From nw141292@sac.sfbay.sun.com Fri Jul 11 14:53:48 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6BLrm2W021555 for ; Fri, 11 Jul 2008 14:53:48 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6BLrij5024443; Fri, 11 Jul 2008 14:53:48 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K3V00J0P3HM9500@brm-avmta-1.central.sun.com>; Fri, 11 Jul 2008 15:53:46 -0600 (MDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K3V00GUJ3HL7410@brm-avmta-1.central.sun.com>; Fri, 11 Jul 2008 15:53:46 -0600 (MDT) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6BLrj05049780; Fri, 11 Jul 2008 14:53:45 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6BLrhLt021550; Fri, 11 Jul 2008 14:53:43 -0700 (PDT) Received: (from nw141292@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m6BLrh2V021546; Fri, 11 Jul 2008 14:53:43 -0700 (PDT) Date: Fri, 11 Jul 2008 14:53:43 -0700 (PDT) From: Nicolas Williams Subject: Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] To: PSARC-ext@sun.com Cc: sparks-discuss@opensolaris.org Message-id: <200807112153.m6BLrh2V021546@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 10035 I'm filing this fasttrack on behalf of Baban Kenkre. The timer is set to expire on 7/18/2008. The project team requests patch binding, though there is no intention to backport. 1. Introduction 1.1. Project/Component Working Name: NSS_AD: Name Service Module for AD 1.2. Name of Document Author/Supplier: Author: Baban Kenkre 1.3 Date: 11 July, 2008 2. Background Microsoft's Active Directory (AD) can be used as Solaris name service repository through nss_ldap by installing Microsoft's Services for Unix (SFU) or Microsoft's Identity Services for Unix on the AD server and configuring schema mapping on the Solaris clients. 3. Problem There are two main problems with using nss_ldap for AD name service. 1. nss_ldap can only access data from a single AD domain whereas in AD we could have several domains in an AD forest. An AD forest is a collection of domains with implicit trust relationship. A key requirement for AD interoperability is to reference data especially users and groups from across the forest and not just a single domain. 2. Another key requirement for Solaris AD interoperability is the use of native AD schema by Solaris clients for name service lookups. idmap service supports AD with native schema and therefore equivalent support is needed for name-service. The current implementation of nss_ldap module makes widespread use of RFC2307bis and other elements not native to AD (e.g. DUAProfiles). Therefore, modifying nss_ldap to support both i.e RFC2307bis and native AD codepaths would be difficult and error-prone. 4. Solution To address the problems stated above, this case proposes a new name service module for Solaris called nss_ad that will resolve name service requests by performing AD lookups for mappable data such as passwd, shadow and groups using the native AD schema and from across the AD forest. Support for the printers database will be addressed by a follow-on RFE. Native AD schema lacks equivalent classes and attributes for other nsswitch databases. A future project may add support for these databases where AD is extended with relevant schemas. 5. Out of scope o Supporting logons of Windows users onto Solaris system is beyond the scope of this case. Much more work is needed here including but not limited to (i) Support ephemeral UIDs/GIDs in lastlog, tmpfs (ii) support SIDs in audit trails (iii) username/groupname length limitations and so on. Till this is supported, users will continue to logon using traditional backends such as nis and ldap. However, by using nss_ad i.e. adding "ad" to the list of sources for passwd and group in nsswitch.conf(4) (e.g. passwd: files ldap ad) the Solaris client will be able to resolve Windows names and ephemeral UIDs/GIDs using the same getXbyY interfaces used to resolve Unixnames and ids. o nss_ad will not support SFU initially and will be limited to native AD schema. If SFU is deployed then nss_ldap must be used. o getXbysid() and getsidbyY() interfaces. o Front-end tools for name-service configuration. 6. Configuration o The Solaris client must be joined to an AD domain before any of the AD Interop functionality including nss_ad can be used. AD domain join can be done either using smbadm(1M) or the kclient(1M) tool. Thereafter, nss_ad can be used to resolve name service requests by specifying "ad" as the source in nsswitch.conf(4) file for supported databases. o nss_ad will initially auto-discover AD servers until a separate service is available that auto-discovers servers for all name service components. Such a service is beyond the scope of this case. o AD is also a KDC and Solaris AD client is a krb5 client of AD. Kerberos is automatically configured on the Solaris AD client at the time of AD join. nss_ad (like the idmap service) will use host credentials to lookup name service information in AD using SASL/ GSSAPI/KRB5. nscd must be enabled to use nss_ad. o nss_ad does not support the notion of default domain and therefore will require that all AD user and group names be qualified with domain names (i.e. user@domain or group@domain). nss_ad will neither accept nor return non-qualified user and group names. E.g. getpwnam("foo") will fail but getpwnam("foo@domain") will pass provided "foo@domain" is a valid Windows user. *Special case*: Well-known SIDs [1] are a set of SIDs that identify generic users or generic groups in the Windows world. They are not domain specific and their values remain constant across all Windows operating systems. nss_ad will accept these users and groups without any domain qualifier. The well-known user "Nobody" will not be accepted. o PSARC/2008/342 effectively added some support for ls(1) to display Windows user/group names (only for ACLs but not file owner/group), but this case adds support for any application using get{pw,gr}{nam,uid,gid}() to do the same. 7. Mapping to passwd(4) and shadow(4) Mapping of Windows user to passwd(4) form will be done as follows: o The Windows's user object belongs to objectClass "user". o Unix username (pw_name, sp_namp) is taken from the value of the "samAccountName" AD attribute of the user object, qualified with the name of the domain in which that object resides (e.g., "foo@example"). o nss_ad will use the idmap(1M) service to map Windows SID from AD attribute "objectSID" to POSIX UID (pw_uid). o The AD attribute "primaryGroupID" contains the RID of the user's primary group. This RID when appended to the domain SID gives the primary group's SID. nss_ad will use the idmap(1M) service to map this group SID to POSIX GID (pw_gid). "primaryGroupID" is not a mandatory attribute for Window's user therefore if it does not exists then nss_ad will use idmap's diagonal mapping facility to map the user SID to GID and use it for pw_gid. o pw_gecos field will use the full name of the Windows's user from the AD attribute "CN". o The AD attribute "homeDirectory" (if present) will contain the Windows user's home directory. If the homeDirectory string is in UNC format then nss_ad will convert it into a SMB URL and use it for pw_dir. See draft-crhertel-smb-url-12 [2]. We think using the SMB URL is okay because Solaris doesn't support logon of Windows users yet. If the homeDirectory refers to a local Windows directory indicated by the prefix "[A-Z]:\" (e.g. C:\Documents and Settings\foo) then pw_dir will be left empty. o There is no login shell in native AD schema. This field will be left empty. o The user password is not available in the AD object and therefore sp_pwdp will be "*NP*" and pw_passwd will be "x". o nss_ad will leave shadow fields empty (i.e. -1 for sp_lstchgst, sp_min, sp_max, sp_warn, sp_inact, sp_expire and 0 for sp_flag) because shadow fields are irrevalent with AD and krb5. 8. Mapping to group(4) Mapping of Windows group to group(4) form will be done as follows: o The Windows's group object belongs to objectclass "group". o Unix groupname (gr_name) is taken from the value of the "samAccountName" AD attribute of the group object, qualified with the name of the domain in which that object resides (e.g., "admins@example"). o nss_ad will use the idmap(1M) service to map Windows SID from AD attribute "objectSID" to POSIX GID (gr_gid). o The multi-valued AD attribute "member" contains LDAP DNs of objects representing the group's members. The Unix gr_mem list will be constructed by retrieving the "samAccountName" for each of these objects, with each name qualified with the name of the domain in which that object resides. o The gr_passwd field will be left NULL because the Windows group AD object does not contain the group's password. 9. Relevant ARC cases and CRs o 6722476 name service switch module for AD (nss_ad) needed o PSARC/2006/315 Winchester:ID Mapping service o PSARC/2006/247 NSS2 umbrella case o PSARC/2007/694 Duckwater: Simplified name services management o PSARC/2008/256 Native LDAP tool command line argument additions o PSARC/2008/342 Further SID support 10. Supporting Documents +---------------------+-----------------------------------+ | Filename | Description | +---------------------+-----------------------------------+ | ad.5.txt | ad(5) manpage | | | | | nsswitch.conf.4.txt | Modified nsswitch.conf(4) manpage | +---------------------+-----------------------------------+ In addition to the above the Solaris admin guide will include a chapter on AD name service in Solaris. 11. References [1] "Well-Known SIDs", . [2] "SMB URL", . Appendix A. Interfaces +--------------------------+-----------------+----------+ | Interface | Classification | Delivery | +--------------------------+-----------------+----------+ | New nsswitch source "ad" | Committed | N/A | | | | | | /usr/lib/nss_ad.so.1 | Committed | SUNWcsu | | | | | | /usr/lib/libadutils.so.1 | Project Private | SUNWcsu | +--------------------------+-----------------+----------+ From mgerdts@gmail.com Fri Jul 11 19:37:48 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6C2blln026710 for ; Fri, 11 Jul 2008 19:37:48 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6C2bhse000076 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Sat, 12 Jul 2008 03:37:47 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K3V00003GMY9G00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 11 Jul 2008 19:37:46 -0700 (PDT) Received: from sca-ea-mail-4.sun.com ([192.18.43.22]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K3V00FF5GMXEBB0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 11 Jul 2008 19:37:45 -0700 (PDT) Received: from relay14i.sun.com (ip124.net129179-4.block1.us.syntegra.com [129.179.4.124]) by sca-ea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m6C2bj95007320 for ; Sat, 12 Jul 2008 02:37:45 +0000 (GMT) Received: from mmp12es.mmp.us.syntegra.com ([160.41.208.12] [160.41.208.12]) by relay14i.sun.com with ESMTP id BT-MMP-1009520 for PSARC-ext@sun.com; Sat, 12 Jul 2008 02:37:45 +0000 (Z) Received: from relay11i.sun.com (relay11i.sun.com [129.179.4.121]) by mmp12es.mmp.us.syntegra.com with ESMTP id BT-MMP-76452364 for PSARC-ext@sun.com; Sat, 12 Jul 2008 02:37:44 +0000 (Z) Received: from rv-out-0708.google.com ([209.85.198.249] [209.85.198.249]) by relay1ib.sun.com with ESMTP id BT-MMP-11525279 for PSARC-ext@sun.com; Sat, 12 Jul 2008 02:37:44 +0000 (Z) Received: by rv-out-0708.google.com with SMTP id k29so3958168rvb.8 for ; Fri, 11 Jul 2008 19:37:42 -0700 (PDT) Received: by 10.114.124.12 with SMTP id w12mr15055579wac.210.1215830261589; Fri, 11 Jul 2008 19:37:41 -0700 (PDT) Received: by 10.114.112.15 with HTTP; Fri, 11 Jul 2008 19:37:41 -0700 (PDT) Date: Fri, 11 Jul 2008 21:37:41 -0500 From: Mike Gerdts Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <200807112153.m6BLrh2V021546@sac.sfbay.sun.com> To: Nicolas Williams Cc: PSARC-ext@sun.com, sparks-discuss@opensolaris.org Message-id: <65f8f3ad0807111937g3febac72udc27662d9b75bf96@mail.gmail.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Content-disposition: inline DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=SpS2mDhEgHEvaB+UXiuTAFPC/LFO7QbZpqX2me26XD0=; b=XmSB6p/hM1v6+JnIsNE1CZX2vx78aqBx+fwSfOAD8sqZf2dcpu3vR4iRMAfjbWj/mV Uh4gftlT5U/SJwLu4Au0G4yBB5typgPAtbjvamwUtJkLX33iYjPf1TxBn+zmEMz3VcQw EAhgioMBKrywH2LSQeI582vTNbehbSg2J/jfc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=R/+z+mp9A7+LBRWDG5FGhplxiz8Jiym0M3MoM3mQ9efm2eJDuWJzDQrgmp39Y/IcUq /GZR/VCoUcuXjZvKL7gt76+fEkpP/1FPnZMgmEasTGsIBGRr8t76VV3kN7JfqrL6pp8F h6B09Rm/ZD6vLqPcMVKSAkdXkmv0RxllBz7bk= X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 0.059sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200807112153.m6BLrh2V021546@sac.sfbay.sun.com> Status: RO Content-Length: 1071 On Fri, Jul 11, 2008 at 4:53 PM, Nicolas Williams wrote: > o Unix username (pw_name, sp_namp) is taken from the value of the > "samAccountName" AD attribute of the user object, qualified with > the name of the domain in which that object resides (e.g., > "foo@example"). If the AD samAccountName does not conform to traditional UNIX account naming semantics, how is this handled? As of snv_91, passwd(4) indicates that warnings will be issued when usernames that don't adhere to the UNIX tradition are encountered. Would this proposal relax the limitations documented in passwd(4) or would only a subset of valid AD usernames be supported? For instance, AD and Windows allow samAccountName to contain a string that looks like a 9-digit number. While a 9-digit number as a username works in Solaris (at least as far back as Solaris 8) with very few real issues, it has been an unsupported username from the standpoint of Sun and some ISV's that provide software on Solaris. -- Mike Gerdts http://mgerdts.blogspot.com/ From Nicolas.Williams@sun.com Sun Jul 13 16:19:42 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6DNJfMJ014056 for ; Sun, 13 Jul 2008 16:19:41 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6DNJakf024275 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Mon, 14 Jul 2008 00:19:40 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K3Y00M01WSQMZ00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Sun, 13 Jul 2008 16:19:38 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K3Y0068IWSQUX70@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Sun, 13 Jul 2008 16:19:38 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6DNJZLV018032; Sun, 13 Jul 2008 18:19:36 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6DNJZdk018031; Sun, 13 Jul 2008 18:19:35 -0500 (CDT) Date: Sun, 13 Jul 2008 18:19:34 -0500 From: Nicolas Williams Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <65f8f3ad0807111937g3febac72udc27662d9b75bf96@mail.gmail.com> To: Mike Gerdts Cc: Nicolas Williams , PSARC-ext@sun.com, sparks-discuss@opensolaris.org Mail-followup-to: Mike Gerdts , Nicolas Williams , PSARC-ext@sun.com, sparks-discuss@opensolaris.org Message-id: <20080713231934.GC17681@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807112153.m6BLrh2V021546@sac.sfbay.sun.com> <65f8f3ad0807111937g3febac72udc27662d9b75bf96@mail.gmail.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 2865 On Fri, Jul 11, 2008 at 09:37:41PM -0500, Mike Gerdts wrote: > On Fri, Jul 11, 2008 at 4:53 PM, Nicolas Williams > wrote: > > o Unix username (pw_name, sp_namp) is taken from the value of the > > "samAccountName" AD attribute of the user object, qualified with > > the name of the domain in which that object resides (e.g., > > "foo@example"). > > If the AD samAccountName does not conform to traditional UNIX account > naming semantics, how is this handled? As of snv_91, passwd(4) > indicates that warnings will be issued when usernames that don't > adhere to the UNIX tradition are encountered. Would this proposal > relax the limitations documented in passwd(4) or would only a subset > of valid AD usernames be supported? passwd(4) says a warning will be displayed, but it doesn't say what tool would display the warning (login(1)? useradd(1M)? w(1)? ls(1)...). I believe it would only be sensible to emit a warning on user creation. We're not providing user account / group administration tools for AD. Therefore there's no chance for us to emit such a warning. > For instance, AD and Windows allow samAccountName to contain a string > that looks like a 9-digit number. While a 9-digit number as a > username works in Solaris (at least as far back as Solaris 8) with > very few real issues, it has been an unsupported username from the > standpoint of Sun and some ISV's that provide software on Solaris. We could impose some constraints, though not, for example, on username length (issues w.r.t. username length are orthogonal to this case, though we'll likely undertake some small projects to relax user/group name legnth constraints in Solaris). But I'd much rather we don't. Keep in mind a couple of things: a) you're already free to violate many user/group naming constraints in various existing name service backends, and little is done about this (aside from username length restrictions in some tools, I can't think of any right now), and b) because of PSARC/2008/342 we already have the ability to display such odd user/group names in contexts where you'd expect a regular Unix user/group name. It is still not wise to name users/groups in AD which might cause problems for Solaris or various applications, such as all numeric user/group names, names that start with '-', names that contain ':', names that contain non-printing or non-ASCII characters, ... It might be useful to have the name service switch filter or escape such names. And it may be nice to setup a convention that the name service switch and the backends use UTF-8, or enhance the relevant interfaces to specify codesets, and then ensure that getXbyY() callers get names that have been converted to their current locales' codesets. But such changes to the name service switch and friends are not this case. Nico -- From mgerdts@gmail.com Sun Jul 13 17:42:35 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6E0gY4d015321 for ; Sun, 13 Jul 2008 17:42:35 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6E0gWTq055781 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Sun, 13 Jul 2008 18:42:34 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K3Z008070MVGU00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Sun, 13 Jul 2008 17:42:31 -0700 (PDT) Received: from sca-ea-mail-1.sun.com ([192.18.43.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K3Z0066W0MVUVD0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Sun, 13 Jul 2008 17:42:31 -0700 (PDT) Received: from relay23.sun.com (relay23.sun.com [192.12.251.54] (may be forged)) by sca-ea-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m6E0fI7V006669 for ; Mon, 14 Jul 2008 00:42:31 +0000 (GMT) Received: from mms24es.mms.us.syntegra.com ([150.143.232.70] [150.143.232.70]) by relay23i.sun.com with ESMTP id BT-MMP-2895075 for PSARC-ext@sun.com; Mon, 14 Jul 2008 00:42:30 +0000 (Z) Received: from relay24.sun.com (relay24.sun.com [192.12.251.74]) by mms24es.mms.us.syntegra.com with ESMTP id BT-MMP-80359208 for PSARC-ext@sun.com; Mon, 14 Jul 2008 00:42:30 +0000 (Z) Received: from py-out-1112.google.com ([64.233.166.183] [64.233.166.183]) by relay24i.sun.com with ESMTP id BT-MMP-52066962 for PSARC-ext@sun.com; Mon, 14 Jul 2008 00:42:30 +0000 (Z) Received: by py-out-1112.google.com with SMTP id u77so2986351pyb.5 for ; Sun, 13 Jul 2008 17:42:15 -0700 (PDT) Received: by 10.115.110.6 with SMTP id n6mr6333983wam.34.1215996134906; Sun, 13 Jul 2008 17:42:14 -0700 (PDT) Received: by 10.114.112.15 with HTTP; Sun, 13 Jul 2008 17:42:14 -0700 (PDT) Date: Sun, 13 Jul 2008 19:42:14 -0500 From: Mike Gerdts Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <20080713231934.GC17681@Sun.COM> To: Mike Gerdts , Nicolas Williams , PSARC-ext@sun.com, sparks-discuss@opensolaris.org Message-id: <65f8f3ad0807131742y2052497bo36f1391b2bfb8246@mail.gmail.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Content-disposition: inline DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=T68VRy4sY4JiWv49x0Gd54+zftuLzVEUkqnLGYcZDDg=; b=jw/TCMKGiRK66bEIBf5ALeb+8qojS3b31N2RXM1gOBcQCLDGU0hiZNPEsLhLPF3vrI nrzhUOOqVVhNe0R0uI2GVweViWqwhaG6362SBhIB87qUX0E00jLkbRqTYXLr4T84nDCs qORjTaGcu3bYQU7tYZbPDDMxeemSst3akTnSE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=JyXYeVK+S98BQ6L8hOzR6KrknbZY3T/A0OXiVHLFWt8rTuEcN7d669iqpfwfttPxO/ dTfsmpfEtAPR5QGviRsjKFYDCY12S7ZxiP98DyumHJQOQSSu03ekZKp7QJUyjF5L9jI0 2KT+ciQxKDQL2Ifv23UjvGMS8jUyspylWgyhk= X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 0.057sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200807112153.m6BLrh2V021546@sac.sfbay.sun.com> <65f8f3ad0807111937g3febac72udc27662d9b75bf96@mail.gmail.com> <20080713231934.GC17681@Sun.COM> Status: RO Content-Length: 1112 On Sun, Jul 13, 2008 at 6:19 PM, Nicolas Williams wrote: > It is still not wise to name users/groups in AD which might cause > problems for Solaris or various applications, such as all numeric > user/group names, names that start with '-', names that contain ':', > names that contain non-printing or non-ASCII characters, ... > > It might be useful to have the name service switch filter or escape such > names. And it may be nice to setup a convention that the name service > switch and the backends use UTF-8, or enhance the relevant interfaces to > specify codesets, and then ensure that getXbyY() callers get names that > have been converted to their current locales' codesets. But such > changes to the name service switch and friends are not this case. Additionally - not part of this case - it would be nice to have a generic username mapping mechanism. An organization that is looking to use AD as their naming service is somewhat likely to have chosen Windows/AD usernames that do not comply with the UNIX view of the world. -- Mike Gerdts http://mgerdts.blogspot.com/ From Nicolas.Williams@sun.com Sun Jul 13 18:04:27 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6E14Qes015741 for ; Sun, 13 Jul 2008 18:04:27 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6E14O1k025024 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Mon, 14 Jul 2008 02:04:26 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K3Z00H051NCG400@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Sun, 13 Jul 2008 19:04:24 -0600 (MDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K3Z007C81NBCIA0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Sun, 13 Jul 2008 19:04:23 -0600 (MDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6E14LMi018134; Sun, 13 Jul 2008 20:04:21 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6E14KmR018133; Sun, 13 Jul 2008 20:04:20 -0500 (CDT) Date: Sun, 13 Jul 2008 20:04:20 -0500 From: Nicolas Williams Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <65f8f3ad0807131742y2052497bo36f1391b2bfb8246@mail.gmail.com> To: Mike Gerdts Cc: Nicolas Williams , PSARC-ext@sun.com, sparks-discuss@opensolaris.org Mail-followup-to: Mike Gerdts , Nicolas Williams , PSARC-ext@sun.com, sparks-discuss@opensolaris.org Message-id: <20080714010420.GF17681@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807112153.m6BLrh2V021546@sac.sfbay.sun.com> <65f8f3ad0807111937g3febac72udc27662d9b75bf96@mail.gmail.com> <20080713231934.GC17681@Sun.COM> <65f8f3ad0807131742y2052497bo36f1391b2bfb8246@mail.gmail.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 2153 On Sun, Jul 13, 2008 at 07:42:14PM -0500, Mike Gerdts wrote: > On Sun, Jul 13, 2008 at 6:19 PM, Nicolas Williams > wrote: > > It is still not wise to name users/groups in AD which might cause > > problems for Solaris or various applications, such as all numeric > > user/group names, names that start with '-', names that contain ':', > > names that contain non-printing or non-ASCII characters, ... > > > > It might be useful to have the name service switch filter or escape such > > names. And it may be nice to setup a convention that the name service > > switch and the backends use UTF-8, or enhance the relevant interfaces to > > specify codesets, and then ensure that getXbyY() callers get names that > > have been converted to their current locales' codesets. But such > > changes to the name service switch and friends are not this case. > > Additionally - not part of this case - it would be nice to have a > generic username mapping mechanism. An organization that is looking > to use AD as their naming service is somewhat likely to have chosen > Windows/AD usernames that do not comply with the UNIX view of the > world. AD already has this in various forms, but we're leaving that out of scope here for several reasons: a) simplicity: we need a way to use AD as is, w/o SFU, and what not, b) nss_ldap already supports this through schema mapping, though only against a single AD domain, and we need to support entire forests and cross-forest trusts, c) expediency. Addressing (b) will be a large project, thus the expediency rationale. But even if we could not assert expediency I believe that simplicity still requires that we pursue this approach. We're really straying now from the case, so please drop PSARC-ext from the cc list and change the subject (or start a new thread) to discuss (b). If and when (b) is addressed then it should be possible to configure the system to prefer AD-provided Unix names over sAMAccountName values, or even to do so on a per-domain basis. But I really don't want to get into that on psarc-ext. If you wish we can discuss (b) in detail on sparks-discuss. Nico -- From gww@eng.sun.com Wed Jul 16 09:40:15 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6GGeEqr027769 for ; Wed, 16 Jul 2008 09:40:15 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6GGcBMR002878 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 16 Jul 2008 17:40:14 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4300F0NYAWBM00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 09:40:08 -0700 (PDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K43005JYYAUPH80@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 09:40:06 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6GGe69C043841; Wed, 16 Jul 2008 09:40:06 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m6GGg0sC012535; Wed, 16 Jul 2008 09:42:00 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m6GGg0XT012534; Wed, 16 Jul 2008 09:42:00 -0700 (PDT) Date: Wed, 16 Jul 2008 09:42:00 -0700 (PDT) From: Gary Winiger Subject: Re: Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] To: PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com Cc: sparks-discuss@opensolaris.org Message-id: <200807161642.m6GGg0XT012534@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 932 > I'm filing this fasttrack on behalf of Baban Kenkre. The timer is set > to expire on 7/18/2008. The project team requests patch binding, though > there is no intention to backport. Sorry for the late review. I'd like to request that this case be let to run. > 10. Supporting Documents > > +---------------------+-----------------------------------+ > | Filename | Description | > +---------------------+-----------------------------------+ > | ad.5.txt | ad(5) manpage | > | | | > | nsswitch.conf.4.txt | Modified nsswitch.conf(4) manpage | > +---------------------+-----------------------------------+ I don't see either of these in the case directory and believe they are important for review. Please provide them and I'll make a best effort to review by the timer. Gary.. From baban.kenkre@sun.com Wed Jul 16 11:19:20 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6GIJJTp004388 for ; Wed, 16 Jul 2008 11:19:20 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m6GIJGQr010316 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 17 Jul 2008 02:19:18 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4400L0D2W6Q200@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 11:19:18 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4400JCN2W5QL30@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 11:19:17 -0700 (PDT) Received: from [10.7.250.4] (punchin-client-10-7-250-4.SFBay.Sun.COM [10.7.250.4]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m6GIJCpx216901; Wed, 16 Jul 2008 11:19:13 -0700 (PDT) Date: Wed, 16 Jul 2008 11:19:12 -0700 From: Baban Kenkre Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <200807161642.m6GGg0XT012534@marduk.eng.sun.com> To: Gary Winiger Cc: PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <487E3BA0.40502@sun.com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_FXXjMeKjC0zFSZovzTCodQ)" X-PMX-Version: 5.4.1.325704 References: <200807161642.m6GGg0XT012534@marduk.eng.sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20071119) Status: RO Content-Length: 25699 This is a multi-part message in MIME format. --Boundary_(ID_FXXjMeKjC0zFSZovzTCodQ) Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT Hi Gary, Sorry about that. I have attached the files you requested. Nico is travelling today so could you please copy these two files to the ARC case directory. --Baban Gary Winiger wrote: >> I'm filing this fasttrack on behalf of Baban Kenkre. The timer is set >> to expire on 7/18/2008. The project team requests patch binding, though >> there is no intention to backport. >> > > Sorry for the late review. I'd like to request that this > case be let to run. > > >> 10. Supporting Documents >> >> +---------------------+-----------------------------------+ >> | Filename | Description | >> +---------------------+-----------------------------------+ >> | ad.5.txt | ad(5) manpage | >> | | | >> | nsswitch.conf.4.txt | Modified nsswitch.conf(4) manpage | >> +---------------------+-----------------------------------+ >> > > I don't see either of these in the case directory and believe > they are important for review. > > Please provide them and I'll make a best effort to review > by the timer. > > Gary.. > _______________________________________________ > sparks-discuss mailing list > sparks-discuss@opensolaris.org > http://mail.opensolaris.org/mailman/listinfo/sparks-discuss > --Boundary_(ID_FXXjMeKjC0zFSZovzTCodQ) Content-type: text/plain; name=ad.5.txt Content-transfer-encoding: 7BIT Content-disposition: inline; filename=ad.5.txt NAME ad - Active Directory as a naming repository DESCRIPTION Solaris clients can obtain naming information from Microsoft's Active Directory (AD) servers by first joining the Solaris system to an AD domain and using the keyword ad in the nsswitch.conf(4) file. AD domain join can be executed using the kclient(1) utility. The naming databases currently supported by AD name service are passwd and group. The AD servers are auto-discovered. The Solaris AD client uses LDAP v3 protocol to access naming information from the AD servers. No schema modification is needed on the AD servers because the Solaris client works with native AD schema. The Solaris AD client uses idmap(1M) service to map Windows SIDs to POSIX UIDs/GIDs and vice-versa. Security model used by the client is SASL/GSSAPI/KRB5. Kerberos v5 is configured on the client at the time of domain join. FILES /etc/nsswitch.conf Configuration file for the name-service switch. /usr/lib/nss_ad.so.1 Name service switch module for AD. SEE ALSO svcs(1), idmap(1M), idmapd(1M), kclient(1M), svcadm(1M), svccfg(1M), attributes(5), smf(5) --Boundary_(ID_FXXjMeKjC0zFSZovzTCodQ) Content-type: text/plain; name=nsswitch.conf.4.txt Content-transfer-encoding: 7BIT Content-disposition: inline; filename=nsswitch.conf.4.txt --- nsswitch.conf.4.txt.old Mon Jul 7 14:04:23 2008 +++ nsswitch.conf.4.txt.new Fri Jul 11 14:10:57 2008 @@ -1,726 +1,736 @@ File Formats nsswitch.conf(4) NAME nsswitch.conf - configuration file for the name service switch SYNOPSIS /etc/nsswitch.conf DESCRIPTION The operating system uses a number of databases of informa- tion about hosts, ipnodes, users (passwd(4), shadow(4), and user_attr(4)), and groups. Data for these can come from a variety of sources: hostnames and host addresses, for exam- ple, can be found in /etc/hosts, NIS, NIS+, LDAP, DNS or Multicast DNS. Zero or more sources may be used for each database; the sources and their lookup order are specified in the /etc/nsswitch.conf file. The following databases use the switch file: Database Used By aliases sendmail(1M) auth_attr getauthnam(3SECDB) automount automount(1M) bootparams rpc.bootparamd(1M) ethers ethers(3SOCKET) group getgrnam(3C) hosts gethostbyname(3NSL), getaddrinfo(3SOCKET). See Interaction with netconfig. ipnodes Same as hosts. netgroup innetgr(3C) netmasks ifconfig(1M) networks getnetbyname(3SOCKET) passwd getpwnam(3C), getspnam(3C), getauusernam(3BSM), getusernam(3SECDB) printers lp(1), lpstat(1), cancel(1), lpr(1B), lpq(1B), lprm(1B), in.lpd(1M), lpadmin(1M), lpget(1M), lpset(1M) prof_attr getprofnam(3SECDB), getexecprof(3SECDB) project getprojent(3PROJECT), getdefaultproj(3PROJECT), inproj(3PROJECT), newtask(1), setproject(3PROJECT) protocols getprotobyname(3SOCKET) publickey getpublickey(3NSL), secure_rpc(3NSL) rpc getrpcbyname(3NSL) services getservbyname(3SOCKET). See Interaction with netconfig. SunOS 5.11 Last change: 21 Aug 2007 1 File Formats nsswitch.conf(4) user_attr getuserattr(3SECDB) The following sources may be used: Source Uses files /etc/hosts, /etc/passwd, /etc/inet/ipnodes, /etc/shadow, /etc/security/auth_attr, /etc/user_attr nis NIS(YP) nisplus NIS+ ldap LDAP + ad Active Directory dns Valid only for hosts and ipnodes. Uses the Internet Domain Name Service. mdns Valid only for hosts and ipnodes. Uses the Multicast Domain Name Service. compat Valid only for passwd and group. Implements + and -. See Interac- tion with +/- syntax. user Valid only for printers. Imple- ments support for ${HOME}/.printers. Note that /etc/inet/ipnodes is a symbolic link to /etc/hosts. There is an entry in /etc/nsswitch.conf for each database. Typically these entries will be simple, such as protocols: files or networks: files nisplus. However, when multiple sources are specified, it is sometimes necessary to define precisely the circumstances under which each source will be tried. A source can return one of the following codes: Status Meaning SUCCESS Requested database entry was found. UNAVAIL Source is not configured on this system or internal failure. NOTFOUND Source responded "no such entry" TRYAGAIN Source is busy or not responding, might respond to retries. SunOS 5.11 Last change: 21 Aug 2007 2 File Formats nsswitch.conf(4) For each status code, two actions are possible: Action Meaning continue Try the next source in the list. return Return now. Additionally, for TRYAGAIN only, the following actions are possible: Action Meaning forever Retry the current source forever. n Retry the current source n more times, where n is an integer between 0 and MAX_INT (that is, 2.14 billion). After n retries has been exhausted, the TRYAGAIN action transitions to continue, until a future request receives a response, at which time TRYAGAIN=n is restored. The complete syntax of an entry is: ::= ":" [ []]* ::= "[" + "]" ::= "=" ::= "success" | "notfound" | "unavail" | "tryagain" For every status except TRYAGAIN, the action syntax is: ::= "return" | "continue" For the TRYAGAIN status, the action syntax is: ::= "return" | "continue" | "forever" | ::= 0...MAX_INT SunOS 5.11 Last change: 21 Aug 2007 3 File Formats nsswitch.conf(4) Each entry occupies a single line in the file. Lines that are blank, or that start with white space, are ignored. Everything on a line following a # character is also ignored; the # character can begin anywhere in a line, to be used to begin comments. The and names are case-sensitive, but and names are case-insensitive. The library functions contain compiled-in default entries that are used if the appropriate entry in nsswitch.conf is absent or syntactically incorrect. The default criteria for DNS and the NIS server in "DNS- forwarding mode" is [SUCCESS=return NOTFOUND=continue UNAVAIL=continue TRYAGAIN=3]. The default criteria for all other sources is [SUCCESS=return NOTFOUND=continue UNAVAIL=continue TRYAGAIN=forever]. The default, or explicitly specified, criteria are meaning- less following the last source in an entry; and they are ignored, since the action is always to return to the caller irrespective of the status code the source returns. Interaction with netconfig In order to ensure that they all return consistent results, gethostbyname(3NSL), getaddrinfo(3SOCKET), getservbyname(3SOCKET), and netdir_getbyname(3NSL) functions are all implemented in terms of the same internal library function. This function obtains the system-wide source lookup policy for hosts, ipnodes, and services based on the inet family entries in netconfig(4) and uses the switch entries only if the netconfig entries have a - (hyphen) in the last column for nametoaddr libraries. See the section in gethostbyname(3NSL) and getservbyname(3SOCKET) for details. YP-compatibility Mode The NIS+ server can be run in YP-compatibility mode, where it handles NIS (YP) requests as well as NIS+ requests. In this case, the clients get much the same results (except for getspnam(3C)) from the nis source as from nisplus; however, nisplus is recommended instead of nis. Interaction with server in DNS-forwarding Mode The NIS (YP) server can be run in DNS-forwarding mode, where it forwards lookup requests to DNS for host-names and SunOS 5.11 Last change: 21 Aug 2007 4 File Formats nsswitch.conf(4) -addresses that do not exist in its database. In this case, specifying nis as a source for hosts is sufficient to get DNS lookups; dns need not be specified explicitly as a source. In SunOS 5.3 (Solaris 2.3) and compatible versions, the NIS+ server in NIS/YP-compatibility mode can also be run in DNS- forwarding mode (see rpc.nisd(1M)). Forwarding is effective only for requests originating from its YP clients; hosts policy on these clients should be configured appropriately. Interaction with Password Aging When password aging is turned on, only a limited set of pos- sible name services are permitted for the passwd: database in the /etc/nsswitch.conf file: passwd: files passwd: files nis passwd: files nisplus passwd: files ldap passwd: compat passwd_compat: nisplus passwd_compat: ldap Any other settings will cause the passwd(1) command to fail when it attempts to change the password after expiration and will prevent the user from logging in. These are the only permitted settings when password aging has been turned on. Otherwise, you can work around incorrect passwd: lines by using the -r repository argument to the passwd(1) command and using passwd -r repository to override the nsswitch.conf settings and specify in which name service you want to modify your password. Interaction with +/- syntax Releases prior to SunOS 5.0 did not have the name service switch but did allow the user some policy control. In SunOS 5.11 Last change: 21 Aug 2007 5 File Formats nsswitch.conf(4) /etc/passwd one could have entries of the form +user (include the specified user from NIS passwd.byname), -user (exclude the specified user) and + (include everything, except excluded users, from NIS passwd.byname). The desired behavior was often everything in the file followed by every- thing in NIS, expressed by a solitary + at the end of /etc/passwd. The switch provides an alternative for this case (passwd: files nis) that does not require + entries in /etc/passwd and /etc/shadow (the latter is a new addition to SunOS 5.0, see shadow(4)). If this is not sufficient, the NIS/YP compatibility source provides full +/- semantics. It reads /etc/passwd for getpwnam(3C) functions and /etc/shadow for getspnam(3C) functions and, if it finds +/- entries, invokes an appropri- ate source. By default, the source is nis, but this may be overridden by specifying nisplus or ldap as the source for the pseudo-database passwd_compat. Note that in compat mode, for every /etc/passwd entry, there must be a corresponding entry in the /etc/shadow file. The NIS/YP compatibility source also provides full +/- semantics for group; the relevant pseudo-database is group_compat. Useful Configurations The compiled-in default entries for all databases use NIS (YP) as the enterprise level name service and are identical to those in the default configuration of this file: passwd: files nis group: files nis hosts: nis [NOTFOUND=return] files ipnodes: nis [NOTFOUND=return] files networks: nis [NOTFOUND=return] files protocols: nis [NOTFOUND=return] files SunOS 5.11 Last change: 21 Aug 2007 6 File Formats nsswitch.conf(4) rpc: nis [NOTFOUND=return] files ethers: nis [NOTFOUND=return] files netmasks: nis [NOTFOUND=return] files bootparams: nis [NOTFOUND=return] files publickey: nis [NOTFOUND=return] files netgroup: nis automount: files nis aliases: files nis services: files nis printers: user files nis nisplus auth_attr files nis prof_attr files nis project files nis Note that the files source for the ipnodes and hosts data- bases is identical, as /etc/inet/ipnodes is a symbolic link to /etc/hosts. Because other sources for the ipnodes and hosts databases are different, do not remove the ipnodes line from the /etc/nsswitch.conf file. The policy nis [NOTFOUND=return] files implies: if nis is UNAVAIL, continue on to files, and if nis returns NOTFOUND, return to the caller. In other words, treat nis as the authoritative source of information and try files only if nis is down. This, and other policies listed in the default SunOS 5.11 Last change: 21 Aug 2007 7 File Formats nsswitch.conf(4) configuration above, are identical to the hard-wired poli- cies in SunOS releases prior to 5.0. If compatibility with the +/- syntax for passwd and group is required, simply modify the entries for passwd and group to: passwd: compat group: compat If NIS+ is the enterprise level name service, the default configuration should be modified to use nisplus instead of nis for every database on client machines. The file /etc/nsswitch.nisplus contains a sample configuration that can be copied to /etc/nsswitch.conf to set this policy. If LDAP is the enterprise level name service, the default configuration should be modified to use ldap instead of nis for every database on client machines. The file /etc/nsswitch.ldap contains a sample configuration that can be copied to /etc/nsswitch.conf to set this policy. + When using Active Directory with native schema for name service, + the default configuration should be modified to use ad for + for passwd and group, dns for hosts resolution and files + for the remaining databases on client machines. + + If the use of +/- syntax is desired in conjunction with nisplus, use the following four entries: passwd: compat passwd_compat: nisplus OR ldap group: compat group_compat: nisplus OR ldap In order to get information from the Internet Domain Name Service for hosts that are not listed in the enterprise level name service, NIS+ or LDAP, use the following confi- guration and set up the /etc/resolv.conf file (see resolv.conf(4) for more details): hosts: nisplus dns [NOTFOUND=return] files SunOS 5.11 Last change: 21 Aug 2007 8 File Formats nsswitch.conf(4) or hosts: ldap dns [NOTFOUND=return] files Enumeration - getXXXent() Many of the databases have enumeration functions: passwd has getpwent(), hosts has gethostent(), and so on. These were reasonable when the only source was files but often make little sense for hierarchically structured sources that con- tain large numbers of entries, much less for multiple sources. The interfaces are still provided and the implemen- tations strive to provide reasonable results, but the data returned may be incomplete (enumeration for hosts is simply not supported by the dns source), inconsistent (if multiple sources are used), formatted in an unexpected fashion (for a host with a canonical name and three aliases, the nisplus source will return four hostents, and they may not be con- secutive), or very expensive (enumerating a passwd database of 5,000 users is probably a bad idea). Furthermore, multi- ple threads in the same process using the same reentrant enumeration function (getXXXent_r() are supported beginning with SunOS 5.3) share the same enumeration position; if they interleave calls, they will enumerate disjoint subsets of the same database. In general, the use of the enumeration functions is depre- cated. In the case of passwd, shadow, and group, it may sometimes be appropriate to use fgetgrent(), fgetpwent(), and fgetspent() (see getgrnam(3C), getpwnam(3C), and getspnam(3C), respectively), which use only the files source. FILES A source named SSS is implemented by a shared object named nss_SSS.so.1 that resides in /usr/lib. /etc/nsswitch.conf Configuration file. /usr/lib/nss_compat.so.1 Implements compat source. /usr/lib/nss_dns.so.1 Implements dns source. /usr/lib/nss_files.so.1 Implements files source. /usr/lib/nss_mdns.so.1 Implements mdns source. SunOS 5.11 Last change: 21 Aug 2007 9 File Formats nsswitch.conf(4) /usr/lib/nss_nis.so.1 Implements nis source. /usr/lib/nss_nisplus.so.1 Implements nisplus source. /usr/lib/nss_ldap.so.1 Implements ldap source. + /usr/lib/nss_ad.so.1 Implements ad source. + + /usr/lib/nss_user.so.1 Implements user source. /etc/netconfig Configuration file for netdir(3NSL) functions that redirects hosts/devices policy to the switch. /etc/nsswitch.files Sample configuration file that uses files only. /etc/nsswitch.nis Sample configuration file that uses files and nis. /etc/nsswitch.nisplus Sample configuration file that uses files and nisplus. /etc/nsswitch.ldap Sample configuration file that uses files and ldap. /etc/nsswitch.dns Sample configuration file that uses files, dns and mdns (dns and mdns only for hosts). SEE ALSO ldap(1), newtask(1), NIS+(1), passwd(1), automount(1M), ifconfig(1M), mdnsd(1M), rpc.bootparamd(1M), rpc.nisd(1M), sendmail(1M), getauusernam(3BSM), getgrnam(3C), getnetgrent(3C), getpwnam(3C), getspnam(3C), gethostbyname(3NSL), getpublickey(3NSL), getrpcbyname(3NSL), netdir(3NSL), secure_rpc(3NSL), getprojent(3PROJECT), getdefaultproj(3PROJECT), inproj(3PROJECT), setproject(3PROJECT), getauthnam(3SECDB), getexecprof(3SECDB), getprofnam(3SECDB), getuserattr(3SECDB), getusernam(3SECDB), ethers(3SOCKET), getaddrinfo(3SOCKET), getnetbyname(3SOCKET), getprotobyname(3SOCKET), getservbyname(3SOCKET), SunOS 5.11 Last change: 21 Aug 2007 10 File Formats nsswitch.conf(4) auth_attr(4), hosts(4), netconfig(4), project(4), - resolv.conf(4), user_attr(4), ypfiles(4) + resolv.conf(4), user_attr(4), ypfiles(4), ad(5) NOTES Within each process that uses nsswitch.conf, the entire file is read only once; if the file is later changed, the process will continue using the old configuration. The use of both nis and nisplus as sources for the same database is strongly discouraged since both the name ser- vices are expected to store similar information and the lookups on the database may yield different results depend- ing on which name service is operational at the time of the request. The same applies for using ldap along with nis or nisplus. Misspelled names of sources and databases will be treated as legitimate names of (most likely nonexistent) sources and databases. The following functions do not use the switch: fgetgrent(3C), fgetprojent(3PROJECT), fgetpwent(3C), fgetspent(3C), getpw(3C), putpwent(3C), shadow(4). SunOS 5.11 Last change: 21 Aug 2007 11 --Boundary_(ID_FXXjMeKjC0zFSZovzTCodQ)-- From gww@eng.sun.com Wed Jul 16 13:47:58 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6GKlvp0009604 for ; Wed, 16 Jul 2008 13:47:58 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m6GKlm0K004364 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 17 Jul 2008 04:47:57 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4400H099RUMR00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 13:47:54 -0700 (PDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K44001129RUV8C0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 13:47:54 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6GKlrkK020659; Wed, 16 Jul 2008 13:47:53 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m6GKnlQ3012947; Wed, 16 Jul 2008 13:49:47 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m6GKnlLo012946; Wed, 16 Jul 2008 13:49:47 -0700 (PDT) Date: Wed, 16 Jul 2008 13:49:47 -0700 (PDT) From: Gary Winiger Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] To: baban.kenkre@sun.com, gww@eng.sun.com Cc: PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <200807162049.m6GKnlLo012946@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 224 > Sorry about that. I have attached the files you requested. Nico is > travelling today so could you please copy these two files to the ARC > case directory. I've placed the supplied files in the case directory. Gary.. From gww@eng.sun.com Wed Jul 16 14:12:31 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6GLCUdW011506 for ; Wed, 16 Jul 2008 14:12:31 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6GLCSIs059449 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 16 Jul 2008 15:12:30 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4400513AWTR900@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 14:12:29 -0700 (PDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4400JBFAWTQTC0@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 14:12:29 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6GLCSLB037418; Wed, 16 Jul 2008 14:12:28 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m6GLEMK0012993; Wed, 16 Jul 2008 14:14:22 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m6GLEMqk012992; Wed, 16 Jul 2008 14:14:22 -0700 (PDT) Date: Wed, 16 Jul 2008 14:14:22 -0700 (PDT) From: Gary Winiger Subject: Re: Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] To: PSARC-ext@sun.com, gww@eng.sun.com, nw141292@sac.sfbay.sun.com Cc: sparks-discuss@opensolaris.org Message-id: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 3250 > > | nsswitch.conf.4.txt | Modified nsswitch.conf(4) manpage | > > +---------------------+-----------------------------------+ > Please provide them and I'll make a best effort to review > by the timer. My concern is here in nsswitch.conf(4) functionality. From the provided it's not clear what the project is proposing. + When using Active Directory with native schema for name service, + the default configuration should be modified to use ad for + for passwd and group, dns for hosts resolution and files + for the remaining databases on client machines. What passwd:, group: entries are supported? In particular how are passwd(1), getauusernam(3), getuserattr(3) and possibly other interfaces affected. Gary.. VIZ. Interaction with Password Aging When password aging is turned on, only a limited set of pos- sible name services are permitted for the passwd: database in the /etc/nsswitch.conf file: passwd: files passwd: files nis passwd: files nisplus passwd: files ldap passwd: compat passwd_compat: nisplus passwd_compat: ldap Any other settings will cause the passwd(1) command to fail when it attempts to change the password after expiration and will prevent the user from logging in. These are the only permitted settings when password aging has been turned on. Otherwise, you can work around incorrect passwd: lines by using the -r repository argument to the passwd(1) command and using passwd -r repository to override the nsswitch.conf settings and specify in which name service you want to modify your password. Interaction with +/- syntax Releases prior to SunOS 5.0 did not have the name service switch but did allow the user some policy control. In /etc/passwd one could have entries of the form +user (include the specified user from NIS passwd.byname), -user (exclude the specified user) and + (include everything, except excluded users, from NIS passwd.byname). The desired behavior was often everything in the file followed by every- thing in NIS, expressed by a solitary + at the end of /etc/passwd. The switch provides an alternative for this case (passwd: files nis) that does not require + entries in /etc/passwd and /etc/shadow (the latter is a new addition to SunOS 5.0, see shadow(4)). If this is not sufficient, the NIS/YP compatibility source provides full +/- semantics. It reads /etc/passwd for getpwnam(3C) functions and /etc/shadow for getspnam(3C) functions and, if it finds +/- entries, invokes an appropri- ate source. By default, the source is nis, but this may be overridden by specifying nisplus or ldap as the source for the pseudo-database passwd_compat. Note that in compat mode, for every /etc/passwd entry, there must be a corresponding entry in the /etc/shadow file. The NIS/YP compatibility source also provides full +/- semantics for group; the relevant pseudo-database is group_compat. From Darren.Moffat@Sun.COM Wed Jul 16 14:15:31 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6GLFVie012001 for ; Wed, 16 Jul 2008 14:15:31 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6GLFVhv060408 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 16 Jul 2008 15:15:31 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4400301B1UR700@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 15:15:30 -0600 (MDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4400DR6B1T55E0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 15:15:30 -0600 (MDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m6GLFTvc006567 for ; Wed, 16 Jul 2008 21:15:29 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4400701B1GXA00@fe-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 22:15:29 +0100 (BST) Received: from [10.0.242.191] ([192.18.41.196]) by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4400KJJB1B6X70@fe-emea-10.sun.com>; Wed, 16 Jul 2008 22:15:28 +0100 (BST) Date: Wed, 16 Jul 2008 22:15:11 +0100 From: Darren J Moffat Subject: Re: Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> Sender: Darren.Moffat@Sun.COM To: Gary Winiger Cc: PSARC-ext@Sun.COM, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <487E64DF.6070304@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080519) Status: RO Content-Length: 936 Gary Winiger wrote: >>> | nsswitch.conf.4.txt | Modified nsswitch.conf(4) manpage | >>> +---------------------+-----------------------------------+ > >> Please provide them and I'll make a best effort to review >> by the timer. > > My concern is here in nsswitch.conf(4) functionality. > From the provided it's not clear what the project is > proposing. > > + When using Active Directory with native schema for name service, > + the default configuration should be modified to use ad for > + for passwd and group, dns for hosts resolution and files > + for the remaining databases on client machines. > > What passwd:, group: entries are supported? > In particular how are passwd(1), getauusernam(3), getuserattr(3) > and possibly other interfaces affected. I think we can resolve this by shipping an /etc/nsswitch.ad just like we do for nis, nisplus, ldap, dns, files today. -- Darren J Moffat From gww@eng.sun.com Wed Jul 16 14:20:52 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6GLKpBO012235 for ; Wed, 16 Jul 2008 14:20:52 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m6GLKbBn017136 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 17 Jul 2008 05:20:50 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4400601BAP4400@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 14:20:49 -0700 (PDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4400JRZBANQTC0@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 14:20:47 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6GLKjQ2043050; Wed, 16 Jul 2008 14:20:45 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m6GLMdia013027; Wed, 16 Jul 2008 14:22:39 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m6GLMd6i013026; Wed, 16 Jul 2008 14:22:39 -0700 (PDT) Date: Wed, 16 Jul 2008 14:22:39 -0700 (PDT) From: Gary Winiger Subject: Re: Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] To: gww@eng.sun.com, Darren.Moffat@sun.com Cc: PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <200807162122.m6GLMd6i013026@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 312 > I think we can resolve this by shipping an /etc/nsswitch.ad just like we > do for nis, nisplus, ldap, dns, files today. That would be fine. It's the contents that I believe need to be understood to understand this proposal. I'm happy for an example nsswitch.ad to be part of the case materials. Gary.. From baban.kenkre@sun.com Wed Jul 16 14:44:18 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6GLiHGn012496 for ; Wed, 16 Jul 2008 14:44:18 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m6GLiBto025725 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 17 Jul 2008 05:44:17 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4400503CDRSG00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 15:44:15 -0600 (MDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K44004LACDQ7N40@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 15:44:14 -0600 (MDT) Received: from [10.7.250.4] (punchin-client-10-7-250-4.SFBay.Sun.COM [10.7.250.4]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m6GLiDYf258993; Wed, 16 Jul 2008 14:44:13 -0700 (PDT) Date: Wed, 16 Jul 2008 14:44:12 -0700 From: Baban Kenkre Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> To: Gary Winiger Cc: PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <487E6BAC.1080404@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20071119) Status: RO Content-Length: 4437 Gary Winiger wrote: >>> | nsswitch.conf.4.txt | Modified nsswitch.conf(4) manpage | >>> +---------------------+-----------------------------------+ >>> > > >> Please provide them and I'll make a best effort to review >> by the timer. >> > > My concern is here in nsswitch.conf(4) functionality. > From the provided it's not clear what the project is > proposing. > This case basically allows any application using get{pw,gr}{nam,uid,gid}() interfaces to resolve Windows users and group names using native Active Directory schema. (nssad_details.txt, Section 6, Bullet 6 has the example). > + When using Active Directory with native schema for name service, > + the default configuration should be modified to use ad for > + for passwd and group, dns for hosts resolution and files > + for the remaining databases on client machines. > > What passwd:, group: entries are supported? > You can add "ad" to any of the existing valid passwd: and group: entries. Examples: passwd: files ad OR passwd: files ldap ad > In particular how are passwd(1), getauusernam(3), getuserattr(3) > and possibly other interfaces affected. > passwd(1) is not supported for "ad". Probably that needs to be addressed when we support Windows users to logon to Solaris which is beyond the scope of this case. For now passwords of Active Directory users can be changed using kpasswd(1) because AD users are Kerberos principals. Currently AD does not have a native schema that can be mapped to Solaris RBAC databases. Therefore RBAC databases won't be supported with "ad". --Baban > Gary.. > VIZ. > > Interaction with Password Aging > When password aging is turned on, only a limited set of pos- > sible name services are permitted for the passwd: database > in the /etc/nsswitch.conf file: > > passwd: files > > passwd: files nis > > passwd: files nisplus > > passwd: files ldap > > passwd: compat > > passwd_compat: nisplus > > passwd_compat: ldap > > Any other settings will cause the passwd(1) command to fail > when it attempts to change the password after expiration and > will prevent the user from logging in. These are the only > permitted settings when password aging has been turned on. > Otherwise, you can work around incorrect passwd: lines by > using the -r repository argument to the passwd(1) command > and using passwd -r repository to override the nsswitch.conf > settings and specify in which name service you want to > modify your password. > > Interaction with +/- syntax > Releases prior to SunOS 5.0 did not have the name service > switch but did allow the user some policy control. In > /etc/passwd one could have entries of the form +user > (include the specified user from NIS passwd.byname), -user > (exclude the specified user) and + (include everything, > except excluded users, from NIS passwd.byname). The desired > behavior was often everything in the file followed by every- > thing in NIS, expressed by a solitary + at the end of > /etc/passwd. The switch provides an alternative for this > case (passwd: files nis) that does not require + entries in > /etc/passwd and /etc/shadow (the latter is a new addition to > SunOS 5.0, see shadow(4)). > > If this is not sufficient, the NIS/YP compatibility source > provides full +/- semantics. It reads /etc/passwd for > getpwnam(3C) functions and /etc/shadow for getspnam(3C) > functions and, if it finds +/- entries, invokes an appropri- > ate source. By default, the source is nis, but this may be > overridden by specifying nisplus or ldap as the source for > the pseudo-database passwd_compat. > > Note that in compat mode, for every /etc/passwd entry, there > must be a corresponding entry in the /etc/shadow file. > > The NIS/YP compatibility source also provides full +/- > semantics for group; the relevant pseudo-database is > group_compat. > _______________________________________________ > sparks-discuss mailing list > sparks-discuss@opensolaris.org > http://mail.opensolaris.org/mailman/listinfo/sparks-discuss > From baban.kenkre@sun.com Wed Jul 16 14:57:17 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6GLvHXc013211 for ; Wed, 16 Jul 2008 14:57:17 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6GLvB3H007505; Wed, 16 Jul 2008 15:57:15 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K440076TCZCFY00@nwk-avmta-2.sfbay.sun.com>; Wed, 16 Jul 2008 14:57:13 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4400JUCCXEQEC0@nwk-avmta-2.sfbay.sun.com>; Wed, 16 Jul 2008 14:56:02 -0700 (PDT) Received: from [10.7.250.4] (punchin-client-10-7-250-4.SFBay.Sun.COM [10.7.250.4]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m6GLu1r7261259; Wed, 16 Jul 2008 14:56:01 -0700 (PDT) Date: Wed, 16 Jul 2008 14:56:01 -0700 From: Baban Kenkre Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <487E64DF.6070304@Sun.COM> To: Darren J Moffat Cc: Gary Winiger , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <487E6E71.4050708@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> <487E64DF.6070304@Sun.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20071119) Status: RO Content-Length: 1482 Darren J Moffat wrote: > Gary Winiger wrote: > >>>> | nsswitch.conf.4.txt | Modified nsswitch.conf(4) manpage | >>>> +---------------------+-----------------------------------+ >>>> >>> Please provide them and I'll make a best effort to review >>> by the timer. >>> >> My concern is here in nsswitch.conf(4) functionality. >> From the provided it's not clear what the project is >> proposing. >> >> + When using Active Directory with native schema for name service, >> + the default configuration should be modified to use ad for >> + for passwd and group, dns for hosts resolution and files >> + for the remaining databases on client machines. >> >> What passwd:, group: entries are supported? >> In particular how are passwd(1), getauusernam(3), getuserattr(3) >> and possibly other interfaces affected. >> > > I think we can resolve this by shipping an /etc/nsswitch.ad just like we > do for nis, nisplus, ldap, dns, files today. > The team decided to leave an example nsswitch.ad out because of the limited use of "ad" i.e. "ad" only resolves "passwd" and "group" and does not support logon of Windows users onto Solaris yet. But I see no problem in delivering nsswitch.ad if that's the consensus. --Baban > -- > Darren J Moffat > _______________________________________________ > sparks-discuss mailing list > sparks-discuss@opensolaris.org > http://mail.opensolaris.org/mailman/listinfo/sparks-discuss > From gww@eng.sun.com Wed Jul 16 15:00:05 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6GM043t013249 for ; Wed, 16 Jul 2008 15:00:04 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6GLxxWE029795 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 16 Jul 2008 23:00:03 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4400699D43FK00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 16:00:03 -0600 (MDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K44004CHCZ17N80@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 15:57:01 -0600 (MDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6GLv0kR062749; Wed, 16 Jul 2008 14:57:00 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m6GLwsHq013108; Wed, 16 Jul 2008 14:58:54 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m6GLws9G013107; Wed, 16 Jul 2008 14:58:54 -0700 (PDT) Date: Wed, 16 Jul 2008 14:58:54 -0700 (PDT) From: Gary Winiger Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] To: gww@eng.sun.com, baban.kenkre@sun.com Cc: PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <200807162158.m6GLws9G013107@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 1805 > > My concern is here in nsswitch.conf(4) functionality. > > From the provided it's not clear what the project is > > proposing. > > > > This case basically allows any application using > get{pw,gr}{nam,uid,gid}() interfaces to resolve Windows users and group > names using native Active Directory schema. (nssad_details.txt, Section > 6, Bullet 6 has the example). > > > + When using Active Directory with native schema for name service, > > + the default configuration should be modified to use ad for > > + for passwd and group, dns for hosts resolution and files > > + for the remaining databases on client machines. > > > > What passwd:, group: entries are supported? > > > > You can add "ad" to any of the existing valid passwd: and group: entries. > Examples: > passwd: files ad OR > passwd: files ldap ad > > > In particular how are passwd(1), getauusernam(3), getuserattr(3) > > and possibly other interfaces affected. > > > > passwd(1) is not supported for "ad". Probably that needs to be addressed So this project intends to modify the architecure of passwd(1) where is keeps in sync a user's password across password repositories. It further seems to add a 3rd name service repository where in the past only two were implicitly supported. For those name services databases that follow the passwd: entry, audit_user(4) and user_attr(4) in particular will there be any issues in lookup? If not found in the first or second entry, will the (now third) be processed? Will getpwnam type stuff function like: passwd: files ldap ad And getauusernam() and getuserattr() function like: passwd: files ldap [NOTFOUND=return] ad IMO, it is important to understand this and ensure that users of nss_ad are correctly informed. Gary.. From John.Plocher@sun.com Wed Jul 16 15:07:30 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6GM7UvG013589 for ; Wed, 16 Jul 2008 15:07:30 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6GM77db011501 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 16 Jul 2008 16:07:30 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K440020HDG6QQ00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 15:07:18 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4400JAWDG67L60@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 15:07:18 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m6GM7HHk012345 for ; Wed, 16 Jul 2008 15:07:17 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4400901DCHO000@fe-sfbay-09.sun.com> (original mail from John.Plocher@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 16 Jul 2008 15:07:17 -0700 (PDT) Received: from wp668.SFBay.Sun.COM ([129.146.226.219]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K440020DDG3IJA0@fe-sfbay-09.sun.com>; Wed, 16 Jul 2008 15:07:15 -0700 (PDT) Date: Wed, 16 Jul 2008 15:07:14 -0700 From: John Plocher Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <487E6E71.4050708@sun.com> Sender: John.Plocher@sun.com To: Baban Kenkre Cc: Darren J Moffat , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, Gary Winiger Message-id: <487E7112.7060900@Sun.Com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> <487E64DF.6070304@Sun.COM> <487E6E71.4050708@sun.com> User-Agent: Thunderbird 2.0.0.14 (Macintosh/20080421) Status: RO Content-Length: 424 Baban Kenkre wrote: > The team decided to leave an example nsswitch.ad out because of the > limited use of "ad" i.e. "ad" only resolves "passwd" and "group" and > does not support logon of Windows users onto Solaris yet. But I see no > problem in delivering nsswitch.ad if that's the consensus. I'd think about putting some of this type of info in that file, so the user of the template can get some clue... -John From Serge.Dussud@sun.com Thu Jul 17 05:49:59 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6HCnwQ0004269 for ; Thu, 17 Jul 2008 05:49:58 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6HCnsm4025609 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 17 Jul 2008 13:49:55 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K450091BIB5UN00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 17 Jul 2008 05:49:53 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4500J8PIB35SB0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 17 Jul 2008 05:49:52 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe3.eu.sun.com [192.18.6.12]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m6HCnouH023005 for ; Thu, 17 Jul 2008 12:49:50 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4500201HTOEA00@fe-emea-09.sun.com> (original mail from Serge.Dussud@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 17 Jul 2008 13:49:50 +0100 (BST) Received: from [129.157.210.6] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4500DOUIATADE0@fe-emea-09.sun.com>; Thu, 17 Jul 2008 13:49:43 +0100 (BST) Date: Thu, 17 Jul 2008 14:49:41 +0200 From: Serge Dussud Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <200807162158.m6GLws9G013107@marduk.eng.sun.com> Sender: Serge.Dussud@sun.com To: Gary Winiger Cc: Baban.Kenkre@sun.com, PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Reply-to: Serge.Dussud@sun.com Message-id: <487F3FE5.6050803@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807162158.m6GLws9G013107@marduk.eng.sun.com> User-Agent: Thunderbird 2.0.0.12 (X11/20080228) Status: RO Content-Length: 3199 Gary Winiger wrote: >>> My concern is here in nsswitch.conf(4) functionality. >>> From the provided it's not clear what the project is >>> proposing. >>> >> This case basically allows any application using >> get{pw,gr}{nam,uid,gid}() interfaces to resolve Windows users and group >> names using native Active Directory schema. (nssad_details.txt, Section >> 6, Bullet 6 has the example). >> >>> + When using Active Directory with native schema for name service, >>> + the default configuration should be modified to use ad for >>> + for passwd and group, dns for hosts resolution and files >>> + for the remaining databases on client machines. >>> >>> What passwd:, group: entries are supported? >>> >> You can add "ad" to any of the existing valid passwd: and group: entries. >> Examples: >> passwd: files ad OR >> passwd: files ldap ad >> >>> In particular how are passwd(1), getauusernam(3), getuserattr(3) >>> and possibly other interfaces affected. >>> >> passwd(1) is not supported for "ad". Probably that needs to be addressed > > So this project intends to modify the architecure of passwd(1) > where is keeps in sync a user's password across password repositories. > It further seems to add a 3rd name service repository where > in the past only two were implicitly supported. > > For those name services databases that follow the passwd: > entry, audit_user(4) and user_attr(4) in particular will > there be any issues in lookup? If not found in the first or > second entry, will the (now third) be processed? > > Will getpwnam type stuff function like: > passwd: files ldap ad > And getauusernam() and getuserattr() function like: > passwd: files ldap [NOTFOUND=return] ad along the same lines, nsswitch.conf(4) states in NOTES section: ..... The use of both nis and nisplus as sources for the same database is strongly discouraged since both the name ser- vices are expected to store similar information and the lookups on the database may yield different results depend- ing on which name service is operational at the time of the request. The same applies for using ldap along with nis or nisplus. .... These sentences probably need to mention ad repository somehow as well. > > IMO, it is important to understand this and ensure that users > of nss_ad are correctly informed. need for Solaris Admin guide update with this case ? Also, I understand that Windows logons are out of scope. However: - I don't see it mentioned in the provided man pages and this shall be somewhere in the public documentation IMO (man pages and/or Admin guide) - it's said in the case that 'sp_pwdp will be "*NP*"' ? will this prevent Windows logons or does our PAM stack/modules need to take this into account ? e.g., what if one answers the login prompt with myuser@addomain, which presumably would get resolved by getpwnam/getspnam ? what's the expected behavior ? Serge > > Gary.. > _______________________________________________ > sparks-discuss mailing list > sparks-discuss@opensolaris.org > http://mail.opensolaris.org/mailman/listinfo/sparks-discuss From Nicolas.Williams@sun.com Thu Jul 17 08:53:20 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6HFrKfa008849 for ; Thu, 17 Jul 2008 08:53:20 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6HFr8MM022305; Thu, 17 Jul 2008 08:53:20 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4500I3VQSVBO00@brm-avmta-1.central.sun.com>; Thu, 17 Jul 2008 09:53:19 -0600 (MDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4500GWOQSS3R20@brm-avmta-1.central.sun.com>; Thu, 17 Jul 2008 09:53:16 -0600 (MDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6HFrA6b023903; Thu, 17 Jul 2008 10:53:10 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6HFr9x2023902; Thu, 17 Jul 2008 10:53:09 -0500 (CDT) Date: Thu, 17 Jul 2008 10:53:09 -0500 From: Nicolas Williams Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <200807162158.m6GLws9G013107@marduk.eng.sun.com> To: Gary Winiger Cc: Baban.Kenkre@sun.com, PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Mail-followup-to: Gary Winiger , Baban.Kenkre@sun.com, PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <20080717155309.GF19647@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807162158.m6GLws9G013107@marduk.eng.sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 2672 On Wed, Jul 16, 2008 at 02:58:54PM -0700, Gary Winiger wrote: > > > What passwd:, group: entries are supported? > > > > You can add "ad" to any of the existing valid passwd: and group: entries. > > Examples: > > passwd: files ad OR > > passwd: files ldap ad > > > > > In particular how are passwd(1), getauusernam(3), getuserattr(3) > > > and possibly other interfaces affected. > > passwd(1) is not supported for "ad". Probably that needs to be addressed Nor is RBAC (after all, if AD users will not be able to login on Solaris using nss_ad, then they won't need rights profiles, nor will they need to run the passwd(1) command. As for administrators, if they have AD they know how to administer it, and if they really want to use Unix commands to change AD users passwords they can always use kpasswd(1). > So this project intends to modify the architecure of passwd(1) > where is keeps in sync a user's password across password repositories. That's a big stretch! These users will not be able to login, ergo they won't be able to run the passwd(1) command. Furthermore, these users cannot all exist in multiple repositories since AD has a notion of forest of domains that we don't have for Unix domains (and the password repositories that go with them)! Of course, when we get around to adding logon support here we'll have to ensure that passwd(1) can change AD users' passwords. > It further seems to add a 3rd name service repository where > in the past only two were implicitly supported. I'm not sure that "in the past only two were implicitly supported," nor why that would limit us now if it was an unstated limit. > For those name services databases that follow the passwd: > entry, audit_user(4) and user_attr(4) in particular will > there be any issues in lookup? If not found in the first or > second entry, will the (now third) be processed? Yes (and if not, we'll make sure it does). getusernam(3SECDB) goes through the name service switch, after all, so the full engine's support for nsswitch.conf entry "criteria" is supported. > Will getpwnam type stuff function like: > passwd: files ldap ad > And getauusernam() and getuserattr() function like: > passwd: files ldap [NOTFOUND=return] ad getpwY() and getusernam() both follow the one 'passwd' database configuration from nsswitch.conf. > IMO, it is important to understand this and ensure that users > of nss_ad are correctly informed. Sure, but note that we're not changing how anything works in the name service switch (except to allow the name service switch to pass ephemeral IDs) or elsewhere, thus all these questions' answers are implied. Nico -- From Nicolas.Williams@sun.com Thu Jul 17 08:59:02 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6HFx1LN009366 for ; Thu, 17 Jul 2008 08:59:02 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m6HFwsp7026874; Thu, 17 Jul 2008 23:58:57 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4500I0BR27PP00@brm-avmta-1.central.sun.com>; Thu, 17 Jul 2008 09:58:55 -0600 (MDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4500GE2R263R30@brm-avmta-1.central.sun.com>; Thu, 17 Jul 2008 09:58:55 -0600 (MDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6HFwqQR023911; Thu, 17 Jul 2008 10:58:52 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6HFwqVx023910; Thu, 17 Jul 2008 10:58:52 -0500 (CDT) Date: Thu, 17 Jul 2008 10:58:52 -0500 From: Nicolas Williams Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <487F3FE5.6050803@Sun.COM> To: Serge Dussud Cc: Gary Winiger , Baban.Kenkre@sun.com, PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Mail-followup-to: Serge Dussud , Gary Winiger , Baban.Kenkre@sun.com, PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <20080717155851.GG19647@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807162158.m6GLws9G013107@marduk.eng.sun.com> <487F3FE5.6050803@Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 2010 On Thu, Jul 17, 2008 at 02:49:41PM +0200, Serge Dussud wrote: > along the same lines, nsswitch.conf(4) states in NOTES section: > > ..... > The use of both nis and nisplus as sources for the same > database is strongly discouraged since both the name ser- > vices are expected to store similar information and the > lookups on the database may yield different results depend- > ing on which name service is operational at the time of the > request. The same applies for using ldap along with nis or > nisplus. > .... > > These sentences probably need to mention ad repository somehow as well. Only when nss_ldap is configured with schema mapping to use AD is there any possibility for conflict with nss_ad (specifically, for getpwuid() and getgrgid() calls). We could add: "When using ldap with schema mapping against an Active Directory domain and the ad backend it is strongly recommended that ldap come first, then ad." > > > > IMO, it is important to understand this and ensure that users > > of nss_ad are correctly informed. > > need for Solaris Admin guide update with this case ? We'll probably add a mention of nss_ad to the ID mapping guide and to the name services guide. > Also, I understand that Windows logons are out of scope. However: > > - I don't see it mentioned in the provided man pages and this shall be > somewhere in the public documentation IMO (man pages and/or Admin guide) IIRC that was my fault for not dropping those manpages in place. > - it's said in the case that 'sp_pwdp will be "*NP*"' ? will this > prevent Windows logons or does our PAM stack/modules need to take this > into account ? e.g., what if one answers the login prompt with > myuser@addomain, which presumably would get resolved by > getpwnam/getspnam ? what's the expected behavior ? That you cannot login since no password for myuser@addomain can be validated (assuming you don't have /etc/passwd entries for myuser@addomain...). Nico -- From Darren.Moffat@sun.com Thu Jul 17 11:00:28 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6HI0R6t014762 for ; Thu, 17 Jul 2008 11:00:28 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6HI0JZQ022595 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 17 Jul 2008 19:00:26 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4500H1LWOO4000@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 17 Jul 2008 11:00:24 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4500APHWOM1K60@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 17 Jul 2008 11:00:23 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m6HI0MsN024571 for ; Thu, 17 Jul 2008 18:00:22 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4500F01WMZ8U00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 17 Jul 2008 19:00:22 +0100 (BST) Received: from [10.0.242.191] ([192.18.41.196]) by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4500EU5WOJ05A0@fe-emea-09.sun.com>; Thu, 17 Jul 2008 19:00:22 +0100 (BST) Date: Thu, 17 Jul 2008 19:00:19 +0100 From: Darren J Moffat Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <487E6E71.4050708@sun.com> Sender: Darren.Moffat@sun.com To: Baban Kenkre Cc: Gary Winiger , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <487F88B3.6090301@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> <487E64DF.6070304@Sun.COM> <487E6E71.4050708@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080519) Status: RO Content-Length: 643 Baban Kenkre wrote: >> I think we can resolve this by shipping an /etc/nsswitch.ad just like >> we do for nis, nisplus, ldap, dns, files today. >> > > The team decided to leave an example nsswitch.ad out because of the > limited use of "ad" i.e. "ad" only resolves "passwd" and "group" and Just like nsswitch.dns only has an entry for dns on hosts and ipnodes. > does not support logon of Windows users onto Solaris yet. But I see no > problem in delivering nsswitch.ad if that's the consensus. Since we have an nsswitch example file for all the other nameservice (full or partial) we should have parity there. -- Darren J Moffat From julian.pullen@sun.com Fri Jul 18 03:15:46 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6IAFj9l014463 for ; Fri, 18 Jul 2008 03:15:45 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6IAFfL0010600 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Fri, 18 Jul 2008 11:15:44 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4700A015U6I300@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 18 Jul 2008 03:15:42 -0700 (PDT) Received: from dm-uk-01.uk.sun.com ([129.156.101.115]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K47005OE5U5CZ80@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 18 Jul 2008 03:15:42 -0700 (PDT) Received: from serinus.UK.Sun.COM (serinus.UK.Sun.COM [129.156.173.208]) by dm-uk-01.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6IAFXr8001462; Fri, 18 Jul 2008 11:15:33 +0100 (BST) Received: from [129.156.173.228] (coptic [129.156.173.228]) by serinus.UK.Sun.COM (8.13.7+Sun/8.13.7/CTE 3.0) with ESMTP id m6IAFWZx007225; Fri, 18 Jul 2008 11:15:33 +0100 (BST) Date: Fri, 18 Jul 2008 11:15:10 +0100 From: Julian Pullen Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <487F88B3.6090301@Sun.COM> To: Darren J Moffat Cc: Baban Kenkre , Gary Winiger , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <48806D2E.4020102@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> <487E64DF.6070304@Sun.COM> <487E6E71.4050708@sun.com> <487F88B3.6090301@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (X11/20080630) Status: RO Content-Length: 975 If we are forced to have an /etc/nsswitch.ad file the with "passwd" and "group" it should have a comment that it does not allow logons. I am sure that someone will notice the file look at what it contains and assume it allows logon via AD. We want to avoid this. Regards Julian Darren J Moffat wrote: > Baban Kenkre wrote: >>> I think we can resolve this by shipping an /etc/nsswitch.ad just like >>> we do for nis, nisplus, ldap, dns, files today. >>> >> >> The team decided to leave an example nsswitch.ad out because of the >> limited use of "ad" i.e. "ad" only resolves "passwd" and "group" and > > Just like nsswitch.dns only has an entry for dns on hosts and ipnodes. > >> does not support logon of Windows users onto Solaris yet. But I see no >> problem in delivering nsswitch.ad if that's the consensus. > > Since we have an nsswitch example file for all the other nameservice > (full or partial) we should have parity there. > > -- > Darren J Moffat From Serge.Dussud@sun.com Fri Jul 18 03:58:50 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6IAwoHl014942 for ; Fri, 18 Jul 2008 03:58:50 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6IAwnSx006581 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Fri, 18 Jul 2008 04:58:49 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4700F0D7TZ5T00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 18 Jul 2008 03:58:47 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4700ELX7TXC220@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 18 Jul 2008 03:58:47 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m6IAwjp3013186 for ; Fri, 18 Jul 2008 10:58:45 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K47003017SOFT00@fe-emea-09.sun.com> (original mail from Serge.Dussud@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 18 Jul 2008 11:58:45 +0100 (BST) Received: from [129.157.210.6] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K47000I57TPD2A0@fe-emea-09.sun.com>; Fri, 18 Jul 2008 11:58:38 +0100 (BST) Date: Fri, 18 Jul 2008 12:58:37 +0200 From: Serge Dussud Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <48806D2E.4020102@sun.com> Sender: Serge.Dussud@sun.com To: Julian Pullen Cc: Darren J Moffat , Baban Kenkre , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, Gary Winiger Reply-to: Serge.Dussud@sun.com Message-id: <4880775D.5000700@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> <487E64DF.6070304@Sun.COM> <487E6E71.4050708@sun.com> <487F88B3.6090301@Sun.COM> <48806D2E.4020102@sun.com> User-Agent: Thunderbird 2.0.0.12 (X11/20080228) Status: RO Content-Length: 1250 man page for ad(5) should also mention this. Serge Julian Pullen wrote: > If we are forced to have an /etc/nsswitch.ad file the with "passwd" and "group" > it should have a comment that it does not allow logons. I am sure that > someone will notice the file look at what it contains and assume it allows > logon via AD. We want to avoid this. > > Regards > > Julian > > Darren J Moffat wrote: >> Baban Kenkre wrote: >>>> I think we can resolve this by shipping an /etc/nsswitch.ad just like >>>> we do for nis, nisplus, ldap, dns, files today. >>>> >>> The team decided to leave an example nsswitch.ad out because of the >>> limited use of "ad" i.e. "ad" only resolves "passwd" and "group" and >> Just like nsswitch.dns only has an entry for dns on hosts and ipnodes. >> >>> does not support logon of Windows users onto Solaris yet. But I see no >>> problem in delivering nsswitch.ad if that's the consensus. >> Since we have an nsswitch example file for all the other nameservice >> (full or partial) we should have parity there. >> >> -- >> Darren J Moffat > _______________________________________________ > sparks-discuss mailing list > sparks-discuss@opensolaris.org > http://mail.opensolaris.org/mailman/listinfo/sparks-discuss From Nicolas.Williams@sun.com Fri Jul 18 10:30:09 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6IHU9GP025437 for ; Fri, 18 Jul 2008 10:30:09 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6IHU5wC014561; Fri, 18 Jul 2008 10:30:06 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4700H09PY3GD00@brm-avmta-1.central.sun.com>; Fri, 18 Jul 2008 11:30:03 -0600 (MDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K47009J4PY2X840@brm-avmta-1.central.sun.com>; Fri, 18 Jul 2008 11:30:02 -0600 (MDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6IHTxeP024392; Fri, 18 Jul 2008 12:30:00 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6IHTxC2024391; Fri, 18 Jul 2008 12:29:59 -0500 (CDT) Date: Fri, 18 Jul 2008 12:29:59 -0500 From: Nicolas Williams Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <4880775D.5000700@Sun.COM> To: Serge Dussud Cc: Julian Pullen , Darren J Moffat , Baban Kenkre , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, Gary Winiger Mail-followup-to: Serge Dussud , Julian Pullen , Darren J Moffat , Baban Kenkre , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, Gary Winiger Message-id: <20080718172958.GK19647@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> <487E64DF.6070304@Sun.COM> <487E6E71.4050708@sun.com> <487F88B3.6090301@Sun.COM> <48806D2E.4020102@sun.com> <4880775D.5000700@Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 316 On Fri, Jul 18, 2008 at 12:58:37PM +0200, Serge Dussud wrote: > man page for ad(5) should also mention this. We'll add text to ad(5) saying that nss_ad does not support logons by Windows users. We'll also add nsswitch.ad with a comment as suggested by Julian. I'll update the materials and send a note. Nico -- From Nicolas.Williams@sun.com Fri Jul 18 12:02:50 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6IJ2nR2027980 for ; Fri, 18 Jul 2008 12:02:50 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m6IJ2PW0000135; Sat, 19 Jul 2008 03:02:43 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4700J01U8HM600@nwk-avmta-1.sfbay.Sun.COM>; Fri, 18 Jul 2008 12:02:41 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4700GDJU8GP5B0@nwk-avmta-1.sfbay.Sun.COM>; Fri, 18 Jul 2008 12:02:40 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6IJ2Y99024511; Fri, 18 Jul 2008 14:02:34 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6IJ2Y5N024510; Fri, 18 Jul 2008 14:02:34 -0500 (CDT) Date: Fri, 18 Jul 2008 14:02:34 -0500 From: Nicolas Williams Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <20080718172958.GK19647@Sun.COM> To: Serge Dussud , Julian Pullen , Darren J Moffat , Baban Kenkre , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, Gary Winiger Mail-followup-to: Serge Dussud , Julian Pullen , Darren J Moffat , Baban Kenkre , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, Gary Winiger Message-id: <20080718190233.GQ19647@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> <487E64DF.6070304@Sun.COM> <487E6E71.4050708@sun.com> <487F88B3.6090301@Sun.COM> <48806D2E.4020102@sun.com> <4880775D.5000700@Sun.COM> <20080718172958.GK19647@Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 3482 On Fri, Jul 18, 2008 at 12:29:59PM -0500, Nicolas Williams wrote: > On Fri, Jul 18, 2008 at 12:58:37PM +0200, Serge Dussud wrote: > > man page for ad(5) should also mention this. > > We'll add text to ad(5) saying that nss_ad does not support logons by > Windows users. > > We'll also add nsswitch.ad with a comment as suggested by Julian. > > I'll update the materials and send a note. I've updated ad(5) as follows: +++ ad.5.txt Fri Jul 18 11:10:26 2008 @@ -7,16 +7,24 @@ to an AD domain and using the keyword ad in the nsswitch.conf(4) file. AD domain join can be executed using the kclient(1) utility. The naming databases currently supported by AD name service are - passwd and group. The AD servers are auto-discovered. + passwd and group. Logins by Windows users are not yet supported + however: the user_attr(4) database currently has no entries for + Windows users, and the passwd(1) command does not support + synchronizing user passwords with AD. - The Solaris AD client uses LDAP v3 protocol to access naming - information from the AD servers. No schema modification is needed - on the AD servers because the Solaris client works with native - AD schema. The Solaris AD client uses idmap(1M) service to map - Windows SIDs to POSIX UIDs/GIDs and vice-versa. + The Solaris AD client auto-discovers AD directory servers ("domain + controllers" and "global catalog" servers) and uses LDAP v3 + protocol to access naming information from the AD servers. No + schema modification is needed on the AD servers because the Solaris + client works with native AD schema. The Solaris AD client uses + idmap(1M) service to map Windows SIDs to POSIX UIDs/GIDs and + vice-versa. User and group names are taken from the sAMAccountName + attribute of user and group objects in AD, and are then suffixed + with '@' and the name of the AD domain where the objects reside. - Security model used by the client is SASL/GSSAPI/KRB5. Kerberos v5 - is configured on the client at the time of domain join. + The security model used by the client is SASL/GSSAPI/KRB5. + Kerberos v5 must be configured on the client at the time of domain + join; see kclient(1M). FILES And I've updated nsswitch.conf(4) as follows: ------- nsswitch.conf.4.txt ------- --- /tmp/sccs.wxaqL2 Fri Jul 18 12:02:09 2008 +++ nsswitch.conf.4.txt Fri Jul 18 12:00:20 2008 @@ -422,6 +422,9 @@ /etc/nsswitch.ldap Sample configuration file that uses files and ldap. + /etc/nsswitch.ad Sample configuration file that + uses files and ad. + /etc/nsswitch.dns Sample configuration file that uses files, dns and mdns (dns and mdns only for hosts). @@ -454,7 +457,9 @@ lookups on the database may yield different results depend- ing on which name service is operational at the time of the request. The same applies for using ldap along with nis or - nisplus. + nisplus. The same applies for using ldap along with ad + when ldap is used with schema mapping with an Active + Directory domain. Misspelled names of sources and databases will be treated as legitimate names of (most likely nonexistent) sources and From storycrafter@gmail.com Fri Jul 18 13:00:38 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6IK0cTv000301 for ; Fri, 18 Jul 2008 13:00:38 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6IK0bG3027765 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Fri, 18 Jul 2008 13:00:37 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K470050BWX1A300@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 18 Jul 2008 14:00:37 -0600 (MDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4700912WX0X8D0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 18 Jul 2008 14:00:36 -0600 (MDT) Received: from relay43i.sun.com ([192.5.209.74]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m6IJphEl011466 for ; Fri, 18 Jul 2008 20:00:36 +0000 (GMT) Received: from mms48es.mms.us.syntegra.com ([160.41.221.230] [160.41.221.230]) by relay43i.sun.com with ESMTP id BT-MMP-37296 for PSARC-ext@sun.com; Fri, 18 Jul 2008 20:00:36 +0000 (Z) Received: from relay44i.sun.com (relay44i.sun.com [192.5.209.118]) by mms48es.mms.us.syntegra.com with ESMTP id BT-MMP-3755023 for PSARC-ext@sun.com; Fri, 18 Jul 2008 20:00:36 +0000 (Z) Received: from hs-out-0708.google.com ([64.233.178.248] [64.233.178.248]) by relay4i.sun.com with ESMTP id BT-MMP-1213041 for PSARC-ext@sun.com; Fri, 18 Jul 2008 20:00:36 +0000 (Z) Received: by hs-out-0708.google.com with SMTP id n78so126590hsc.8 for ; Fri, 18 Jul 2008 13:00:12 -0700 (PDT) Received: by 10.100.190.14 with SMTP id n14mr548732anf.91.1216411212055; Fri, 18 Jul 2008 13:00:12 -0700 (PDT) Received: by 10.100.174.8 with HTTP; Fri, 18 Jul 2008 13:00:11 -0700 (PDT) Date: Fri, 18 Jul 2008 15:00:11 -0500 From: Mark Martin Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <20080718190233.GQ19647@Sun.COM> To: Serge Dussud , Julian Pullen , Darren J Moffat , Baban Kenkre , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, Gary Winiger Message-id: MIME-version: 1.0 Content-type: multipart/alternative; boundary="Boundary_(ID_8673L9xVale9hm/VGbx5TA)" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:in-reply-to:mime-version:content-type:references; bh=LgICA0hEDjrjpkKU3fpa6yweap/FrqOlmMsOBpl4Wi8=; b=gvPiHM4QH36uVCJAIzviTsYhXJ5TAlWybfhpt4ctmlhLp2PooLM5smrt+ABlczh2Nf /FBAAPTqjADzPPs0UiYhB0Xvl8ABuXUdhcoX9ces7r5t55fN6m4ranlZSO0OnijhStW7 k/9aJJfEGbQHkEyeaFdKZPCnRTTb7c80mz8U8= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version :content-type:references; b=u202q2ZCxQs9sv2R30LR1wokGaYDyP+LoNefW9JxjtByNZGN9nclAcvMkPkIAO4BIY cbD+gGXnYxxIafruIGa2THNbc6juzjyfT9RAG/IFmP/VZja+W/m9dW2DYdgEhhpJ3AhN b5RnRHfzRCwxL4GynayxUEnEOzI6iq4IN24vA= X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 0.068sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> <487E64DF.6070304@Sun.COM> <487E6E71.4050708@sun.com> <487F88B3.6090301@Sun.COM> <48806D2E.4020102@sun.com> <4880775D.5000700@Sun.COM> <20080718172958.GK19647@Sun.COM> <20080718190233.GQ19647@Sun.COM> Status: RO Content-Length: 2061 --Boundary_(ID_8673L9xVale9hm/VGbx5TA) Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Content-disposition: inline On Fri, Jul 18, 2008 at 2:02 PM, Nicolas Williams wrote: > > > I've updated ad(5) as follows: > > +++ ad.5.txt Fri Jul 18 11:10:26 2008 > > > + protocol to access naming information from the AD servers. No > + schema modification is needed on the AD servers because the Solaris > + client works with native AD schema. The Solaris AD client uses I wasn't able to find enough materials on the public site for this case or for CIFS client incl. idmap to validate this -- will this work for SBS as well? What if SFU is installed (or the server is R2)? --Boundary_(ID_8673L9xVale9hm/VGbx5TA) Content-type: text/html; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Content-disposition: inline

On Fri, Jul 18, 2008 at 2:02 PM, Nicolas Williams <Nicolas.Williams@sun.com> wrote:


I've updated ad(5) as follows:

+++ ad.5.txt    Fri Jul 18 11:10:26 2008
<snip>

+     protocol to access naming information from the AD servers.  No
+     schema modification is needed on the AD servers because the Solaris
+     client works with native AD schema. The Solaris AD client uses

I wasn't able to find enough materials on the public site for this case or for CIFS client incl. idmap to validate this -- will this work for SBS  as well?  What if SFU is installed (or the server is R2)?

--Boundary_(ID_8673L9xVale9hm/VGbx5TA)-- From Nicolas.Williams@sun.com Fri Jul 18 13:30:21 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6IKUKOt001255 for ; Fri, 18 Jul 2008 13:30:20 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6IKUEMi008411; Fri, 18 Jul 2008 14:30:17 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4700E01YAGRR00@nwk-avmta-2.sfbay.sun.com>; Fri, 18 Jul 2008 13:30:17 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4700ABKYAFLB70@nwk-avmta-2.sfbay.sun.com>; Fri, 18 Jul 2008 13:30:15 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6IKUCt7024570; Fri, 18 Jul 2008 15:30:12 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6IKUBxZ024569; Fri, 18 Jul 2008 15:30:11 -0500 (CDT) Date: Fri, 18 Jul 2008 15:30:11 -0500 From: Nicolas Williams Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: To: Mark Martin Cc: Serge Dussud , Julian Pullen , Darren J Moffat , Baban Kenkre , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, Gary Winiger Mail-followup-to: Mark Martin , Serge Dussud , Julian Pullen , Darren J Moffat , Baban Kenkre , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, Gary Winiger Message-id: <20080718203011.GR19647@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> <487E64DF.6070304@Sun.COM> <487E6E71.4050708@sun.com> <487F88B3.6090301@Sun.COM> <48806D2E.4020102@sun.com> <4880775D.5000700@Sun.COM> <20080718172958.GK19647@Sun.COM> <20080718190233.GQ19647@Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1319 On Fri, Jul 18, 2008 at 03:00:11PM -0500, Mark Martin wrote: > On Fri, Jul 18, 2008 at 2:02 PM, Nicolas Williams > wrote: > > > > > > > I've updated ad(5) as follows: > > > > +++ ad.5.txt Fri Jul 18 11:10:26 2008 > > > > > > > > + protocol to access naming information from the AD servers. No > > + schema modification is needed on the AD servers because the Solaris > > + client works with native AD schema. The Solaris AD client uses > > > I wasn't able to find enough materials on the public site for this case or > for CIFS client incl. idmap to validate this -- will this work for SBS as > well? What if SFU is installed (or the server is R2)? There's plenty of documentation, starting with the CIFS server admin guide, which contains the ID mapping admin guide, as well as various ARC cases, man pages, ... The case materials for this case indicate that SFU will not be used by nss_ad for any purpose, although a future case may add support for using SFU in idmapd for mapping Windows users in _one_ domain to non-ephemeral UIDs and GIDs. Such a future case would cause nss_ad to indirectly support SFU for the same purpose because nss_ad will use ID mapping APIs for mapping Windows SIDs to UIDs/GIDs, and consequently nss_ad will use idmapd. Nico -- From storycrafter@gmail.com Fri Jul 18 13:59:15 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6IKxFkt001764 for ; Fri, 18 Jul 2008 13:59:15 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6IKxEG8012852 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Fri, 18 Jul 2008 13:59:15 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4700909ZMPCF00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 18 Jul 2008 13:59:13 -0700 (PDT) Received: from sca-ea-mail-4.sun.com ([192.18.43.22]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4700KD8ZMODLC0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 18 Jul 2008 13:59:12 -0700 (PDT) Received: from relay15i.sun.com (ip125.net129179-4.block1.us.syntegra.com [129.179.4.125]) by sca-ea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m6IKxBxr023425 for ; Fri, 18 Jul 2008 20:59:11 +0000 (GMT) Received: from mmp11es.mmp.us.syntegra.com ([160.41.208.11] [160.41.208.11]) by relay15i.sun.com with ESMTP id BT-MMP-50186 for PSARC-ext@sun.com; Fri, 18 Jul 2008 20:59:11 +0000 (Z) Received: from relay13i.sun.com (relay13i.sun.com [129.179.4.123]) by mmp11es.mmp.us.syntegra.com with ESMTP id BT-MMP-1771081 for PSARC-ext@sun.com; Fri, 18 Jul 2008 20:59:10 +0000 (Z) Received: from an-out-0708.google.com ([209.85.132.240] [209.85.132.240]) by relay1ib.sun.com with ESMTP id BT-MMP-521794 for PSARC-ext@sun.com; Fri, 18 Jul 2008 20:59:10 +0000 (Z) Received: by an-out-0708.google.com with SMTP id d31so231460and.92 for ; Fri, 18 Jul 2008 13:59:09 -0700 (PDT) Received: by 10.100.119.12 with SMTP id r12mr619621anc.73.1216414749488; Fri, 18 Jul 2008 13:59:09 -0700 (PDT) Received: by 10.100.174.8 with HTTP; Fri, 18 Jul 2008 13:59:09 -0700 (PDT) Date: Fri, 18 Jul 2008 15:59:09 -0500 From: Mark Martin Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <20080718203011.GR19647@Sun.COM> To: Serge Dussud , Julian Pullen , Darren J Moffat , Baban Kenkre , PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, Gary Winiger Message-id: MIME-version: 1.0 Content-type: multipart/alternative; boundary="Boundary_(ID_afIvWApr5KQF4b7yidlaHA)" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:in-reply-to:mime-version:content-type:references; bh=0HZ7SdbcWs5p7250fAcdNN9jd9w2cUXZWKKhnLgAppY=; b=ikBuZbOLMRoxvzCXw7/4zVfiFiQljOwuzU3V+CZuJS7CKjLJjDUvdE8cQi50FHrHq/ YZ/o4voXIUvYOy5Nh5qHtmUYqUbV5Wsfu43K/GWv8B6JlkF77uoNUJ7guUlVJQNMIf0j WKCB8gwSLTVsSLEA5Ei6kYTJMbsbTGYZt2+4M= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version :content-type:references; b=fZmi+4eiqDdN5Nlrb1dcuA+/FsZjBmqh713finibd8Uhz+6l82KYsjpk6fvhSRYuzi KvMg/08wG1+SnvbkX+aPE2sA67yvArJ4x+nv34xKABllJsbA50BAIwhrto77WfW5aDrG +lQXVjBilRr1aeC2mQecg84HZOublERzwNZzk= X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 0.437sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200807162114.m6GLEMqk012992@marduk.eng.sun.com> <487E64DF.6070304@Sun.COM> <487E6E71.4050708@sun.com> <487F88B3.6090301@Sun.COM> <48806D2E.4020102@sun.com> <4880775D.5000700@Sun.COM> <20080718172958.GK19647@Sun.COM> <20080718190233.GQ19647@Sun.COM> <20080718203011.GR19647@Sun.COM> Status: RO Content-Length: 4051 --Boundary_(ID_afIvWApr5KQF4b7yidlaHA) Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Content-disposition: inline On Fri, Jul 18, 2008 at 3:30 PM, Nicolas Williams wrote: > > There's plenty of documentation, starting with the CIFS server admin > guide, which contains the ID mapping admin guide, as well as various ARC > cases, man pages, ... True enough. Unfortunately, at least some of the referred ARC cases are closed, and the only materials in this caselog available publicly are the onepager and the email sink. I wasn't able to find the answer on SBS in the referred materials (or on Winchester's project page nor SunDocs). I know from personal experience nss_ldap requires extra twiddling for that schema, and I was curious about this case. > > The case materials for this case indicate that SFU will not be used by > nss_ad for any purpose, although a future case may add support for using > SFU in idmapd for mapping Windows users in _one_ domain to non-ephemeral > UIDs and GIDs. Such a future case would cause nss_ad to indirectly > support SFU for the same purpose because nss_ad will use ID mapping APIs > for mapping Windows SIDs to UIDs/GIDs, and consequently nss_ad will use > idmapd. > It doesn't explicitly prohibit the use of SFU either, though, from the man page excerpts I can see in this thread. "I have SFU installed on SBS, will nss_ad still work?" was the question I was after. Call it migration from the legacy solution. I suspect that's a question better posed in general to the CIFS client/idmapper team as it would appear that's where the dependency is. This was mostly for curiosity. I'm not interested in dwelling -- moving along. Thanks for the response. --Boundary_(ID_afIvWApr5KQF4b7yidlaHA) Content-type: text/html; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Content-disposition: inline On Fri, Jul 18, 2008 at 3:30 PM, Nicolas Williams <Nicolas.Williams@sun.com> wrote:

There's plenty of documentation, starting with the CIFS server admin
guide, which contains the ID mapping admin guide, as well as various ARC
cases, man pages, ...

True enough.  Unfortunately, at least some of the referred ARC cases are closed, and the only materials in this caselog available publicly are the onepager and the email sink.  I wasn't able to find the answer on SBS in the referred materials (or on Winchester's project page nor SunDocs). I know from personal experience nss_ldap requires extra twiddling for that schema, and I was curious about this case.



The case materials for this case indicate that SFU will not be used by
nss_ad for any purpose, although a future case may add support for using
SFU in idmapd for mapping Windows users in _one_ domain to non-ephemeral
UIDs and GIDs.  Such a future case would cause nss_ad to indirectly
support SFU for the same purpose because nss_ad will use ID mapping APIs
for mapping Windows SIDs to UIDs/GIDs, and consequently nss_ad will use
idmapd.

It doesn't explicitly prohibit the use of SFU either, though, from the man page excerpts I can see in this thread.  "I have SFU installed on SBS, will nss_ad still work?" was the question I was after.  Call it migration from the legacy solution.  I suspect that's a question better posed in general to the CIFS client/idmapper team as it would appear that's where the dependency is.

This was mostly for curiosity.  I'm not interested in dwelling -- moving along.  Thanks for the response. --Boundary_(ID_afIvWApr5KQF4b7yidlaHA)-- From Nicolas.Williams@sun.com Fri Jul 18 14:51:18 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6ILpIta003725 for ; Fri, 18 Jul 2008 14:51:18 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6ILpFVI024489; Fri, 18 Jul 2008 14:51:15 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4800I0121FOS00@nwk-avmta-2.sfbay.sun.com>; Fri, 18 Jul 2008 14:51:15 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4800A5W21EL3A0@nwk-avmta-2.sfbay.sun.com>; Fri, 18 Jul 2008 14:51:14 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6ILp7x8024704; Fri, 18 Jul 2008 16:51:08 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6ILp7Iw024703; Fri, 18 Jul 2008 16:51:07 -0500 (CDT) Date: Fri, 18 Jul 2008 16:51:07 -0500 From: Nicolas Williams Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: To: Mark Martin Cc: Serge Dussud , Julian Pullen , Darren J Moffat , Baban Kenkre , psarc-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, Gary Winiger Mail-followup-to: Mark Martin , Serge Dussud , Julian Pullen , Darren J Moffat , Baban Kenkre , psarc-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, Gary Winiger Message-id: <20080718215106.GS19647@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <487E64DF.6070304@Sun.COM> <487E6E71.4050708@sun.com> <487F88B3.6090301@Sun.COM> <48806D2E.4020102@sun.com> <4880775D.5000700@Sun.COM> <20080718172958.GK19647@Sun.COM> <20080718190233.GQ19647@Sun.COM> <20080718203011.GR19647@Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 3068 On Fri, Jul 18, 2008 at 03:59:09PM -0500, Mark Martin wrote: > On Fri, Jul 18, 2008 at 3:30 PM, Nicolas Williams > wrote: > > There's plenty of documentation, starting with the CIFS server admin > > guide, which contains the ID mapping admin guide, as well as various ARC > > cases, man pages, ... > > True enough. Unfortunately, at least some of the referred ARC cases are > closed, and the only materials in this caselog available publicly are the > onepager and the email sink. I wasn't able to find the answer on SBS in the > referred materials (or on Winchester's project page nor SunDocs). I know > from personal experience nss_ldap requires extra twiddling for that schema, > and I was curious about this case. We should look into opening related closed cases. In any case, the answer to your question is that nss_ad will require no additional features from AD -- it will work with Windows 2000 through Windows 2008 without requiring the deployment of SFU (bundled in Windows 2003R2). nss_ldap does require schema mapping, but this case is not about nss_ldap. (For the benefit of ARC members, "SBS" stands for Small Business Server, which is a flavor of Windows that includes Active Directory.) > > The case materials for this case indicate that SFU will not be used by > > nss_ad for any purpose, although a future case may add support for using > > SFU in idmapd for mapping Windows users in _one_ domain to non-ephemeral > > UIDs and GIDs. Such a future case would cause nss_ad to indirectly > > support SFU for the same purpose because nss_ad will use ID mapping APIs > > for mapping Windows SIDs to UIDs/GIDs, and consequently nss_ad will use > > idmapd. > > It doesn't explicitly prohibit the use of SFU either, though, from the man > page excerpts I can see in this thread. The original e-mail said: o nss_ad will not support SFU initially and will be limited to native AD schema. If SFU is deployed then nss_ldap must be used. > "I have SFU installed on SBS, will > nss_ad still work?" was the question I was after. The answer is "yes," and it's so because whether or not you use SFU there will be Windows-specific user/group information in AD, and that is what nss_ad uses. > Call it migration from > the legacy solution. I suspect that's a question better posed in general to > the CIFS client/idmapper team as it would appear that's where the dependency > is. Considering that you will not be able to login on a Solaris system using Windows user accounts resolved via nss_ad, I think it's too soon to speak of "migration from the legacy solution." Future cases may redress this, but until then if you wish to login on Solaris with a Windows user account then you'll have to keep using nss_ldap with schema mapping. > This was mostly for curiosity. I'm not interested in dwelling -- moving > along. Thanks for the response. No problem. These are good questions. Thanks for participating! Nico -- From gww@eng.sun.com Tue Jul 22 15:50:22 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6MMoLmi027068 for ; Tue, 22 Jul 2008 15:50:22 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6MMoKC7051835 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 22 Jul 2008 16:50:21 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4F00109JFWEQ00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 22 Jul 2008 15:50:20 -0700 (PDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4F00J29JFWLE80@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 22 Jul 2008 15:50:20 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6MMoJ23064078; Tue, 22 Jul 2008 15:50:19 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m6MMqM1W021351; Tue, 22 Jul 2008 15:52:22 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m6MMqMdg021350; Tue, 22 Jul 2008 15:52:22 -0700 (PDT) Date: Tue, 22 Jul 2008 15:52:22 -0700 (PDT) From: Gary Winiger Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] To: baban.kenkre@sun.com, gww@eng.sun.com Cc: PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <200807222252.m6MMqMdg021350@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 577 > This case basically allows any application using > get{pw,gr}{nam,uid,gid}() interfaces to resolve Windows users and group > names using native Active Directory schema. (nssad_details.txt, Section > 6, Bullet 6 has the example). Hummm, I don't seem to find nssad_details.txt Section 6 Bullet 6 in the case materials or log. Is this something that should be recorded in the case? Is ``6. Configuration'' of the case submission being referred to? There are only 5 Bullets in that section. Is this just a nit that isn't fully relevant to the architecture? Gary.. From gww@eng.sun.com Tue Jul 22 16:05:19 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6MN5JsG027560 for ; Tue, 22 Jul 2008 16:05:19 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6MN5GLE006653 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 23 Jul 2008 00:05:18 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4F00F13K4S5900@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 22 Jul 2008 16:05:16 -0700 (PDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4F001HVK4QAA80@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 22 Jul 2008 16:05:14 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6MN5D5w006646; Tue, 22 Jul 2008 16:05:13 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m6MN7HRY021385; Tue, 22 Jul 2008 16:07:17 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m6MN7GnS021384; Tue, 22 Jul 2008 16:07:16 -0700 (PDT) Date: Tue, 22 Jul 2008 16:07:16 -0700 (PDT) From: Gary Winiger Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] To: Nicolas.Williams@sun.com, gww@eng.sun.com Cc: Baban.Kenkre@sun.com, PSARC-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <200807222307.m6MN7GnS021384@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 1789 > On Wed, Jul 16, 2008 at 02:58:54PM -0700, Gary Winiger wrote: > > > > What passwd:, group: entries are supported? > > > > > > You can add "ad" to any of the existing valid passwd: and group: entries. > > > Examples: > > > passwd: files ad OR > > > passwd: files ldap ad > > > > In particular how are passwd(1), getauusernam(3), getuserattr(3) > > > > and possibly other interfaces affected. > > > > > passwd(1) is not supported for "ad". Probably that needs to be addressed > > So this project intends to modify the architecure of passwd(1) > > where is keeps in sync a user's password across password repositories. > > That's a big stretch! These users will not be able to login, ergo they > won't be able to run the passwd(1) command. Furthermore, these users > cannot all exist in multiple repositories since AD has a notion of > forest of domains that we don't have for Unix domains (and the password > repositories that go with them)! Hummm, looking at the architecture of passwd(1), it only supports 2 repositories. I suspect this is left over from some other day and age. It has nothing to do with whether an AD user can login. It has to do with passwd(1) getting an error if the nsswitch passwd: line were to look like the example given. Diving below the architecture, I suspect: struct __nsw_switchconfig *conf conf = __nsw_getconfig("passwd", &pserr); conf->num_lookups will be 3 in the above example. In that case, passwd(1) looks like it will return "Unexpected failure. Password file/table unchanged." (localized of course). I guess I've just ended up in this code too often. So is this example correct? If so, doesn't it require some change to the passwd(1) architecture dealing with the various limitations imposed? Gary.. From John.Plocher@sun.com Tue Jul 22 16:26:25 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6MNQOTc027806 for ; Tue, 22 Jul 2008 16:26:24 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6MNQES9014347 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 23 Jul 2008 00:26:23 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4F00307L3YE200@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 22 Jul 2008 16:26:22 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4F00JPVL3XL8B0@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 22 Jul 2008 16:26:21 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m6MNQL8L004068 for ; Tue, 22 Jul 2008 16:26:21 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4F00H01L1J4I00@fe-sfbay-09.sun.com> (original mail from John.Plocher@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 22 Jul 2008 16:26:21 -0700 (PDT) Received: from [192.168.168.4] ([208.74.177.212]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4F00IVDL3X15E0@fe-sfbay-09.sun.com>; Tue, 22 Jul 2008 16:26:21 -0700 (PDT) Date: Tue, 22 Jul 2008 16:26:17 -0700 From: John Plocher Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <200807222307.m6MN7GnS021384@marduk.eng.sun.com> Sender: John.Plocher@sun.com To: Gary Winiger Cc: Nicolas.Williams@sun.com, Baban.Kenkre@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, PSARC-ext@sun.com Message-id: <48866C99.3020001@Sun.Com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807222307.m6MN7GnS021384@marduk.eng.sun.com> User-Agent: Thunderbird 2.0.0.14 (Macintosh/20080421) Status: RO Content-Length: 1082 Gary Winiger wrote: > Hummm, looking at the architecture of passwd(1), it only > supports 2 repositories. Being pedantic: Are you referring to lines 1402 and following in http://src.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/cmd/passwd/passwd.c In particular: 1402 /* 1403 * get_namelist_nisplus 1404 * 1405 */ 1406 1407 /* 1408 * Our private version of the switch frontend for getspent. We want to 1409 * search just the nisplus sp file, so we want to bypass normal nsswitch.conf 1410 * based processing. This implementation compatible with version 2 of the 1411 * name service switch. 1412 */ in particular (@ line 1510): 1510 int 1511 get_namelist(pwu_repository_t repository, char ***namelist, int *num_user) 1512 { 1513 if (IS_NISPLUS(repository)) 1514 return (get_namelist_nisplus(namelist, num_user)); 1515 else if (IS_FILES(repository)) 1516 return (get_namelist_files(namelist, num_user)); 1517 1518 rusage(); 1519 return (BADSYN); 1520 } -John From gww@eng.sun.com Tue Jul 22 16:33:08 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6MNX7ar028008 for ; Tue, 22 Jul 2008 16:33:08 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6MNX7jo007942 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 22 Jul 2008 16:33:07 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4F00G03LF78A00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 22 Jul 2008 17:33:07 -0600 (MDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4F00FUALF75Q00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 22 Jul 2008 17:33:07 -0600 (MDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6MNX5Wb019716; Tue, 22 Jul 2008 16:33:05 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m6MNZ9g6021441; Tue, 22 Jul 2008 16:35:09 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m6MNZ8Ma021440; Tue, 22 Jul 2008 16:35:08 -0700 (PDT) Date: Tue, 22 Jul 2008 16:35:08 -0700 (PDT) From: Gary Winiger Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] To: gww@eng.sun.com, John.Plocher@sun.com Cc: Nicolas.Williams@sun.com, Baban.Kenkre@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org, PSARC-ext@sun.com Message-id: <200807222335.m6MNZ8Ma021440@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 426 > Gary Winiger wrote: > > Hummm, looking at the architecture of passwd(1), it only > > supports 2 repositories. > > Being pedantic: No. And I'm not sure code inspection is useful in line with the case discussion. If you want to take it to an offline discussion, we could do all the archichology there. The important thing for this case is what it means to have more than two repositories going forward. Gary.. From Nicolas.Williams@sun.com Tue Jul 22 23:09:57 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6N69uJh007459 for ; Tue, 22 Jul 2008 23:09:56 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6N69AMe024642; Wed, 23 Jul 2008 07:09:54 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4G0000T3SALU00@nwk-avmta-2.sfbay.sun.com>; Tue, 22 Jul 2008 23:09:46 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4G008S33S8LSB0@nwk-avmta-2.sfbay.sun.com>; Tue, 22 Jul 2008 23:09:44 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6N69d6J027798; Wed, 23 Jul 2008 01:09:39 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6N69dfI027797; Wed, 23 Jul 2008 01:09:39 -0500 (CDT) Date: Wed, 23 Jul 2008 01:09:39 -0500 From: Nicolas Williams Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <200807222307.m6MN7GnS021384@marduk.eng.sun.com> To: Gary Winiger Cc: Baban.Kenkre@sun.com, psarc-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Mail-followup-to: Gary Winiger , Baban.Kenkre@sun.com, psarc-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Message-id: <20080723060909.GT25547@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807222307.m6MN7GnS021384@marduk.eng.sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 826 On Tue, Jul 22, 2008 at 04:07:16PM -0700, Gary Winiger wrote: > Hummm, looking at the architecture of passwd(1), it only > supports 2 repositories. I suspect this is left over from some The question is: Is this architecture? Where is it written that passwd(1) has/must have this limitation? If it isn't a stated limitation then we'll simply fix this bug, otherwise we'll simply change that limitation. passwd(1) says: When a user has a password stored in one of the name ser- vices as well as a local files entry, the passwd command updates both. It is possible to have different passwords in the name service and local files entry. Use passwd -r to change a specific password repository. I don't think that implies a limit of two name service backends for the passwd database. From Serge.Dussud@sun.com Wed Jul 23 01:26:02 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6N8Q2EN010811 for ; Wed, 23 Jul 2008 01:26:02 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6N8Q1kk043830 for <@sunmail2sca.sfbay.sun.com:psarc-ext@sun.com>; Wed, 23 Jul 2008 02:26:01 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4G00A01A3CKU00@nwk-avmta-1.sfbay.Sun.COM> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 Jul 2008 01:26:00 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4G00D9MA3ALUD0@nwk-avmta-1.sfbay.Sun.COM> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 Jul 2008 01:26:00 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m6N8Pwwu011420 for ; Wed, 23 Jul 2008 08:25:58 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4G00D019PBL700@fe-emea-09.sun.com> (original mail from Serge.Dussud@Sun.COM) for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 Jul 2008 09:25:58 +0100 (BST) Received: from [129.157.210.6] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4G009H4A2U1SC0@fe-emea-09.sun.com>; Wed, 23 Jul 2008 09:25:43 +0100 (BST) Date: Wed, 23 Jul 2008 10:25:42 +0200 From: Serge Dussud Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <20080723060909.GT25547@Sun.COM> Sender: Serge.Dussud@sun.com To: Gary Winiger , Baban.Kenkre@sun.com, psarc-ext@sun.com, nw141292@sac.sfbay.sun.com, sparks-discuss@opensolaris.org Reply-to: Serge.Dussud@sun.com Message-id: <4886EB06.5020203@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807222307.m6MN7GnS021384@marduk.eng.sun.com> <20080723060909.GT25547@Sun.COM> User-Agent: Thunderbird 2.0.0.12 (X11/20080228) Status: RO Content-Length: 2161 Nicolas Williams wrote: > On Tue, Jul 22, 2008 at 04:07:16PM -0700, Gary Winiger wrote: >> Hummm, looking at the architecture of passwd(1), it only >> supports 2 repositories. I suspect this is left over from some > > The question is: Is this architecture? Where is it written that > passwd(1) has/must have this limitation? If it isn't a stated > limitation then we'll simply fix this bug, otherwise we'll simply change > that limitation. > > passwd(1) says: > > When a user has a password stored in one of the name ser- > vices as well as a local files entry, the passwd command > updates both. It is possible to have different passwords in > the name service and local files entry. Use passwd -r to > change a specific password repository. > > I don't think that implies a limit of two name service backends for the > passwd database. passwd(1) also says: .... If all requirements are met, by default, the passwd command consults /etc/nsswitch.conf to determine in which reposi- tories to perform password update. It searches the passwd and passwd_compat entries. The sources (repositories) asso- ciated with these entries are updated. However, the password update configurations supported are limited to the following cases. Failure to comply with the configurations prevents users from logging onto the system. The password update con- figurations are: o passwd: files o passwd: files ldap SunOS 5.11 Last change: 27 Aug 2007 2 User Commands passwd(1) o passwd: files nis o passwd: files nisplus o passwd: compat (==> files nis) o passwd: compat (==> files ldap) passwd_compat: ldap o passwd: compat (==> files nisplus) passwd_compat: nisplus .... Serge > > _______________________________________________ > sparks-discuss mailing list > sparks-discuss@opensolaris.org > http://mail.opensolaris.org/mailman/listinfo/sparks-discuss From gww@eng.sun.com Wed Jul 23 09:05:43 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6NG5g0q023807 for ; Wed, 23 Jul 2008 09:05:42 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6NG5Zwd006959 for <@sunmail2sca.sfbay.sun.com:psarc-ext@sun.com>; Wed, 23 Jul 2008 17:05:41 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4G00M6HVDGRJ00@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 Jul 2008 10:05:40 -0600 (MDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4G00FJ1VDDEJ80@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 Jul 2008 10:05:37 -0600 (MDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6NG5Y2N059323; Wed, 23 Jul 2008 09:05:34 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m6NG7cmm022101; Wed, 23 Jul 2008 09:07:38 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m6NG7c75022100; Wed, 23 Jul 2008 09:07:38 -0700 (PDT) Date: Wed, 23 Jul 2008 09:07:38 -0700 (PDT) From: Gary Winiger Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] To: Baban.Kenkre@sun.com, Serge.Dussud@sun.com, gww@eng.sun.com, nw141292@sac.sfbay.sun.com, psarc-ext@sun.com, sparks-discuss@opensolaris.org Message-id: <200807231607.m6NG7c75022100@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 3077 > Nicolas Williams wrote: > > On Tue, Jul 22, 2008 at 04:07:16PM -0700, Gary Winiger wrote: > >> Hummm, looking at the architecture of passwd(1), it only > >> supports 2 repositories. I suspect this is left over from some > > > > The question is: Is this architecture? Where is it written that > > passwd(1) has/must have this limitation? If it isn't a stated > > limitation then we'll simply fix this bug, otherwise we'll simply change > > that limitation. > > > > passwd(1) says: > > > > When a user has a password stored in one of the name ser- > > vices as well as a local files entry, the passwd command > > updates both. It is possible to have different passwords in > > the name service and local files entry. Use passwd -r to > > change a specific password repository. > > > > I don't think that implies a limit of two name service backends for the > > passwd database. > > passwd(1) also says: IMO, there is still an incomplete specification here. The getxby stuff is clear enough from the discussion, but IMO, not from the man page changes. IMO, that's a NIT that can be worked off line. It's the putxby stuff as privately implemented since SunOS 2.x/3.x when NIS (nee yp) was added to passwd that has been brought forward to/through the name service switch that is more the architecture that I'm finding a need for more detail. Indeed not all architecture is captured in man pages. And without doing a good bit of archaeology on passwd/passwdutil, name services (probably also nisplus) ARC cases, I can't say if the two backends architecture was ever formally presented. I can say it is present in the code and has been explicitly called out for some time. IMO, that may not make it formal architecture, but it also does not make it a bug. Back to my original concern: Is this case modifying the passwd: (and any other database:) architecture to allow for more than two name services? If so, will ad be explicitly worked around in the passwd(1) implementation (including the putxbyy private implementations and interactions with nsswitch)? How will such be documented for the admin/user? Please don't interpret this as opposing adding nss_ad, or changing the nsswitch or passwd/passwdutil/putxbyy architectures. It's that these are security relevant and don't seem to me well enough specified in the case materials. Gary.. > > .... > If all requirements are met, by default, the passwd command > consults /etc/nsswitch.conf to determine in which reposi- > tories to perform password update. It searches the passwd > and passwd_compat entries. The sources (repositories) asso- > ciated with these entries are updated. However, the password > update configurations supported are limited to the following > cases. Failure to comply with the configurations prevents > users from logging onto the system. The password update con- > figurations are: > > o passwd: files > > o passwd: files ldap From Nicolas.Williams@sun.com Wed Jul 23 09:57:26 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6NGvQoH026876 for ; Wed, 23 Jul 2008 09:57:26 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6NGvNZv029314; Wed, 23 Jul 2008 17:57:23 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4G00563XRN0500@nwk-avmta-2.sfbay.sun.com>; Wed, 23 Jul 2008 09:57:23 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4G003XDXRLAZ70@nwk-avmta-2.sfbay.sun.com>; Wed, 23 Jul 2008 09:57:22 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6NGvJrE028238; Wed, 23 Jul 2008 11:57:19 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6NGvILU028237; Wed, 23 Jul 2008 11:57:18 -0500 (CDT) Date: Wed, 23 Jul 2008 11:57:18 -0500 From: Nicolas Williams Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <200807231607.m6NG7c75022100@marduk.eng.sun.com> To: Gary Winiger Cc: Baban.Kenkre@sun.com, Serge.Dussud@sun.com, nw141292@sac.sfbay.sun.com, psarc-ext@sun.com, sparks-discuss@opensolaris.org Mail-followup-to: Gary Winiger , Baban.Kenkre@sun.com, Serge.Dussud@sun.com, nw141292@sac.sfbay.sun.com, psarc-ext@sun.com, sparks-discuss@opensolaris.org Message-id: <20080723165718.GV25547@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807231607.m6NG7c75022100@marduk.eng.sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 704 OK, so looking at passwdutils source I see that the supported configurations are hardcoded in $SRC/lib/passwdutil/switch_utils:get_ns() and in __set_authtoken_attr(). Not only is there a limit on the number of backends that can appear in passwd, but also which ones as well. This isn't good if we want to eventually open the name service switch SPI. For now we can hardcode 'ad' as a the name of a backend to ignore, and we can update the passwd(1) manpage to indicate that having 'ad' in passwd is supported, though changing AD users' passwords through passwd(1) will not be. A more complete treatment of the problem may have to wait until we're ready to open the name service switch SPI. Nico -- From baban.kenkre@sun.com Wed Jul 23 13:15:35 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6NKFYd0007078 for ; Wed, 23 Jul 2008 13:15:35 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6NKFQte023169; Wed, 23 Jul 2008 21:15:33 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4H00G076XWB800@nwk-avmta-1.sfbay.Sun.COM>; Wed, 23 Jul 2008 13:15:32 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4H00AV96XWNQ30@nwk-avmta-1.sfbay.Sun.COM>; Wed, 23 Jul 2008 13:15:32 -0700 (PDT) Received: from [10.7.250.4] (punchin-client-10-7-250-4.SFBay.Sun.COM [10.7.250.4]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m6NKFVKZ870760; Wed, 23 Jul 2008 13:15:31 -0700 (PDT) Date: Wed, 23 Jul 2008 13:15:31 -0700 From: Baban Kenkre Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <200807231607.m6NG7c75022100@marduk.eng.sun.com> To: Gary Winiger Cc: Serge.Dussud@sun.com, nw141292@sac.sfbay.sun.com, psarc-ext@sun.com, sparks-discuss@opensolaris.org Message-id: <48879163.9070703@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807231607.m6NG7c75022100@marduk.eng.sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20071119) Status: RO Content-Length: 4499 Gary Winiger wrote: >> Nicolas Williams wrote: >> >>> On Tue, Jul 22, 2008 at 04:07:16PM -0700, Gary Winiger wrote: >>> >>>> Hummm, looking at the architecture of passwd(1), it only >>>> supports 2 repositories. I suspect this is left over from some >>>> >>> The question is: Is this architecture? Where is it written that >>> passwd(1) has/must have this limitation? If it isn't a stated >>> limitation then we'll simply fix this bug, otherwise we'll simply change >>> that limitation. >>> >>> passwd(1) says: >>> >>> When a user has a password stored in one of the name ser- >>> vices as well as a local files entry, the passwd command >>> updates both. It is possible to have different passwords in >>> the name service and local files entry. Use passwd -r to >>> change a specific password repository. >>> >>> I don't think that implies a limit of two name service backends for the >>> passwd database. >>> >> passwd(1) also says: >> > > IMO, there is still an incomplete specification here. The > getxby stuff is clear enough from the discussion, but IMO, > not from the man page changes. IMO, that's a NIT that can be > worked off line. > It's the putxby stuff as privately implemented since SunOS 2.x/3.x > when NIS (nee yp) was added to passwd that has been brought > forward to/through the name service switch that is more the > architecture that I'm finding a need for more detail. Indeed > not all architecture is captured in man pages. And without > doing a good bit of archaeology on passwd/passwdutil, name > services (probably also nisplus) ARC cases, I can't say if the > two backends architecture was ever formally presented. > The nsswitch is capable of supporting multiple backends architecture-wise. However in the past we have told customers (and is also mentioned in nsswitch.conf manpage) that we do not support mixing nis, nisplus and ldap name services on a single box. This is because we have not tested these configurations and we do not provide any tools to the customer to install/configure their systems in such manner. (For e.g. ldapclient does not allow the user to keep their existing nis/nisplus configuration alongwith ldap. They have to manually move files which is not supported). Therefore all that remains and which were tested are the single and two-backends (where one must be files) configurations. Removing this restriction will require testing configurations involving multilple non-ad backends and is beyond the scope of this case. Therefore for this case, I suggest we notify users through nsswitch.conf(4) and passwd(1) manpages that adding "ad" to the existing valid configurations is supported and that "ad" will be skipped during password updates via passwd(1). --Baban > I can say it is present in the code and has been explicitly > called out for some time. IMO, that may not make it formal > architecture, but it also does not make it a bug. > Back to my original concern: Is this case modifying the passwd: > (and any other database:) architecture to allow for more than > two name services? If so, will ad be explicitly worked around > in the passwd(1) implementation (including the putxbyy private > implementations and interactions with nsswitch)? How will > such be documented for the admin/user? > Please don't interpret this as opposing adding nss_ad, or > changing the nsswitch or passwd/passwdutil/putxbyy architectures. > It's that these are security relevant and don't seem to me > well enough specified in the case materials. > > Gary.. > >> .... >> If all requirements are met, by default, the passwd command >> consults /etc/nsswitch.conf to determine in which reposi- >> tories to perform password update. It searches the passwd >> and passwd_compat entries. The sources (repositories) asso- >> ciated with these entries are updated. However, the password >> update configurations supported are limited to the following >> cases. Failure to comply with the configurations prevents >> users from logging onto the system. The password update con- >> figurations are: >> >> o passwd: files >> >> o passwd: files ldap >> > _______________________________________________ > sparks-discuss mailing list > sparks-discuss@opensolaris.org > http://mail.opensolaris.org/mailman/listinfo/sparks-discuss > From nicolas.williams@sun.com Wed Jul 23 19:31:02 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6O2V1PH017820 for ; Wed, 23 Jul 2008 19:31:02 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6O2Uqxc009838; Thu, 24 Jul 2008 03:30:59 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4H0070BOBMYA00@nwk-avmta-2.sfbay.sun.com>; Wed, 23 Jul 2008 19:30:58 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4H00MSAOBKI1A0@nwk-avmta-2.sfbay.sun.com>; Wed, 23 Jul 2008 19:30:56 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6O2Us4H028825; Wed, 23 Jul 2008 21:30:54 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6O2Urae028824; Wed, 23 Jul 2008 21:30:53 -0500 (CDT) Date: Wed, 23 Jul 2008 21:30:53 -0500 From: Nicolas Williams Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <200807231607.m6NG7c75022100@marduk.eng.sun.com> To: Gary Winiger Cc: Baban.Kenkre@sun.com, Serge.Dussud@sun.com, nw141292@sac.sfbay.sun.com, psarc-ext@sun.com, sparks-discuss@opensolaris.org Mail-followup-to: Gary Winiger , Baban.Kenkre@sun.com, Serge.Dussud@sun.com, nw141292@sac.sfbay.sun.com, psarc-ext@sun.com, sparks-discuss@opensolaris.org Message-id: <20080724023053.GM25547@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807231607.m6NG7c75022100@marduk.eng.sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 17350 The materials have been updated. New materials: - passwd.1.txt Updated materials: - nsswitch.conf.4.txt - the actual proposal (see nssad-details.txt) Diffs: ------- nsswitch.conf.4.txt ------- --- /tmp/sccs.NSaWCI Wed Jul 23 19:28:15 2008 +++ nsswitch.conf.4.txt Wed Jul 23 19:19:03 2008 @@ -1,5 +1,7 @@ File Formats nsswitch.conf(4) + + NAME nsswitch.conf - configuration file for the name service switch @@ -7,6 +9,7 @@ SYNOPSIS /etc/nsswitch.conf + DESCRIPTION The operating system uses a number of databases of informa- tion about hosts, ipnodes, users (passwd(4), shadow(4), and @@ -17,8 +20,11 @@ database; the sources and their lookup order are specified in the /etc/nsswitch.conf file. + The following databases use the switch file: + + Database Used By aliases sendmail(1M) auth_attr getauthnam(3SECDB) @@ -48,10 +54,12 @@ rpc getrpcbyname(3NSL) services getservbyname(3SOCKET). See Interaction with netconfig. - user_attr getuserattr(3SECDB) + The following sources may be used: + + Source Uses files /etc/hosts, /etc/passwd, /etc/inet/ipnodes, /etc/shadow, @@ -74,9 +82,12 @@ ments support for ${HOME}/.printers. + + Note that /etc/inet/ipnodes is a symbolic link to /etc/hosts. + There is an entry in /etc/nsswitch.conf for each database. Typically these entries will be simple, such as protocols: files or networks: files nisplus. However, when multiple @@ -85,6 +96,7 @@ tried. A source can return one of the following codes: + Status Meaning SUCCESS Requested database entry was found. UNAVAIL Source is not configured on this @@ -93,16 +105,22 @@ TRYAGAIN Source is busy or not responding, might respond to retries. + For each status code, two actions are possible: + Action Meaning continue Try the next source in the list. return Return now. + + Additionally, for TRYAGAIN only, the following actions are possible: + + Action Meaning forever Retry the current source forever. n Retry the current source n more @@ -116,6 +134,7 @@ TRYAGAIN=n is restored. + The complete syntax of an entry is: ::= ":" [ []]* @@ -123,15 +142,20 @@ ::= "=" ::= "success" | "notfound" | "unavail" | "tryagain" + + For every status except TRYAGAIN, the action syntax is: ::= "return" | "continue" + + For the TRYAGAIN status, the action syntax is: ::= "return" | "continue" | "forever" | ::= 0...MAX_INT + Each entry occupies a single line in the file. Lines that are blank, or that start with white space, are ignored. Everything on a line following a # character is also @@ -140,18 +164,22 @@ are case-sensitive, but and names are case-insensitive. + The library functions contain compiled-in default entries that are used if the appropriate entry in nsswitch.conf is absent or syntactically incorrect. + The default criteria for DNS and the NIS server in "DNS- forwarding mode" is [SUCCESS=return NOTFOUND=continue UNAVAIL=continue TRYAGAIN=3]. + The default criteria for all other sources is [SUCCESS=return NOTFOUND=continue UNAVAIL=continue TRYAGAIN=forever]. + The default, or explicitly specified, criteria are meaning- less following the last source in an entry; and they are ignored, since the action is always to return to the caller @@ -185,6 +213,7 @@ DNS lookups; dns need not be specified explicitly as a source. + In SunOS 5.3 (Solaris 2.3) and compatible versions, the NIS+ server in NIS/YP-compatibility mode can also be run in DNS- forwarding mode (see rpc.nisd(1M)). Forwarding is effective @@ -198,18 +227,28 @@ passwd: files + passwd: files nis + passwd: files nisplus + passwd: files ldap + passwd: compat + passwd_compat: nisplus + passwd_compat: ldap + + ++ Adding 'ad' to the configurations listed above is supported ++ though changing AD users' passwords through passwd(1) is not. Any other settings will cause the passwd(1) command to fail when it attempts to change the password after expiration and will prevent the user from logging in. These are the only @@ -234,6 +273,7 @@ /etc/passwd and /etc/shadow (the latter is a new addition to SunOS 5.0, see shadow(4)). + If this is not sufficient, the NIS/YP compatibility source provides full +/- semantics. It reads /etc/passwd for getpwnam(3C) functions and /etc/shadow for getspnam(3C) @@ -242,9 +282,11 @@ overridden by specifying nisplus or ldap as the source for the pseudo-database passwd_compat. + Note that in compat mode, for every /etc/passwd entry, there must be a corresponding entry in the /etc/shadow file. + The NIS/YP compatibility source also provides full +/- semantics for group; the relevant pseudo-database is group_compat. @@ -256,42 +298,62 @@ passwd: files nis + group: files nis + hosts: nis [NOTFOUND=return] files + ipnodes: nis [NOTFOUND=return] files + networks: nis [NOTFOUND=return] files + protocols: nis [NOTFOUND=return] files + rpc: nis [NOTFOUND=return] files + ethers: nis [NOTFOUND=return] files + netmasks: nis [NOTFOUND=return] files + bootparams: nis [NOTFOUND=return] files + publickey: nis [NOTFOUND=return] files + netgroup: nis + automount: files nis + aliases: files nis + services: files nis + printers: user files nis nisplus + auth_attr files nis + prof_attr files nis + project files nis + + Note that the files source for the ipnodes and hosts data- bases is identical, as /etc/inet/ipnodes is a symbolic link to /etc/hosts. Because other sources for the ipnodes and @@ -298,6 +360,7 @@ hosts databases are different, do not remove the ipnodes line from the /etc/nsswitch.conf file. + The policy nis [NOTFOUND=return] files implies: if nis is UNAVAIL, continue on to files, and if nis returns NOTFOUND, return to the caller. In other words, treat nis as the @@ -306,13 +369,17 @@ configuration above, are identical to the hard-wired poli- cies in SunOS releases prior to 5.0. + If compatibility with the +/- syntax for passwd and group is required, simply modify the entries for passwd and group to: passwd: compat + group: compat + + If NIS+ is the enterprise level name service, the default configuration should be modified to use nisplus instead of nis for every database on client machines. The file @@ -319,6 +386,7 @@ /etc/nsswitch.nisplus contains a sample configuration that can be copied to /etc/nsswitch.conf to set this policy. + If LDAP is the enterprise level name service, the default configuration should be modified to use ldap instead of nis for every database on client machines. The file @@ -325,22 +393,26 @@ /etc/nsswitch.ldap contains a sample configuration that can be copied to /etc/nsswitch.conf to set this policy. -+ When using Active Directory with native schema for name service, -+ the default configuration should be modified to use ad for -+ for passwd and group, dns for hosts resolution and files -+ for the remaining databases on client machines. ++ When using Active Directory dns is required for hosts ++ resolution. ++ If the use of +/- syntax is desired in conjunction with nisplus, use the following four entries: passwd: compat + passwd_compat: nisplus OR ldap + group: compat + group_compat: nisplus OR ldap + + In order to get information from the Internet Domain Name Service for hosts that are not listed in the enterprise level name service, NIS+ or LDAP, use the following confi- @@ -353,6 +425,7 @@ hosts: ldap dns [NOTFOUND=return] files + Enumeration - getXXXent() Many of the databases have enumeration functions: passwd has getpwent(), hosts has gethostent(), and so on. These were @@ -374,6 +447,7 @@ interleave calls, they will enumerate disjoint subsets of the same database. + In general, the use of the enumeration functions is depre- cated. In the case of passwd, shadow, and group, it may sometimes be appropriate to use fgetgrent(), fgetpwent(), @@ -387,48 +461,65 @@ /etc/nsswitch.conf Configuration file. + /usr/lib/nss_compat.so.1 Implements compat source. + /usr/lib/nss_dns.so.1 Implements dns source. + /usr/lib/nss_files.so.1 Implements files source. + /usr/lib/nss_mdns.so.1 Implements mdns source. + /usr/lib/nss_nis.so.1 Implements nis source. + /usr/lib/nss_nisplus.so.1 Implements nisplus source. + /usr/lib/nss_ldap.so.1 Implements ldap source. -+ /usr/lib/nss_ad.so.1 Implements ad source. ++ /usr/lib/nss_ad.so.1 Implements ad source. ++ ++ /usr/lib/nss_user.so.1 Implements user source. + /etc/netconfig Configuration file for netdir(3NSL) functions that redirects hosts/devices policy to the switch. + /etc/nsswitch.files Sample configuration file that uses files only. + /etc/nsswitch.nis Sample configuration file that uses files and nis. + /etc/nsswitch.nisplus Sample configuration file that uses files and nisplus. + /etc/nsswitch.ldap Sample configuration file that uses files and ldap. - /etc/nsswitch.ad Sample configuration file that - uses files and ad. ++ /etc/nsswitch.ad Sample configuration file that ++ uses files and ad. ++ ++ /etc/nsswitch.dns Sample configuration file that uses files, dns and mdns (dns and mdns only for hosts). + SEE ALSO ldap(1), newtask(1), NIS+(1), passwd(1), automount(1M), ifconfig(1M), mdnsd(1M), rpc.bootparamd(1M), rpc.nisd(1M), @@ -451,6 +542,7 @@ is read only once; if the file is later changed, the process will continue using the old configuration. + The use of both nis and nisplus as sources for the same database is strongly discouraged since both the name ser- vices are expected to store similar information and the @@ -457,16 +549,17 @@ lookups on the database may yield different results depend- ing on which name service is operational at the time of the request. The same applies for using ldap along with nis or - nisplus. The same applies for using ldap along with ad - when ldap is used with schema mapping with an Active - Directory domain. +- nisplus. ++ nisplus. The same applies for using ldap along with ad ++ when ldap is used with schema mapping with an Active ++ Directory domain. + Misspelled names of sources and databases will be treated as legitimate names of (most likely nonexistent) sources and databases. + The following functions do not use the switch: fgetgrent(3C), fgetprojent(3PROJECT), fgetpwent(3C), fgetspent(3C), getpw(3C), putpwent(3C), shadow(4). - - SunOS 5.11 Last change: 21 Aug 2007 11 --- nssad-details.txt-orig Jul 23 19:22:48 2008 +++ nssad-details.txt Wed Jul 23 19:25:14 2008 @@ -2,10 +2,10 @@ 1. Introduction 1.1. Project/Component Working Name: - NSS_AD: Name Service Module for AD + NSSAD: Name Service Module for AD 1.2. Name of Document Author/Supplier: Author: Baban Kenkre - 1.3 Date: + 1.3 Date of This Document: 11 July, 2008 @@ -115,8 +115,38 @@ get{pw,gr}{nam,uid,gid}() to do the same. -7. Mapping to passwd(4) and shadow(4) +7. Password Updates + passwd(1) manpage contains a list of valid password update + configurations for the passwd entry in nsswitch.conf(4) file. Adding + 'ad' to these configurations will be supported though changing AD + users' passwords through passwd(1) won't be supported. 'ad' will be + skipped if found in the passwd entry during password update. AD + users' passwords can be updated using kpasswd(1) command. passwd(1) + and nsswitch.conf(4) manpages as well as the Solaris Admin Guide will + be updated to reflect this. + + +8. Other consumers of passwd entry + + As mentioned previously "ad" can be added to any of the existing + valid passwd and group entries in nsswitch.conf. + + Examples: + passwd: files ad OR + passwd: files ldap ad + + This allows consumers of get{pw|gr}{nam|uid|gid} to resolve Windows + names and ephemeral IDs. Other name service databases such as + audit_user(4) and user_attr(4) that follow passwd entry in + nsswitch.conf will not be affected by the additional backend in the + passwd entry. This backend will be processed (based on the + configuration) and if it's 'ad' then it will return NOTFOUND because + RBAC is not yet suppported by AD. + + +9. Mapping to passwd(4) and shadow(4) + Mapping of Windows user to passwd(4) form will be done as follows: o The Windows's user object belongs to objectClass "user". @@ -160,7 +190,7 @@ because shadow fields are irrevalent with AD and krb5. -8. Mapping to group(4) +10. Mapping to group(4) Mapping of Windows group to group(4) form will be done as follows: @@ -184,9 +214,9 @@ object does not contain the group's password. -9. Relevant ARC cases and CRs +11. Relevant ARC cases and CRs - o 6722476 name service switch module for AD (nss_ad) needed + o 6722476 name service switch module for AD (nssad) needed o PSARC/2006/315 Winchester:ID Mapping service @@ -199,7 +229,7 @@ o PSARC/2008/342 Further SID support -10. Supporting Documents +12. Supporting Documents +---------------------+-----------------------------------+ | Filename | Description | @@ -207,13 +237,17 @@ | ad.5.txt | ad(5) manpage | | | | | nsswitch.conf.4.txt | Modified nsswitch.conf(4) manpage | + | | | + | passwd.1.txt | Modified passwd(1) manpage | +---------------------+-----------------------------------+ - In addition to the above the Solaris admin guide will include a - chapter on AD name service in Solaris. + In addition to the above the Solaris Admin Guide will include (i) a + chapter on nss_ad and (ii) the Naming and Directory services (DNS, + NIS, and LDAP) chapter will be modified to clarify the password + update issue related to AD users. -11. References +13. References [1] "Well-Known SIDs", . From Nicolas.Williams@sun.com Fri Jul 25 09:10:48 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6PGAmPr024237 for ; Fri, 25 Jul 2008 09:10:48 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6PGAhhM026474; Fri, 25 Jul 2008 09:10:46 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4K0070ZKXY2I00@nwk-avmta-1.sfbay.Sun.COM>; Fri, 25 Jul 2008 09:10:46 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4K00A8EKXYLIB0@nwk-avmta-1.sfbay.Sun.COM>; Fri, 25 Jul 2008 09:10:46 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6PGAhu4000087; Fri, 25 Jul 2008 11:10:43 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6PGAhJX000086; Fri, 25 Jul 2008 11:10:43 -0500 (CDT) Date: Fri, 25 Jul 2008 11:10:42 -0500 From: Nicolas Williams Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <20080724023053.GM25547@Sun.COM> To: Gary Winiger , Baban.Kenkre@sun.com, Serge.Dussud@sun.com, nw141292@sac.sfbay.sun.com, psarc-ext@sun.com, sparks-discuss@opensolaris.org Mail-followup-to: Gary Winiger , Baban.Kenkre@Sun.COM, Serge.Dussud@Sun.COM, nw141292@sac.sfbay.sun.com, psarc-ext@sun.com, sparks-discuss@opensolaris.org Message-id: <20080725161042.GB29358@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807231607.m6NG7c75022100@marduk.eng.sun.com> <20080724023053.GM25547@Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 322 On Wed, Jul 23, 2008 at 09:30:53PM -0500, Nicolas Williams wrote: > The materials have been updated. > > New materials: > > - passwd.1.txt > > Updated materials: > > - nsswitch.conf.4.txt > - the actual proposal (see nssad-details.txt) Also added: nsswitch.ad and references to it from nsswitch.conf(4) and ad(5). From gww@sac.sfbay.sun.com Mon Jul 28 19:07:00 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6T26x3D013022 for ; Mon, 28 Jul 2008 19:06:59 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6T26uMj020716 for <@sunmail2sca.sfbay.sun.com:psarc-ext@sun.com>; Tue, 29 Jul 2008 03:06:58 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4Q00F0JWJKZU00@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Mon, 28 Jul 2008 20:06:56 -0600 (MDT) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4Q005HLWJJ3L60@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Mon, 28 Jul 2008 20:06:55 -0600 (MDT) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6T26q34048011; Mon, 28 Jul 2008 19:06:52 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6T26pMu013020; Mon, 28 Jul 2008 19:06:51 -0700 (PDT) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m6T26pIC013019; Mon, 28 Jul 2008 19:06:51 -0700 (PDT) Date: Mon, 28 Jul 2008 19:06:51 -0700 (PDT) From: Gary Winiger Subject: Re: [sparks-discuss] Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] To: Baban.Kenkre@sun.com, Nicolas.Williams@sun.com, Serge.Dussud@sun.com, gww@eng.sun.com, nw141292@sac.sfbay.sun.com, psarc-ext@sun.com, sparks-discuss@opensolaris.org Message-id: <200807290206.m6T26pIC013019@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 362 > On Wed, Jul 23, 2008 at 09:30:53PM -0500, Nicolas Williams wrote: > > The materials have been updated. > > > > New materials: > > > > - passwd.1.txt > > > > Updated materials: > > > > - nsswitch.conf.4.txt > > - the actual proposal (see nssad-details.txt) > > Also added: nsswitch.ad and references to it from nsswitch.conf(4) and > ad(5). +1 Gary.. From Nicolas.Williams@sun.com Thu Jul 31 12:26:25 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6VJQOed017894 for ; Thu, 31 Jul 2008 12:26:25 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6VJQDOl018934 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 31 Jul 2008 20:26:23 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4V0030TXZXBV00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 31 Jul 2008 13:26:21 -0600 (MDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4V0015PXZXYE10@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 31 Jul 2008 13:26:21 -0600 (MDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m6VJQFog007002; Thu, 31 Jul 2008 14:26:16 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m6VJQFwq007001; Thu, 31 Jul 2008 14:26:15 -0500 (CDT) Date: Thu, 31 Jul 2008 14:26:15 -0500 From: Nicolas Williams Subject: Re: Active Directory name service module (nss_ad) [PSARC/2008/441 FastTrack timeout 07/18/2008] In-reply-to: <200807112153.m6BLrh2V021546@sac.sfbay.sun.com> To: Nicolas Williams Cc: PSARC-ext@sun.com, sparks-discuss@opensolaris.org Mail-followup-to: Nicolas Williams , PSARC-ext@sun.com, sparks-discuss@opensolaris.org Message-id: <20080731192615.GA25547@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807112153.m6BLrh2V021546@sac.sfbay.sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 89 This case was approved yesterday during the open portion of the PSARC meeting. Nico -- From Nicolas.Williams@Sun.COM Mon Nov 3 11:24:46 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mA3JOkr2014733 for ; Mon, 3 Nov 2008 11:24:46 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mA3JOiYl027446; Mon, 3 Nov 2008 12:24:44 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K9R00F0JV96OA00@nwk-avmta-2.sfbay.sun.com>; Mon, 03 Nov 2008 11:24:42 -0800 (PST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K9R00CI5V951H90@nwk-avmta-2.sfbay.sun.com>; Mon, 03 Nov 2008 11:24:42 -0800 (PST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id mA3JOAV8107746; Mon, 03 Nov 2008 13:24:10 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.14.3+Sun/8.14.3/Submit) id mA3JOA69107745; Mon, 03 Nov 2008 13:24:10 -0600 (CST) Date: Mon, 03 Nov 2008 13:24:10 -0600 From: Nicolas Williams Subject: Dealing with Windows user homedir [PSARC/2008/441 nss_ad] To: PSARC-ext@Sun.COM, Baban Kenkre , Douglas Leavitt Message-id: <20081103192409.GE106460@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 X-Authentication-warning: binky.central.sun.com: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1254 An issue has come up. The spec for this case said that getpw*() for Windows users would for the time being return an SMB URL in the home directory field. This is quite clearly incorrect since SMB URLs contain a colon, the separator character for passwd(4)[*]. We could use a /net/// scheme, but this won't work unless the server also speaks NFS, as the -hosts automount map does not yet support negotiation of CIFS vs. NFS -- it only supports NFS. And it's entirely possible that in the future the automounter may get a new -hosts-like map for CIFS that is distinct from the existing -hosts map. There has been a small amount of discussion about this, but it's been inconclusive. Currently there are no plans to either enhance the existing -hosts map nor to introduce a new one that is specific to CIFS. What to do? I propose that we use /net//... simply because: a) it can be made to work with multi-protocol file servers, b) we can always change it later (perhaps by adding a knob) if a CIFS-specific -hosts-like map is added. Alternatively, we could simply not return a home directory value at all. Nico [*] Incidentally, the file format is used internally in the name service switch / backend protocol.