[SSSD] [PATCHES] Add Active Directory identity, auth and chpass providers to SSSD

Simo Sorce simo at redhat.com
Mon Jul 2 16:02:42 UTC 2012


On Mon, 2012-07-02 at 10:37 -0400, Stephen Gallagher wrote:
> On Wed, 2012-06-27 at 21:51 -0400, Stephen Gallagher wrote:
> > These patches add a new provider to SSSD: the AD provider. This provider
> > is designed to simplify communication with Active Directory 2008 R2 and
> > later. It may work with earlier versions of Active Directory, but we're
> > not planning to test or support them.
> > 
> > This set of patches adds the identity, auth and chpass providers. I will
> > be providing an access provider as well, but it's not ready and I wanted
> > to land these patches sooner rather than later. I also have not added
> > any manpages or the SSSDConfig API entries for the new options yet.
> > Those are also still forthcoming.
> > 
> > This provider can be configured for testing as follows:
> > {{{
> > [domain/AD.DOMAIN]
> > id_provider = ad
> > auth_provider = ad
> > chpass_provider = ad
> > 
> > ad_server = dc1.example.com, dc2.example.com, _srv_
> > ad_domain = AD.DOMAIN
> > case_sensitive = False
> > }}}
> > 
> > That should be all the configuration needed. The ad_server line can be
> > ommitted if SRV records for AD domain controllers exist in DNS. I'm
> > working on a way to eliminate the need for 'case_sensitive = False' as
> > well, but that's trickier than it sounds because it needs to be set in
> > the NSS responder, not just the back-end.
> > 
> > Patches 0001-0005 are minor enhancements to utility.
> > Patch 0001: Some logging enhancements for krb5_child
> > Patch 0002: KRB5_LOCATOR: Print the filename that couldn't be opened
> > Patch 0003: Drop memctx parameter of krb5_try_kdcip and fix a small
> > memory leak in the process.
> > Patch 0004: Converge the assorted IPA and KRB5 routines for setting up
> > the online/offline handlers into a common function that can also be
> > reused for the AD provider.
> > Patch 0005: Just change the name of the "AD-compatible" schema map for
> > the pure LDAP provider so it won't conflict with the one I'm adding to
> > the AD provider.
> > 
> > 
> > The following two patches add the "meat" of the new functionality. Sorry
> > for the size of the patches, but I couldn't find a sensible way to break
> > them up any further.
> > 
> > Patch 0006: Add AD identity provider
> > Patch 0007: Add AD auth and chpass providers
> 
> Patches rebased atop the current master (some conflicts resolved with
> the recently-pushed SUDO patches).

0001 ACK
0002 ACK
0003 ACK
0004 ACK
0005 ACK

0006 NACK

1.
You should never allow to set a domain that differs from the realm name
in the AD provider, it is always assumed realm = domain in AD.

In AD both the realm and the domain are case insensitive however MIT
libs needs to use the Realm all upper case for compat reasons.

I think the best thing for now is to simply ignore KRB5_REALM (do not
even define AD_KRB5_REALM) and just always user the upper cased domain
for the realm variable unconditionally.


2.
This is not really a nack, but I noticed you are using only the basic
SRV records to resolve the DC. Please open a ticket to perform full DC
discovery, using CLDAP pings and handling 'sites'.


3.
I think we should also probably ignore SDAP_SASL_AUTHID and
SDAP_SASL_REALM, they are redundant in an AD environment I think, as you
cannot have arbitrary values in there.


4.
Do we really support sudo with AD ?


5.
We probably want to always set the canonicalize bit by default, also
should we turn off ldap_referrals by default ?

Everything else seem very close to the IPA provider so the code in
general is ok and needs only the mentioned minor fixes.


0007 NACK

1.
We should probably not support krb5_try_kdcip() in the AD provider.

2.
Remove AD_KRB5_REALM/KRB5_REALM and always use upper(domain)

The rest looks fine.


Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list