[SSSD] [Patch] Improvements for the Kerberos locator plugin

Sumit Bose sbose at redhat.com
Fri Mar 5 16:14:32 UTC 2010


Hi,

the following two patches are related to the Kerberos locator plugin.

The first patch removes the name resolution from the locator plugin and
let it use the IP address found by the resolver code. This way we can be
sure to always talk to the same server until the resolver chooses a new
server.

The second patch tries to make debugging of the locator plugin easier by
activating it automatically if the debug level of the Kerberos provider
is 5 or higher. Also the timestamp and debug-to-files flags are
respected.

bye,
Sumit
-------------- next part --------------
From 6a506027029f01dd7cc06ffe79215fde0c57e100 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 4 Mar 2010 12:44:21 +0100
Subject: [PATCH 1/2] Write the IP address of the KDC to the kdcinfo file

---
 src/krb5_plugin/sssd_krb5_locator_plugin.c |   78 ++++++++++++++--------------
 src/providers/ipa/ipa_common.c             |   14 ++++-
 src/providers/krb5/krb5_common.c           |   26 ++++------
 3 files changed, 60 insertions(+), 58 deletions(-)

diff --git a/src/krb5_plugin/sssd_krb5_locator_plugin.c b/src/krb5_plugin/sssd_krb5_locator_plugin.c
index 5e79733..ccaef4f 100644
--- a/src/krb5_plugin/sssd_krb5_locator_plugin.c
+++ b/src/krb5_plugin/sssd_krb5_locator_plugin.c
@@ -45,7 +45,7 @@
 
 struct sssd_ctx {
     char *sssd_realm;
-    struct addrinfo *sssd_kdc_addrinfo;
+    char *kdc_addr;
     bool debug;
 };
 
@@ -122,16 +122,7 @@ static int get_kdcinfo(const char *realm, struct sssd_ctx *ctx)
     }
     PLUGIN_DEBUG(("Found kdcinfo [%s].\n", buf));
 
-    ret = getaddrinfo((char *) buf, "kerberos", NULL, &ctx->sssd_kdc_addrinfo);
-    if (ret != 0) {
-        PLUGIN_DEBUG(("getaddrinfo failed [%d][%s].\n", ret,
-                                                        gai_strerror(ret)));
-        if (ret == EAI_SYSTEM) {
-            PLUGIN_DEBUG(("getaddrinfo failed [%d][%s].\n", errno,
-                                                            strerror(errno)));
-        }
-        goto done;
-    }
+    ctx->kdc_addr = strdup((char *) buf);
 
     ctx->sssd_realm = strdup(realm);
     if (ctx->sssd_realm == NULL) {
@@ -178,7 +169,7 @@ void sssd_krb5_locator_close(void *private_data)
     ctx = (struct sssd_ctx *) private_data;
     PLUGIN_DEBUG(("sssd_krb5_locator_close called\n"));
 
-    freeaddrinfo(ctx->sssd_kdc_addrinfo);
+    free(ctx->kdc_addr);
     free(ctx->sssd_realm);
     free(ctx);
     private_data = NULL;
@@ -197,14 +188,15 @@ krb5_error_code sssd_krb5_locator_lookup(void *private_data,
     int ret;
     struct addrinfo *ai;
     struct sssd_ctx *ctx;
-    char hostip[NI_MAXHOST];
+    struct addrinfo ai_hints;
+    const char *service = NULL;
 
     if (private_data == NULL) return KRB5_PLUGIN_NO_HANDLE;
     ctx = (struct sssd_ctx *) private_data;
 
     if (ctx->sssd_realm == NULL || strcmp(ctx->sssd_realm, realm) != 0) {
-        freeaddrinfo(ctx->sssd_kdc_addrinfo);
-        ctx->sssd_kdc_addrinfo = NULL;
+        free(ctx->kdc_addr);
+        ctx->kdc_addr = NULL;
         free(ctx->sssd_realm);
         ctx->sssd_realm = NULL;
         ret = get_kdcinfo(realm, ctx);
@@ -221,10 +213,15 @@ krb5_error_code sssd_krb5_locator_lookup(void *private_data,
     switch (svc) {
         case locate_service_kdc:
         case locate_service_master_kdc:
+            service = "kerberos";
+            break;
         case locate_service_kadmin:
+            service = "kerberos-adm";
             break;
-        case locate_service_krb524:
         case locate_service_kpasswd:
+            service = "kpasswd";
+            break;
+        case locate_service_krb524:
             return KRB5_PLUGIN_NO_HANDLE;
         default:
             return EINVAL;
@@ -250,32 +247,35 @@ krb5_error_code sssd_krb5_locator_lookup(void *private_data,
     if (strcmp(realm, ctx->sssd_realm) != 0)
         return KRB5_PLUGIN_NO_HANDLE;
 
-    for (ai = ctx->sssd_kdc_addrinfo; ai != NULL; ai = ai->ai_next) {
-        ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, hostip, NI_MAXHOST,
-                          NULL, 0, NI_NUMERICHOST);
-        if (ret != 0) {
-            PLUGIN_DEBUG(("getnameinfo failed [%d][%s].\n", ret,
-                          gai_strerror(ret)));
-            if (ret == EAI_SYSTEM) {
-                PLUGIN_DEBUG(("getnameinfo failed [%d][%s].\n", errno,
-                              strerror(errno)));
-            }
+    memset(&ai_hints, 0, sizeof(struct addrinfo));
+    ai_hints.ai_flags = AI_NUMERICHOST;
+    ai_hints.ai_socktype = socktype;
+    ret = getaddrinfo(ctx->kdc_addr, service, &ai_hints, &ai);
+    if (ret != 0) {
+        PLUGIN_DEBUG(("getaddrinfo failed [%d][%s].\n", ret,
+                                                        gai_strerror(ret)));
+        if (ret == EAI_SYSTEM) {
+            PLUGIN_DEBUG(("getaddrinfo failed [%d][%s].\n", errno,
+                                                            strerror(errno)));
         }
-        PLUGIN_DEBUG(("addr[%s] family[%d] socktype[%d] - ", hostip,
-                      ai->ai_family, ai->ai_socktype));
-
-        if ((family == AF_UNSPEC || ai->ai_family == family) &&
-            ai->ai_socktype == socktype) {
-
-            ret = cbfunc(cbdata, socktype, ai->ai_addr);
-            if (ret != 0) {
-                PLUGIN_DEBUG(("\ncbfunc failed\n"));
-            } else {
-                PLUGIN_DEBUG(("used\n"));
-            }
+        return EFAULT;
+    }
+
+    PLUGIN_DEBUG(("addr[%s] family[%d] socktype[%d]\n", ctx->kdc_addr,
+                 ai->ai_family, ai->ai_socktype));
+
+    if ((family == AF_UNSPEC || ai->ai_family == family) &&
+        ai->ai_socktype == socktype) {
+
+        ret = cbfunc(cbdata, socktype, ai->ai_addr);
+        if (ret != 0) {
+            PLUGIN_DEBUG(("cbfunc failed\n"));
+            return ret;
         } else {
-            PLUGIN_DEBUG((" NOT used\n"));
+            PLUGIN_DEBUG(("[%s] used\n", ctx->kdc_addr));
         }
+    } else {
+        PLUGIN_DEBUG(("[%s] NOT used\n", ctx->kdc_addr));
     }
 
     return 0;
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index 92da9d1..a50b63b 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -24,6 +24,8 @@
 
 #include <netdb.h>
 #include <ctype.h>
+#include <arpa/inet.h>
+
 #include "providers/ipa/ipa_common.h"
 
 struct dp_option ipa_basic_opts[] = {
@@ -472,9 +474,15 @@ static void ipa_resolve_callback(void *private_data, struct fo_server *server)
         return;
     }
 
-    address = talloc_asprintf(service, "%s", srvaddr->h_name);
-    if (!address) {
-        DEBUG(1, ("Failed to copy address ...\n"));
+    address = talloc_zero_size(service, 128);
+    if (address == NULL) {
+        DEBUG(1, ("talloc_zero failed.\n"));
+        return;
+    }
+
+    if (inet_ntop(srvaddr->h_addrtype, srvaddr->h_addr_list[0],
+                  address, 128) == NULL) {
+        DEBUG(1, ("inet_ntop failed [%d][%s].\n", errno, strerror(errno)));
         return;
     }
 
diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c
index 7619e6a..8c1c7fa 100644
--- a/src/providers/krb5/krb5_common.c
+++ b/src/providers/krb5/krb5_common.c
@@ -25,6 +25,7 @@
 #include <sys/stat.h>
 #include <unistd.h>
 #include <netdb.h>
+#include <arpa/inet.h>
 
 #include "providers/dp_backend.h"
 #include "providers/krb5/krb5_common.h"
@@ -47,7 +48,6 @@ errno_t check_and_export_options(struct dp_option *opts,
     char *value;
     const char *realm;
     const char *dummy;
-    char **list;
 
     realm = dp_opt_get_cstring(opts, KRB5_REALM);
     if (realm == NULL) {
@@ -68,18 +68,6 @@ errno_t check_and_export_options(struct dp_option *opts,
     dummy = dp_opt_get_cstring(opts, KRB5_KDC);
     if (dummy == NULL) {
         DEBUG(1, ("No KDC expicitly configured, using defaults"));
-    } else {
-        ret = split_on_separator(opts, dummy, ',', true, &list, NULL);
-        if (ret != EOK) {
-            DEBUG(1, ("Failed to parse server list!\n"));
-            return ret;
-        }
-        ret = write_kdcinfo_file(realm, list[0]);
-        if (ret != EOK) {
-            DEBUG(1, ("write_kdcinfo_file failed, "
-                      "using kerberos defaults from /etc/krb5.conf"));
-        }
-        talloc_free(list);
     }
 
     dummy = dp_opt_get_cstring(opts, KRB5_CCNAME_TMPL);
@@ -248,9 +236,15 @@ static void krb5_resolve_callback(void *private_data, struct fo_server *server)
         return;
     }
 
-    address = talloc_asprintf(krb5_service, "%s", srvaddr->h_name);
-    if (!address) {
-        DEBUG(1, ("Failed to copy address ...\n"));
+    address = talloc_zero_size(krb5_service, 128);
+    if (address == NULL) {
+        DEBUG(1, ("talloc_zero failed.\n"));
+        return;
+    }
+
+    if (inet_ntop(srvaddr->h_addrtype, srvaddr->h_addr_list[0],
+                  address, 128) == NULL) {
+        DEBUG(1, ("inet_ntop failed [%d][%s].\n", errno, strerror(errno)));
         return;
     }
 
-- 
1.6.6.1

-------------- next part --------------
From 974d6c6941187e5546f09692ea5415a5eaec2007 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Fri, 12 Feb 2010 10:05:23 +0100
Subject: [PATCH 2/2] Align debugging of Kerberos locator plugin

- Enable debug messages of the locator plugin if debug level is 5
- add timestamps if configured
- write to file if configured and file is writeable
---
 .gitignore                                 |    1 +
 src/configure.ac                           |    2 +-
 src/krb5_plugin/sssd_krb5_locator_plugin.c |   99 ++++++++++++++++++++--------
 src/man/include/variables.xml.in           |    1 +
 src/man/sssd_krb5_locator_plugin.8.xml     |   41 +++++++++++-
 src/providers/ipa/ipa_init.c               |    2 +-
 src/providers/krb5/krb5_common.h           |    4 +
 src/providers/krb5/krb5_init.c             |   37 ++++++++++-
 src/providers/ldap/sdap_child_helpers.c    |    2 +-
 src/util/debug.c                           |    6 +-
 src/util/util.h                            |    2 +-
 11 files changed, 160 insertions(+), 37 deletions(-)
 create mode 100644 src/man/include/variables.xml.in

diff --git a/.gitignore b/.gitignore
index 478cd7f..480a715 100644
--- a/.gitignore
+++ b/.gitignore
@@ -59,5 +59,6 @@ sssd_nss
 sssd_pam
 krb5_child
 ldap_child
+variables.xml
 *~
 
diff --git a/src/configure.ac b/src/configure.ac
index d7a7a77..04c8eee 100644
--- a/src/configure.ac
+++ b/src/configure.ac
@@ -145,5 +145,5 @@ AM_CONDITIONAL([HAVE_CHECK], [test x$have_check != x])
 abs_build_dir=`pwd`
 AC_DEFINE_UNQUOTED([ABS_BUILD_DIR], ["$abs_build_dir"], [Absolute path to the build directory])
 
-AC_CONFIG_FILES([Makefile doxy.config po/Makefile.in])
+AC_CONFIG_FILES([Makefile doxy.config po/Makefile.in man/include/variables.xml])
 AC_OUTPUT
diff --git a/src/krb5_plugin/sssd_krb5_locator_plugin.c b/src/krb5_plugin/sssd_krb5_locator_plugin.c
index ccaef4f..c0ea16e 100644
--- a/src/krb5_plugin/sssd_krb5_locator_plugin.c
+++ b/src/krb5_plugin/sssd_krb5_locator_plugin.c
@@ -35,11 +35,10 @@
 #include "providers/krb5/krb5_common.h"
 
 #define BUFSIZE 512
-#define SSSD_KRB5_LOCATOR_DEBUG "SSSD_KRB5_LOCATOR_DEBUG"
 #define DEBUG_KEY "[sssd_krb5_locator] "
-#define PLUGIN_DEBUG(body) do { \
-    if (ctx->debug) { \
-        debug_fn body; \
+#define PLUGIN_DEBUG(__ctx__, __level__, ...) do { \
+    if (__ctx__->debug) { \
+        plugin_debug_fn(__ctx__, __level__, __VA_ARGS__); \
     } \
 } while(0);
 
@@ -47,13 +46,21 @@ struct sssd_ctx {
     char *sssd_realm;
     char *kdc_addr;
     bool debug;
+    bool debug_timestamps;
+    bool debug_to_file;
 };
 
-void debug_fn(const char *format, ...)
+void plugin_debug_fn(struct sssd_ctx *ctx, int level, const char *format, ...)
 {
     va_list ap;
     char *s = NULL;
     int ret;
+    time_t now;
+    char stamp[25];
+    char logfile[PATH_MAX];
+    FILE *f = stderr;
+    FILE *fp = NULL;
+    mode_t old_umask;
 
     va_start(ap, format);
 
@@ -65,7 +72,30 @@ void debug_fn(const char *format, ...)
 
     va_end(ap);
 
-    fprintf(stderr, DEBUG_KEY "%s", s);
+    if (ctx->debug_to_file) {
+        ret = snprintf(logfile, PATH_MAX - 1,
+                       "%s/"SSSD_KRB5_LOCATOR_DEBUG_FILE".log", LOG_PATH);
+        if (ret > 0 && ret < (PATH_MAX - 1)) {
+            old_umask = umask(0177);
+            fp = fopen(logfile, "a");
+            umask(old_umask);
+            if (fp != NULL) {
+                f = fp;
+            }
+        }
+    }
+
+    if (ctx->debug_timestamps) {
+        now = time(NULL);
+        memcpy(stamp, ctime(&now), 24);
+        stamp[24] = '\0';
+        fprintf(f, "(%s) " DEBUG_KEY " (%d): %s", stamp, level, s);
+    } else {
+        fprintf(f, DEBUG_KEY " (%d): %s", level, s);
+    }
+    if (fp != NULL) {
+        fclose(fp);
+    }
     free(s);
 }
 
@@ -82,20 +112,20 @@ static int get_kdcinfo(const char *realm, struct sssd_ctx *ctx)
 
     kdcinfo_name = calloc(1, len + 1);
     if (kdcinfo_name == NULL) {
-        PLUGIN_DEBUG(("malloc failed.\n"));
+        PLUGIN_DEBUG(ctx, 5, "malloc failed.\n");
         return ENOMEM;
     }
 
     ret = snprintf(kdcinfo_name, len, KDCINFO_TMPL, realm);
     if (ret < 0) {
-        PLUGIN_DEBUG(("snprintf failed"));
+        PLUGIN_DEBUG(ctx, 5, "snprintf failed");
         ret = EINVAL;
     }
     kdcinfo_name[len] = '\0';
 
     fd = open(kdcinfo_name, O_RDONLY);
     if (fd == -1) {
-        PLUGIN_DEBUG(("open failed [%d][%s].\n", errno, strerror(errno)));
+        PLUGIN_DEBUG(ctx, 5, "open failed [%d][%s].\n", errno, strerror(errno));
         ret = errno;
         goto done;
     }
@@ -106,7 +136,8 @@ static int get_kdcinfo(const char *realm, struct sssd_ctx *ctx)
     while (len != 0 && (ret = read(fd, p, len)) != 0) {
         if (ret == -1) {
             if (errno == EINTR) continue;
-            PLUGIN_DEBUG(("read failed [%d][%s].\n", errno, strerror(errno)));
+            PLUGIN_DEBUG(ctx, 5, "read failed [%d][%s].\n", errno,
+                                                            strerror(errno));
             close(fd);
             goto done;
         }
@@ -117,16 +148,16 @@ static int get_kdcinfo(const char *realm, struct sssd_ctx *ctx)
     close(fd);
 
     if (len == 0) {
-        PLUGIN_DEBUG(("Content of kdcinfo file [%s] is [%d] or larger.\n",
-                      kdcinfo_name, BUFSIZE));
+        PLUGIN_DEBUG(ctx, 5, "Content of kdcinfo file [%s] is [%d] or larger.\n",
+                      kdcinfo_name, BUFSIZE);
     }
-    PLUGIN_DEBUG(("Found kdcinfo [%s].\n", buf));
+    PLUGIN_DEBUG(ctx, 7, "Found kdcinfo [%s].\n", buf);
 
     ctx->kdc_addr = strdup((char *) buf);
 
     ctx->sssd_realm = strdup(realm);
     if (ctx->sssd_realm == NULL) {
-        PLUGIN_DEBUG(("strdup failed.\n"));
+        PLUGIN_DEBUG(ctx, 5, "strdup failed.\n");
         ret = ENOMEM;
         goto done;
     }
@@ -147,12 +178,24 @@ krb5_error_code sssd_krb5_locator_init(krb5_context context,
     ctx = calloc(1,sizeof(struct sssd_ctx));
     if (ctx == NULL) return ENOMEM;
 
+    ctx->debug_timestamps = true;
+    dummy = getenv(SSSD_KRB5_LOCATOR_DEBUG_NOTIMESTAMPS);
+    if (dummy != NULL) {
+        ctx->debug_timestamps = false;
+    }
+
+    ctx->debug_to_file = false;
+    dummy = getenv(SSSD_KRB5_LOCATOR_DEBUG_TO_FILE);
+    if (dummy != NULL) {
+        ctx->debug_to_file = true;
+    }
+
     dummy = getenv(SSSD_KRB5_LOCATOR_DEBUG);
     if (dummy == NULL) {
         ctx->debug = false;
     } else {
         ctx->debug = true;
-        PLUGIN_DEBUG(("sssd_krb5_locator_init called\n"));
+        PLUGIN_DEBUG(ctx, 9, "sssd_krb5_locator_init called\n");
     }
 
     *private_data = ctx;
@@ -167,7 +210,7 @@ void sssd_krb5_locator_close(void *private_data)
     if (private_data == NULL) return;
 
     ctx = (struct sssd_ctx *) private_data;
-    PLUGIN_DEBUG(("sssd_krb5_locator_close called\n"));
+    PLUGIN_DEBUG(ctx, 9, "sssd_krb5_locator_close called\n");
 
     free(ctx->kdc_addr);
     free(ctx->sssd_realm);
@@ -201,14 +244,14 @@ krb5_error_code sssd_krb5_locator_lookup(void *private_data,
         ctx->sssd_realm = NULL;
         ret = get_kdcinfo(realm, ctx);
         if (ret != EOK) {
-            PLUGIN_DEBUG(("get_kdcinfo failed.\n"));
+            PLUGIN_DEBUG(ctx, 5, "get_kdcinfo failed.\n");
             return KRB5_PLUGIN_NO_HANDLE;
         }
     }
 
-    PLUGIN_DEBUG(("sssd_realm[%s] requested realm[%s] family[%d] socktype[%d] "
+    PLUGIN_DEBUG(ctx, 7, "sssd_realm[%s] requested realm[%s] family[%d] socktype[%d] "
                   "locate_service[%d]\n", ctx->sssd_realm, realm, family,
-                                          socktype, svc));
+                                          socktype, svc);
 
     switch (svc) {
         case locate_service_kdc:
@@ -252,30 +295,30 @@ krb5_error_code sssd_krb5_locator_lookup(void *private_data,
     ai_hints.ai_socktype = socktype;
     ret = getaddrinfo(ctx->kdc_addr, service, &ai_hints, &ai);
     if (ret != 0) {
-        PLUGIN_DEBUG(("getaddrinfo failed [%d][%s].\n", ret,
-                                                        gai_strerror(ret)));
+        PLUGIN_DEBUG(ctx, 5, "getaddrinfo failed [%d][%s].\n", ret,
+                                                             gai_strerror(ret));
         if (ret == EAI_SYSTEM) {
-            PLUGIN_DEBUG(("getaddrinfo failed [%d][%s].\n", errno,
-                                                            strerror(errno)));
+            PLUGIN_DEBUG(ctx, 5, "getaddrinfo failed [%d][%s].\n", errno,
+                                                               strerror(errno));
         }
         return EFAULT;
     }
 
-    PLUGIN_DEBUG(("addr[%s] family[%d] socktype[%d]\n", ctx->kdc_addr,
-                 ai->ai_family, ai->ai_socktype));
+    PLUGIN_DEBUG(ctx, 9, "addr[%s] family[%d] socktype[%d]\n", ctx->kdc_addr,
+                 ai->ai_family, ai->ai_socktype);
 
     if ((family == AF_UNSPEC || ai->ai_family == family) &&
         ai->ai_socktype == socktype) {
 
         ret = cbfunc(cbdata, socktype, ai->ai_addr);
         if (ret != 0) {
-            PLUGIN_DEBUG(("cbfunc failed\n"));
+            PLUGIN_DEBUG(ctx, 5, "cbfunc failed\n");
             return ret;
         } else {
-            PLUGIN_DEBUG(("[%s] used\n", ctx->kdc_addr));
+            PLUGIN_DEBUG(ctx, 7, "[%s] used\n", ctx->kdc_addr);
         }
     } else {
-        PLUGIN_DEBUG(("[%s] NOT used\n", ctx->kdc_addr));
+        PLUGIN_DEBUG(ctx, 7, "[%s] NOT used\n", ctx->kdc_addr);
     }
 
     return 0;
diff --git a/src/man/include/variables.xml.in b/src/man/include/variables.xml.in
new file mode 100644
index 0000000..0e9c4d9
--- /dev/null
+++ b/src/man/include/variables.xml.in
@@ -0,0 +1 @@
+<!ENTITY LOG_PATH "<filename class='directory'>@logpath@</filename>">
diff --git a/src/man/sssd_krb5_locator_plugin.8.xml b/src/man/sssd_krb5_locator_plugin.8.xml
index 6c60431..4552b1b 100644
--- a/src/man/sssd_krb5_locator_plugin.8.xml
+++ b/src/man/sssd_krb5_locator_plugin.8.xml
@@ -1,6 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE reference PUBLIC "-//OASIS//DTD DocBook V4.4//EN"
-"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
+<!ENTITY % include.variables SYSTEM "include/variables.xml">
+%include.variables;
+]>
 <reference>
 <title>SSSD Manual pages</title>
 <refentry>
@@ -57,6 +60,42 @@
         </para>
     </refsect1>
 
+    <refsect1 id='enviroment'>
+        <title>ENVIRONMENT</title>
+        <para>
+            The following environment variables can be used to control the debug
+            output of the plugin:
+            <variablelist>
+                <varlistentry>
+                    <term>SSSD_KRB5_LOCATOR_DEBUG</term>
+                    <listitem>
+                        <para>
+                            If set debug messages will be generated.
+                        </para>
+                    </listitem>
+                </varlistentry>
+                <varlistentry>
+                    <term>SSSD_KRB5_LOCATOR_DEBUG_NOTIMESTAMPS</term>
+                    <listitem>
+                        <para>
+                            If set log messages are generated without time
+                            stamps.
+                        </para>
+                    </listitem>
+                </varlistentry>
+                <varlistentry>
+                    <term>SSSD_KRB5_LOCATOR_DEBUG_TO_FILE</term>
+                    <listitem>
+                        <para>
+                            If set try to write the log messages to
+                            krb5_locator_plugin.log in &LOG_PATH;. If the file
+                            cannot be opened the output is sent to STDOUT.
+                        </para>
+                    </listitem>
+                </varlistentry>
+            </variablelist>
+        </para>
+    </refsect1>
     <refsect1 id='notes'>
         <title>NOTES</title>
         <para>
diff --git a/src/providers/ipa/ipa_init.c b/src/providers/ipa/ipa_init.c
index 10b9257..49cbe41 100644
--- a/src/providers/ipa/ipa_init.c
+++ b/src/providers/ipa/ipa_init.c
@@ -211,7 +211,7 @@ int sssm_ipa_auth_init(struct be_ctx *bectx,
     }
 
     if (debug_to_file != 0) {
-        ret = open_debug_file_ex("krb5_child", &debug_filep);
+        ret = open_debug_file_ex("krb5_child", &debug_filep, false);
         if (ret != EOK) {
             DEBUG(0, ("Error setting up logging (%d) [%s]\n",
                     ret, strerror(ret)));
diff --git a/src/providers/krb5/krb5_common.h b/src/providers/krb5/krb5_common.h
index 832ffcd..6149083 100644
--- a/src/providers/krb5/krb5_common.h
+++ b/src/providers/krb5/krb5_common.h
@@ -36,6 +36,10 @@
 #define SSSD_KRB5_KDC "SSSD_KRB5_KDC"
 #define SSSD_KRB5_REALM "SSSD_KRB5_REALM"
 #define SSSD_KRB5_CHANGEPW_PRINCIPLE "SSSD_KRB5_CHANGEPW_PRINCIPLE"
+#define SSSD_KRB5_LOCATOR_DEBUG "SSSD_KRB5_LOCATOR_DEBUG"
+#define SSSD_KRB5_LOCATOR_DEBUG_NOTIMESTAMPS "SSSD_KRB5_LOCATOR_DEBUG_NOTIMESTAMPS"
+#define SSSD_KRB5_LOCATOR_DEBUG_TO_FILE "SSSD_KRB5_LOCATOR_DEBUG_TO_FILE"
+#define SSSD_KRB5_LOCATOR_DEBUG_FILE "krb5_locator_plugin"
 
 #define KDCINFO_TMPL PUBCONF_PATH"/kdcinfo.%s"
 
diff --git a/src/providers/krb5/krb5_init.c b/src/providers/krb5/krb5_init.c
index 4d21238..f3a140d 100644
--- a/src/providers/krb5/krb5_init.c
+++ b/src/providers/krb5/krb5_init.c
@@ -50,6 +50,7 @@ int sssm_krb5_auth_init(struct be_ctx *bectx,
     int ret;
     struct tevent_signal *sige;
     unsigned v;
+    FILE *loc_debug_filep = NULL;
     FILE *debug_filep;
     const char *krb5_servers;
     const char *krb5_realm;
@@ -119,8 +120,42 @@ int sssm_krb5_auth_init(struct be_ctx *bectx,
         goto fail;
     }
 
+    if (debug_level >= 5) {
+        ret = setenv(SSSD_KRB5_LOCATOR_DEBUG, "1", 1);
+        if (ret != EOK) {
+            DEBUG(1, ("setenv failed, cannot set [%s].\n",
+                  SSSD_KRB5_LOCATOR_DEBUG));
+        }
+
+        if (!debug_timestamps) {
+            ret = setenv(SSSD_KRB5_LOCATOR_DEBUG_NOTIMESTAMPS, "1", 1);
+            if (ret != EOK) {
+                DEBUG(1, ("setenv failed, cannot set [%s].\n",
+                      SSSD_KRB5_LOCATOR_DEBUG_NOTIMESTAMPS));
+            }
+        }
+
+        if (debug_to_file) {
+            ret = open_debug_file_ex(SSSD_KRB5_LOCATOR_DEBUG_FILE,
+                                     &loc_debug_filep, true);
+            if (ret != EOK) {
+                DEBUG(0, ("Error setting up logging for locator plugin: "
+                          "(%d) [%s]\n", ret, strerror(ret)));
+            }
+            if (loc_debug_filep != NULL) {
+                fclose(loc_debug_filep);
+            }
+
+            ret = setenv(SSSD_KRB5_LOCATOR_DEBUG_TO_FILE, "1", 1);
+            if (ret != EOK) {
+                DEBUG(1, ("setenv failed, cannot set [%s].\n",
+                      SSSD_KRB5_LOCATOR_DEBUG_TO_FILE));
+            }
+        }
+    }
+
     if (debug_to_file != 0) {
-        ret = open_debug_file_ex("krb5_child", &debug_filep);
+        ret = open_debug_file_ex("krb5_child", &debug_filep, false);
         if (ret != EOK) {
             DEBUG(0, ("Error setting up logging (%d) [%s]\n",
                     ret, strerror(ret)));
diff --git a/src/providers/ldap/sdap_child_helpers.c b/src/providers/ldap/sdap_child_helpers.c
index 273fc67..5fd41b7 100644
--- a/src/providers/ldap/sdap_child_helpers.c
+++ b/src/providers/ldap/sdap_child_helpers.c
@@ -440,7 +440,7 @@ int setup_child(struct sdap_id_ctx *ctx)
     }
 
     if (debug_to_file != 0 && ldap_child_debug_fd == -1) {
-        ret = open_debug_file_ex("ldap_child", &debug_filep);
+        ret = open_debug_file_ex("ldap_child", &debug_filep, false);
         if (ret != EOK) {
             DEBUG(0, ("Error setting up logging (%d) [%s]\n",
                         ret, strerror(ret)));
diff --git a/src/util/debug.c b/src/util/debug.c
index d26d31c..b70a899 100644
--- a/src/util/debug.c
+++ b/src/util/debug.c
@@ -110,7 +110,7 @@ void ldb_debug_messages(void *context, enum ldb_debug_level level,
     free(message);
 }
 
-int open_debug_file_ex(const char *filename, FILE **filep)
+int open_debug_file_ex(const char *filename, FILE **filep, bool public)
 {
     FILE *f = NULL;
     char *logpath;
@@ -131,7 +131,7 @@ int open_debug_file_ex(const char *filename, FILE **filep)
 
     if (debug_file && !filep) fclose(debug_file);
 
-    old_umask = umask(0177);
+    old_umask = umask((public ? 0111 : 0177));
     f = fopen(logpath, "a");
     if (f == NULL) {
         free(logpath);
@@ -150,5 +150,5 @@ int open_debug_file_ex(const char *filename, FILE **filep)
 
 int open_debug_file(void)
 {
-    return open_debug_file_ex(NULL, NULL);
+    return open_debug_file_ex(NULL, NULL, false);
 }
diff --git a/src/util/util.h b/src/util/util.h
index 1f5573d..c548e07 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -199,7 +199,7 @@ safealign_memcpy(void *dest, const void *src, size_t n, size_t *counter)
 /* From debug.c */
 void ldb_debug_messages(void *context, enum ldb_debug_level level,
                         const char *fmt, va_list ap);
-int open_debug_file_ex(const char *filename, FILE **filep);
+int open_debug_file_ex(const char *filename, FILE **filep, bool public);
 int open_debug_file(void);
 
 /* from server.c */
-- 
1.6.6.1



More information about the sssd-devel mailing list