[SSSD] [PATCHES] Support native IPA netgroups

Jan Zelený jzeleny at redhat.com
Fri Dec 9 10:00:24 UTC 2011


> On Dec 8, 2011, at 2:11 PM, Jr Aquino wrote:
> > On Dec 8, 2011, at 9:27 AM, JR Aquino wrote:
> >> On Dec 8, 2011, at 12:04 AM, Jan Zelený wrote:
> >>>>> I'm sending updated set of patches. All your comments were addressed,
> >>>>> I also added man page updates and one modification to
> >>>>> sdap_parse_search_base() which can be now used for at more places in
> >>>>> IPA provider.
> >>>>> 
> >>>>> 
> >>>>> Thanks
> >>>>> Jan
> >>>> 
> >>>> I am unable to get sssd to turn any netgroup over with: getent
> >>>> netgroup <netgroupname>
> >>>> 
> >>>> When I do a tcpdump, I don't see any attempt at communicating with the
> >>>> IPA server at all.
> >>>> 
> >>>> Am I missing some initiation value in the sssd.conf?
> >>> 
> >>> That's odd, could you please send your config file and sanitized logs?
> >>> 
> >>> Thanks
> >>> Jan
> >> 
> >> [sssd]
> >> services = nss, pam
> >> config_file_version = 2
> >> domains = example.com
> >> 
> >> [nss]
> >> 
> >> [pam]
> >> 
> >> [domain/example.com]
> >> cache_credentials = True
> >> ipa_domain = example.com
> >> id_provider = ipa
> >> auth_provider = ipa
> >> access_provider = ipa
> >> ipa_hostname = opsecutil1.example.com
> >> chpass_provider = ipa
> >> ipa_server = authmgr1.example.com
> >> ldap_netgroup_search_base = cn=ng,cn=compat,dc=example,dc=com
> >> ipa_hbac_refresh = 300
> > 
> >> this is all that i get out of /var/log/sssd/sssd_nss.log with debug_level 
8 when i tail -f and do a getent netgroup name:
> > OK!
> > 
> > sgallagh found a utf bug and got it fixed...
> > 
> > Now my log look like this:
> > 
> > (Thu Dec  8 14:02:05 2011) [sssd[nss]] [accept_fd_handler] (0x0100):
> > Client connected! (Thu Dec  8 14:02:05 2011) [sssd[nss]]
> > [sss_cmd_get_version] (0x0200): Received client version [1]. (Thu Dec  8
> > 14:02:05 2011) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered
> > version [1]. (Thu Dec  8 14:02:05 2011) [sssd[nss]] [setnetgrent_send]
> > (0x0100): Requesting info for netgroup [ops] from [<ALL>] (Thu Dec  8
> > 14:02:05 2011) [sssd[nss]] [lookup_netgr_step] (0x0100): Requesting info
> > for [ops at example.com] (Thu Dec  8 14:02:05 2011) [sssd[nss]]
> > [lookup_netgr_step] (0x0400): Returning info for netgroup [ops at example]
> > (Thu Dec  8 14:02:05 2011) [sssd[nss]] [nss_cmd_getnetgrent] (0x0100):
> > Requesting netgroup data (Thu Dec  8 14:02:05 2011) [sssd[nss]]
> > [nss_cmd_getnetgrent] (0x0400): Returning results for [ops] (Thu Dec  8
> > 14:02:05 2011) [sssd[nss]] [nss_cmd_getnetgrent] (0x0100): Requesting
> > netgroup data (Thu Dec  8 14:02:05 2011) [sssd[nss]]
> > [nss_cmd_getnetgrent] (0x0400): Returning results for [ops] (Thu Dec  8
> > 14:02:05 2011) [sssd[nss]] [client_recv] (0x0200): Client disconnected!
> > 
> > And my CLI looks like this:
> > 
> > [root at opsecutil1.ops ~]# getent netgroup ops
> > ops                   (-, -, example.com)
> > 
> > This ^ netgroup should be chalked FULL of hosts...
> > 
> > 
> > When I manually create a /Native/ netgroup and perform a look up, i DO
> > get the results.
> > 
> > [root at authmgr1 ~]# ipa netgroup-add testing
> > Description: test
> > ------------------------
> > Added netgroup "testing"
> > ------------------------
> > 
> >  Netgroup name: testing
> >  Description: test
> >  NIS domain name: example.com
> >  IPA unique ID: f58247ee-21e8-11e1-b338-9c8e9927cab0
> > 
> > [root at authmgr1 ~]# ipa netgroup-add-member --hosts=jump1.ops.example.com
> > testing
> > 
> >  Netgroup name: testing
> >  Description: test
> >  NIS domain name: example.com
> >  Member Host: jump1.ops.example.com
> > 
> > -------------------------
> > Number of members added 1
> > -------------------------
> > 
> > [root at opsecutil1.ops ~]# getent netgroup testing
> > testing               (jump1.ops.example.com, -, example.com)
> > 
> > I think the problem is the sssd native support for netgroups + managed
> > entries.
> > 
> > All of my netgroups are created via managed entries via hostgroups:
> > 
> > 
> > [root at authmgr1 ~]# ipa netgroup-find --all --raw ops --managed
> > --------------------
> > 14 netgroups matched
> > --------------------
> > 
> >  dn: cn=ops,cn=ng,cn=alt,dc=example,dc=com
> >  cn: ops
> >  description: ipaNetgroup ops
> >  nisdomainname: example.com
> >  ipauniqueid: e9135d68-1ac7-11e1-971a-9c8e9927cab0
> >  memberhost: cn=ops,cn=hostgroups,cn=accounts,dc=example,dc=com
> >  mepmanagedby: cn=ops,cn=hostgroups,cn=accounts,dc=example,dc=com
> >  objectclass: ipanisnetgroup
> >  objectclass: ipaobject
> >  objectclass: mepManagedEntry
> >  objectclass: ipaAssociation
> >  objectclass: top
> 
> After further inspection, I was able to get native netgroups to produce the
> same null entries if I added hostgroups to the netgroup.
> 
> It appears that sssd's native netgroup support, does not enumerate the
> contents of a member hostgroup contained inside of a netgroup.  The
> desired result is that the netgroup should contain a netgroup triple per
> host in the hostgroup.

Patch is on the list in a new thread. Thanks for catching this.

Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111209/6219dda7/attachment.sig>


More information about the sssd-devel mailing list