[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

[Freeipa-devel] #4389: DS deref broken after ACI refactoring

Hello all,

I would like to discuss what should we do with the latest issue we found in
SSSD-DS communication which is broken after the ACI refactoring.

I was working with Ludwig, there is a problem in the way how deref plugin
checks the access to the referenced entry. Instead of checking the target entry
itself, Ludwig found out that the deref plugin checks a dummy entry created
from the dereferenced DN, not the real entry. Details in DS ticket:

Previously, we allowed read access globally so it worked fine. Now, when we
have targeted ACIs using objectclass targetfilter, the access control goes
wrong, deref plugin does not return all attributes and SSSD does not work (see

Question is, what should we do in 4.0. We could have the DS team to fix the
deref plugin, but this would break SSSD connected to old RHEL/CentOs 6.x
replicas which would not have the fix. So we need to be cautious about this one.

I see couple ways:
1) Fix DS deref plugin in F20 and next RHEL 6.x and specify the RHEL-6.x as
minimal version of FreeIPA/DS required when replicating with FreeIPA 4.0. This
option is a bit clumsy.

2) Add temporary ACIs allowing access to attributes that SSSD needs for deref
calls. I tested it with Jakub's example call and it fixed this query:

# ipa permission-add --subtree
--right={read,search,compare} --attrs={objectclass,memberof,managedby}
--bindtype all deref_managedby
# kinit -kt /etc/krb5.keytab

# ldapsearch -Y GSSAPI -h vm-236.idm.lab.eng.brq.redhat.com -b
-E 'deref=managedBy:objectClass'
dn: fqdn=vm-086.idm.lab.bos.redhat.com,cn=computers,cn=accounts,dc=idm,dc=lab,
control: false MIQAAAEgMIQAAAEaBAltYW5hZ2VkQnkEaGZxZ
# managedBy: <objectClass=ipaobject>;<objectClass=ieee802device>;<objectClass

Jakub, what else would we need to allow? After this change, login/sudo seemed
to work for me on F20.

The ACIs would be removed when all our supported DS versions have the deref
plugin fixed.

Martin Kosek <mkosek redhat com>
Supervisor, Software Engineering - Identity Management Team
Red Hat Inc.

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]