On Fri, 19 Jul 2013, Jakub Hrozek wrote:
On Fri, Jul 19, 2013 at 04:29:37PM +0300, Alexander Bokovoy wrote:
> Hi!
>
> Apparently, getgrouplist(3) call is not available in Python older than
> Python 3.3. So I agreed with Jakub to have it bound to pysss Python
> module. We need this call to obtain list of groups trusted domain user
> belongs to for HBAC testing in FreeIPA.
>
> Additionally, I've fixed bug with linking of pysss. This patch is
> relevant to 1.10 as well, while the first one is needed in sssd 1.11.
>
>
> --
> / Alexander Bokovoy
> Subject: [PATCH 1/2] build: fix dependencies for pysss module
Ack
> Subject: [PATCH 2/2] pysss: add pysss.getgrouplist(username)
I would just like to amend the doctext to make it clear that this is
just a system wrapper and not limited to users served by the sssd. See
the attached patch, I'd like to squash it before pushing.
From a4b19b4b0e5d1e9b088059fc77f01e07d2407ca0 Mon Sep 17 00:00:00
2001
From: Jakub Hrozek <jhrozek(a)redhat.com>
Date: Fri, 19 Jul 2013 16:52:11 +0200
Subject: [PATCH] Amend the doctext
---
src/python/pysss.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/python/pysss.c b/src/python/pysss.c
index a2924ff32575e1d41a776769720129b42de860da..6ae9a25268e632817311ff3cf0cb9354d99b5be3
100644
--- a/src/python/pysss.c
+++ b/src/python/pysss.c
@@ -751,6 +751,8 @@ fail:
*/
PyDoc_STRVAR(py_sss_getgrouplist__doc__,
"Get list of groups user belongs to.\n\n"
+ "NOTE: The interface uses the system NSS calls and is not limited to "
+ "users served by the SSSD!\n"
":param username: name of user to get list for\n");
static PyObject *py_sss_getgrouplist(PyObject *self, PyObject *args)
ACK.
However, when testing this all with new FreeIPA code, I've found
following issue: in ipa_server_mode = True I'm getting getgrgid(UPG) to
return NULL (and my code in pysss_getgrouplist crashes). UPG here is a user private
group.
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sbus_message_handler] (0x4000): Received
SBUS method [getAccountInfo]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [be_get_account_info] (0x0100): Got
request for [4098][1][idnumber=1442800500]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [ldb] (0x4000): Added timed event
"ltdb_callback": 0x7f0338945b80
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [ldb] (0x4000): Added timed event
"ltdb_timeout": 0x7f033897a450
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [ldb] (0x4000): Running timer event
0x7f0338945b80 "ltdb_callback"
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [ldb] (0x4000): Destroying timer event
0x7f033897a450 "ltdb_timeout"
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [ldb] (0x4000): Ending timer event
0x7f0338945b80 "ltdb_callback"
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_id_op_connect_step] (0x4000):
reusing cached connection
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_groups_next_base] (0x0400):
Searching for groups with base [cn=accounts,dc=lvee,dc=ipa]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_generic_ext_step] (0x0400):
calling ldap_search_ext with
[(&(gidNumber=1442800500)(objectclass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))][cn=accounts,dc=lvee,dc=ipa].
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [objectClass]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [cn]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [userPassword]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [gidNumber]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [member]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [nsUniqueId]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [ipaNTSecurityIdentifier]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [modifyTimestamp]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [entryUSN]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_generic_ext_step] (0x2000):
ldap_search_ext called, msgid = 35
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_process_result] (0x2000): Trace:
sh[0x7f033893bc20], connected[1], ops[0x7f0338979900], ldap[0x7f0338919400]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_process_message] (0x4000): Message
type: [LDAP_RES_SEARCH_RESULT]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_generic_ext_done] (0x0400):
Search result: Success(0), no errmsg set
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_get_groups_process] (0x0400): Search
for groups, returned 0 results.
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_id_op_done] (0x4000): releasing
operation connection
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [acctinfo_callback] (0x0100): Request
processed. Returned 0,0,Success
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_process_result] (0x2000): Trace:
sh[0x7f033893bc20], connected[1], ops[(nil)], ldap[0x7f0338919400]
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sdap_process_result] (0x2000): Trace:
ldap_result found nothing!
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sbus_dispatch] (0x4000): dbus conn:
7F0338931050
(Fri Jul 19 19:06:49 2013) [sssd[be[lvee.ipa]]] [sbus_dispatch] (0x4000): Dispatching.
Also this:
$ python
Python 2.7.5 (default, Jul 8 2013, 09:48:59)
[GCC 4.8.1 20130603 (Red Hat 4.8.1-1)] on linux2
Type "help", "copyright", "credits" or "license"
for more information.
>> import grp
>> grp.getgrname("1442800500")
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
AttributeError: 'module' object has no attribute 'getgrname'
>> grp.getgrnam("1442800500")
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
KeyError: 'getgrnam(): name not found: 1442800500'
>> grp.getgrnam("administrator(a)ad.lan")
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
KeyError: 'getgrnam(): name not found: administrator(a)ad.lan'
>> import pwd
>> pwd.getpwnam("1442800500")
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
KeyError: 'getpwnam(): name not found: 1442800500'
>> pwd.getpwnam("administrator(a)ad.lan")
pwd.struct_passwd(pw_name='administrator(a)ad.lan', pw_passwd='*',
pw_uid=1442800500, pw_gid=1442800500, pw_gecos='Administrator',
pw_dir='/', pw_shell='')
>>
--
/ Alexander Bokovoy