
>> > @@ -1211,6 +1212,21 @@ static void ad_subdomains_refresh_master_done(struct tevent_req *subreq)
>> > goto done;
>> > }
>> >
>> > + /*
>> > + * If ad_enabled_domains contains only master domain
>> > + * we shouldn't lookup other domains.
>> > + */
>> > + if (state->sd_ctx->ad_enabled_domains != NULL) {
>> > + if (talloc_array_length(state->sd_ctx->ad_enabled_domains) == 2) {
>> > + if (strcmp(state->sd_ctx->ad_enabled_domains[0],
>> > + state->be_ctx->domain->name) == 0) {
> I only notices this now, but IIRC the domains are case insensitive,
> shouldn't we use strcasecmp here?
I see strcasecmp in other places. So I fixed it.
>> > + DEBUG(SSSDBG_TRACE_FUNC,
>> > + "No other enabled domain than master.\n");
>> > + goto done;
>> > + }
>> > + }
>> > + }
>> > +
>> > subreq = ad_get_root_domain_send(state, state->ev, forest,
>> > sdap_id_op_handle(state->sdap_op),
>> > state->sd_ctx);
>> > --
>> > 2.7.4
>> >
>> > From 0d2b0c67875663d0e614b8361152ec7edc14c37e Mon Sep 17 00:00:00 2001
>> > From: Petr Cech <pcech(a)redhat.com>
>> > Date: Mon, 27 Jun 2016 11:51:30 +0200
>> > Subject: [PATCH 4/5] AD_PROVIDER: ad_enabled_domains - other then master
>> >
>> > We can skip looking up other domains if
>> > option ad_enabled_domains doesn't contain them.
>> >
>> > Resolves:
>> > https://fedorahosted.org/sssd/ticket/2828
>> > ---
>> > src/providers/ad/ad_subdomains.c | 49 ++++++++++++++++++++++++++++++++++++----
>> > 1 file changed, 45 insertions(+), 4 deletions(-)
>> >
>> > diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
>> > index eaa85f802dbb4022dc632cc4c05d89685eccd901..32f7d7b3b2c4917d15d516c5e8beac159ffe164f 100644
>> > --- a/src/providers/ad/ad_subdomains.c
>> > +++ b/src/providers/ad/ad_subdomains.c
>> > @@ -130,6 +130,23 @@ done:
>> > return ret;
>> > }
>> >
>> > +static bool is_domain_enabled (const char *domain,
>> > + const char **enabled_doms)
> ^
> We don't put a space between function name and the argument list.
Addressed.
>> > +{
>> > + bool ret;
>> > +
>> > + if (enabled_doms == NULL) {
>> > + ret = true;
>> > + goto done;
> Do we really need to use jump labels instead of just returning true?
Addressed.
>> > + }
>> > +
>> > + ret = string_in_list(domain, discard_const_p(char *, enabled_doms), true) ?
>> > + true : false;
> Can you also fix the indentation here? We could also just return the
> function return value and get rid of the 'ret' variable completely.
Addressed.
>> > +
>> > +done:
>> > + return ret;
>> > +}
>> > +
>> > static errno_t
>> > ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,
>> > struct ad_id_ctx *id_ctx,
>> > @@ -485,6 +502,7 @@ done:
>> >
>> > From 92af52a3b4d8fa138282030a72122d6cbe9c5413 Mon Sep 17 00:00:00 2001
>> > From: Petr Cech <pcech(a)redhat.com>
>> > Date: Mon, 27 Jun 2016 11:53:19 +0200
>> > Subject: [PATCH 5/5] TESTS: Adding tests for ad_enabled_domains option
> ACK
Thanks.
Regards
--
Petr^4 Čech
7 years, 2 months
[PATCH] WIP: PROXY: Adding proxy_max_children option
by Petr Cech
Hello,
I am fighting with adding new option to sssd.conf.
I slowly running out of breath.
I know proxy could be id, auth or chpass provider. I don't know
where is the right place for my option. And the second issue is
it breaks test for SSSD config. :-(
Is there anyone who would like to join to the fight? Please,
see attached patch.
Regards
--
Petr^4 Čech
7 years, 2 months