[SSSD] [PATCH] IPA: verify group memberships of trusted domain users

Lukas Slebodnik lslebodn at redhat.com
Wed Dec 17 15:07:42 UTC 2014


On (16/12/14 10:47), Sumit Bose wrote:
>On Mon, Dec 15, 2014 at 10:41:25AM +0100, Lukas Slebodnik wrote:
>> On (12/12/14 11:04), Sumit Bose wrote:
>> >Hi,
>> >
>> >This patch tries to assure on IPA clients that users from trusted
>> >domains are really belong ot all groups they are member of and should
>> >fix https://fedorahosted.org/sssd/ticket/2529 .
>> >
>> >bye,
>> >Sumit
>> 
>> >From 57f82b2f316d78b1971d6d045c6662a54fe8a6a6 Mon Sep 17 00:00:00 2001
>> >From: Sumit Bose <sbose at redhat.com>
>> >Date: Thu, 11 Dec 2014 10:49:39 +0100
>> >Subject: [PATCH] IPA: verify group memberships of trusted domain users
>> >
>> >Depending on the state of the cache group object a freshly created or
>> >updates user entry for a trusted domain user might already be a member
>> >of the group or not. This cache makes sure the requested user is a
>> >member of all groups returned from the extdom request.
>> >
>> >Resolves https://fedorahosted.org/sssd/ticket/2529
>> >---
>> Your patch fixes problem just partially. There is still problem with external
>> group. I had similar problem with RESP_GROUP_MEMBERS in ticket #2524.
>> The main problem is that domain for storing result in sysdb needn't be the
>> same. In my case, external groups were stored to ad.domain instead of
>> ipa.domain. I fixed it with using right domain (attached patch)
>> 
>> There is still problem if two AD users are members of the same groups
>>  (especially external IPA group).
>> For the first user, groups are resolved due to RESP_GROUP_MEMBERS.
>> Membership for the second user is partially fixed by your patch for
>> RESP_USER_GROUPLIST, but external group is not fixed.
>> 
>> Let me show small example.
>> 
>> We have users aduser1 at ipaad2012.test and aduser2 at ipaad2012r2.test.
>> aduser1 connects with ssh to machine. group membership is resolved due to
>> RESP_GROUP_MEMBERS. The second user aduser2 connects to the same machine and
>> is member of the same groups. It will receive list of groups
>> (RESP_USER_GROUPLIST)
>>     list = { "aduser2 at ipaad2012.test", "domain users at ipaad2012.test",
>>              "adgroup1 at ipaad2012.test", "tgroup5" }
>> "tgroup5" is ipa group.
>> 
>> There are errors in log file::
>> [sysdb_update_members_ex] (0x0020): Could not add
>>     member [aduser2 at ipaad2012r2.test] to group [tgroup5]. Skipping.
>> [sysdb_update_members_ex] (0x0020): Could not add
>>     member [aduser2 at ipaad2012r2.test] to group [aduser2 at ipaad2012r2.test]. Skipping.
>> 
>> The reason why it failed is that sssd tried to update membership
>> in the group tgroup5 at ipaad2012.test, which does not exists.
>> 
>> I'm not sure what is right solution. In my opinion IPA server mode should
>> enable fully quallified names. So we sould be extract domain from group name
>> "tgroup5 at ipa.test", but it would not fix the bug in RESP_USER_GROUPLIST
>> it would need to be speacial cased. Another solution can be to change default
>> domain to ipa domain and search for subdomain where it is necessary.
>
>Thank you for the rigid testing. I've attached a new over of the patch
>which used the DNs of the groups to make sure they will be added to the
>cache in the right place.
>
>I've added a commit message to your patch and added it here as well.
>
>> 
>> BTW: the function ipa_s2n_save_objects is big enough. So it would be good to
>> extract your patch to static function. The another season for separate function
>> is ldb transaction.
>
>I agree, but I prefer to complete refactor ipa_s2n_save_objects() when
>all open issues related to group lookups on IPA clients are solved.
Fair enough

>Maybe it would be even better to schedule this for 1.13 for make fixing
>and backporting patches for upcoming issues in this area more easy. If
>you agree I'll open a ticket about it so it won't get lost.
OK

>From 58e0e132d291234f0bf6305e5410a68481fe50be Mon Sep 17 00:00:00 2001
>From: Sumit Bose <sbose at redhat.com>
>Date: Thu, 11 Dec 2014 10:49:39 +0100
>Subject: [PATCH 1/2] IPA: verify group memberships of trusted domain users
>
>Depending on the state of the cache group object a freshly created or
>updates user entry for a trusted domain user might already be a member
>of the group or not. This cache makes sure the requested user is a
>member of all groups returned from the extdom request. Special care has
>to be taken to cover cross-domain group-memberships properly.
>
>Resolves https://fedorahosted.org/sssd/ticket/2529
>---
Problem with two users which are in the same external group is fixed.
ACK

>From 37193dc35297bf9d552c67be2c5f2d80bc9c9e5a Mon Sep 17 00:00:00 2001
>From: Lukas Slebodnik <lslebodn at redhat.com>
>Date: Fri, 12 Dec 2014 13:07:55 -0500
>Subject: [PATCH 2/2] IPA: properly handle groups from different domains
>
>When groups are resolved on IPA clients as part of a user lookup not all
>groups have to be from the same domain as the used. This has to be
>checked to store the group object properly in the cache.
>
>Related to https://fedorahosted.org/sssd/ticket/2529
You can add ticket https://fedorahosted.org/sssd/ticket/2524 as well, but it is
not important.

I will not ACK my own patch :-)

LS



More information about the sssd-devel mailing list