[SSSD] [PATCHES] Add Active Directory identity, auth and chpass providers to SSSD

Stephen Gallagher sgallagh at redhat.com
Thu Jun 28 01:51:27 UTC 2012


These patches add a new provider to SSSD: the AD provider. This provider
is designed to simplify communication with Active Directory 2008 R2 and
later. It may work with earlier versions of Active Directory, but we're
not planning to test or support them.

This set of patches adds the identity, auth and chpass providers. I will
be providing an access provider as well, but it's not ready and I wanted
to land these patches sooner rather than later. I also have not added
any manpages or the SSSDConfig API entries for the new options yet.
Those are also still forthcoming.

This provider can be configured for testing as follows:
{{{
[domain/AD.DOMAIN]
id_provider = ad
auth_provider = ad
chpass_provider = ad

ad_server = dc1.example.com, dc2.example.com, _srv_
ad_domain = AD.DOMAIN
case_sensitive = False
}}}

That should be all the configuration needed. The ad_server line can be
ommitted if SRV records for AD domain controllers exist in DNS. I'm
working on a way to eliminate the need for 'case_sensitive = False' as
well, but that's trickier than it sounds because it needs to be set in
the NSS responder, not just the back-end.

Patches 0001-0005 are minor enhancements to utility.
Patch 0001: Some logging enhancements for krb5_child
Patch 0002: KRB5_LOCATOR: Print the filename that couldn't be opened
Patch 0003: Drop memctx parameter of krb5_try_kdcip and fix a small
memory leak in the process.
Patch 0004: Converge the assorted IPA and KRB5 routines for setting up
the online/offline handlers into a common function that can also be
reused for the AD provider.
Patch 0005: Just change the name of the "AD-compatible" schema map for
the pure LDAP provider so it won't conflict with the one I'm adding to
the AD provider.


The following two patches add the "meat" of the new functionality. Sorry
for the size of the patches, but I couldn't find a sensible way to break
them up any further.

Patch 0006: Add AD identity provider
Patch 0007: Add AD auth and chpass providers
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-KRB5-Some-logging-enhancements-for-krb5_child.patch
Type: text/x-patch
Size: 3165 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120627/70f3acda/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-KRB5_LOCATOR-Print-the-filename-that-couldn-t-be-ope.patch
Type: text/x-patch
Size: 1069 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120627/70f3acda/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-KRB5-Drop-memctx-parameter-of-krb5_try_kdcip.patch
Type: text/x-patch
Size: 6199 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120627/70f3acda/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-KRB5-Create-a-common-init-routine-for-krb5_child-opt.patch
Type: text/x-patch
Size: 12535 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120627/70f3acda/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-LDAP-Rename-user-and-group-maps-for-AD.patch
Type: text/x-patch
Size: 2243 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120627/70f3acda/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-AD-Add-AD-identity-provider.patch
Type: text/x-patch
Size: 50879 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120627/70f3acda/attachment-0005.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0007-AD-Add-AD-auth-and-chpass-providers.patch
Type: text/x-patch
Size: 7290 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120627/70f3acda/attachment-0006.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120627/70f3acda/attachment.sig>


More information about the sssd-devel mailing list