[SSSD] [PATCHES][PRELIMINARY] Add support for Active Directory objectSID mappings

Stephen Gallagher sgallagh at redhat.com
Fri Apr 13 01:53:18 UTC 2012


First of all, these patches are definitely preliminary. I'm mainly
looking for input on whether I'm headed in the right direction.

Patch 0001: Add safe copy functions for 8-bit integers

Patch 0002: LDAP: Add objectSID config option
This patch is not complete (it needs manpages). This patch adds an
option to specify the objectSID attribute on the LDAP server, for use
when performing ID-mapping

Patch 0003: Add function to convert binary LDAP blob to a dom_sid
Does what it says on the box. It is designed to safely convert the
binary objectSID representation in LDAP into a struct dom_sid, with
alignment addressed.

Patch 0004: Add function to convert a dom_sid to its string
representation
I considered making the functions of patch 0003 and 0004 into a single
function, but I think it's possible we might want to use just one or the
other at some point. This function takes the dom_sid representation and
converts it to the "S-1-5-21-..." representation of a SID. It has one
limitation: the id_auths array can result in a 96-bit integer value, but
we can only support writing up to a 64-bit value without using
arbitrary-precision routines. That said, the IPA code makes the same
assumption I do that the upper bits aren't being used.

Patch 0005: Add option to enable id-mapping.
This patch is preliminary and requires a manpage to explain (among other
things) that enabling ID mapping disables support for explicit IDs (to
avoid collision issues).

Patch 0006: The meat of the work. This patch will almost certainly be
broken up into multiple patches before formal review, but right now it's
late and I'm tired.

This patch initializes the idmap context, reading the LDB for existing
mappings so that we guarantee that they end up in the same slice. It
also implements the logic for adding a new domain to the context, using
an algorithmic approach to pick the slice to use. This algorithm is
based on murmurhash3 + modulus to limit the result to the available
number of slices. If the hashing ends up colliding with an existing
entry, it will take the next available slice.

This is somewhat improved over the basic autorid algorithm in the common
case, because autorid simply always assigns the next slice in order to
each domain that is added. With this algorithm, a significant portion of
the time (when two domains don't hash to the same slice), we have a
simple and repeatable algorithm. The worst-case situation would be for
every domain in the network to hash to the same value, in which case it
becomes identical to autorid.

This patch does not USE the automatic creation yet. I used
sdap_save_user() as a test example and pre-loaded my cache file with a
domain mapping to prove that it is working. If my above algorithm is
approved, I will move on to implementing that (and group support)
immediately.

The catch with using this new algorithm is that we will most likely end
up needing to propose it as a winbind idmap plugin as well, so as to
minimize differences on systems in the network using winbind instead of
SSSD. I don't think this is a sufficient negative to give up on this
algorithm, however.

I'd like to hear some feedback on the algorithm and approach, please.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-UTIL-Add-safe-copy-functions-for-8-bit-integers.patch
Type: text/x-patch
Size: 1141 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120412/696e3d15/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-LDAP-Add-objectSID-config-option-Needs-manpage.patch
Type: text/x-patch
Size: 6089 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120412/696e3d15/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-LDAP-Add-function-to-convert-binary-LDAP-blob-to-a-d.patch
Type: text/x-patch
Size: 2874 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120412/696e3d15/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-LDAP-Add-function-to-convert-a-dom_sid-to-its-string.patch
Type: text/x-patch
Size: 3921 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120412/696e3d15/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-LDAP-Add-id-mapping-option-needs-manpage.patch
Type: text/x-patch
Size: 4753 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120412/696e3d15/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-PRELIMINARY-Add-support-for-ID-mapping-to-the-LDAP-p.patch
Type: text/x-patch
Size: 21549 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120412/696e3d15/attachment-0005.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120412/696e3d15/attachment.sig>


More information about the sssd-devel mailing list