sssd-devel December 2021

sssd-devel@lists.fedorahosted.org

2 participants
82 discussions

[sssd PR#5927][opened] ad: add required 'cn' attribute to subdomain object
by sumit-bose 17 Jan '22

17 Jan '22

URL: https://github.com/SSSD/sssd/pull/5927 Author: sumit-bose Title: #5927: ad: add required 'cn' attribute to subdomain object Action: opened PR body: """ If the forest root is not part of the return trusted domain objects from the local domain controller we generate an object for further processing. During this processing it is expected that the 'cn' attribute is set and contains the name of the forest root. So far this attribute was missing and it is now added by this patch. Resolves: https://github.com/SSSD/sssd/issues/5926 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5927/head:pr5927 git checkout pr5927

3 12

[sssd PR#5881][opened] SDAP: Do not fail ASQ search when parsing a referenced entry fails
by scabrero 16 Jan '22

16 Jan '22

URL: https://github.com/SSSD/sssd/pull/5881 Author: scabrero Title: #5881: SDAP: Do not fail ASQ search when parsing a referenced entry fails Action: opened PR body: """ In an attribute scoped query it may happen sssd doen't have permissions to read the attribute referenced entry, for example when it is located under a restricted LDAP sub-tree for security reasons. In this scenario sssd fails to resolve the group because the referenced entry can't be parsed and this can lead to missing groups and breaks using the group in simple access provider. This patch changes the ASQ entry parser to do not return an error when it is not possible to parse an entry. The issue can be replicated deploying this AD setup: CN=users,DC=aforest,DC=ad CN=g1,CN=users,DC=aforest,DC=ad member: CN=g2,CN=users,DC=aforest,DC=ad member: CN=g3,CN=users,DC=aforest,DC=ad member: CN=g4,CN=users,DC=aforest,DC=ad member: CN=g5,CN=users,DC=aforest,DC=ad member: CN=user1,CN=users,DC=aforest,DC=ad CN=g2,CN=users,DC=aforest,DC=ad member: CN=g3,CN=users,DC=aforest,DC=ad member: CN=g4,CN=users,DC=aforest,DC=ad member: CN=g5,CN=users,DC=aforest,DC=ad member: CN=user2,CN=users,DC=aforest,DC=ad memberOf: CN=g1,CN=users,DC=aforest,DC=ad CN=g3,CN=users,DC=aforest,DC=ad <-- Deny access to sssd account member: CN=g4,CN=users,DC=aforest,DC=ad member: CN=g5,CN=users,DC=aforest,DC=ad member: CN=user3,CN=users,DC=aforest,DC=ad memberOf: CN=g2,CN=users,DC=aforest,DC=ad memberOf: CN=g1,CN=users,DC=aforest,DC=ad CN=g4,CN=users,DC=aforest,DC=ad member: CN=g5,CN=users,DC=aforest,DC=ad member: CN=user5,CN=users,DC=aforest,DC=ad memberOf: CN=g3,CN=users,DC=aforest,DC=ad memberOf: CN=g2,CN=users,DC=aforest,DC=ad memberOf: CN=g1,CN=users,DC=aforest,DC=ad CN=g5,CN=users,DC=aforest,DC=ad member: CN=user5,CN=users,DC=aforest,DC=ad memberOf: CN=g4,CN=users,DC=aforest,DC=ad memberOf: CN=g3,CN=users,DC=aforest,DC=ad memberOf: CN=g2,CN=users,DC=aforest,DC=ad memberOf: CN=g1,CN=users,DC=aforest,DC=ad CN=user1,CN=users,DC=aforest,DC=ad memberOf: CN=g1,CN=users,DC=aforest,DC=ad CN=user2,CN=users,DC=aforest,DC=ad memberOf: CN=g2,CN=users,DC=aforest,DC=ad CN=user3,CN=users,DC=aforest,DC=ad memberOf: CN=g3,CN=users,DC=aforest,DC=ad CN=user4,CN=users,DC=aforest,DC=ad memberOf: CN=g4,CN=users,DC=aforest,DC=ad CN=user5,CN=users,DC=aforest,DC=ad memberOf: CN=g5,CN=users,DC=aforest,DC=ad And using this sssd.conf ------------------------------------------------------------------------------- [sssd] config_file_version = 2 services = nss, pam domains = aforest.ad [nss] [pam] [domain/aforest.ad] auth_provider = ad id_provider = ad access_provider = simple simple_allow_groups = g1 ldap_deref_threshold = 1 debug_level = 10 ------------------------------------------------------------------------------- In this setup sssd can't resolve group 'g1' because it fails parsing one of the referenced members, 'g3': $> getent group g1 No output. $> id user5 uid=1862001108(user5) gid=1862000513(domain users) groups=1862000513(domain users),1862001111,1862001109(s-1-5-21-3230380732-2157500517-2047582823-1109),1862001113(g5),1862001110(s-1-5-21-3230380732-2157500517-2047582823-1110),1862001112(g4) When the group is used to filter access it does not work: ... [simple_access_check_send] (0x0200): [RID#7] Simple access check for user1(a)aforest.ad ... [simple_check_get_groups_send] (0x0400): [RID#7] Need to resolve 3 groups [sdap_get_generic_ext_step] (0x0400): [RID#8] calling ldap_search_ext with [(&(objectSID=S-1-5-21-3230380732-2157500517-2047582823-1109)(objectClass=group)(sAMAccountName=*))][DC=aforest,DC=ad]. ... [sdap_nested_group_hash_insert] (0x4000): [RID#8] Inserting [CN=g1,CN=Users,DC=aforest,DC=ad] into hash table [groups] [sdap_nested_group_process_send] (0x2000): [RID#8] About to process group [CN=g1,CN=Users,DC=aforest,DC=ad] ... [sdap_nested_group_process_send] (0x0400): [RID#8] More members were missing than the deref threshold [sdap_nested_group_process_send] (0x2000): [RID#8] Looking up 2/5 members of group [CN=g1,CN=Users,DC=aforest,DC=ad] [sdap_nested_group_process_send] (0x2000): [RID#8] Dereferencing members of group [CN=g1,CN=Users,DC=aforest,DC=ad] [sdap_deref_search_send] (0x2000): [RID#8] Server supports ASQ [sdap_asq_search_send] (0x0400): [RID#8] Dereferencing entry [CN=g1,CN=Users,DC=aforest,DC=ad] using ASQ ... [sdap_get_generic_ext_step] (0x0400): [RID#8] calling ldap_search_ext with [no filter][CN=g1,CN=Users,DC=aforest,DC=ad]. ... [sdap_process_message] (0x4000): [RID#8] Message type: [LDAP_RES_SEARCH_ENTRY] [sdap_asq_search_parse_entry] (0x0040): [RID#8] Unknown entry type, no objectClass found for DN [CN=g3,CN=Users,DC=aforest,DC=ad]! [sdap_get_generic_op_finished] (0x0020): [RID#8] reply parsing callback failed. [sdap_op_destructor] (0x1000): [RID#8] Abandoning operation 3 [generic_ext_search_handler] (0x0020): [RID#8] sdap_get_generic_ext_recv request failed: [22]: Invalid argument [sdap_deref_search_done] (0x0040): [RID#8] dereference processing failed [22]: Invalid argument [sdap_nested_group_deref_direct_done] (0x0020): [RID#8] Error processing direct membership [22]: Invalid argument [sdap_nested_done] (0x0020): [RID#8] Nested group processing failed: [22][Invalid argument] ... [simple_resolve_group_done] (0x0080): [RID#8] Cannot refresh data from DP: 3,0: Group lookup failed ... [simple_check_get_groups_next] (0x2000): [RID#9] All groups resolved. Done. [simple_access_check_done] (0x0040): [RID#9] Could not collect groups of user user1(a)aforest.ad [simple_access_check_done] (0x0400): [RID#9] But no deny groups were defined so we can continue. [simple_check_groups] (0x4000): [RID#9] Checking against allow list group name [g1(a)aforest.ad] [simple_access_check_done] (0x2000): [RID#9] Group check done [simple_access_check_recv] (0x1000): [RID#9] Access not granted ... Resolves: https://github.com/SSSD/sssd/issues/4893 Signed-off-by: Samuel Cabrero <scabrero(a)suse.de> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5881/head:pr5881 git checkout pr5881

5 23

[sssd PR#5674][opened] [WIP] This is just a test
by ikerexxe 16 Jan '22

16 Jan '22

URL: https://github.com/SSSD/sssd/pull/5674 Author: ikerexxe Title: #5674: [WIP] This is just a test Action: opened PR body: """ This is just a test for Deepak's latest PR, which fails in CI. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5674/head:pr5674 git checkout pr5674

2 4

[sssd PR#5937][opened] [WIP] Another attempt to resolve #5134
by alexey-tikhonov 13 Jan '22

13 Jan '22

URL: https://github.com/SSSD/sssd/pull/5937 Author: alexey-tikhonov Title: #5937: [WIP] Another attempt to resolve #5134 Action: opened PR body: """ There are two ideas: - get rid of re-alloc for every new member added: instead reserve space with a margin and shrink later. - don't add every new member to the list immediately: instead keep new members in a temporarily hash table. This will allow to avoid cross strcmp() at least among new members - hopefully, hash table should be much faster. 2nd patch actually makes 1st patch obsolete, but I will keep it a while to measure impact. This is "WIP" as I didn't conduct perf measurements yet. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5937/head:pr5937 git checkout pr5937

1 6

[sssd PR#5928][opened] IPA: Add password expire warning
by elkoniu 11 Jan '22

11 Jan '22

URL: https://github.com/SSSD/sssd/pull/5928 Author: elkoniu Title: #5928: IPA: Add password expire warning Action: opened PR body: """ When LDAP is used as an access provider it can be configured to show user password expiration warning. This commit enables similar behaviour for IPA access provider. Resolves: https://github.com/SSSD/sssd/issues/5080 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5928/head:pr5928 git checkout pr5928

4 8

[sssd PR#5908][opened] Check default debug level of sssd and corresponding logs
by sgoveas 11 Jan '22

11 Jan '22

URL: https://github.com/SSSD/sssd/pull/5908 Author: sgoveas Title: #5908: Check default debug level of sssd and corresponding logs Action: opened PR body: """ It consists of five test cases: 1. Check default debug level when sssd start successfully 2. Check default debug level by successful authentication of the user 3. Check default level as 0 and 1 4. Check default level as 2 5. Check SBUS code should not trigger failure message during modules startup Verifies: Issues: #5422 #5425 Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1893159 https://bugzilla.redhat.com/show_bug.cgi?id=1915319 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5908/head:pr5908 git checkout pr5908

3 22

[sssd PR#5929][opened] Tests: Add tests for poor man's backtrace
by sgoveas 11 Jan '22

11 Jan '22

URL: https://github.com/SSSD/sssd/pull/5929 Author: sgoveas Title: #5929: Tests: Add tests for poor man's backtrace Action: opened PR body: """ Tests are added to check that no duplicate backtrace is generated and it is generated when * no debug level is defined / default debug level * debug level is set to 0 or 1 * no backtrace when debug level is >= 9 * backtrace can be disabled Verifies: #5585 https://bugzilla.redhat.com/show_bug.cgi?id=1949149 https://bugzilla.redhat.com/show_bug.cgi?id=2021196 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5929/head:pr5929 git checkout pr5929

3 8

[sssd PR#5925][opened] TEST: Current value of ssh_hash_known_hosts causes error in the default configuration in FIPS mode
by dparmar18 10 Jan '22

10 Jan '22

URL: https://github.com/SSSD/sssd/pull/5925 Author: dparmar18 Title: #5925: TEST: Current value of ssh_hash_known_hosts causes error in the default configuration in FIPS mode Action: opened PR body: """ Explanation - In SSSD the default value for ssh_hash_known_hosts is set to true, It should be changed to false for consistency with the OpenSSH setting that does not hashes hostnames by default Verifies Issue: https://github.com/SSSD/sssd/issues/5848 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2014249 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5925/head:pr5925 git checkout pr5925

4 20

[sssd PR#5830][opened] Tests: Port the old ns_account_lock.sh script to pytest
by aborah-sudo 08 Jan '22

08 Jan '22

URL: https://github.com/SSSD/sssd/pull/5830 Author: aborah-sudo Title: #5830: Tests: Port the old ns_account_lock.sh script to pytest Action: opened PR body: """ Port the old ns_account_lock.sh script to pytest """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5830/head:pr5830 git checkout pr5830

3 9

[sssd PR#5930][opened] Tests: Health and Support Analyzer - Add request log parsing utility
by shridhargadekar 06 Jan '22

06 Jan '22

URL: https://github.com/SSSD/sssd/pull/5930 Author: shridhargadekar Title: #5930: Tests: Health and Support Analyzer - Add request log parsing utility Action: opened PR body: """ Tests for Health and Support Analyzer - Add request log parsing utility Verifies: #5712 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1294670 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5930/head:pr5930 git checkout pr5930

4 18

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel December 2021