-  **ADD** **method** FindGroupByIdInDomain(String domain, Int64 id)

     -  *id*: the group's GID

     -  returns: Path *group*: the path for the group object

     -  Error *org.freedesktop.Accounts.Error.Failed*: no such group

        exists

     name)

     -  *name*: the group's name

     -  returns: Path *group*: the path for the group object

     -  Error *org.freedesktop.Accounts.Error.Failed*: no such group

        exists

  Problem Statement

  -----------------

  domain is using the `AD

  provider <http://jhrozek.fedorapeople.org/sssd/1.11.0/man/sssd-ad.5.html>`__.

  However, in the default configuration of the Active Directory provider,

  ------------------------------

  With the existing SSSD, the administrator has two basic means to

  control

  provider <http://jhrozek.fedorapeople.org/sssd/1.11.0/man/sssd-simple.5.html>`__

  or configuring the LDAP access control provider. Each approach has its

  -  Cons:

     -  Account expiration is not checked

     -  Does not align with the LDAP structure the Active Directory uses

  Using the LDAP access provider

  The proposal is to add a new access filter configuration option to the

  existing AD access provider. Adding the option to the AD provider would

  greatly simplify the configuration when compared to the LDAP access

  ``ldap_access_filter``. The new option would be called

  ``ad_access_filter``. If the new option was set, then the AD access

  provider would first match the entry against the filter in that option.

  If the entry matched, then the account would be checked for expiration.

  using the proposed AD options: ::

          access_provider = ad

        denied access

     -  this test must include users from the primary domain as well as a

        sub domain

        filter applies

        -  example: add a restrictive filter for dom1 and permissive

  -  the computer is restarted

  -  the DHCP lease is renewed

     -  this is configurable in the windows registry using the

        ``DefaultRegistrationRefreshInterval`` key under the

        -  The other client's DNS records should remain intact in the DNS

           MMC console

  -------------------

  -  `Understanding aging and

  ---------

  The site discovery relies on client being part of subnet. It is not

  subnet. Still, these clients should be able to leverage the nearest AD

  site, even at the expense of manual configuration in ``sssd.conf``.

  interactive, remote interactive) and consisting of a whitelist [and

  blacklist] of users and groups that are allowed [or denied] access to

  the computer using the set's logon method. In order to integrate Windows

  mapped to a specific Logon Right. We provide default mappings for all of

  the commonly used pam service names, but we also allow the admin to

  add/remove mappings as needed (to support custom pam service names, for

     that contain the "Security Settings" CSE, which it feeds, one by one,

     to the SMB/CIFS Engine

  -  SMB/CIFS Engine: makes blocking libsmbclient calls to retrieve each

     cache (/var/lib/sss/gpo\_cache), from which the GPO Enforcement

     Engine will retrieve them

  -  GPO Enforcement Engine: enforces GPO-based access control by

     parsing it, and making an access control decision by comparing the

     user/groups against the whitelist/blacklist of the Logon Right of

     interest (which is based on the pam service name)

  can be set to "disabled" (neither evaluated nor enforced), "enforcing"

  (evaluated and enforced), or "permissive" (evaluated, but not

  enforced).The "permissive" value is the default, primarily to facilitate

  control rules and outputs a syslog message if access would have been

  denied. By examining the logs, administrators can then make the

  necessary changes before setting the mode to "enforcing".

        there is no cached version)

        -  Retrieves the policy file corresponding to the GPO

           (/var/lib/sss/gpo\_cache)

        -  Returns the fresh version to the backend, which stores it in

           the cache

     -  For each GPO

        -  Retrieves GPO's corresponding policy file (i.e. GptTmpl.inf)

        -  Parses policy file, extracting entries corresponding to the

           Logon Right of interest (determined by the pam service name)

        -  Enforces access control policy settings

  implementation, we should keep in mind that user-based GPOs could have a

  different refresh interval. As such, we would need to add a new

  configuration option ("computer\_gpo\_refresh\_interval") to the

  interval in seconds. This would specify the period to use in the

  By default, Microsoft sets this value to 90 minutes. It is an open issue

  as to whether we want to support the random offset interval or the

  ability to disable refresh altogether.

     retrieval takes place when returning to online mode from offline

     mode. This really depends on what we decide about the first two

     retrieval times above. If we aren't doing periodic refresh, and are

     not be needed. If we are doing periodic refresh, then we can set the

     "offline" parameter of be\_ptask\_create(...) to DISABLE (which means

     the task is disabled immediately when back end goes offline and then

     do here? If we wanted to log out the user, do we have an existing

     mechanism to do this?

  should we implement and how?

  -  sssd configuration options

     -  disable\_gpo\_refresh (default false)? Presumably, this would be

        done so that performance would not be adversely affected during

        the logon session. Alternatively, we could tell admins that wanted

        entry\_cache\_computer\_gpo\_timeout to zero (0), although this

        would not be how Microsoft interprets a zero value. Does sssd

        interpret '0' as "disable" elsewhere?

     -  if we didn't want to clutter sssd's configuration namespace, we

        could just use the standard Microsoft GPO that allows an admin to

        consistent configuration to a set of computers)

  Options

     -  suffers performance hit at initial startup and then periodically

     -  policy data likely to be stale

     -  requires implementation of periodic refresh, including refresh

  Recommendation

  --------------

  -  Test ad\_gpo\_cache\_timeout config option

        clean sysdb cache)

     -  make a change to a GPO policy setting so that the

        sysvol\_gpt\_version is incremented

  In other words, there will be 3 settings:

  **Maximum** number of worker processes **running**.

  Autofs is able to look up maps stored in LDAP. However, autofs does all

  the lookups on its own. Even though autofs uses the ``nsswitch.conf``

  configuration file, there is no glibc interface such as those for

  The benefits of the integration would be:

  The lookup modules are named ``<autofs library dir>/lookup_<source>.so``

  where ``<source>`` is the source name from the "automount:" line of

  ``lookup_sss.so`` and selected in nsswitch.conf with the directive

  ``automount: files sss`` (to allow for local client overrides) or just

  ``automount: sss``.

  The API provided by SSSD

  ------------------------

  library a little with functions that are not strictly

  name-service-switch related, but would allow us to reuse a fair amount

  of code and talk to the NSS responder socket easily.

  ^^^^^^^^^^^^^^^^^^^^^

  With user/group lookups, the domain can be specified by using a

  something similar with autofs. However, maps can include any characters

  that are valid for filesystem path names, including '@', so there's a

  potential conflict.

  -  FQDN requests will be allowed by default, but not required unless

     ``use_fully_qualified_names`` is set to TRUE

  -  The FQDN name-domain separator is @ by default, but SSSD allows it to

     parameter.

  The first iteration will aim at providing a working autofs integration

  for generic LDAP servers. There is a number of tasks that might not make

     will be used by all.

  2. A secondary implementation method that provides a DNS domain and the

     providing a list of servers:services. The helper will decide when it

     is time to refresh the SRV list.

  ----------------------

  A more technical extension of the previous section. Might include low-level

  details, such as C structures, function synopsis etc. In case of very

  previous one.

  Configuration changes

  -  Config validation

        the rest

        -  Autogenerate dp\_opts, man pages and configAPI sources from a

  A more technical extension of the previous section. Might include

  low-level details, such as C structures, function synopsis etc. In case

  with the previous one.

  Configuration changes

  -----------------

  Current state of data provider interface is not extensible enough to

  <https://docs.pagure.org/SSSD.sssd/design_pages/sssctl.html>`__.

  The main flaw that we aim to solve is to simplify adding of new methods,

  properties and possibly signals using our *sbus* interface. As a side

  -  make adding a new target automated and error proof

  -  make adding a new method automated and error proof

  -  create a proper talloc hierarchy so we can control clean up process

     initialization functions

  -  make method handlers pure tevent requests that returns single error

     code

  process parameters and *create a data provider request*. This request

  will call a data provider method handler which is a basic **tevent

  request**. When the request is finished, data provider tevent callback

  request result the reply message may be either error, sending an error

  code and message, or success where a default or *custom \_recv* function

  may be called to obtain and send additional attributes.

      ... asynchronous processing ...

      (tevent done) -> (dp request done) -> (error detected) -> (dbus error) -> Responder

  Data Provider Initialization

  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  This section describes what is needed to initialize data provider. It

  talks only about sections that may change in the future in order to

  extend SSSD's functionality, it does not describe how it works under the

  **1. Initialization of data provider modules and targets**

  #. Add new method (or interface) into data provider introspection file

     **dp\_iface.xml**

  #. Register this interface or method in **dp\_iface.c** by providing the

  #. (optionally if needed) Add new data provider method and/or target

     into **enum dp\_methods** and **enum dp\_targets** respectively

  #. Implement the method handler

  All parameters except memory context are combined into one structure to

  simplify possible future extensions (thus when a new parameter needs to

  be added we don't have to modify existing handler). The *data* in

  reply. For example, the following reply callback simulates current reply

  message which returns major and minor error together with error message. ::

  ~~~~~~~~~~~~~~~~~~~

  The memory hierarchy is known strictly specified and should not be

  data on SSSD exit. ::

                                     struct be_ctx

  a special message prefix: **DP Request [$name #$index]**. The $name is

  the name of the request (i.e. which method was called), $index is a

  cyclic number assigned to the request. When we run out of number we

  In the debugger we can monitor active data provider request, clients,

  modules and targets in **be\_ctx->provider**.

  -  **property** Uint32 min\_id

  -  **property** Uint32 max\_id

  -  **property** String realm

  -  **property** Boolean enumerable

  -  **property** Boolean use\_fully\_qualified\_names

  This section gathers feedback expressed in mailing lists, private e-mail

  conversations and IRC discussions and summarizes feature requests and

  areas that need improvement into a design proposal of both the DBus API

  Cached objects

  ~~~~~~~~~~~~~~

  Instead of a single interface returning object attributes in an

  LDAP-like way, the interface would be built in an object-oriented

  object path and methods would be available to the interface user to make

  it possible to retrieve either a single object or a set of object.

     -  *debug\_level*: Debug level to set

     -  returns: nothing

     -  note: changes will be permanent but do not require restart of the

  -  **property** String name

  -  **property** Uint32 min\_id

  -  **property** Uint32 max\_id

  -  **property** String realm

  -  **property** Boolean enumerable

  -  **property** Boolean use\_fully\_qualified\_names

  Synchronous getter behaviour

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  the value currently cached. The getter might schedule an out-of-band

  update depending on the state of the cache object. The primary reason

  for the getter being synchronous is to be able to be composable, in

  other words being able to call N getters in a loop and construct a reply

  of the properties.

  Callers that with to have an up-to-date view of the properties should

  method or subscribe to the PropertiesChanged interface.

  SSSD daemon features

  query. No other attributes will be returned. Requesting an attribute

  that is not permitted will yield an empty response, same as if the

  attribute didn't exist. The whitelist will include the standard set of

  The administrator will be allowed to extend the whitelist in sssd.conf

  using a configuration directive either in the ``[ifp]`` section itself

  #. Hook onto *PropertiesChanged* signal, e. g. with *dbus-monitor'̈́'*

  #. Trigger change of user/group

  Questions

  ~~~~~~~~~

  underlying library API. Libraries like libdbus or libdbus\_glib are

  quite complex and requires a lot of code to do even the simplest things.

  The purpose of this document is to describe a new public API to access

  a user doesn't have to deal with D-Bus at all.

  Prerequisites

  -  u gidNumber

  -  ao users

  **filter\_limit**. This option can be present in [ifp] and [domain]

  sections to set this limit for data provider filter searches ([domain]

  section) and also global hard limit for the listing methods itself

  databases so we process only a small number of records. If the option is

  set to 0, the limit is disabled.

  present on the beginning of the filter '\*filter', its end 'filter\*',

  both sides '\*filter\*' or even in the middle '\*fil\*ter\*', since it

  is supported by both LDAP and LDB. However, only prefix-filter

  may not perform so good with huge databases.

  Configuration changes

  Use cases

  ~~~~~~~~~

  workaround

  Overview of the solution

  busy answering many requests a queue may build up and replies be

  delayed.

  various reasons including:

  -  sssd uses LDB as caching backend and LDB depends on byte range locks.

  -  sssd stores data not all clients are allowed to get access to

     (password hashes for example) and partitioning access to this data

     within the LDB cache is not feasible.

  parallel within each process with synchronization (in order to allow

  updates) performed by using memory barriers.

  enumerations are \_never\_ handled via fast cache lookups by design,

  they always fallback to socket communication.

  Configuration

  -------------

  the caches.

  -  Per map cache size to fine tune the cache sizes in case space is at a

     premium or the dataset does not fit the default cache.

  -  Expiration time for entries.

  #. Failover from ``sss`` to ``files`` when SSSD is not running - this is

     the 'worst' case where ``sss`` is enabled in ``nsswitch.conf`` but

     ``sss`` to ``files`` for user lookups.

     -  Single lookup ::

            _nss_files_getpwnam cnt:100 avg:19 min:16 max:42 sum:1907 us

            _nss_sss_getpwnam cnt:100 avg:22 min:19 max:74 sum:2248 us

     memory cache is not used or not populated

     -  Single lookup ::

  Overview of the solution

  ------------------------

  FleetCommander consists on two components:

     for different users.

   * a client side component activated by SSSD, which applies all the

     profiles retrieved by the latter.

  will look for the user and all his groups. For performance reasons, we

  need to check if initgroups was performed prior to looking up the

  profiles and only issue another initgroups request if the user entry's

  The profiles will also be stored in the cache to allow offline

  processing. As an additional enhancement, we can skip writing the

  Since the Global Catalog lookups just replace the current lookup methods

  SSSD should just behave as before (Regression testing).

  level.

  AD provider

  different SIDs or at no SIDs at all.

  For example Active Directory users might not be able to access their

  UNIX IDs not the current ones.

  After this feature is implemented administrator's action will not be

     domains that SID belongs to.

  -  If such list is not empty then check if SID matches against secondary

     ranges of these domains and perform similar computation of UNIX ID as

     is generated and its identifier string is *domain\_sid-$first\_rid*

     where $first\_rid is **((int)(RIDofSID / range\_size)) \*

     range\_size**.

  Introduce new struct **idmap\_range\_params** that holds all relevant

  information for slice ranges, such as:

  -  char \*range\_id

  -  uint32\_t first\_rid

  Problem Statement

  ~~~~~~~~~~~~~~~~~

  share it might become necessary when working with files on the share,

  e.g. when modifying ACLs. Up to version 5.8 the cifs-utils package uses

  Winbind for this exclusively and the following binaries were linked

  With version 5.9 of cifs-utils a plugin interface was introduced by Jeff

  Layton (Thank you very much Jeff) to allow services other than winbind

  to allow the cifs-utils to ask SSSD to map the ID. With this plugin an

  SSSD client can access a CIFS share with the same functionality as a

  client running Winbind.

     ID mapping calls. Although it might be possible possible to map IDs

     algorithmically without talking to SSSD I think those calls should

     also reach out to SSSD to do the mapping. The main reason is to allow

     AD). ::

        57 /*

       123  * cifs_idmap_sids_to_ids - convert struct cifs_sids to struct cifs_uxids

       124  * @handle - context handle

       125  * @sid    - pointer to array of struct cifs_sids to be converted

       127  * @cuxid  - pointer to preallocated array of struct cifs_uxids for return

       128  *

       129  * This function should map an array of struct cifs_sids to an array of

       151  *

       152  * This function should map an array of cifs_uxids an array of struct cifs_sids.

       153  * Returns 0 if at least one conversion was successful and non-zero on error.

       155  * number set to 0.

       156  *

       157  * On any error, the plugin should reset the errmsg pointer passed to the

  If there is no plugin for the CIFS client utilities or the plugin cannot

  resolve the SIDs to names getcifsacl will only show the SID strings in

      # getcifsacl /tmp/bla/Users/Administrator/Desktop/putty.exe

      REVISION:0x1

  The following switches can be used to test the functions mentioned in

  the implementation section: ::

        -i, --user-info=USER                  Get user info

            --group-info=GROUP                Get group info

        -r, --user-groups=USER                Get user groups

  Additional links

  Now the AD provider code can be used to lookup up the users and group of

  the trusted AD domain. Only the ID-mapping logic should be refactored so

  that the same code can be used in the standalone AD provider where the

  where the idrange objects read from the IPA server dictates the mapping.

  Maybe libsss\_idmap can be extended to handle idranges for mappings in

  AD as well, e.g. a specific error code can be used to indicate to the

  accordingly.

  Additional the code paths where new subdomains are created must be

  is set according to the range type.

  Although I think that the code path where an IPA client (i.e.

  The identity of the ccache owner is read from the client socket connection.

  However, because in containerized environments, the same ID can often

  identify multiple apps, it is important to also track the SELinux label

  the same ID but different SELinux label to access each other's credentials.

  not be used in production. If the persistent storage in sssd-secrets (which

  is the default) is used, the KCM responder is allowed to idle-terminate.

  in the form of ``http://localhost/kcm/persistent/$uid`` where ``$uid``

  is the user ID of the user whose credentials are being saved. In order to

  impersonate different users, the KCM responder runs as a trusted user

  user can access the ``/kcm`` hive in the sssd-secrets responder.

  The peer identity consists of an UID/GID tuple that is read from the

  ``SELINUX_getpeercon()``. To evaluate whether the MCS category the peer

  is running with can access the ccache potentially created with a different

  category, we'll call ``selinux_check_access()``.

  Internally in the secrets responder, the ccaches are stored at a new

  top-level anchor ``cn=kcm``. The secret responder's quotas on secrets

  also apply separately to the ``cn=kcm`` tree; separately here means

  time ``max_secrets`` credential caches. There is a `separate ticket

  <https://pagure.io/SSSD/sssd/issue/3363>`_ to make the quotas per-UID.

       principal : {

           "type": "number",

           "realm": "string",

       }

       creds : [

   # systemctl enable sssd-kcm.service

  Please note that starting the KCM socket auto-starts the sssd-secrets