[SSSD] [PATCHES] Add Active Directory identity, auth and chpass providers to SSSD

Stephen Gallagher sgallagh at redhat.com
Mon Jul 2 14:37:08 UTC 2012


On Wed, 2012-06-27 at 21:51 -0400, Stephen Gallagher wrote:
> These patches add a new provider to SSSD: the AD provider. This provider
> is designed to simplify communication with Active Directory 2008 R2 and
> later. It may work with earlier versions of Active Directory, but we're
> not planning to test or support them.
> 
> This set of patches adds the identity, auth and chpass providers. I will
> be providing an access provider as well, but it's not ready and I wanted
> to land these patches sooner rather than later. I also have not added
> any manpages or the SSSDConfig API entries for the new options yet.
> Those are also still forthcoming.
> 
> This provider can be configured for testing as follows:
> {{{
> [domain/AD.DOMAIN]
> id_provider = ad
> auth_provider = ad
> chpass_provider = ad
> 
> ad_server = dc1.example.com, dc2.example.com, _srv_
> ad_domain = AD.DOMAIN
> case_sensitive = False
> }}}
> 
> That should be all the configuration needed. The ad_server line can be
> ommitted if SRV records for AD domain controllers exist in DNS. I'm
> working on a way to eliminate the need for 'case_sensitive = False' as
> well, but that's trickier than it sounds because it needs to be set in
> the NSS responder, not just the back-end.
> 
> Patches 0001-0005 are minor enhancements to utility.
> Patch 0001: Some logging enhancements for krb5_child
> Patch 0002: KRB5_LOCATOR: Print the filename that couldn't be opened
> Patch 0003: Drop memctx parameter of krb5_try_kdcip and fix a small
> memory leak in the process.
> Patch 0004: Converge the assorted IPA and KRB5 routines for setting up
> the online/offline handlers into a common function that can also be
> reused for the AD provider.
> Patch 0005: Just change the name of the "AD-compatible" schema map for
> the pure LDAP provider so it won't conflict with the one I'm adding to
> the AD provider.
> 
> 
> The following two patches add the "meat" of the new functionality. Sorry
> for the size of the patches, but I couldn't find a sensible way to break
> them up any further.
> 
> Patch 0006: Add AD identity provider
> Patch 0007: Add AD auth and chpass providers

Patches rebased atop the current master (some conflicts resolved with
the recently-pushed SUDO patches).
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-KRB5-Some-logging-enhancements-for-krb5_child.patch
Type: text/x-patch
Size: 3165 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120702/29f5376f/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-KRB5_LOCATOR-Print-the-filename-that-couldn-t-be-ope.patch
Type: text/x-patch
Size: 1069 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120702/29f5376f/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-KRB5-Drop-memctx-parameter-of-krb5_try_kdcip.patch
Type: text/x-patch
Size: 6199 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120702/29f5376f/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-KRB5-Create-a-common-init-routine-for-krb5_child-opt.patch
Type: text/x-patch
Size: 12535 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120702/29f5376f/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-LDAP-Rename-user-and-group-maps-for-AD.patch
Type: text/x-patch
Size: 2243 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120702/29f5376f/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-AD-Add-AD-identity-provider.patch
Type: text/x-patch
Size: 51298 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120702/29f5376f/attachment-0005.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0007-AD-Add-AD-auth-and-chpass-providers.patch
Type: text/x-patch
Size: 7290 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120702/29f5376f/attachment-0006.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120702/29f5376f/attachment.sig>


More information about the sssd-devel mailing list