sssd performance on large domains
by zfnoctis@gmail.com
Hi,
I'm wondering if there are any plans to improve sssd performance on large active directory domains (100k+ users, 40k+ groups), or if there are settings I am not aware of that can greatly improve performance, specifically for workstation use cases.
Currently if I do not set "ignore_group_members = True" in sssd.conf, logins can take upwards of 6 minutes and "sssd_be" will max the CPU for up to 20 minutes after logon, which makes it a non-starter. The reason I want to allow group members to be seen is that I want certain domain groups to be able to perform elevated actions using polkit. If I ignore group members, polkit reports that the group is empty and so no one can elevate in the graphical environment.
Ultimately this means that Linux workstations are at a severe disadvantage since they cannot be bound to the domain and have the normal set of access features users and IT expect from macOS or Windows.
Distributions used: Ubuntu 16.04 (sssd 1.13.4-1ubuntu1.1), Ubuntu 16.10 (sssd 1.13.4-3) and Fedora 24 (sssd-1.13.4-3.fc24). All exhibit the same problems.
I've also tried "ldap_group_nesting_level = 1" without seeing any noticeable improvement with respect to performance. Putting the database on /tmp isn't viable as these are workstations that will reboot semi-frequently, and I don't believe this is an I/O bound performance issue anyways.
Thanks for your time.
1 year, 3 months
Enumerate users from external group from AD trust
by Bolke de Bruin
Hello,
I have sssd 1.13.00 working against FreeIPA 4.2 domain. This domain has a trust relationship with a active directory domain.
One of the systems we are using requires to enumerate all users in groups by (unfortunate) design (Apache Ranger). This is done by using
“getent group”. During this enumeration the full user list for a group that has a nested external member group* is not always returned so we thought to
add “getent group mygroup” in order to get more details. Unfortunately this does not seem to work consistently: sometimes this gives information sometimes it does not:
[root@master centos]# getent group ad_users
ad_users:*:1950000004:
[root@master centos]# id bolke(a)ad.local
UID=1796201107(bolke(a)ad.local) GID=1796201107(bolke(a)ad.local) groepen=1796201107(bolke(a)ad.local),1796200513(domain users@ad.local),1796201108(test(a)ad.local)
[root@master centos]# getent group ad_users
ad_users:*:1950000004:bolke@ad.local <mailto:bolke@ad.local>
If I clear the cache (sss_cache -E) the entry is gone again:
[root@master centos]# getent group ad_users
ad_users:*:1950000004:
My question is how do I get sssd to enumerate *all users* in a group consistently?
Thanks!
Bolke
* https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/trust-g...
3 years, 6 months
Does anyone use id_provider=local ?
by Jakub Hrozek
Hi,
are there any SSSD users who actively use a configuration with:
id_provider=local ?
If so, what is your use-case?
We're considering deprecating and eventually removing this provider
upstream. The replacemant for id_provider=local would be id_provider=files:
https://fedorahosted.org/sssd/wiki/DesignDocs/FilesProvider
which is already under review and later extension of the SSSD's D-Bus
interface to allow manipulating custom user attributes.
My current plan for deprecating the local provider is to only build the
provider and the tools around it if a configure-time flag is provided.
This flag would be disabled by default. Then, if noone complains,
eventually just remove the code.
5 years, 7 months
SSSD Packet Capture Samples
by Tom Peterson
Hi All,
First off thank you for all the hard work put into SSSD! It's been a great
piece of software to work with and seems like it has a configuration
setting for just about anything that can be thrown at it!
We use SSSD at work and I've helped troubleshoot a few instances of
authenticating against an external LDAP server. I setup a little lab to
collect captures of some different config settings. My initial set is
around different TLS scenarios:
https://support.cloudshark.org/kb/sssd-activedirectory-captures.html
All of the raw capture files can be downloaded after opening them by going
to 'Export -> Download File'.
I'll be adding to this and have a few more scenarios in mind I want to
explore. If anyone has any feedback or suggestions on things they would
like to see please let me know!I Hoping someone finds this little
contribution of captures useful.
And once again, thank you for all the work put into SSSD!
-Tom
5 years, 9 months
Announcing SSSD 1.15.3
by Jakub Hrozek
SSSD 1.15.3
===========
The SSSD team is proud to announce the release of version 1.15.3 of the
System Security Services Daemon.
The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback
--------
Please provide comments, bugs and other feedback via the sssd-devel or
sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Highlights
----------
New Features
^^^^^^^^^^^^
* In a setup where an IPA domain trusts an Active Directory domain,
it is now possible to define the domain resolution order
(see http://www.freeipa.org/page/Releases/4.5.0#AD_User_Short_Names).
Starting with this version, SSSD is able to read and honor the domain
resolution order, providing a way to resolve Active Directory users by
just their short name. SSSD also supports a new option
"domain_resolution_order" applicable in the "[sssd]" section
that allows to configure short names for AD users in setup with
"id_provider=ad" or in a setup with an older IPA server that doesn't
support the "ipa config-mod --domain-resolution-order"
configuration option. Also, it is now possible to use
"use_fully_qualified_names=False" in a subdomain configuration, but
please note that the user and group output from trusted domains will
always be qualified to avoid conflicts.
* Design page - Shortnames in trusted domains <https://docs.pagure.org/SSSD.sssd/design_pages/shortnames.html>
* SSSD ships with a new service called KCM. This service acts as a
storage for Kerberos tickets when "libkrb5" is configured to use
"KCM:" in "krb5.conf". Compared to other Kerberos credential
cache types, KCM is better suited for containerized environments and
because the credential caches are managed by a stateful daemon, in
future releases will also allow to renew tickets acquired outside SSSD
(e.g. with "kinit") or provide notifications about ticket changes.
This feature is optional and can be disabled by selecting
"--without-kcm" when configuring the SSSD build.
* Design page - KCM server for SSSD <https://docs.pagure.org/SSSD.sssd/design_pages/kcm.html>
* NOTE: There are several known issues in the "KCM" responder that
will be handled in the next release such as
issues with very large tickets <https://pagure.io/SSSD/sssd/issue/3386>
or tracking the SELinux label of the peer <https://pagure.io/SSSD/sssd/issue/3434>
or even one intermittent crash <https://pagure.io/SSSD/sssd/issue/3454>
There are also some differences between how SSSD's KCM server works compared to
Heimdal's KCM server such as visibility of ccaches by root
<https://pagure.io/SSSD/sssd/issue/3376>.
* Support for user and group resolution through the D-Bus interface and
authentication and/or authorization through the PAM interface even
for setups without UIDs or Windows SIDs present on the LDAP directory
side. This enhancement allows SSSD to be used together with apache
modules <https://github.com/adelton/mod_lookup_identity> to provide
identities for applications
* Design page - Support for non-POSIX users and groups <https://docs.pagure.org/SSSD.sssd/design_pages/non_posix_support.html>
* SSSD ships a new public library called "libsss_certmap" that allows
a flexible and configurable way of mapping a certificate to a user
identity. This is required e.g. in environments where it is not possible
to add the certificate to the LDAP user entry, because the certificates
are issued externally or the LDAP schema cannot be modified. Additionally,
specific matching rules allow a specific certificate on a smart card to
be selected for authentication.
* Design page - Matching and Mapping Certificates <https://docs.pagure.org/SSSD.sssd/design_pages/matching_and_mapping_certi...>
* The Kerberos locator plugin can be disabled using an environment variable
"SSSD_KRB5_LOCATOR_DISABLE". Please refer to the
"sssd_krb5_locator_plugin" manual page for mode details.
* The "sssctl" command line tool supports a new command "user-checks"
that enables the administrator to check whether a certain user should be
allowed or denied access to a certain PAM service.
* The "secrets" responder now forwards requests to a proxy Custodia
back end over a secure channel.
Notable bug fixes
^^^^^^^^^^^^^^^^^
* The IPA HBAC evaluator no longer relies on "originalMemberOf"
attributes to construct the list of groups the user is a member of.
Maintaining the "originalMemberOf" attribute was unreliable and
was causing intermittent HBAC issues.
* A bug where the cleanup operation might erroneously remove cached users
during their cache validation in case SSSD was set up with
"enumerate=True" was fixed.
* Several bugs related to configuration of trusted domains were fixed, in
particular handling of custom LDAP search bases set for trusted domains.
* Password changes for users from trusted Active Directory domains
were fixed
Packaging Changes
-----------------
* A new KCM responder was added along with a manpage. The upstream
reference specfile packages the responder in its own subpackage called
"sssd-kcm" and a krb5.conf snippet that enables the "KCM"
credentials cache simply by installing the subpackage
* The "libsss_certmap" library was packaged in a separate package. There
is also a "libsss_certmap-devel" subpackage in the upstream packaging.
Documentation Changes
---------------------
* "sssd-kcm" and "libsss_certmap" are documented in their own
manual pages.
* A new option "domain_resolution_order" was added. This option allows to
specify the lookup order (especially w.r.t. trusted domains) that sssd will
follow. Please see the Shortnames in trusted domains
<https://docs.pagure.org/SSSD.sssd/design_pages/shortnames.html> design page.
for mode details.
* New options "pam_app_services" and "domain_type" were added. These
options can be used to only limit certain PAM services to reach certain
SSSD domains that should only be exposed to non-OS applications. For
more details, refer to the Support for non-POSIX users and groups
<https://docs.pagure.org/SSSD.sssd/design_pages/non_posix_support.html>
design page.
* The "secrets" responder supports several new options related to TLS
setup and handling including "verify_peer", "verify_host",
"capath", "cacert" and "cert". These options are all described
in the "sssd-secrets" manual page.
Tickets Fixed
-------------
* https://pagure.io/SSSD/sssd/issue/#3424 - calling nspr_nss_setup/cleanup repeatedly in sss_encrypt SIGABRTs NSS eventually
* https://pagure.io/SSSD/sssd/issue/#3452 - ad_account_can_shortcut: allow shortcut for unhandled IDs
* https://pagure.io/SSSD/sssd/issue/#3447 - files provider should not use LOCAL_pam_handler but call the backend
* https://pagure.io/SSSD/sssd/issue/#3435 - Create a function to copy search bases between sdap_domain structures
* https://pagure.io/SSSD/sssd/issue/#3431 - Loading enterprise principals doesn't work with a primed cache
* https://pagure.io/SSSD/sssd/issue/#3426 - IPA client cannot change AD Trusted User password
* https://pagure.io/SSSD/sssd/issue/#3418 - Segfault in access_provider = krb5 is set in sssd.conf due to an off-by-one error when constructing the child send buffer
* https://pagure.io/SSSD/sssd/issue/#3410 - python-sssdconfig doesn't parse hexadecimal debug_level, resulting in set_option(): /usr/lib/python2.7/site-packages/SSSDConfig/__init__.py killed by TypeError
* https://pagure.io/SSSD/sssd/issue/#3408 - Accept changed principal if krb5_canonicalize=True
* https://pagure.io/SSSD/sssd/issue/#3404 - man: Update option "ipa_server_mode=True" in "man sssd-ipa"
* https://pagure.io/SSSD/sssd/issue/#3403 - SSSD doesn't handle conflicts between users from trusted domains with the same name when shortname user resolution is enabled
* https://pagure.io/SSSD/sssd/issue/#3398 - MAN: The timeout option doesn't say after how many heartbeats will the process be killed
* https://pagure.io/SSSD/sssd/issue/#3397 - ad provider: Child domains always use autodiscovered search bases
* https://pagure.io/SSSD/sssd/issue/#3393 - sss_nss_getlistbycert() does not return results from multiple domains
* https://pagure.io/SSSD/sssd/issue/#3391 - sss_override doesn't work with files provider
* https://pagure.io/SSSD/sssd/issue/#3389 - subdomain_homedir is not present in cfg_rules.ini
* https://pagure.io/SSSD/sssd/issue/#3378 - domain_to_basedn() function should use SDAP_SEARCH_BASE value from the domain code
* https://pagure.io/SSSD/sssd/issue/#3377 - sssd-ad man page should clarify that GSSAPI is used
* https://pagure.io/SSSD/sssd/issue/#3375 - minor typo fix that might have big impact
* https://pagure.io/SSSD/sssd/issue/#3361 - sssd_be crashes if ad_enabled_domains is selected
* https://pagure.io/SSSD/sssd/issue/#3359 - Allow to disable krb5 locator plugin selectively
* https://pagure.io/SSSD/sssd/issue/#3358 - [abrt] [faf] sssd: vfprintf(): /usr/libexec/sssd/sssd_be killed by 11
* https://pagure.io/SSSD/sssd/issue/#3354 - ifp: Users.FindByCertificate fails when certificate contains data before encapsilation boundary
* https://pagure.io/SSSD/sssd/issue/#3344 - Include sssd-secrets in SEE ALSO section of sssd.conf man page
* https://pagure.io/SSSD/sssd/issue/#3343 - Properly fall back to local Smartcard authentication
* https://pagure.io/SSSD/sssd/issue/#3340 - The option enable_files_domain does not work if sssd is not compiled with --enable-files-domain
* https://pagure.io/SSSD/sssd/issue/#3339 - sssd failed to start with missing /etc/sssd/sssd.conf if compiled without --enable-files-domain
* https://pagure.io/SSSD/sssd/issue/#3332 - Issue processing ssh keys from certificates in ssh respoder
* https://pagure.io/SSSD/sssd/issue/#3448 - Idle nss file descriptors should be closed
* https://pagure.io/SSSD/sssd/issue/#3428 - getent failed to fetch netgroup information after changing default_domain_suffix to ADdomin in /etc/sssd/sssd.conf
* https://pagure.io/SSSD/sssd/issue/#3356 - Config file validator doesn't process entries from application domain
* https://pagure.io/SSSD/sssd/issue/#3331 - Wrong pam return code for user from subdomain with
* https://pagure.io/SSSD/sssd/issue/#3329 - Wrong principal found with ad provider and long host name
* https://pagure.io/SSSD/sssd/issue/#3421 - Wrong search base used when SSSD is directly connected to AD child domain
* https://pagure.io/SSSD/sssd/issue/#3406 - sssd goes offline when renewing expired ticket
* https://pagure.io/SSSD/sssd/issue/#3394 - LDAP to IPA migration doesn't work in master
* https://pagure.io/SSSD/sssd/issue/#3392 - org.freedesktop.sssd.infopipe.GetUserGroups does not resolve groups into names with AD
* https://pagure.io/SSSD/sssd/issue/#3382 - SSSD should use memberOf, not originalMemberOf to evaluate group membership for HBAC rules
* https://pagure.io/SSSD/sssd/issue/#3381 - Per-subdomain LDAP filter is not applied for subsequent subdomains
* https://pagure.io/SSSD/sssd/issue/#3373 - Infopipe method ListByCertificate does not return the users with overrides
* https://pagure.io/SSSD/sssd/issue/#3372 - crash in sssd-kcm due to a race-condition between two concurrent requests
* https://pagure.io/SSSD/sssd/issue/#3369 - ldap_purge_cache_timeout in RHEL7.3 invalidate most of the entries once the cleanup task kicks in
* https://pagure.io/SSSD/sssd/issue/#3362 - fiter_users and filter_groups stop working properly in v 1.15
* https://pagure.io/SSSD/sssd/issue/#3351 - User lookup failure due to search-base handling
* https://pagure.io/SSSD/sssd/issue/#3347 - gpo_child fails when log is enabled in smb
* https://pagure.io/SSSD/sssd/issue/#3318 - SSSD in server mode iterates over all domains for group-by-GID requests, causing unnecessary searches
* https://pagure.io/SSSD/sssd/issue/#3310 - Support delivering non-POSIX users and groups through the IFP and PAM interfaces
* https://pagure.io/SSSD/sssd/issue/#3050 - [RFE] Use one smartcard and certificate for authentication to distinct logon accounts
* https://pagure.io/SSSD/sssd/issue/#3001 - [RFE] Short name input format with SSSD for users from all domains when domain autodiscovery is used or when SSSD acts as an IPA client for server with IPA-AD trusts
* https://pagure.io/SSSD/sssd/issue/#2887 - [RFE] KCM ccache daemon in SSSD
* https://pagure.io/SSSD/sssd/issue/#3419 - krb5: properly handle 'password expired' information retured by the KDC during PKINIT/Smartcard authentication
* https://pagure.io/SSSD/sssd/issue/#3407 - IPA: do not lookup IPA users via extdom plugin
* https://pagure.io/SSSD/sssd/issue/#3405 - Handle certmap errors gracefully during user lookups
* https://pagure.io/SSSD/sssd/issue/#3395 - Properly support IPA's promptusername config option
* https://pagure.io/SSSD/sssd/issue/#3387 - Dbus activate InfoPipe does not answer some initial request
* https://pagure.io/SSSD/sssd/issue/#3385 - Smart card login fails if same cert mapped to IdM user and AD user
* https://pagure.io/SSSD/sssd/issue/#3355 - application domain requires inherit_from and cannot be used separately
* https://pagure.io/SSSD/sssd/issue/#3327 - expect sss_ssh_authorizedkeys and sss_ssh_knownhostsproxy manuals to be packaged into sssd-common package
* https://pagure.io/SSSD/sssd/issue/#3297 - selinux_provider fails in a container if libsemanage is not available
* https://pagure.io/SSSD/sssd/issue/#3268 - D-Bus GetUserGroups method of sssd is always qualifying all group names
* https://pagure.io/SSSD/sssd/issue/#3240 - Smartcard authentication with UPN as logon name might fail
* https://pagure.io/SSSD/sssd/issue/#3210 - [RFE] Read prioritized list of trusted domains for unqualified ID resolution from IDM server
* https://pagure.io/SSSD/sssd/issue/#3192 - [sssd-secrets] https proxy talks plain http
* https://pagure.io/SSSD/sssd/issue/#3182 - sssd does not refresh expired cache entries with enumerate=true
* https://pagure.io/SSSD/sssd/issue/#3065 - sssctl: distinguish between autodiscovered and joined domains
* https://pagure.io/SSSD/sssd/issue/#2940 - The member link is not removed when the last group's nested member goes away
* https://pagure.io/SSSD/sssd/issue/#2714 - Add SSSD domain as property to user on D-Bus
* https://pagure.io/SSSD/sssd/issue/#1498 - sss_ssh_knownhostsproxy prevents connection if the network is unreachable via one IP address
* https://pagure.io/SSSD/sssd/issue/#3330 - sssctl config-check does not give any error when default configuration file is not present
* https://pagure.io/SSSD/sssd/issue/#3292 - RFE: Create troubleshooting tool to check authentication, authorization and extended attribute lookup
* https://pagure.io/SSSD/sssd/issue/#3133 - RFE to add option of check user access in SSSD
Detailed Changelog
------------------
* AmitKumar (2):
* MAN: The timeout option doesn't say after how many heartbeats will the process be killed
* MAN: Updating option ipa_server_mode in man sssd-ipa
* David Kupka (1):
* libsss_certmap: Accept certificate with data before header
* Fabiano Fidêncio (40):
* CACHE_REQ: Descend into subdomains on lookups
* NSS/TESTS: Improve setup/teardown for subdomains tests
* NSS/TESTS: Include searches for non-fqnames members of a subdomain
* SYSDB: Add methods to deal with the domain's resolution order
* SYSDB/TESTS: Add tests for the domain's resolution order methods
* IPA: Get ipaDomainsResolutionOrder from ipaConfig
* IPA_SUBDOMAINS: Rename _refresh_view() to _refresh_view_name()
* IPA: Get ipaDomainsResolutionOrder from IPA ID View
* DLINKLIST: Add DLIST_FOR_EACH_SAFE macro
* CACHE_REQ: Make use of domainResolutionOrder
* UTIL: Expose replace_char() as sss_replace_char()
* Add domain_resolution_order config option
* RESPONDER: Fallback to global domain resolution order in case the view doesn't have this option set
* NSS/TESTS: Improve non-fqnames tests
* CACHE_REQ: Allow configurationless shortname lookups
* CACHE_REQ_DOMAIN: Add some comments to cache_req_domain_new_list_from_string_list()
* RESPONDER_COMMON: Improve domaiN_resolution_order debug messages
* CACHE_REQ_DOMAIN: debug the set domain resolution order
* NSS: Fix typo inigroups -> initgroups
* LDAP: Remove duplicated debug message
* CONTRIB: Force single-thread install to workaround concurrency issues
* LDAP/AD: Do not fail in case rfc2307bis_nested_groups_recv() returns ENOENT
* CACHE_REQ: Add a new cache_req_ncache_filter_fn() plugin function
* CACHE_REQ_RESULT: Introduce cache_req_create_ldb_result_from_msg_list()
* CACHE_REQ: Make use of cache_req_ncache_filter_fn()
* CACHE_REQ: Avoid using of uninitialized value
* CACHE_REQ: Ensure the domains are updated for "filter" related calls
* CACHE_REQ: Simplify _search_ncache_filter()
* CACHE_REQ_SEARCH: Check for filtered users/groups also on cache_req_send()
* INTG_TESTS: Add one more test for filtered out users/groups
* SYSDB: Return ERR_NO_TS when there's no timestamp cache present
* SYSDB: Internally expose sysdb_search_ts_matches()
* SYSDB: Make the usage of the filter more generic for search_ts_matches()
* SYSDB_OPS: Mark an entry as expired also in the timestamp cache
* SYSDB_OPS: Invalidate a cache entry also in the ts_cache
* SYSDB: Introduce _search_{users,groups}_by_timestamp()
* LDAP_ID_CLEANUP: Use sysdb_search_*_by_timestamp()
* RESPONDER: Use fqnames as output when needed
* DOMAIN: Add sss_domain_info_{get,set}_output_fqnames()
* INTG/FILES_PROVIDER: Test user and group override
* Jakub Hrozek (70):
* Updating the version for the 1.15.3 release
* UTIL: iobuf: Make input parameter for the readonly operation const
* UTIL: Fix a typo in the tcurl test tool
* UTIL: Add SAFEALIGN_COPY_UINT8_CHECK
* UTIL: Add utility macro cli_creds_get_gid()
* UTIL: Add type-specific getsetters to sss_iobuf
* UTIL: krb5 principal (un)marshalling
* KCM: Initial responder build and packaging
* KCM: request parsing and sending a reply
* KCM: Implement an internal ccache storage and retrieval API
* KCM: Add a in-memory credential storage
* KCM: Implement KCM server operations
* MAN: Add a manual page for sssd-kcm
* TESTS: Add integration tests for the KCM responder
* SECRETS: Create DB path before the operation itself
* SECRETS: Return a nicer error message on request with no PUT data
* SECRETS: Store ccaches in secrets for the KCM responder
* TCURL: Support HTTP POST for creating containers
* KCM: Store ccaches in secrets
* KCM: Make the secrets ccache back end configurable, make secrets the default
* KCM: Queue requests by the same UID
* KCM: Idle-terminate the responder if the secrets back end is used
* CONFDB: Introduce SSSD domain type to distinguish POSIX and application domains
* CONFDB: Allow configuring [application] sections as non-POSIX domains
* CACHE_REQ: Domain type selection in cache_req
* IFP: Search both POSIX and non-POSIX domains
* IFP: ListByName: Don't crash when no results are found
* PAM: Remove unneeded memory context
* PAM: Add application services
* SYSDB: Allow storing non-POSIX users
* SYSDB: Only generate new UID in local domain
* LDAP: save non-POSIX users in application domains
* LDAP: Relax search filters in application domains
* KRB5: Authenticate users in a non-POSIX domain using a MEMORY ccache
* KCM: Fix off-by-one error in secrets key parsing
* Move sized_output_name() and sized_domain_name() into responder common code
* IFP: Use sized_domain_name to format the groups the user is a member of
* IPA: Improve DEBUG message if a group has no ipaNTSecurityIdentifier
* LDAP: Allow passing a NULL map to sdap_search_bases_ex_send
* IPA: Use search bases instead of domain_to_basedn when fetching external groups
* CONFDB: Fix standalone application domains
* AD: Make ad_account_can_shortcut() reusable by SSSD on an IPA server
* KRB5: Advise the user to inspect the krb5_child.log if the child doesn't return a valid response
* KCM: Fix the per-client serialization queue
* TESTS: Add a test for parallel execution of klist
* IPA: Avoid using uninitialized ret value when skipping entries from the joined domain
* IPA: Return from function after marking a request as finished
* HBAC: Do not rely on originalMemberOf, use the sysdb memberof links instead
* test_kcm: Remove commented code
* TESTS: Fix pep8 errors in test_kcm.py
* TESTS: Fix pep8 errors in test_secrets.py
* TESTS: Fix pep8 errors in test_ts_cache.py
* RESP: Provide a reusable request to fully resolve incomplete groups
* IFP: Only format the output name to the short version before output
* IFP: Resolve group names from GIDs if required
* KRB5: Fix access_provider=krb5
* IFP: Fix error handling in ifp_user_get_attr_handle_reply()
* IPA: Enable enterprise principals even if there are no changes to subdomains
* README: Add a hint on how to submit bugs
* README: Add social network links
* Fix fedorahosted links in BUILD.txt
* README.md: Point to our releases on pagure
* RESPONDERS: Fix terminating idle connections
* TESTS: Integration test for idle timeout
* MAN: Document that client_idle_timeout can't be shorter than 10 seconds
* CRYPTO: Do not call NSS_Shutdown after every operation
* KRB5: Return invalid credentials internally when attempting to renew an expired TGT
* KCM: Fix Description of sssd-kcm.socket
* Remove the locale tag from zanata.xml
* Updating translations for the 1.15.3 release
* Justin Stephenson (9):
* IPA: Add s2n request to string function
* IPA: Enhance debug logging for ipa s2n operations
* IPA: Improve s2n debug message for missing ipaNTSecurityIdentifier
* MAN: AD Provider GSSAPI clarification
* DP: Reduce Data Provider log level noise
* CONFIG: Add subdomain_homedir to config locations
* SSSCTL: Add parent or trusted domain type
* LDAP: Fix nesting level comparison
* TESTS: Update zero nesting level test
* Lukas Slebodnik (57):
* MAN: Mention sssd-secrets in "SEE ALSO" section
* CONFIGURE: Fix fallback if pkg-config for uuid is missing
* intg: fix configure failure with strict cflags
* intg: Remove bashism from intgcheck-prepare
* BUILD: Fix compilation of libsss_certmap with libcrypto
* CONFDB: Fix handling of enable_files_domain
* UTIL: Use max 15 characters for AD host UPN
* SPEC: Drop conditional build for krb5_local_auth_plugin
* README: Update links to mailing lists
* SECRETS: remove unused variable
* cache_req: Avoid bool in switch/case
* SPEC: Update processing of translation in %install
* SPEC: Move systemd service sssd-ifp.service to right package
* SPEC: Add missing scriptlets for package sssd-dbus
* SPEC: Use correct package for translated sssd-ifp man page
* SPEC: Move man page for sss_rpcidmapd to the right package
* SPEC: Use correct package for translated sss_ssh* man pages
* SPEC: Use correct package for translated sssctl man pages
* SPEC: Use correct package for translated idmap_sss man pages
* SPEC: Use correct package for translated sss_certmap man pages
* SPEC: Use correct package for translated sssd-kcm man pages
* SPEC: Move files provider files within package
* SPEC: Move kcm scriptlets to systemd section
* SPEC: Call ldconfig in libsss_certmap scriptlets
* SPEC: Use macro python_provide conditionally
* SPEC: Use %license macro
* KCM: include missing header file
* test_ldap.py: Add test for filter_{users,groups}
* CONFDB: Use default configuration with missing sssd.conf
* UTIL: Drop unused error code ERR_MISSING_CONF
* INTG: Do not use configure time option enable-files-domain
* BUILD: Link libwbclient with libdl
* BUILD: Fix build without ssh
* SSSDConfig: Handle integer parsing more leniently
* SSSDConfig: Fix saving of debug_level
* SECRETS: Fix warning Wpointer-bool-conversion
* BUILD: Improve error messages for optional dependencies
* VALIDATOR: prevent duplicite report from subdomain sections
* test_config_check: Fix few issues
* pam_sss: Fix checking of empty string cert_user
* codegen: Remove util.h from generated files
* UTIL: Remove few unused headed files
* UTIL: Remove signal.h from util/util.h
* UTIL: Remove signal.h from util/util.h
* UTIL: Remove fcntl.h from util/util.h
* Remove string{,s}.h
* UTIL: Remove ctype.h from util/util.h
* UTIL: Remove limits.h from util/util.h
* Remove unnecessary sys/param.h
* certmap: Remove unnecessary included files
* cache_req: Do not use default_domain_suffix with netgroups
* pam_sss: Fix leaking of memory in case of failures
* CI: Do not use valgrind for dummy-child
* Revert "CI: Use /bin/sh as a CONFIG SHELL"
* Revert "LDAP: Fix nesting level comparison"
* KCM: temporary increase hardcoded buffers
* KCM: Modify krb5 snippet file kcm_default_ccache
* Michal Židek (20):
* UTIL: Typo in comment
* UTIL: Introduce subdomain_create_conf_path()
* SUBDOMAINS: Allow use_fully_qualified_names for subdomains
* selinux: Do not fail if SELinux is not managed
* config-check: Message when sssd.conf is missing
* SDAP: Fix handling of search bases
* SERVER_MODE: Update sdap lists for each ad_ctx
* AD: Add debug messages
* AD SUBDOMAINS: Fix search bases for child domains
* VALIDATORS: Add subdomain section
* VALIDATORS: Remove application section domain
* VALIDATORS: Escape special regex chars
* TESTS: Add unit tests for cfg validation
* MAN: Fix typo in trusted domain section
* VALIDATORS: Change regex for app domains
* VALIDATORS: Detect inherit_from in normal domain
* TESTS: Add one config-check test case
* GPO: Fix typo in DEBUG message
* SDAP: Update parent sdap_list
* SDAP: Add sdap_domain_copy_search_bases
* Nikolai Kondrashov (1):
* NSS: Move output name formatting to utils
* Pavel Březina (22):
* NSS/TESTS: Fix subdomains attribution
* tcurl: add support for ssl and raw output
* tcurl test: refactor so new options can be added more easily
* tcurl test: add support for raw output
* tcurl test: add support for tls settings
* tcurl: add support for http basic auth
* tcurl test: allow to set custom headers
* tcurl test: add support for client certificate
* ci: do not build secrets on rhel6
* build: make curl required by secrets
* secrets: use tcurl in proxy provider
* secrets: remove http-parser code in proxy provider
* secrets: allow to configure certificate check
* secrets: support HTTP basic authentication with proxy provider
* secrets: fix debug message
* secrets: always add Content-Length header
* sss_iobuf: fix 'read' shadows a global declaration
* configure: fix typo
* responders: do not leak selinux context on clients destruction
* ipa_s2n_get_acct_info_send: provide correct req_input name
* DP: Fix typo
* IFP: Add domain and domainname attributes to the user
* René Genz (2):
* minor typo fixes
* Use correct spelling of override
* Simo Sorce (3):
* ssh tools: The ai structure is not an array,
* ssh tools: Fix issues with multiple IP addresses
* ssh tools: Split connect and communication phases
* Sumit Bose (53):
* split_on_separator: move to a separate file
* util: move string_in_list to util_ext
* certmap: add new library libsss_certmap
* certmap: add placeholder for OpenSSL implementation
* sysdb: add sysdb_attrs_copy()
* sdap_get_users_send(): new argument mapped_attrs
* LDAP: always store the certificate from the request
* sss_cert_derb64_to_ldap_filter: add sss_certmap support
* sysdb: add certmap related calls
* IPA: add certmap support
* nss-idmap: add sss_nss_getlistbycert()
* nss: allow larger buffer for certificate based requests
* ssh: handle binary keys correctly
* ssh: add support for certificates from non-default views
* krb5: return to responder that pkinit is not available
* IPA: add mapped attributes to user from trusted domains
* IPA: lookup AD users by certificates on IPA clients
* IPA: enable AD user lookup by certificate
* pam_test_client: add service and environment to PAM test client
* pam_test_client: add SSSD getpwnam lookup
* sss_sifp: update method names
* pam_test_client: add InfoPipe user lookup
* sssctl: integrate pam_test_client into sssctl
* i18n: adding sssctl files
* KRB5_LOCATOR: add env variable to disable plugin
* sbus: check connection for NULL before unregister it
* utils: add sss_domain_is_forest_root()
* ad: handle forest root not listed in ad_enabled_domains
* overrides: add certificates to mapped attribute
* PAM: check matching certificates from all domains
* sss_nss_getlistbycert: return results from multiple domains
* cache_req: use the right negative cache for initgroups by upn
* test: make sure p11_child is build for pam-srv-tests
* pam: properly support UPN logon names
* ipa: filter IPA users from extdom lookups by certificate
* krb5: accept changed principal if krb5_canonicalize=True
* ldap: handle certmap errors gracefully
* RESPONDER_COMMON: update certmaps in responders
* tests: fix test_pam_preauth_cert_no_logon_name()
* pam_sss: add support for SSS_PAM_CERT_INFO_WITH_HINT
* add_pam_cert_response: add support for SSS_PAM_CERT_INFO_WITH_HINT
* PAM: send user name hint response when needed
* sysdb: sysdb_get_certmap() allow empty certmap
* sssctl: show user name used for authentication in user-checks
* IPA: Fix the PAM error code that auth code expects to start migration
* krb5: disable enterprise principals during password changes
* krb5: use plain principal if password is expired
* tests: update expired certificate
* files: refresh override attributes after re-read
* responders: update domain even for local and files provider
* PAM: make sure the files provider uses the right auth provider
* idmap_error_string: add missing descriptions
* ad_account_can_shortcut: shortcut if ID is unknown
* Ville Skyttä (1):
* SSSDConfig: Python 3.6 invalid escape sequence deprecation fix
5 years, 10 months
Samba NT_STATUS_WRONG_PASSWORD when using IP Address
by Marc-Henri Pamiseux
Hi sssd user's,
I contacted yesterday the Samba discussion list about a malfunction with
this software. I was asked to put my question to the sssd list, which I
do :)
You will find below the email sent to the Samba list:
**************************************************************************
I've update a domain member smb server to samba 4.6.5.
I don't want to use winbind for this upgrade so i'm trying with sssd.
After a long informative reading on this subject, i've finaly success to
connect using the hostname.
The domain member is well join to AD-DC :
# net ads testjoin
Join is OK
Another test :
# adcli info -D local.mydomain
[domain]
domain-name = local.mydomain
domain-short = MYDOMAIN
domain-forest = local.mydomain
domain-controller = hera.local.mydomain
domain-controller-site = Laval
domain-controller-flags = pdc gc ldap ds kdc timeserv closest writable
good-timeserv full-secret
domain-controller-usable = yes
domain-controllers = hera.local.mydomain
[computer]
computer-site = Laval
From the Domain member server (RHEA), i can view the main sharing using
my account but not when using the administrator account. By the way, i
belive i made some limitation on this account because nobody have to use
this one
# smbclient -L //RHEA -U myident
Enter MYDOMAIN\myident's password:
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba 4.6.5-Debian)
projets Disk Gestion des projets
public Disk Public Stuff
myident Disk Repertoire Personnel
Domain=[MYDOMAIN] OS=[] Server=[]
Server Comment
--------- -------
RHEA Samba 4.6.5-Debian
Workgroup Master
--------- -------
MYDOMAIN RHEA
From the AD-DC server (HERA), i can see the same thing using my account.
Stil on the AD-DC, i've try another method :
# smbclient -L //192.168.1.2 -U myident
Enter MYDOMAIN\myident's password:
Domain=[MYDOMAIN] OS=[] Server=[]
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba 4.6.5-Debian)
projets Disk Gestion des projets
public Disk Public Stuff
myident Disk Repertoire Personnel
Domain=[MYDOMAIN] OS=[] Server=[]
Server Comment
--------- -------
RHEA Samba 4.6.5-Debian
Workgroup Master
--------- -------
MYDOMAIN RHEA
Well...
Everything seems to work.
Now i want to test an access from a windows client. I have open the
session on the domain using my account. Now i open windows explorer and
i type //RHEA in the address bar. I can see the share that i can use.
So, why do i post on this mailing list ?
Because when I use address //192.168.1.2, the operating system asks me
to identify myself. But i'have already done this when i've open this
session. I am surprised because it is usually the opposite error that
occurs. Let's go to the log on RHEA Host (192.168.1.2) :
[2017/07/25 02:46:15.286177, 0]
../source3/auth/auth_domain.c:226(domain_client_validate)
domain_client_validate: unable to validate password for user myident
in domain MYDOMAIN to Domain controller HERA.LOCAL.MYDOMAIN. Error was
NT_STATUS_WRONG_PASSWORD.
[2017/07/25 02:46:15.288928, 2]
../source3/auth/auth.c:315(auth_check_ntlm_password)
check_ntlm_password: Authentication for user [myident] -> [myident]
FAILED with error NT_STATUS_WRONG_PASSWORD
[2017/07/25 02:46:15.296364, 2]
../auth/gensec/spnego.c:768(gensec_spnego_server_negTokenTarg)
SPNEGO login failed: NT_STATUS_WRONG_PASSWORD
Ok, but this error occurred even before I specified an identifier.
I removed the Windows-based workstation from the domain and then, i join
it again. In this regard, i have noticed that a computer can not join a
Windows Active Directory domain if the Netbios over TCP / IP option is
not enabled. Too bad !
RSAT is installed on this computer and i still can login and maintain
Active Directory and DNS zone from this computer. But now, i cannot see
RHEA share anymore. I've got the same error even if i use IP or hostname.
sssd seems to work fine because the command getent passwd give me a result :
# getent passwd myident
myident:*:1072:513:Marc-Henri Pamiseux:/home/MYDOMAIN/myident:/bin/bash
Does someone can help me to investigate ?
**************************************************************************
Thanks in advance.
--
Marc-Henri Pamiseux - SARL Libricks - www.libricks.fr
6 rue Léonard de Vinci - CS 20119, 53001 LAVAL Cedex
Tel. : 02.30.96.15.24 / Mobile : 06.26.71.30.97
5 years, 10 months
Autofs Entries Caching
by Douglas Duckworth
Hi
We have autofs working great with sssd thanks to support of this listserv.
Though during testing we noticed that only home directories, for users who
had previously logged into a given server, were cached by the sssd client.
Can sssd cache autofs for all users in our directory even if they haven't
recently logged into a server?
Here's our current config for autofs portion:
autofs_provider = ldap
ldap_autofs_search_base = ou=autofs.maps,cn=server,ou=machines,dc=blah
ldap_autofs_map_master_name = autofs.maps
ldap_autofs_map_object_class = automountMap
ldap_autofs_entry_object_class = automount
ldap_autofs_map_name = ou
ldap_autofs_entry_key = cn
ldap_autofs_entry_value = automountInformation
ldap_deref = always
Thanks
Doug
Thanks,
Douglas Duckworth, MSc, LFCS
HPC System Administrator
Scientific Computing Unit
Physiology and Biophysics
Weill Cornell Medicine
E: doug(a)med.cornell.edu
O: 212-746-6305
F: 212-746-8690
5 years, 10 months
Re: kerberos ticket not renewed in 15.2/master
by Lukas Slebodnik
On (22/05/17 06:51), Joakim Tjernlund wrote:
>On Fri, 2017-05-19 at 16:59 +0200, Lukas Slebodnik wrote:
>> On (19/05/17 14:41), Joakim Tjernlund wrote:
>> > On Fri, 2017-05-19 at 16:34 +0200, Lukas Slebodnik wrote:
>> > > On (19/05/17 14:07), Joakim Tjernlund wrote:
>> > > > Will do over the week end
>> > > >
>> > > > >
>> > > > > Please also provide an output of following command
>> > > > > rpm -V sssd-common sssd-krb5-common
>> > > >
>> > > > That is a bit hard as this is Gentoo :)
>> > >
>> > > Ahh sorry;
>> > >
>> > > I cannot see 1.15.2 in portage.
>> > > Which arguments did you pass to configure?
>> >
>> > Sending the ebuilds I use, made by myself as upstream is lagging behind.
>> >
>>
>> Logging to journald is not enabled enabled. So I do not think
>> you fwill find anything in journald :-)
>>
>> sssd is not compiled with non-privileged user therefore
>> it should not cause problems.
>>
>> We will not be able to move it forward without
>> *child log files.
>>
>> LS
>
>Hi again
>
>Got some *child logs now. Can you make something of these?
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [main] (0x0400): ldap_child started.
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [main] (0x2000): context initialized
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [unpack_buffer] (0x1000): total buffer size: 49
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [unpack_buffer] (0x1000): realm_str size: 12
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [unpack_buffer] (0x1000): got realm_str: INFINERA.COM
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [unpack_buffer] (0x1000): princ_str size: 13
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [unpack_buffer] (0x1000): got princ_str: GENTOO-LABBB$
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [unpack_buffer] (0x1000): keytab_name size: 0
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [unpack_buffer] (0x1000): lifetime: 86400
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [unpack_buffer] (0x0200): Will run as [0][0].
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [privileged_krb5_setup] (0x2000): Kerberos context initialized
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [main] (0x2000): Kerberos context initialized
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [become_user] (0x0200): Trying to become user [0][0].
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [become_user] (0x0200): Already user [0].
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [main] (0x2000): Running as [0][0].
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [main] (0x2000): getting TGT sync
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [ldap_child_get_tgt_sync] (0x2000): got realm_name: [INFINERA.COM]
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [ldap_child_get_tgt_sync] (0x0100): Principal name is: [GENTOO-LABBB$(a)INFINERA.COM]
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [ldap_child_get_tgt_sync] (0x0100): Using keytab [MEMORY:/etc/krb5.keytab]
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [ldap_child_get_tgt_sync] (0x0100): Will canonicalize principals
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.430433: Getting initial credentials for GENTOO-LABBB$(a)INFINERA.COM
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.430585: Looked up etypes in keytab: des-cbc-crc, des, des-cbc-crc, aes128-cts, aes256-cts, rc4-hmac
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.430660: Sending request (203 bytes) to INFINERA.COM
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.430840: Resolving hostname se-dc01.infinera.com
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.431709: Sending initial UDP request to dgram 10.210.34.21:88
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.432672: Received answer (266 bytes) from dgram 10.210.34.21:88
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.432741: Response was not from master KDC
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.432786: Received error from KDC: -1765328359/Additional pre-authentication required
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.432851: Processing preauth types: 16, 15, 19, 2
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.432880: Selected etype info: etype aes256-cts, salt "INFINERA.COMhostgentoo-labbb.infinera.com", params ""
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.432923: Retrieving GENTOO-LABBB$(a)INFINERA.COM from MEMORY:/etc/krb5.keytab (vno 0, enctype aes256-cts) with result: 0/Success
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.432960: AS key obtained for encrypted timestamp: aes256-cts/645C
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.433059: Encrypted timestamp (for 1495435577.276052): plain 301AA011180F32303137303532323036343631375AA1050203043654, encrypted 08B7186DAB549BD6AC8DCC76C9E88A5FB59619A42672B848C1CF6605E2AB5EFB54D0EDD8B8FC3D9BC154519791BD77F8938FBADEB6C9F65C
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.433087: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.433103: Produced preauth for next request: 2
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.433137: Sending request (283 bytes) to INFINERA.COM
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.433172: Resolving hostname se-dc01.infinera.com
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.433387: Sending initial UDP request to dgram 10.210.34.21:88
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.434554: Received answer (96 bytes) from dgram 10.210.34.21:88
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.434603: Response was not from master KDC
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.434624: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.434636: Request or response is too big for UDP; retrying with TCP
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.434647: Sending request (283 bytes) to INFINERA.COM (tcp only)
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.434665: Resolving hostname se-dc01.infinera.com
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.434807: Initiating TCP connection to stream 10.210.34.21:88
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.435110: Sending TCP request to stream 10.210.34.21:88
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.436061: Received answer (1543 bytes) from stream 10.210.34.21:88
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.436086: Terminating TCP connection to stream 10.210.34.21:88
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.436130: Response was not from master KDC
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.436166: Processing preauth types: 19
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.436180: Selected etype info: etype aes256-cts, salt "INFINERA.COMhostgentoo-labbb.infinera.com", params ""
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.436191: Produced preauth for next request: (empty)
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.436204: AS key determined by preauth: aes256-cts/645C
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.436268: Decrypted AS reply; session key is: aes256-cts/00F2
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.436287: FAST negotiation: unavailable
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [ldap_child_get_tgt_sync] (0x2000): credentials initialized
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [ldap_child_get_tgt_sync] (0x2000): keytab ccname: [FILE:/var/lib/sss/db/ccache_INFINERA.COM_wwO4jb]
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.436396: Initializing FILE:/var/lib/sss/db/ccache_INFINERA.COM_wwO4jb with default princ GENTOO-LABBB$(a)INFINERA.COM
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [sss_child_krb5_trace_cb] (0x4000): [17650] 1495435574.436543: Storing GENTOO-LABBB$(a)INFINERA.COM -> krbtgt/INFINERA.COM(a)INFINERA.COM in FILE:/var/lib/sss/db/ccache_INFINERA.COM_wwO4jb
>
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [ldap_child_get_tgt_sync] (0x2000): credentials stored
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [ldap_child_get_tgt_sync] (0x2000): Got KDC time offset
The time is not synchronised between client and server.
MIT krb5 can handle small offset. But I would highly recommends
to keep time in sync.
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [ldap_child_get_tgt_sync] (0x2000): Renaming [/var/lib/sss/db/ccache_INFINERA.COM_wwO4jb] to [/var/lib/sss/db/ccache_INFINERA.COM]
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [unique_filename_destructor] (0x2000): Unlinking [/var/lib/sss/db/ccache_INFINERA.COM_wwO4jb]
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [unlink_dbg] (0x2000): File already removed: [/var/lib/sss/db/ccache_INFINERA.COM_wwO4jb]
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [prepare_response] (0x0400): Building response for result [0]
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [pack_buffer] (0x2000): response size: 60
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [pack_buffer] (0x1000): result [0] krberr [0] msgsize [40] msg [FILE:/var/lib/sss/db/ccache_INFINERA.COM]
>(Mon May 22 08:46:14 2017) [[sssd[ldap_child[17650]]]] [main] (0x0400): ldap_child completed successfully
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [main] (0x0400): krb5_child started.
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [unpack_buffer] (0x1000): total buffer size: [154]
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [unpack_buffer] (0x0100): cmd [248] uid [1001] gid [100] validate [true] enterprise principal [false] offline [false] UPN [jocke(a)INFINERA.COM]
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_1001] old_ccname: [FILE:/tmp/krb5cc_1001] keytab: [/etc/krb5.keytab]
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [check_use_fast] (0x0100): Not using FAST.
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [switch_creds] (0x0200): Switch user to [1001][100].
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [switch_creds] (0x0200): Switch user to [0][0].
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [k5c_check_old_ccache] (0x4000): Ccache_file is [FILE:/tmp/krb5cc_1001] and is active and TGT is valid.
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [privileged_krb5_setup] (0x0080): Cannot open the PAC responder socket
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [become_user] (0x0200): Trying to become user [1001][100].
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [main] (0x2000): Running as [1001][100].
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [k5c_setup] (0x2000): Running as [1001][100].
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [set_lifetime_options] (0x0100): Renewable lifetime is set to [7d]
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [set_lifetime_options] (0x0100): Lifetime is set to [24h]
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [set_canonicalize_option] (0x0100): Canonicalization is set to [true]
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [main] (0x0400): Will perform ticket renewal
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [renew_tgt_child] (0x1000): Renewing a ticket
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.515585: Retrieving jocke(a)INFINERA.COM -> krbtgt/INFINERA.COM(a)INFINERA.COM from FILE:/tmp/krb5cc_1001 with result: 0/Success
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.515616: Get cred via TGT krbtgt/INFINERA.COM(a)INFINERA.COM after requesting krbtgt/INFINERA.COM(a)INFINERA.COM (canonicalize off)
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.515681: Generated subkey for TGS request: aes256-cts/2D54
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.515747: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, des-cbc-crc, des, des-cbc-md4
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.515862: Encoding request body and padata into FAST request
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.515973: Sending request (1901 bytes) to INFINERA.COM
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.516194: Resolving hostname se-dc01.infinera.com
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.516448: Initiating TCP connection to stream 10.210.34.21:88
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.516778: Sending TCP request to stream 10.210.34.21:88
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.517190: Received answer (123 bytes) from stream 10.210.34.21:88
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.517203: Terminating TCP connection to stream 10.210.34.21:88
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.517247: Response was not from master KDC
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [sss_child_krb5_trace_cb] (0x4000): [17652] 1495435574.517270: Got cred; -1765328352/Ticket expired
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [map_krb5_error] (0x0020): 1643: [-1765328352][Ticket expired]
Renewing of a ticket failed because it is already expired.
Maybe due to time shift between client and server(KDC)
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [k5c_send_data] (0x0200): Received error code 1432158229
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [pack_response_packet] (0x2000): response packet size: [4]
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [k5c_send_data] (0x4000): Response sent.
>(Mon May 22 08:46:14 2017) [[sssd[krb5_child[17652]]]] [main] (0x0400): krb5_child completed successfully
There were 5 more attempts to renew tickets within a second.
4 of them failed due to expired ticket. And the last one failed
due to offline mode.
Few seconds later (7) user was authenticated in offline mode.
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [main] (0x0400): krb5_child started.
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [unpack_buffer] (0x1000): total buffer size: [141]
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [unpack_buffer] (0x0100): cmd [241] uid [1001] gid [100] validate [true] enterprise principal [false] offline [true] UPN [jocke(a)INFINERA.COM]
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_1001] old_ccname: [FILE:/tmp/krb5cc_1001] keytab: [/etc/krb5.keytab]
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [check_use_fast] (0x0100): Not using FAST.
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [switch_creds] (0x0200): Switch user to [1001][100].
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [switch_creds] (0x0200): Switch user to [0][0].
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [k5c_check_old_ccache] (0x4000): Ccache_file is [FILE:/tmp/krb5cc_1001] and is active and TGT is valid.
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [privileged_krb5_setup] (0x0080): Cannot open the PAC responder socket
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [become_user] (0x0200): Trying to become user [1001][100].
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [main] (0x2000): Running as [1001][100].
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [become_user] (0x0200): Trying to become user [1001][100].
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [become_user] (0x0200): Already user [1001].
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [k5c_setup] (0x2000): Running as [1001][100].
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [set_lifetime_options] (0x0100): Renewable lifetime is set to [7d]
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [set_lifetime_options] (0x0100): Lifetime is set to [24h]
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [main] (0x0400): Will perform offline auth
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [create_empty_ccache] (0x1000): Existing ccache still valid, reusing
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [k5c_send_data] (0x0200): Received error code 0
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [pack_response_packet] (0x2000): response packet size: [45]
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [k5c_send_data] (0x4000): Response sent.
>(Mon May 22 08:46:21 2017) [[sssd[krb5_child[17694]]]] [main] (0x0400): krb5_child completed successfully
LS
5 years, 10 months
2008AD and uidNumber, gidNumber mapping on CentOS7 with sssd
by Jelle de Jong
Hello everybody,
I been trying hard to get sssd to work on a new CentOS 7 workstation.
sssd --version
1.14.0
# working ldapsearch command and output
https://paste.fedoraproject.org/paste/L3Uv8Mg6FMuLlIHXkL5~0Q/raw
The problem is I am at a customer that has an old Windows 2008 AD server
with Unix tools and the uidNumber, gidNumber, unixHomeDirectory and
loginShell need to be used, so that my nfs shares have the correct mapping.
They used an old NIS server in the passed but it is broken and has no AD
connection any more.
I can not seem to bind to the RootDSE without using a username and
password, see the ldapsearch command, i tried converting the
"LDAP(a)wdm.local" to a cn path, but whatever i try i get a " additional
info: 80090308: LdapErr: DSID-0C0903A8, comment: AcceptSecurityContext
error, data 52e, v1db1" back.
My sssd just keeps loging: ([sssd[be[default]]] [dp_req_reply_gen_error]
(0x0080): DP Request [Subdomains #0]: Finished. Target is not supported
with this configuration.
[root@vsxtest01 ~]# cat /etc/sssd/sssd.conf
[domain/default]
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://sw008.wdm.local/
ldap_search_base = ou=COMPANY,dc=wdm,dc=local
#ldap_schema = rfc2307bis
#ldap_user_home_directory = unixHomeDirectory
#ldap_tls_reqcert = allow
#ldap_id_use_start_tls = True
ldap_tls_cacertdir = /etc/openldap/cacerts
debug_level = 5
autofs_provider = ldap
#ldap_default_bind_dn = cn=LDAP,ou=Users,ou=COMPANY,dc=wdm,dc=local
ldap_default_bind_dn = LDAP(a)wdm.local
ldap_default_authtok = *secret*
ldap_default_authtok_type = password
cache_credentials = True
[sssd]
config_file_version = 2
services = autofs
domains = default
[autofs]
I have no idea how to get my user authentication working with the
correct uidNumber, gidNumber mapping.
Can somebody maybe help?
Kind regards,
Jelle de Jong
5 years, 10 months
SSSD exits abruptly
by Pankaj V. Dorlikar
Hello,
We have Cent OS 6.2 (X86_64) server with sssd and client (version : 1.5.1-66) and integrated with LDAP
###########################################################
Jul 19 07:03:35 server1 ntpd[17554]: Listening on routing socket on fd #26 for interface updates
Jul 19 07:03:35 server1 ntpd[17554]: kernel time sync status 2040
Jul 19 07:07:55 server1 ntpd[17554]: synchronized to nsvr stratum 4
Jul 19 07:07:55 server1 ntpd[17554]: kernel time sync status change 2001
Jul 19 07:23:21 server1 sssd[be[default]]: Starting up
Jul 19 07:23:51 server1 sssd[be[default]]: Starting up
Jul 19 07:24:01 server1 sssd[nss]: Starting up
Jul 19 07:24:21 server1 sssd[be[default]]: Starting up
Jul 19 07:24:31 server1 sssd[nss]: Starting up
Jul 19 07:24:51 server1 sssd[be[default]]: Starting up
Jul 19 07:24:51 server1 sssd[nss]: Shutting down
Jul 19 07:24:51 server1 sssd[be[default]]: Shutting down
Jul 19 07:24:51 server1 sssd[nss]: Shutting down
Jul 19 07:24:51 server1 sssd[be[default]]: Shutting down
Jul 19 07:24:51 server1 sssd[be[default]]: Shutting down
Jul 19 07:24:51 server1 sssd[be[default]]: Shutting down
Jul 19 07:25:01 server1 sssd[nss]: Shutting down
Jul 19 07:25:01 server1 sssd[nss]: Starting up
Jul 19 07:25:03 server1 sssd[nss]: Starting up
Jul 19 07:33:15 server1 ntpd[17554]: ntpd exiting on signal 15
Jul 19 07:33:17 server1 ntpd[20568]: ntpd 4.2.4p8(a)1.1612-o Tue Nov 29 00:09:12 UTC 2011 (1)
Jul 19 07:33:17 server1 ntpd[20569]: precision = 0.066 usec
Jul 19 07:33:17 server1 ntpd[20569]: Listening on interface #0 wildcard, 0.0.0.0#123 Disabled
And it dies.
##########################################################
When it runs, below is the process output
##########################################################
ps -ef|grep sss
root 32523 1 0 09:35 ? 00:00:00 /usr/sbin/sssd -f -D
root 32525 32523 0 09:35 ? 00:00:09 /usr/libexec/sssd/sssd_be -d 0 --debug-to-files --domain default
root 32526 32523 0 09:35 ? 00:00:00 /usr/libexec/sssd/sssd_nss -d 0 --debug-to-files
root 32527 32523 0 09:35 ? 00:00:00 /usr/libexec/sssd/sssd_pam -d 0 --debug-to-files
##########################################################
Not able to find out, what could be the issue. Any help in this regard would be appriciated.
--
Regards,
Pankaj D.
-------------------------------------------------------------------------------------------------------------------------------
[ C-DAC is on Social-Media too. Kindly follow us at:
Facebook: https://www.facebook.com/CDACINDIA & Twitter: @cdacindia ]
This e-mail is for the sole use of the intended recipient(s) and may
contain confidential and privileged information. If you are not the
intended recipient, please contact the sender by reply e-mail and destroy
all copies and the original message. Any unauthorized review, use,
disclosure, dissemination, forwarding, printing or copying of this email
is strictly prohibited and appropriate legal action will be taken.
-------------------------------------------------------------------------------------------------------------------------------
5 years, 10 months