sssd-users June 2013

sssd-users@lists.fedorahosted.org

6 participants
9 discussions

ldap_sasl_mech EXTERNAL and SSL client authc
by Michael Ströder 18 Mar '15

18 Mar '15

HI! Is it possible to use SASL/EXTERNAL when connecting to a LDAP server with StartTLS or LDAPS using client certs? In a project they have certs in all systems anyway (because of using puppet) and I'd like to let the sssd instances on all the systems authenticate to the LDAP server to restrict visibility of LDAP entries by ACL. I'd like to avoid having to set/configure passwords for each system's sssd. Ciao, Michael.

5 22

Announcing SSSD 1.11 beta 1
by Jakub Hrozek 28 Jun '13

28 Jun '13

=== SSSD 1.11 beta 1 === The SSSD team is proud to announce the first beta release of version 1.11 of the System Security Services Daemon. This pre-release does not bring any changes visible to the end-user. It is intended to be part of the development of FreeIPA 3.3 and its focus of supporting legacy (non-SSSD) clients in a setup where IPA server established a trust relationship with an Active Directory clients. The second beta will be released on July 17th with the final release coming up before the end of July. As always, the source is available from https://fedorahosted.org/sssd. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * The handling of ID ranges in the provides has been changed to use a plugin interface where each provider can use a different plugin and have a different behaviour * The libsss_idmap library has been enhanced in several ways such as handling "external mappings" or supporting base RIDs other than 0 * The assumption that subdomain users always have a primary user-private-group (UPG) has been removed * If the SSSD is running on the IPA server, it is able to perform lookups for trusted users directly against the AD server using the AD provider lookups == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1938 [RFE] Add a new call to libsss_idmap to add a new mapping where the first RID is not 0 https://fedorahosted.org/sssd/ticket/1960 [RFE] Add range type for ID mapping in AD to libsss_idmap https://fedorahosted.org/sssd/ticket/1961 [RFE] Add plugin to LDAP provider to find new ranges https://fedorahosted.org/sssd/ticket/1962 [RFE] Integrate AD provider lookup code into IPA subdomain user lookup https://fedorahosted.org/sssd/ticket/1979 [RFE] Add an optional unique range identifier https://fedorahosted.org/sssd/ticket/1993 [RFE] Add a new option to denote server mode == Detailed Changelog == Jakub Hrozek (11): * Updating the version for the 1.10.1 release * Bump version to track 1.11 development * IPA: Add a server mode option * LDAP: Add utility function sdap_copy_map * AD: decouple ad_id_ctx initialization * AD: initialize failover with custom realm, domain and failover service * IPA: Initialize server mode ctx if server mode is on * AD: Move storing sdap_domain for subdomain to generic LDAP code * IPA: Create and remove AD id_ctx for subdomains discovered in server mode * IPA: Look up AD users directly if IPA server mode is on * Updating translations for the 1.11 beta1 release Sumit Bose (18): * idmap: allow first RID to be set * idmap: add optional unique range id * idmap: add option to indicate external_mapping * idmap: allow NULL domain sid for external mappings * idmap: add calls to check if ID mapping conforms to ranges * idmap: add sss_idmap_domain_has_algorithmic_mapping * Add cmocka based tests for libsss_idmap * Add now options ldap_min_id and ldap_max_id * SDAP IDMAP: Add configured domain to idmap context * Allow different methods to find new domains for idmapping * Add sdap_idmap_domain_has_algorithmic_mapping() * Replace SDAP_ID_MAPPING checks with sdap_idmap_domain_has_algorithmic_mapping * Add ipa_idmap_init() * Add support for new ipaRangeType attribute * Replace new_subdomain() with find_subdomain_by_name() * IPA: read ranges before subdomains * Save mpg state for subdomains * Read mpg state for subdomains from cache

1 0

Announcing SSSD 1.10.0
by Jakub Hrozek 27 Jun '13

27 Jun '13

=== SSSD 1.10.0 === The SSSD team is proud to announce the final release of version 1.10 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd. RPM packages will be made available for Fedora 19 and rawhide shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * The main focus of the 1.10 release was improving the Active Directory integration. - The Active Directory provider now includes support for Site-based discovery. This feature allows the Active Directory clients to find the most suitable Domain Controller to connect to. - Support for dynamic DNS updates in the Active Directory provider. This feature enables the clients to automatically update or refresh their DNS records stored in the AD server. - The Active Directory provider now includes support for retrieving identity information and authentication as users from trusted domains in the same forest. The SSSD looks up the information using the Global Catalog. - The group memberships for Active Directory users can optionally be read from the PAC during login. If the PAC is not available (such as when group membership is requested for a user who has never logged in), the SSSD falls back to using tokenGroups. To enable this feature, add "pac" to the list of configured services in the "[sssd]" section of the "sssd.conf" config file. - The Active Directory provider is able to autodiscover the NetBIOS (flat) name of the domain it connects to. The NetBIOS name is discovered automatically on startup. - The support for Enterprise Kerberos principals was added. Currently the enterprise principals are only enabled by default in the Active Directory provider * A new library, called libsss_nss_idmap was introduced. This library allows the user to convert Windows Security Identifiers (SIDs) to names and vice versa. The library also includes Python bindings. * A new option "ipa_dyndns_ttl" was added, allowing the client to set a custom TTL on IPA dynamic DNS updates * A new "ignore_group_members option" was added. This option can be used to suppress downloading group members on group lookups, making the group lookups much faster for environments that do not need to know the group members. * A new option "ldap_rfc2307_fallback_to_local_users" was added. If this option is set to true, SSSD is able to resolve local group members of LDAP groups. * The "subdomain_homedir" configuration option gained a new template expansion "%F" that expands to the flat name (NetBIOS name) of the trusted AD domain * The "full_name_format" option now accepts a new parameter that expands to the NetBIOS name of the domain * The new "krb5_use_kdcinfo" option allows the administrator to disable the Kerberos locator plugin and rely on information read from the krb5.conf file completely. * A new option "ldap_disable_range_retrieval" was added. Switching this option to True skips large Active Directory groups that might otherwise take a long time to download and process. * A new option "refresh_expired_interval" was added. This option allows to configure a background task that would automatically refresh entries that are nearing their expiration time. In this release, only refreshing netgroups is implemented. * Setting the SELinux context on the IPA server now also works for users coming from a trusted Active Directory domain * Many internal interfaces were refactored, making the code more readable and maintainable in the long term. This refactoring includes the subdomains code, the sysdb interface as a whole, internal error code reporting, SELinux login context processing and processing of nested LDAP groups. == Packaging changes == * The shared components of the SSSD are now built as a shared library to reduce amount of duplicated code being linked into multiple SSSD binaries and lower the disk usage of SSSD installation. * The check that ensured that SSSD is running with the same ldb version it was built against was made optional, defaulting to false. You can enable the strict check again by selecting --enable-ldb-version-check during configure * The SSSD python ConfigAPI was moved to its own noarch subpackage to make the SSSD packaging more compliant with the Fedora packaging guidelines * The libsss_nss_idmap library and its Python bindings are packaged in separate subpackages * The upstream RPM specfile now packages each provider separately. The SSSD deamon and the responders are now included in the sssd-common package, while the sssd package has become a "meta package" that Requires all the existing providers for backwards compatibility. * The libsss_sudo and libsss_autofs libraries are now part of the sssd-common package == Tickets fixed == https://fedorahosted.org/sssd/ticket/1199 [RFE] Prune idle connections from responders https://fedorahosted.org/sssd/ticket/1693 sudoHost mismatch response is incorrect sometimes https://fedorahosted.org/sssd/ticket/1806 sssd_be goes to 99% CPU and causes significant login delays when client is under load https://fedorahosted.org/sssd/ticket/1815 "touch" krb5.conf file after installing new domain-realm mappings https://fedorahosted.org/sssd/ticket/1847 if there is no blank line at the end of /etc/sssd/sssd.conf, sssd wont start and you get an error in /var/log/messages about "sssd: Cannot load configuration database". https://fedorahosted.org/sssd/ticket/1849 improper use of negative value https://fedorahosted.org/sssd/ticket/1863 Dereference after a NULL check in krb5_child.c https://fedorahosted.org/sssd/ticket/1871 krb5 validation code always picks the first matching principal https://fedorahosted.org/sssd/ticket/1873 password migration is not working using sssd https://fedorahosted.org/sssd/ticket/1886 If previous SRV query failed, the next try might not be retried in some cases https://fedorahosted.org/sssd/ticket/1894 sssd_be crashes while processing ASQ dereference request https://fedorahosted.org/sssd/ticket/1931 cannot login to the 1st domain when 2 domains are configured in sssd https://fedorahosted.org/sssd/ticket/1936 GSSAPI working only on first login https://fedorahosted.org/sssd/ticket/1947 [abrt] sssd-1.10.0-4.fc19.beta1: get_server_status: Process /usr/libexec/sssd/sssd_be was killed by signal 11 (SIGSEGV) https://fedorahosted.org/sssd/ticket/1949 SSH host keys are not removed from cache when host is deleted in IPA https://fedorahosted.org/sssd/ticket/1953 System error while trying to auth as an expired user https://fedorahosted.org/sssd/ticket/1959 Enhance sssd init script so that it would source a configuration https://fedorahosted.org/sssd/ticket/1969 dead code in SRV resolution https://fedorahosted.org/sssd/ticket/1973 Improve global catalog DNS SRV lookups https://fedorahosted.org/sssd/ticket/1980 SSSD service randomly dies https://fedorahosted.org/sssd/ticket/1986 SYSV init script should use @sbindir@ https://fedorahosted.org/sssd/ticket/1989 Fix core dump in the PAC responder https://fedorahosted.org/sssd/ticket/1995 The PAC responder is contacted even for local IPA users. https://fedorahosted.org/sssd/ticket/364 [RFE] Recognize trusted domains in AD provider https://fedorahosted.org/sssd/ticket/453 Replace pam status codes with sssd specific codes https://fedorahosted.org/sssd/ticket/812 Support libnl 3.x https://fedorahosted.org/sssd/ticket/902 [RFE] Allow setting krb5_renew_interval with a delimiter https://fedorahosted.org/sssd/ticket/1032 [RFE] sssd should support DNS sites https://fedorahosted.org/sssd/ticket/1033 [RFE] implement a script/tool joining to the Active Directory domain https://fedorahosted.org/sssd/ticket/1287 compilation warnings with -O2 https://fedorahosted.org/sssd/ticket/1327 When multiple values are assigned, sss_debuglevel should display a usage message https://fedorahosted.org/sssd/ticket/1371 Missing resolv.conf should be non-fatal https://fedorahosted.org/sssd/ticket/1376 [RFE] Add support for suppressing group members https://fedorahosted.org/sssd/ticket/1405 [RFE] Kerberos canonicalization should be skipped on password-changes in AD provider https://fedorahosted.org/sssd/ticket/1414 [RFE] Improve syslog message when configuration cannot be loaded https://fedorahosted.org/sssd/ticket/1468 [RFE] AD: Should be able to log in as long or short domains https://fedorahosted.org/sssd/ticket/1476 SSSD has a much longer TTL when updating a DNS record than IPA client install placed in the beginning https://fedorahosted.org/sssd/ticket/1481 Move sss_cache to the main subpackage https://fedorahosted.org/sssd/ticket/1484 failover should protect against empty host names https://fedorahosted.org/sssd/ticket/1495 include talloc log in our debug facility https://fedorahosted.org/sssd/ticket/1504 [RFE] AD dyndns updates https://fedorahosted.org/sssd/ticket/1510 Split providers into their own subpackages https://fedorahosted.org/sssd/ticket/1557 [RFE] Use the Global Catalog in SSSD for the AD provider https://fedorahosted.org/sssd/ticket/1558 [RFE] Use MS-PAC to retrieve user's group list https://fedorahosted.org/sssd/ticket/1559 [RFE] Use the getpwnam()/getgrnam() interface as a gateway to resolve SID to Names https://fedorahosted.org/sssd/ticket/1575 Change responder contexts hierarchy https://fedorahosted.org/sssd/ticket/1586 Make authtoken opaque objects https://fedorahosted.org/sssd/ticket/1603 [RFE] Send user principal together with the PAC to the pac responder https://fedorahosted.org/sssd/ticket/1609 [RFE] Subdomain homedir template should be configurable/use flatname by default https://fedorahosted.org/sssd/ticket/1625 Confusing error messages for invalid sssd.conf https://fedorahosted.org/sssd/ticket/1643 Refactor sysdb interface https://fedorahosted.org/sssd/ticket/1648 Fully qualified account names form should be able to use flatname in the fq format https://fedorahosted.org/sssd/ticket/1660 LDAP_CONTROL_X_DEREF: sssd should fallback if server returns LDAP_UNAVAILABLE_CRITICAL_EXTENSION error https://fedorahosted.org/sssd/ticket/1712 sudoNotBefore/sudoNotAfter not supported by sssd sudoers plugin https://fedorahosted.org/sssd/ticket/1713 [RFE] Add a task to the SSSD to periodically refresh cached entries https://fedorahosted.org/sssd/ticket/1733 [RFE] support autoconfiguring SUDO with ipa provider and compat tree https://fedorahosted.org/sssd/ticket/1738 Decrease the krb5_auth_timeout default value of 15 https://fedorahosted.org/sssd/ticket/1741 sss_cache doesn't support subdomains https://fedorahosted.org/sssd/ticket/1743 selinux: move all logic to responder, provider should only update db https://fedorahosted.org/sssd/ticket/1744 selinux: reuse IPA_HBAC_REFRESH or provide an alternative https://fedorahosted.org/sssd/ticket/1745 Unnecessary output is seen when invalid option is passed to sss_cache https://fedorahosted.org/sssd/ticket/1746 sss_* tools with use_fully_qualified_names should require fqdn https://fedorahosted.org/sssd/ticket/1747 Refactor subdomain interfaces https://fedorahosted.org/sssd/ticket/1756 append new line to error string from poptStrerror() https://fedorahosted.org/sssd/ticket/1763 check the return values of sysdb_transaction_commit in sysdb tests https://fedorahosted.org/sssd/ticket/1765 remove the alt_db_path parameter of sysdb_init https://fedorahosted.org/sssd/ticket/1766 use an explanatory macro for checking if a domain is a subdomain https://fedorahosted.org/sssd/ticket/1767 unify sss_mc_set_recycled https://fedorahosted.org/sssd/ticket/1771 Negative cache messages are displayed at too low of a DEBUG level https://fedorahosted.org/sssd/ticket/1772 Rename or alias the SAFEALIGN macros https://fedorahosted.org/sssd/ticket/1774 move processing of password expiration back to PAM provider only https://fedorahosted.org/sssd/ticket/1784 rewrite nested group processing to follow the tevent_req coding style https://fedorahosted.org/sssd/ticket/1785 NSCD warning is irritating https://fedorahosted.org/sssd/ticket/1786 Use new interface from ding-libs ini interface https://fedorahosted.org/sssd/ticket/1789 ldap_access_order improvements (man page fix) https://fedorahosted.org/sssd/ticket/1790 Possible null derefence in ipa_subdomains.c https://fedorahosted.org/sssd/ticket/1794 reuse open_cloexec elsewhere in the code https://fedorahosted.org/sssd/ticket/1797 Use hardened flags for building RPMs https://fedorahosted.org/sssd/ticket/1802 [abrt] sssd-1.9.3-1.fc18: talloc_abort: Process /usr/libexec/sssd/sssd_be was killed by signal 6 (SIGABRT) https://fedorahosted.org/sssd/ticket/1803 SSSD returns System Error if the ccachedir is not writable https://fedorahosted.org/sssd/ticket/1804 Filter out inappropriate multicast and subnet broadcast addresses from IPA dynamic DNS update https://fedorahosted.org/sssd/ticket/1805 [RFE] Add a new override_homedir expansion for the "original value" https://fedorahosted.org/sssd/ticket/1809 Document that SSSD domains should only be named using ASCII characters https://fedorahosted.org/sssd/ticket/1810 Uninitialized scalar variable in responder_get_domain https://fedorahosted.org/sssd/ticket/1811 Unchecked return value in tests https://fedorahosted.org/sssd/ticket/1812 [RFE] make the get_next_domain() function a little more readable https://fedorahosted.org/sssd/ticket/1813 make the ldb check configurable https://fedorahosted.org/sssd/ticket/1816 Non-fatal errors looking up trusted domains with IPA back end https://fedorahosted.org/sssd/ticket/1819 Refresh doxygen template files https://fedorahosted.org/sssd/ticket/1820 sysdb unit tests uses system memberof https://fedorahosted.org/sssd/ticket/1823 getgrnam / getgrgid for large user groups is too slow due to range retrieval functionality https://fedorahosted.org/sssd/ticket/1825 Invalid assignment to enum https://fedorahosted.org/sssd/ticket/1830 make the authtok structure really opaque https://fedorahosted.org/sssd/ticket/1831 use the -v flag with nsupdate to force TCP transmission for better security https://fedorahosted.org/sssd/ticket/1832 [RFE] Provide a new option to update the reverse DNS zone in IPA domain https://fedorahosted.org/sssd/ticket/1833 segmentation fault in cmocka unit tests with raised optization level https://fedorahosted.org/sssd/ticket/1834 Support for libini 1.0 https://fedorahosted.org/sssd/ticket/1838 nss and pam clients broken in master https://fedorahosted.org/sssd/ticket/1839 Incorrect *.py[co] files placement https://fedorahosted.org/sssd/ticket/1840 Add --with-test-dir=/dev/shm to DISTCHECK_CONFIGURE_FLAGS https://fedorahosted.org/sssd/ticket/1842 Allow usage of enterprise principals https://fedorahosted.org/sssd/ticket/1843 Add exit value section to sss_ssh_* man page pages https://fedorahosted.org/sssd/ticket/1844 add a call to calculated the range for a given domain SID to libsss_idmap https://fedorahosted.org/sssd/ticket/1845 move libsss_sudo and libsss_autofs back into the main sssd package https://fedorahosted.org/sssd/ticket/1848 unused parameter in ipa_selinux handler https://fedorahosted.org/sssd/ticket/1860 pidfile() may leak memory on error https://fedorahosted.org/sssd/ticket/1861 potential out-of-bounds-write in sss_idmap_sid_to_dom_sid https://fedorahosted.org/sssd/ticket/1862 negative return in files.c https://fedorahosted.org/sssd/ticket/1864 Bad comparisons in checks found by new Coverity instance https://fedorahosted.org/sssd/ticket/1865 Logically dead code in tools_util.c https://fedorahosted.org/sssd/ticket/1867 document that AD provider is always case insensitive https://fedorahosted.org/sssd/ticket/1870 wrong failure handler in sdap_get_map https://fedorahosted.org/sssd/ticket/1877 ding-libs.dhash: uninitialized pointer read https://fedorahosted.org/sssd/ticket/1883 Add a new option to disable the Kerberos locator plugin completely https://fedorahosted.org/sssd/ticket/1888 freeipa 3.2 trusted ad user not listed in external group https://fedorahosted.org/sssd/ticket/1889 coverity: dead code in sudo client https://fedorahosted.org/sssd/ticket/1890 SSSD doesn't display warning for last grace login. https://fedorahosted.org/sssd/ticket/1891 unite periodic refresh API https://fedorahosted.org/sssd/ticket/1892 In IPA AD trust setup, the sssd logs throws 'sysdb_search_user_by_name failed' error when AD user tries to login via ipa client. https://fedorahosted.org/sssd/ticket/1897 Autenticity of ipa server can't be established https://fedorahosted.org/sssd/ticket/1900 Uninitialized scalar variable in idmap.c https://fedorahosted.org/sssd/ticket/1901 confdb: possible double free in new ini module https://fedorahosted.org/sssd/ticket/1905 pysss_nss_idmap improvements https://fedorahosted.org/sssd/ticket/1909 Clarify the AD site discovery in sssd-ad man page https://fedorahosted.org/sssd/ticket/1910 Clarify that AD DNS updates are performed using GSS-TSIG https://fedorahosted.org/sssd/ticket/1912 SUDO is not working for users from trusted AD domain https://fedorahosted.org/sssd/ticket/1913 SSSD crashes during nsupdate if the client hostname can't be resolved https://fedorahosted.org/sssd/ticket/1914 pysss_nss_idmap: Support also Unicode strings and return them by default https://fedorahosted.org/sssd/ticket/1915 Turn on dyndns updates by default in the AD provider https://fedorahosted.org/sssd/ticket/1921 Login failure: Enterprise Principal enabled by default for AD Provider https://fedorahosted.org/sssd/ticket/1922 sssd_be crashes when looking up users in the LDAP provider with ID mapping https://fedorahosted.org/sssd/ticket/1924 MAN: Make it clear which address is used to update DNS records https://fedorahosted.org/sssd/ticket/1927 Provide a script to create a SRPM without having to run configure https://fedorahosted.org/sssd/ticket/1928 Libtool fails to find dependent libraries https://fedorahosted.org/sssd/ticket/1929 Junk character in sssd_domain.log for domain string when sssd tries to go online from offline mode https://fedorahosted.org/sssd/ticket/1930 Crash with negative values in ldap_idmap_range_size https://fedorahosted.org/sssd/ticket/1934 sssd crashes if junk is present in sssd.conf https://fedorahosted.org/sssd/ticket/1950 segfault while processing ASQ request https://fedorahosted.org/sssd/ticket/1951 NetBIOS domain name should be read at startup https://fedorahosted.org/sssd/ticket/1971 Dereference before NULL check in nscd.c https://fedorahosted.org/sssd/ticket/1972 Dereference after a NULL check in tests/common_dom.c https://fedorahosted.org/sssd/ticket/1976 Copy-n-paste error in AD provider == Detailed Changelog == Abhishek Singh (4): * filename in comment is corrected * cmocka unittest for find_uid added * cmocka unittest for io added * Fix segmentation fault in test_io. Ariel Barria (4): * Improve syslog message when configuration cannot be loaded * Allow setting krb5_renew_interval with a delimiter * Confusing error messages for invalid sssd.conf * Removing BUILD.txt content Jakub Hrozek (144): * Bump version to 1.10dev * Require ar in configure.ac * TESTS: Fix a couple of debug-level setters * SYSDB: Remove unused macros * LDAP: Remove double break * Indentation fix * Bump the version and reset release back to 0 * tests: add a unit test for sysdb_netgroup_base_dn * tests: unit test for test_sysdb_search_users * tests: adda a unit test for test_sysdb_search_groups * tests: test sysdb_initgroups * tests: add unit test for sysdb_get_new_id * tests: unit test for sysdb_remove_attrs * TOOLS: set domain in check_group_names * Fix code style * Don't use srcdir with tests * krb5: include backwards compatible declaration of krb5_trace_info * LDAP: Check for authtok validity * Filter out multicast addresses from IPA DNS updates * Lower the DEBUG level if an entry cannot be deleted from memcache * Fix the krb5 password expiration warning * Remove enumerate=true from man sssd-ldap * Do not process success case in an else * Revert "Add debug message to autofs client" * Don't treat 0 as default for pam_pwd_expiration warning * Remove unused functions * Use the correct memory context in be_req_create * Check the return value of sysdb_search_services * Detect the presence of libcmocka during configure * Add utility functions for tests that use sysdb or tevent. * Move sss_cmd_execute from client to responder code. * CMocka based test for the NSS responder * Retry the correct service on krb5 child timeout * Remove duplicate remake from bashrc_sssd * Provide a be_get_account_info_send function * Add unit tests for simple access test by groups * Do not compile main() in DP if UNIT_TESTING is defined * Resolve GIDs in the simple access provider * Return error code from ipa_subdom_store * Move signal.m4 from src/util to external * Document what does access_provider=ad do * Include config.h to build io.c on RHEL5 * selinux: Remove unused parameter * Updating the translations for the 1.10 alpha release * Updating the version for the 1.10 beta1 release * krb5 child: Use the correct type when processing OTP * pidfile(): Do not leak fd on error * Fix potential out-of-bounds write in sss_idmap_sid_to_dom_sid * Return errno, not -1 on failure in files.c * Check for correct variable name * Init failover with be_res options * Centralize resolv_init, remove resolv context list * dyndns: Fix initializing sdap_id_ctx * Check for the correct variables * Allocate PAM DP request data on responder context * LDAP: Always fail if a map can't be found * Put the override_homedir into an included xml file * Allow using flatname for subdomain home dir template * Fix simple access group control in case-insensitive domains * Make leak checks usable in tests that do not utilize check * tests: Fix the order of key/values * LDAP: do not invalidate pointer with realloc while processing ghost users * Convert the simple access check to new error codes * tests: Link the simple access tests with -ldl * Do not keep growing event context * Document the naming convention for SSSD domains * Document that the AD provider is case-insensitive * selinux: if no domain matches, make the debug message louder * Only try to relink ghost users if we're not enumerating * Display the last grace warning, too * Refactor dynamic DNS updates * Convert IPA-specific options to be back-end agnostic * dyndns: new option dyndns_refresh_interval * resolver: Return PTR record as string * dyndns: New option dyndns_update_ptr * dyndns: new option dyndns_force_tcp * dyndns: new option dyndns_auth * Split out the common code from timed DNS updates * Active Directory dynamic DNS updates * AD: Always initialize ID mapping * Only check UPN if enterprise principals are not used * Updating the translations for the 1.10 beta1 release * Update the version for the 1.10 beta2 release * Actually use the index parameter in resolv_get_sockaddr_address_index * Fix a typo in sssd-ad man page * tests: Do not set cwd twice * Enable the AD dynamic DNS updates by default * man: Clarify that AD dyndns updates are secured using GSS-TSIG * LDAP: Always initialize idmap object * Re-add a useful DEBUG message * man: Clarify the AD site discovery documentation * man: Note that IPA updates are secured with GSS-TSIG * Remove unneeded parameter of setup_child and namespace it * Fix dyndns timer initialization * IPA: Check for ENOMEM * Remove unneeded comment * FO: Fix setting status of duplicates * AD dyndns: extract the host name from URI * Add utility functions for formatting fully-qualified names * Check the validity of FQname format prior to using it * Allow flat name in the FQname format * Remove branching to improve readability * tests: Link fqnames_tests with libsss_test_common.la * Do not obfuscate calls with booleans * LDAP: sdap_id_ctx might contain several connections * LDAP: Refactor account info handler into a tevent request * LDAP: Pass in a connection to ID functions * LDAP: new SDAP domain structure * LDAP: return sdap search return code to ID * Move domain_to_basedn outside IPA subtree * New utility function sss_get_domain_name * LDAP: split a function to create search bases * LDAP: store FQDNs for trusted users and groups * Split generating primary GID for ID mapped users into a separate function * LDAP: Do not store separate GID for subdomain users * AD: Add additional service to support Global Catalog lookups * AD ID lookups - choose GC or LDAP as appropriate * AD: Store trusted AD domains as subdomains * rpm: Fold libsss_sudo and libsss_autofs back into the main SSSD package * dyndns: Fix NULL check * man: document the need to set ldap_access_order * A new option krb5_use_kdcinfo * Fix allocation check in the AD provider * rpm: Use hardened flags for RPM build * rpm: Split providers into separate subpackages * Update transifex URL to transifex.com * Updating translations for the 1.10 beta2 release * Bumping the version for the 1.10 final release * Use the correct talloc context when creating AD subdomains * AD: Fix segfault in DEBUG message * AD: Remove ad_options->auth options reference * rpm: couple of small fixes * Fix allocation check * Fix dp_copy_options * FO: Check the return value of send_fn * LDAP: Retry SID search based on result of LDAP search, not the return code * IPA: Do not download or store the member attribute of host groups * AD: kinit with the local DC even when talking to a GC * KRB5: guess UPN for subdomain users * AD: Write out domain-realm mappings * Fix compilation warning * Update the translations for the 1.10.0 release * Update the version for the 1.10.0 release * Updating the version for the 1.10.1 release James Hogarth (1): * Make TTL configurable for dynamic dns updates Jan Cholasta (8): * LDAP: If deref search fails, try again without deref * Add exit status section to sss_ssh_* man pages * UTIL: Add function sss_names_init_from_args * SSH: Fix parsing of names from client requests * SSH: Use separate field for domain name in client requests * SSH: Do not skip domains with use_fully_qualified_names in host key requests * SSH: When host is removed from LDAP, remove it from the cache as well * SSH: Update known_hosts file after unsuccessful requests as well. Jan Engelhardt (1): * sysdb: try dealing with binary-content attributes John Hodrien (1): * Correct sss_ssh_knowhostsproxy typo in man pages Kamil Dudka (1): * sssd-1.8.0: work around a bug in cov-build from Coverity Lukas Slebodnik (37): * Improved readability of get_next_domain() * Fixed typo in debug message. * Removing unused parameter type from sudosrv_get_sudorules_query_cache() * Reuse sss_open_cloexec at other places in code. * More generalized function open_debug_file_ex() * Removing unused header file providers.h * Fix sss_client breakage. * Removing unused declaration of functions and variable. * Making the ldb check configurable * Fixing duplicate const * Reusing create_pam_data() on the other places. * Making the authtok structure really opaque. * LDAP: Fix value initialization warnings * Incorrect *.py[co] files placement * Fix krbcc dir creation issue with MIT krb5 1.11 * Default TEST_DIR to cwd, not empty string if not set explicitly * SUDO: IPA provider * Fixes compilation without selinux. * Fix broken build with selinux. * Fix segfault in AD Subdomains Module * Fixing critical format string issues. * Adding script to create a SRPM * Removing unused functions. * Adding option to disable retrieving large AD groups. * Making order in tests. * Remove empty directories after tests run. * Prevent segfault while processing ASQ request * Fix compilation with disabled link_all_deplibs. * Use deep copy for dns_domain and discovery_domain * Fix dereference after a NULL check in tests. * Change order of libraries in linking process. * Fix wrong detection of krb5 ccname * Every time return directory for krb5 cache collection. * Do not switch to credentials everytime. * Add missing argument to DEBUG message * Handle too many results from getnetgr. * Do not call sss_cmd_done in function check_cache. Michal Zidek (22): * sss_debuglevel: Multiple arguments are treated as error. * Include talloc log in our debug facility * failover: Protect against empty host names * sss_cache: Call DEBUG_INIT sooner * tools: Respect use_fully_qualified_names * Possible null derefence in ipa_subdomains.c. * Unchecked return value in files.c * Use the same dbg level for all ncache hits. * Remove the alt_db_path parameter of sysdb_init * File descriptor leak in nss responder. * Debug message in sss_mc_create_file. * Move SELinux processing to provider. * Reuse cached SELinux mappings. * Make the SELinux refresh time configurable. * tests: Print warning if LDB_MODULES_PATH is not set * Check for waitpid failure at wrong place. * Wrong condition after waitpid. * sss_cache: support for subdomains * sss_cache: Remove annoying messages * Inform about function duplication. * libsss_idmap: function to calculate range * Rename SAFEALIGN macros. Milan Cejnar (1): * tools: append new line to string from poptStrerror() Nathaniel McCallum (1): * Add support for krb5 1.11's responder callback. Ondrej Kos (25): * MAN: quotation fix * Display more information on DB version mismatch * SYSDB: split sysdb_add_user * TESTS: Fix coverity issues 13126, 13127 * TESTS: include error message on fail * Fix uninitialized time_t var in responder * krb5_child: fix value type and initialization * Fix initialization of multiple variables * Fix coverity issue 13136 * Decrease krb5_auth_timeout default * Update README file * LDAP: Fix value initialization * Provide libnl3 support * DB: Switch to new libini_config API * CONFDB: prevent double free * IDMAP: Fix variable initialization * Fix segfault in DYNDNS * DB: Fix segfault when configuration file cannot be parsed * Move nscd.c from tools to util * Check NSCD configuration file * Fail with misconfigured id-mapping ranges * MAN: state default dyndns interface * DB: Don't add invalid ranges * Don't test for NULL in nscd config check * KRB: Handle preauthentication error correctly Paul B. Henson (1): * Add ignore_group_members option. Pavel Březina (63): * sudo: do not hardcode protocol version * fix -O3 variable may be uninitialized warnings * sudo: print message if old protocol is used * sudo manpage: clarify that sudoHost may contain wildcards and not regular expression * use talloc_zfree when freeing rhostent in resolver * set ret to EOK after for loop in sdap_sudo_purge_sudoers * Fix LDAP authentication - invalid password length * set struct bet_info->bet_type * krb: recreate ccache if it was deleted * dp: check whether hostid backend is configured before filing be request * get_next_domain() test dom->parent->next for NULL * subdomains: replace invalid characters with underscore in krb5 mapping file name * if selinux is disabled, ignore that selogin dir is missing * sdap_fill_memberships: continue if a member is not foud in sysdb * Add debug message to autofs client * autofs: fix invalid header 'number of entries' in packet * build: require libcmocka on fedora 18+ * fix segfault in nss responder unit test * krb5-utils-tests: remove invalid condition * correct order in error_to_str table * do not leak memory on failure in *_process_init() * change responder contexts hierarchy * coding style fix * refactor nested group processing: add new code * refactor nested group processing: replace old code * resolv: add resolv_get_domain request to resolv utils * resolv: add resolv_discover_srv request to resolv utils * DNS sites support - SRV lookup plugin interface * DNS sites support - SRV DNS lookup plugin * fail over - add function to insert multiple servers to the list * DNS sites support - replace SRV lookup code with a plugin call * DNS sites support - use SRV DNS lookup plugin in all providers * DNS sites support - add IPA SRV plugin * sudo client: remove dead code * add fo_discover_servers request * IPA SRV plugin: use fo_discover_servers request * IPA SRV plugin: improve debugging * sdap: add sdap_connect_host request * add sss_ldap_encode_ndr_uint32 * DNS sites support - add AD SRV plugin * dns srv plugin: compare domain names case insensitive * AD SRV plugin: check if site name is empty * fo_discover_servers_send: don't crash when backup_domain is NULL * sudo responder: search rules for subdomains in parent domain subtree * back end: periodic task API * back end: periodical refresh of expired records API * back end: add refresh expired records periodic task * providers: refresh expired netgroups * be_ptask: send and recv shadow a global declaration * be_refresh: send and recv shadow a global declaration * failover: set state->out when meta server remains in SRV_RESOLVE_ERROR * subdomains: touch krb5.conf when creating new domain-realm mappings * nested groups: allocate more space if deref returns more members * handle ERR_ACCOUNT_EXPIRED properly * nested groups: do not return ENOMEM if num_groups is 0 * nested groups: do not expect any particular number of groups * failover: do not return invalid pointer when server is already present * failover: return error when SRV lookup returned only duplicates * collapse_srv_lookup may free the server, make it clear from the API * failover: if expanded server is marked as neutral, invoke srv collapse * init script: source /etc/sysconfig/sssd * fix dead code in fail_over_srv.c * sudo responder: use different callback for oob refresh Simo Sorce (132): * Add helpers to set common mc record fields * Save errno before it might be modified. * Revert "Avoid accessing half-deallocated memory when using talloc_zfree macro." * Avoid duplicating macros * Avoid const warnings when deallocating memory * Fix tevent_req style for krb5_auth * Fix ipa_subdomain_id names and tevent_req style * Fix tevent_req style for get_netgroup in ipa_id * Streamline ipa_account_info handler * Use an entry type mask macro to filter entry types * Fix comment on wrong line * Remove redundant definition. * Fix tevent_req style for sdap_async_sudo. * Remove unhelpful vtable from sss_cache * Remove dead netgroup functions * Revert "Add a default section to a switch-statement" * Add sysdb_search_service() helper function * Use sysdb_search_service() for all svc queries * Fix sdap reinit. * Code can only check for cached passwords * Add function to safely wipe memory. * Add authtok utility functions. * Change pam data auth tokens. * Use new sysdb_search_service() in sss_cache * The Big sysdb/domain split-up! * Refactor sysdb initialization * Refactor single domain initialization * Remove the sysdb_ctx_get_domain() function. * Make sysdb_user_dn() require a domain explictly. * Make sysdb_group_dn() require a domain explictly. * Make sysdb_netgroup_dn() require a domain explictly. * Make sysdb_netgroup_base_dn() require a domain. * Make sysdb_domain_dn() require a domain. * Make sysdb_custom_dn() require a domain. * Make sysdb_custom_subtree_dn() require a domain. * Move range objects into their own top-level tree. * Upgrade DB and move ranges into top level object * Pass domain to sysdb_get<pw/gr>nam() functions * Pass domain to sysdb_get<pwu/grg><id() functions * Pass domain to sysdb_enum<pw/gr>ebt() functions * Add domain option to sysdb_get/netgr/attrs() fns * Add domain argument to sysdb_initgroups() * Add domain argument to sysdb_get_user_attr() * Add domain to sysdb_search_user_by_name() * Add domain to sysdb_search_user_by_uid() * Add domain to sysdb_search_group_by_name() * Add domain to sysdb_search_group_by_gid() * Add domain arg to sysdb_search_netgroup_by_name() * Add domain argument to sysdb_set_user_attr() * Add domain argument to sysdb_set_group_attr() * Add domain argument to sysdb_set_netgroup_attr() * Add domain argument to sysdb_get_new_id() * Add domain argument to sysdb_add_basic_user() * Add domain argument to sysdb_add_user() * Add domain arguments to sysdb_add_group functions. * Add domain arguments to sysdb_add_inetgroup fns. * Add domain argument to sysdb_store_user() * Add domain argument to sysdb_store_group() * Add domain arg to sysdb group member functions * Add domain argument to sysdb_cache_password() * Add domain argument to sysdb_cache_auth() * Add domain argument to sysdb_store_custom() * Add domain argument to sysdb_search_custom() * Add domain to sysdb_delete_custom * Add domain arg to sysdb_search_users() * Add domain argument to sysdb_delete_user() * Add domain argument to sysdb_search_groups() * Add domain argument to sysdb_delete_group() * Add domain arg to sysdb_search/delete_netgroup() * Add domain argument to sysdb_has/set_enumerated() * Add domain argument to sysdb_remove_attrs() * Add domain argument to sysdb_idmap_ funcitons * Add domain arguemnt to sysdb_get_real_name() * Add domain argument to sysdb autofs functions * Add domain argument to sysdb selinux functions * Add domain arguments to sysdb services functions * Add domain arguments to sysdb ssh functions * Add domain arguments to sysdb sudo functions * Add domain to some subdomain functions * Pass the domain to upgrade functions * Move mpg flag to the domain where it belongs * Kill sysdb->domain * Stop creating fake sysdb contexts * Tidy up BASE dn macros * Remove outdated code. * Move ldap provider access functions * Remove sysdb as a be context structure member * Remove sysdb as a be request structure member * Remove sysdb argument from ipa_host_info_send() * Remove unused structure * Remove sysdb argument from hbac_user_attrs_to_rule() * Remove sysdb arg from hbac_service_attrs_to_rule() * Remove sysdb arg from hbac_*host_attrs_to_rule() * Remove sysdb arg from ipa_hbac_service_info_send() * Remove sysdb arg from [ipa_]hbac_sysdb_save() * Remove sysdb argument from hbac_get_cached_rules() * Remove hbac_ctx_sysdb() * Remove hbac_ctx_be() * Remove hbac_ctx_ev() * Remove hbac_ctx_sdap_id_[ctx|op]() * Move hbac_ctx_is_offline() * Do not pass NULL to ipa_subdomain_retrieve() * Split simple_access_check function out * Pass domain not be_req to access check functions * Remove domain from be_req structure * Introduce be_req_terminate() helper * Add be_req_create() helper * Add be_req_get_be_ctx() helper. * Add be_req_get_data() helper funciton. * Make struct be_req opaque * Add realm info to sss_domain_info * Avoid sysdb_subdom in sysdb_get_subdomains() * Update main domain info in place * Refactor sysdb_master_domain_add_info() * Add sysdb_subdomain_store() function * Remove sysdb_subdom completely * Add function get_next_domain() * Add ability to disable domains * Change the way domains are linked. * Parent and subdomains use the same sysdb * Introduce IS_SUBDOMAIN() macro * krb5_child style fix * Refactor krb5 child * Add SSSD specific error codes and definitions * Use SSSD specific errors for offline auth * Return ERR_INTERNAL instead of EIO * Cleanup error message handling for krb5 child * Improve IS_SSSD_ERROR() macro * Use common error facility instead of sdap_result * Convert sdap_access to new error codes * ldap: Fallback option for rfc2307 schema * Further restrict become_user drop of privileges. Stef Walter (1): * Add a domain config attribute for realmd Stephen Gallagher (13): * LDAP: Better debug logging when saving groups * Correct format security for talloc_named of auth tokens * Fix minor grammar error in log * NSS: Add original homedir to home directory template options * BUILD: Build shared components as an internal shared library * BUILD: Add contributed macros and aliases to simplify building * BUILD: Include build aliases in the tarball * BUILD: Fix cmocka detection * BUILD: Fix up whitespace in Makefile.am * BUILD: Always run distcheck and RPM tests in /dev/shm * Remove old hash support from example spec * Add 'description' attribute to SSSDConfig API * Configure SYSV init scripts properly Sumit Bose (54): * Add a default section to a switch-statement * Fix and rename get_my_domain_data() * Refactoring: remove duplicated code in nss responder * Allow usage of enterprise principals * Make IPA SELinux provider aware of subdomain users * Add override_homedir.xml to po4a.cfg * Remove unused TALLOC_CTX from responder_get_domain() * responder_get_domain: do not return disabled domains * responder_get_domain(): remove timeout calculation * LDAP: always store SID if available * Add secid filter to responder-dp protocol * Add two new request types to the data-provider interface * Add idmap context to nss context * Add responder_get_domain_by_id() * sysdb: add sysdb_search_object_by_sid() * Add sss_ncache_set_sid() and sss_ncache_check_sid() * Remove unused attribute list * Use struct to hold different types of request parameters * Add SID related lookups to IPA subdomains * Add SID related calls to the NSS responder * Add client library for SID related lookups * Add python interface to libsss_nss_idmap * AD: read flat name and SID of the AD domain * Add missing \n to debug string * Fix missing initialization in Python bindings for libsss_nss_idmap * Add support for tuples and unicode pysss_nss_idmap.so * Always update cached upn if enterprise principals are used * Fix return code for AD subdomain request * pysss_nss_idmap: do not treat strings as sequences * IPA: Always initialize ID mapping * Handle SID strings in sdap_attrs_get_sid_str() as well * IPA: read user and group SID * Add SID related requests to the LDAP provider * Set canonicalize flag if enterprise principals are used * Lookup domains at startup * Add be request queue * Use queue for get_subdomains * Read SIDs of groups with sysdb_initgroups() as well * Enhance PAC responder for AD users * Intermittent fix for get_user_and_group_users_done * Always send the PAC to the PAC responder * Implicitly activate the PAC responder for AD provider * Fix some doxygen warnings * Use principal from the ticket to find validation entry * Set default realm for enterprise principals * PAC: do not expect that sysdb_search_object_by_sid() return ENOENT * PAC: do not delete originalDN or cached password if present * KRB5: use the right authtok type for renewals * Fix typo in pack_authtok() * Revert "Always send the PAC to the PAC responder" * krb5: do not send pac for IPA users from the local domain * krb5: do not use enterprise principals for renewals * Revert "Implicitly activate the PAC responder for AD provider" * Use forest for GC SRV lookups Thorsten Scherf (1): * Updated Doxygen configuration to 1.8.1 Yuri Chornoivan (3): * Fix typos in man pages * Fix minor typos * Fix minor typos

1 0

ldap_access_filter with pattern
by Joke de Buhr 13 Jun '13

13 Jun '13

hi, i'm using sssd (1.9.4 fedora 18). i was wondering if sssd supports any kind of pattern in the ldap_access_filter directive to check access based on the pam service name being accessed. for example: ldap_access_filter memberOf=cn=$service,ou=services,... i would like to check group membership rather than using an attribute like authorizedService. nss-pam-ldapd [1] supports this kind of pattern expansion for example [1] http://arthurdejong.org/nss-pam-ldapd/nslcd.conf.5 regards joke de buhr

2 1

Announcing SSSD 1.10.0 Beta 2
by Jakub Hrozek 11 Jun '13

11 Jun '13

=== SSSD 1.10 Beta 2 === The SSSD team is proud to announce the second beta release of version 1.10 of the System Security Services Daemon. This beta release includes the rest of the new features planned for 1.10. The features are mostly targeted at better integration with Microsoft Active Directory. As always, the source is available from https://fedorahosted.org/sssd. RPM packages will be made available for Fedora 19 and rawhide shortly. With this release, the 1.10 version is considered feature complete and the strings are frozen. We will release the final 1.10.0 version once we fix all the known crashes and regressions. The 1.10.0 release is tentatively scheduled for the end of this week. Because the short period between this beta and the final release would not allow the translators to provide updated translations, the strings will remain frozen even for the 1.10.1 release. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * The Active Directory provider now includes support for retrieving identity information and authentication as users from trusted domains in the same forest. The SSSD looks up the information using the Global Catalog. Currently this feature is only supported when the SSSD is connected to the forest root. * The group memberships for Active Directory users are read from the PAC during login. If the PAC is not available (such as when group membership is requested for a user who has never logged in), the SSSD falls back to using tokenGroups. * The Active Directory provider is able to autodiscover the NetBIOS (flat) name of the domain it connects to. The NetBIOS name is discovered automatically on startup. * The full_name_format option now accepts a new parameter that expands to the NetBIOS name of the domain * The new krb5_use_kdcinfo option allows the administrator to disable the Kerberos locator plugin and rely on information read from the krb5.conf file completely. * A new option ldap_disable_range_retrieval was added. Switching this option to True skips large Active Directory groups that might otherwise take a long time to download and process. * A new option refresh_expired_interval was added. This option allows to configure a background task that would automatically refresh entries that are nearing their expiration time. In this release, only refreshing netgroups is implemented. == Packaging Changes == * The Makefile has been amended so that it no longer uses overlinking which is disabled by default on some distributions (such as Debian and its derivatives) * The upstream RPM specfile now packages each provider separately. The SSSD deamon and the responders are now included in the sssd-common package, while the sssd package has become a "meta package" that Requires all the existing providers for backwards compatibility. * The libsss_sudo and libsss_autofs libraries are now part of the sssd-common package == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1510 Split providers into their own subpackages https://fedorahosted.org/sssd/ticket/1797 Use hardened flags for building RPMs https://fedorahosted.org/sssd/ticket/1976 Copy-n-paste error in AD provider https://fedorahosted.org/sssd/ticket/1883 Add a new option to disable the Kerberos locator plugin completely https://fedorahosted.org/sssd/ticket/1713 [RFE] Add a task to the SSSD to periodically refresh cached entries https://fedorahosted.org/sssd/ticket/1891 unite periodic refresh API https://fedorahosted.org/sssd/ticket/1789 ldap_access_order improvements (man page fix) https://fedorahosted.org/sssd/ticket/1972 Dereference after a NULL check in tests/common_dom.c https://fedorahosted.org/sssd/ticket/1971 Dereference before NULL check in nscd.c https://fedorahosted.org/sssd/ticket/1816 Non-fatal errors looking up trusted domains with IPA back end https://fedorahosted.org/sssd/ticket/1845 move libsss_sudo and libsss_autofs back into the main sssd package https://fedorahosted.org/sssd/ticket/364 [RFE] Recognize trusted domains in AD provider https://fedorahosted.org/sssd/ticket/1557 [RFE] Use the Global Catalog in SSSD for the AD provider https://fedorahosted.org/sssd/ticket/1558 [RFE] Use MS-PAC to retrieve user's group list https://fedorahosted.org/sssd/ticket/1951 NetBIOS domain name should be read at startup https://fedorahosted.org/sssd/ticket/1929 Junk character in sssd_domain.log for domain string when sssd tries to go online from offline mode https://fedorahosted.org/sssd/ticket/1928 Libtool fails to find dependent libraries https://fedorahosted.org/sssd/ticket/1950 segfault while processing ASQ request https://fedorahosted.org/sssd/ticket/1924 MAN: Make it clear which address is used to update DNS records https://fedorahosted.org/sssd/ticket/1648 Fully qualified account names form should be able to use flatname in the fq format https://fedorahosted.org/sssd/ticket/1930 Crash with negative values in ldap_idmap_range_size https://fedorahosted.org/sssd/ticket/1823 getgrnam / getgrgid for large user groups is too slow due to range retrieval functionality https://fedorahosted.org/sssd/ticket/1927 Provide a script to create a SRPM without having to run configure https://fedorahosted.org/sssd/ticket/1785 NSCD warning is irritating https://fedorahosted.org/sssd/ticket/1934 sssd crashes if junk is present in sssd.conf https://fedorahosted.org/sssd/ticket/1772 Rename or alias the SAFEALIGN macros https://fedorahosted.org/sssd/ticket/1909 Clarify the AD site discovery in sssd-ad man page https://fedorahosted.org/sssd/ticket/1921 Login failure: Enterprise Principal enabled by default for AD Provider https://fedorahosted.org/sssd/ticket/1905 pysss_nss_idmap improvements https://fedorahosted.org/sssd/ticket/1914 pysss_nss_idmap: Support also Unicode strings and return them by default https://fedorahosted.org/sssd/ticket/1922 sssd_be crashes when looking up users in the LDAP provider with ID mapping https://fedorahosted.org/sssd/ticket/1910 Clarify that AD DNS updates are performed using GSS-TSIG https://fedorahosted.org/sssd/ticket/1915 Turn on dyndns updates by default in the AD provider https://fedorahosted.org/sssd/ticket/1912 SUDO is not working for users from trusted AD domain https://fedorahosted.org/sssd/ticket/1468 [RFE] AD: Should be able to log in as long or short domains == Detailed Changelog == Jakub Hrozek (45): * Update the version for the 1.10 beta2 release * Actually use the index parameter in resolv_get_sockaddr_address_index * Fix a typo in sssd-ad man page * tests: Do not set cwd twice * Enable the AD dynamic DNS updates by default * man: Clarify that AD dyndns updates are secured using GSS-TSIG * LDAP: Always initialize idmap object * Re-add a useful DEBUG message * man: Clarify the AD site discovery documentation * man: Note that IPA updates are secured with GSS-TSIG * Remove unneeded parameter of setup_child and namespace it * Fix dyndns timer initialization * IPA: Check for ENOMEM * Remove unneeded comment * FO: Fix setting status of duplicates * AD dyndns: extract the host name from URI * Add utility functions for formatting fully-qualified names * Check the validity of FQname format prior to using it * Allow flat name in the FQname format * Remove branching to improve readability * tests: Link fqnames_tests with libsss_test_common.la * Do not obfuscate calls with booleans * LDAP: sdap_id_ctx might contain several connections * LDAP: Refactor account info handler into a tevent request * LDAP: Pass in a connection to ID functions * LDAP: new SDAP domain structure * LDAP: return sdap search return code to ID * Move domain_to_basedn outside IPA subtree * New utility function sss_get_domain_name * LDAP: split a function to create search bases * LDAP: store FQDNs for trusted users and groups * Split generating primary GID for ID mapped users into a separate function * LDAP: Do not store separate GID for subdomain users * AD: Add additional service to support Global Catalog lookups * AD ID lookups - choose GC or LDAP as appropriate * AD: Store trusted AD domains as subdomains * rpm: Fold libsss_sudo and libsss_autofs back into the main SSSD package * dyndns: Fix NULL check * man: document the need to set ldap_access_order * A new option krb5_use_kdcinfo * Fix allocation check in the AD provider * rpm: Use hardened flags for RPM build * rpm: Split providers into separate subpackages * Update transifex URL to transifex.com * Updating translations for the 1.10 beta2 release Jan Cholasta (4): * UTIL: Add function sss_names_init_from_args * SSH: Fix parsing of names from client requests * SSH: Use separate field for domain name in client requests * SSH: Do not skip domains with use_fully_qualified_names in host key requests Lukas Slebodnik (13): * Fixes compilation without selinux. * Fix broken build with selinux. * Fix segfault in AD Subdomains Module * Fixing critical format string issues. * Adding script to create a SRPM * Removing unused functions. * Adding option to disable retrieving large AD groups. * Making order in tests. * Remove empty directories after tests run. * Prevent segfault while processing ASQ request * Fix compilation with disabled link_all_deplibs. * Use deep copy for dns_domain and discovery_domain * Fix dereference after a NULL check in tests. Michal Zidek (1): * Rename SAFEALIGN macros. Ondrej Kos (8): * Fix segfault in DYNDNS * DB: Fix segfault when configuration file cannot be parsed * Move nscd.c from tools to util * Check NSCD configuration file * Fail with misconfigured id-mapping ranges * MAN: state default dyndns interface * DB: Don't add invalid ranges * Don't test for NULL in nscd config check Pavel Březina (5): * sudo responder: search rules for subdomains in parent domain subtree * back end: periodic task API * back end: periodical refresh of expired records API * back end: add refresh expired records periodic task * providers: refresh expired netgroups Stef Walter (1): * Add a domain config attribute for realmd Stephen Gallagher (2): * Remove old hash support from example spec * Add 'description' attribute to SSSDConfig API Sumit Bose (21): * AD: read flat name and SID of the AD domain * Add missing \n to debug string * Fix missing initialization in Python bindings for libsss_nss_idmap * Add support for tuples and unicode pysss_nss_idmap.so * Always update cached upn if enterprise principals are used * Fix return code for AD subdomain request * pysss_nss_idmap: do not treat strings as sequences * IPA: Always initialize ID mapping * Handle SID strings in sdap_attrs_get_sid_str() as well * IPA: read user and group SID * Add SID related requests to the LDAP provider * Set canonicalize flag if enterprise principals are used * Lookup domains at startup * Add be request queue * Use queue for get_subdomains * Read SIDs of groups with sysdb_initgroups() as well * Enhance PAC responder for AD users * Intermittent fix for get_user_and_group_users_done * Always send the PAC to the PAC responder * Implicitly activate the PAC responder for AD provider * Fix some doxygen warnings Yuri Chornoivan (1): * Fix minor typos

1 0

FreeIPA Training Series
by Martin Kosek 05 Jun '13

05 Jun '13

Hello FreeIPA and SSSD users, Our team just published FreeIPA&SSSD training presentations created in the event of finishing FreeIPA 3.0 and SSSD 1.9.2 back in beginning of 2013. I would like to welcome you to look at the presentations, they contain useful information with aim to help you with understanding, configuring or even debugging the features. All presentations were uploaded to the FreeIPA.org wiki: http://www.freeipa.org/page/Documentation#FreeIPA_Training_Series -- Martin Kosek <mkosek(a)redhat.com> Supervisor, Software Engineering - Identity Management Team Red Hat Inc.

1 0

Re: [SSSD-users] Problem with sssd and udev
by John Bossert 04 Jun '13

04 Jun '13

>> On Mon, May 20, 2013 at 08:59:28PM +0000, John Bossert wrote: >> /var/log/messages suggests that udev starts before sssd: >> >> May 17 16:54:07 seadv01-db01 kernel: udev: starting version 147 >> May 17 16:54:09 seadv01-db01 sssd: Starting up > On Tue, May 21, 2013 at 09:01:53 -0700, Jakub Hrozek wrote: > I haven't found the bug Stephen was referring to (though I remember > there was one as well) but if udev needs a remote user, then it should > be starting after the SSSD. Does this suggest a different bug - that sssd should be started before udev? If so, how should it be submitted?

3 3

sssd + PAM access.conf
by Bryan Harris 04 Jun '13

04 Jun '13

Hi all, I have the following lines in my file /etc/security/access.conf for the purpose of my testing. - : bryan.harris.adm : ALL - : ALL : ALL When I place the following into /etc/pam.d/sshd I can prevent my login. The error is "pam_access(sshd:account): access denied for user `bryan.harris.adm' from" which looks like exactly what I want to see. account required pam_access.so When I place the following into /etc/pam.d/sshd I can once again login just fine and access.conf seems to be ignored. account required pam_access.so listsep=, The motivation is that I want to only allow the AD group "Linux Admins" (without quotes) to be able to login. So eventually I want to get a line like - : @Linux Admins : ALL into my /etc/security/access.conf file. Can anyone explain how I can make this work properly? I doubt I can convince the Windows guys to not use spaces in their group names but I could try. Or is it better for me to just use ldap_access_filter and leave the security up to sssd? The reason I looked into access.conf was to have another security layer "just in case", but if that's redundant and unnecessary than I suppose I don't need any of this anyway. Bryan

3 3

passwd: Authentication token manipulation error
by Harris, Bryan L. 04 Jun '13

04 Jun '13

Howdy folks, I'm having an issue with password resets which I'm sorry to say I haven't been able to figure out by google search or searching the mailing list archives. I tried to make my sssd configuration as minimal as possible following the doc on the wiki about authenticating to 2008 AD server (see [3] below) and I used the keytab method and instead of editing PAM files I ran authconfig because I'm on Red Hat. When I switch (su - bryan.harris.adm) to my AD user and run passwd, it allows me to type both old and new passwords. Right away it says "Password change failed." Then after about 2 seconds it says "passwd: Authentication token manipulation error" on a new line. I found [1] and [2] below which seem similar to my issue. I have played a bit with my PAM options, but to no avail. Can anyone tell me what I'm doing wrong? I can post the huge log messages, I just didn't want the email to get too large straight away. [1] - https://bugs.launchpad.net/ubuntu/+source/libpam-krb5/+bug/826989 [2] - https://lists.fedorahosted.org/pipermail/sssd-users/2012-July/000041.html [3] - https://fedorahosted.org/sssd/wiki/Configuring%20sssd%20to%20authenticate%2… RHEL 6.4 pam-1.1.1-13 sssd-1.9.2-82 --- first off here is what I added to the my.great.domain zone in BIND --- _ldap._tcp 1D IN SRV 0 100 389 dc01 _ldap._tcp 1D IN SRV 0 100 389 dc02 _kerberos._tcp 1D IN SRV 0 100 88 dc01 _kerberos._tcp 1D IN SRV 0 100 88 dc02 _kpasswd._tcp 1D IN SRV 0 100 464 dc01 _kpasswd._tcp 1D IN SRV 0 100 464 dc02 _kerberos._udp 1D IN SRV 0 100 88 dc01 _kerberos._udp 1D IN SRV 0 100 88 dc02 _kpasswd._udp 1D IN SRV 0 100 464 dc01 _kpasswd._udp 1D IN SRV 0 100 464 dc02 The rest of the files below are on linux-server. --- /etc/pam.d/system-auth --- #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth sufficient pam_krb5.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account [default=bad success=ok user_unknown=ignore] pam_krb5.so account required pam_permit.so password requisite pam_cracklib.so maxrepeat=3 difok=4 lcredit=-1 ocredit=-1 ucredit=-1 dcredit=-1 try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow try_first_pass remember=24 use_authtok password sufficient pam_sss.so use_authtok password sufficient pam_krb5.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_oddjob_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so session optional pam_krb5.so --- /etc/pam.d/password-auth --- #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth sufficient pam_krb5.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account [default=bad success=ok user_unknown=ignore] pam_krb5.so account required pam_permit.so password requisite pam_cracklib.so maxrepeat=3 difok=4 lcredit=-1 ocredit=-1 ucredit=-1 dcredit=-1 try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok password sufficient pam_sss.so use_authtok password sufficient pam_krb5.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_oddjob_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so session optional pam_krb5.so --- /etc/krb5.conf --- [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = MY.GREAT.DOMAIN dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = yes [realms] MY.GREAT.DOMAIN = { } [domain_realm] my.great.domain = MY.GREAT.DOMAIN .my.great.domain = MY.GREAT.DOMAIN --- /etc/krb5.keytab --- # This has the keytab from the 2008 AD domain controller. --- /etc/sssd/sssd.conf --- [domain/default] cache_credentials = False krb5_realm = MY.GREAT.DOMAIN auth_provider = krb5 chpass_provider = krb5 debug_level = 9 [sssd] config_file_version = 2 domains = MY.GREAT.DOMAIN services = nss, pam debug_level = 9 [nss] filter_groups = root filter_users = root reconnection_retries = 3 debug_level = 9 [pam] reconnection_retries = 3 debug_level = 9 [domain/MY.GREAT.DOMAIN] enumerate = True cache_credentials = False id_provider = ldap access_provider = ldap ldap_access_filter = memberOf=CN=Linux Admins,OU=Security Groups,OU=Groups,OU=MYGROUP,DC=my,DC=great,DC=domain auth_provider = krb5 chpass_provider = krb5 debug_level = 9 ldap_schema = rfc2307bis ldap_force_upper_case_realm = True ldap_sasl_mech = gssapi ldap_sasl_authid = host/linux-server.my.great.domain(a)MY.GREAT.DOMAIN ldap_uri = ldap://dc01.my.great.domain/,ldap://dc02.my.great.domain ldap_user_name = sAMAccountName ldap_user_object_class = person ldap_group_object_class = group ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_modify_timestamp = whenChanged ldap_user_home_directory = unixHomeDirectory ldap_user_shell = loginShell ldap_user_principal = userPrincipalName ldap_user_gecos = displayName ldap_krb5_keytab = /etc/krb5.keytab ldap_krb5_ticket_lifetime = 86400 krb5_realm = MY.GREAT.DOMAIN #krb5_kpasswd = dc01.my.great.domain #krb5_server = dc01.my.great.domain,dc02.my.great.domain krb5_validate = true krb5_canonicalize = false krb5_renewable_lifetime = 7d krb5_lifetime = 24h krb5_use_fast = try --- grep -i error /var/log/secure --- May 30 08:43:26 linux-server passwd: pam_sss(passwd:chauthtok): system info: [Generic error (see e-text)] May 30 08:43:26 linux-server passwd: pam_sss(passwd:chauthtok): Password change failed for user bryan.harris.adm: 20 (Authentication token manipulation error --- /var/log/sss/* --- I am not sure what's relevant, I just posted some error lines. If needed I can (A) truncate the files + (B) re-run passwd and then post the results. I ignored the DNS errors after I noticed in the logs that it's correctly resolving everything afterwords because it does a lookup on the SRV record (which I added to my BIND server), or at least it looks to be correct AFAICS. ldap_child.log: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP ldap_child.log: Received error from KDC: -1765328359/Additional pre-authentication required ... sssd_nss.log: Got reply from Data Provider - DP error code: 3 errno: 19 error message: Subdomains back end target is not configured sssd_nss.log: Got reply from Data Provider - DP error code: 0 errno: 0 error message: Success ... sssd_MY.GREAT.DOMAIN.log: Could not get fully qualified name for host name linux-server.my.great.domain error [2]: No such file or directory, resolver returned: [4]: Domain name not found Thanks in advance, Bryan

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users June 2013