URL: https://github.com/SSSD/sssd/pull/193 Author: lslebodn Title: #193: UTIL: Use max 15 characters for AD host UPN Action: opened
PR body: """ We do not want to use host principal with AD "host/name.domain.tld@DOMAIN.TLD" becasue it does not work. We need to use correct user principal for AD hosts. And we cannot rely all fallback "*$" becuase of other principals in keytab.
Resolves: https://pagure.io/SSSD/sssd/issue/3329 """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/193/head:pr193 git checkout pr193
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
lslebodn commented: """ retest this please """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-287043533
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
mzidek-rh commented: """ Hi, I have this on my "to test" list, but could you please add a comment to the code, why we use exactly 15. It is cleat from the ticket, but in the code the number is a magic number. So dispel that magic with some scroll... I mean comment. """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-290034951
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
Label: +Changes requested
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
lslebodn commented: """ Thank you for review after two weeks.
I was able to find in msdn documentation that `sAMAccountName` must be less than 20 characters and computers have to have '$' sign at the end; + that it should be derived from netbios name.
https://msdn.microsoft.com/en-us/library/ms677605(v=vs.85).aspx#sAMAccountNa... https://msdn.microsoft.com/en-us/library/cc245685.aspx https://msdn.microsoft.com/en-us/library/cc220838.aspx
I was not able to find anything about 15 characters (maybe it is a limitation of netbios name). But samba and adcli uses at most 15 characters for UPN.
@abbra I know you are very familiar with AD related documentation. Could you help us?
"""
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-290456967
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
sumit-bose commented: """ MSFT speaks about the size of NetBIOS names (16 characters, so 15 character plus the '$') e.g. in https://support.microsoft.com/en-us/help/163409/netbios-suffixes-16th-charac.... But since NetBIOS predates the usage by Microsoft there is also https://www.ietf.org/rfc/rfc1001.txt section 14.
There is a 20 character limit on sAMCcountName and the attribute is used in AD to store the NetBIOS name of a host as well because from the AD perspective hosts and users share various properties. But although user names can be up to 20 characters the NetBIOS names are limited to 16 (15 + $) because of the restrictions of the NetBIOS protocol. """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-290508874
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
abbra commented: """ I think the requirement for computer accounts comes from NT compatibility where it is based on NetBIOS spec. Note that samAccountName is not limited by 20 characters but recommended to be less than 20 characters. This is only for users and groups. For machine accounts the real limit is a NetBIOS name limit. Thus, 15+$. """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-290509971
URL: https://github.com/SSSD/sssd/pull/193 Author: lslebodn Title: #193: UTIL: Use max 15 characters for AD host UPN Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/193/head:pr193 git checkout pr193
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
lslebodn commented: """ Thank you very much for links. """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-290695949
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
Label: -Changes requested
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
lslebodn commented: """ And link to green CI results due to issues with test_enumeration.
http://sssd-ci.duckdns.org/logs/job/67/14/summary.html """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-290725836
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
mzidek-rh commented: """ A rather important nitpick :)
``` diff --git a/src/util/sss_krb5.c b/src/util/sss_krb5.c index 8dfb6af..a3f066e 100644 --- a/src/util/sss_krb5.c +++ b/src/util/sss_krb5.c @@ -57,7 +57,7 @@ sss_krb5_get_primary(TALLOC_CTX *mem_ctx, * NetBIOS names are limited to 16 (15 + $) * https://support.microsoft.com/en-us/help/163409/netbios-suffixes-16th-charac... */ - primary = talloc_asprintf(mem_ctx, ".15%s$", shortname); + primary = talloc_asprintf(mem_ctx, "%.15s$", shortname); talloc_free(shortname); return primary; }
```
"""
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-293578425
URL: https://github.com/SSSD/sssd/pull/193 Author: lslebodn Title: #193: UTIL: Use max 15 characters for AD host UPN Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/193/head:pr193 git checkout pr193
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
mzidek-rh commented: """ Everything works as expected. Just waiting for the CI to finish. """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-293582258
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
mzidek-rh commented: """ ACK.
CI (fail on rhel6 with enum tests is unrelated): http://sssd-ci.duckdns.org/logs/job/67/87/summary.html """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-293614926
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
Label: +Accepted
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
lslebodn commented: """ master: * c6f1bc32774a7cf2f8678499dfbced420be3a3a1
sssd-1-14: * fee7386e3af5e55eb3c66d8cf3533075b977a734
sssd-1-13: * 56ca9ad3d7ec7da2e82b51ffc55f6d1367d14f34
"""
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-293710988
URL: https://github.com/SSSD/sssd/pull/193 Author: lslebodn Title: #193: UTIL: Use max 15 characters for AD host UPN Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/193/head:pr193 git checkout pr193
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
Label: +Pushed
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
simo5 commented: """ Sorry to be Johhny come late, but I do not think you can simply truncate the hostname here.
This function is used to search a principal from the keytab that would work for Windows, I think at this point it would be best to enumrate the keys in the keytab and patternmatch on a single componenet principal that ends in a $ rather than trying to guess what key you might find in there, no? """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-293716783
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
lslebodn commented: """ And what would you do in case If I have 2 principals ending with "$"? """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-293721101
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
lslebodn commented: """ @simo BTW sssd still can fall back to any other UPN for AD. The only issue can be higher priority of ""host/%s" then "*$"
https://pagure.io/SSSD/sssd/blob/master/f/src/util/sss_krb5.c#_102 """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-293722071
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
simo5 commented: """ For AD name$ should be the first you try, if there are more then one try them in series one after the other, but it is highly unlikely you have more than one. Calling just the first one is also ok, as that's the noemral behavior when you have multiple keys in a keytab (unless you specify exactly what identity you want to kinit). """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-293896877
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
lslebodn commented: """
For AD name$ should be the first you try, if there are more then one try them in series one after the >other, but it is highly unlikely you have more than one. Calling just the first one is also ok, as that's the noemral behavior when you have multiple keys in a >keytab (unless you specify exactly what identity you want to kinit).
It is a little bit unrelated to this PR. adcli and samba created UPN with 15 characters for longer hostnames by default. And this PR is about improving the default state and not corner-cases. We can improve even corner cases but there is simple workaround: to set option `ldap_sasl_authid` to right UPN.
@simo5 Feel free to open a ticket or provide a patch :-) Thank you very much for your comments. """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-294750392
URL: https://github.com/SSSD/sssd/pull/193 Title: #193: UTIL: Use max 15 characters for AD host UPN
lslebodn commented: """
For AD name$ should be the first you try, if there are more then one try them in series one after the >other, but it is highly unlikely you have more than one. Calling just the first one is also ok, as that's the noemral behavior when you have multiple keys in a >keytab (unless you specify exactly what identity you want to kinit).
It is a little bit unrelated to this PR. adcli and samba created UPN with 15 characters for longer hostnames by default. And this PR is about improving the default state and not corner-cases. We can improve even corner cases but there is simple workaround: to set option `ldap_sasl_authid` to right UPN.
@simo5 Feel free to open a ticket or provide a patch :-) Thank you very much for your comments. """
See the full comment at https://github.com/SSSD/sssd/pull/193#issuecomment-294750392
sssd-devel@lists.fedorahosted.org