Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1684979 - The HBAC code requires dereference to be enabled and fails otherwise
Summary: The HBAC code requires dereference to be enabled and fails otherwise
Keywords:
Status: ON_QA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.6
Hardware: All
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: SSSD Maintainers
QA Contact: ipa-qe
URL:
Whiteboard:
Depends On:
Blocks: 1684981
TreeView+ depends on / blocked
 
Reported: 2019-03-04 04:09 UTC by Ahmed Nazmy
Modified: 2019-04-03 06:42 UTC (History)
9 users (show)

Fixed In Version: sssd-1.16.4-6.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1684981 (view as bug list)
Environment:
Last Closed:
Target Upstream Version:


Attachments (Terms of Use)

Description Ahmed Nazmy 2019-03-04 04:09:32 UTC
Description of problem:

In some situations we recommend "ldap_deref_threshold=0" setting for sssd for performance enhancement.

This setting when applied breaks ssh access to IdM clients, as it seems sssd's HBAC code doesn't work when de-reference is disabled.



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. enroll a machine to and IdM domain
2. set "ldap_deref_threshold=0" in sssd.conf and restart sssd
3. try to ssh to this machine


Actual results:

SSH access fails and errors similar to the below is captured on sssd debug logs:
~~~
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [objectClass]
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [cn]
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [fqdn]
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [serverHostname]
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaSshPubKey]
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_parse_range] (0x2000): No sub-attributes for [ipaUniqueID]
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55a082395c50], connected[1], ops[0x55a0823cfab0], ldap[0x55a08238ae60]
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_get_generic_op_finished] (0x2000): Total count [0]
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_op_destructor] (0x2000): Operation 28 finished
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [ipa_host_info_done] (0x0020): Server does not support deref
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_id_op_destroy] (0x4000): releasing operation connection
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [ipa_pam_access_handler_done] (0x0020): Unable to fetch  rules [5]: Input/output error
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [dp_req_done] (0x0400): DP Request [PAM Account #7]: Request handler finished [0]: Success
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [_dp_req_recv] (0x0400): DP Request [PAM Account #7]: Receiving request data.
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [dp_req_destructor] (0x0400): DP Request [PAM Account #7]: Request removed.
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [dp_req_destructor] (0x0400): Number of active DP request: 0
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [dp_pam_reply] (0x1000): DP Request [PAM Account #7]: Sending result [4][example.com]
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_process_result] (0x2000): Trace: sh[0x55a082395c50], connected[1], ops[(nil)], ldap[0x55a08238ae60]
(Sun Feb 24 14:27:03 2019) [sssd[be[example.com]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list
~~~

Expected results:

SSH access works fine (honoring HBAC rules) while derefrence control is set to zero.

Additional info:

Comment 3 thierry bordaz 2019-03-04 08:20:06 UTC
Just for recording, in case SSSD requires to use deref control and hit performance issue (long lasting ldap req) then we could investigate an improvement on DS side https://pagure.io/389-ds-base/issue/49951

Comment 4 Jakub Hrozek 2019-03-06 21:46:57 UTC
Upstream ticket:
https://pagure.io/SSSD/sssd/issue/3979

Comment 6 Jakub Hrozek 2019-03-27 20:37:39 UTC
* master:
  * 9d63616
  * 1eb3ae1
* sssd-1-16:
  * 2c97edb
  * eaceb6a


Note You need to log in before you can comment on or make changes to this bug.