From sacadmin Sat May 30 01:22:25 2009 Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n4U8MPRd026435; Sat, 30 May 2009 01:22:25 -0700 (PDT) Received: (from nw141292@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n4U8MIWo026431; Sat, 30 May 2009 01:22:18 -0700 (PDT) Date: Sat, 30 May 2009 01:22:18 -0700 (PDT) From: Nicolas Williams Message-Id: <200905300822.n4U8MIWo026431@sac.sfbay.sun.com> To: PSARC-record@sac.sfbay.sun.com Cc: Nicolas.Williams@Sun.COM, Erwin Aitenbichler Subject: nss_ldap should support AD-style groups [PSARC/2009/328 FastTrack timeout 06/05/2009] Status: RO Content-Length: 575 Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI This information is Copyright 2009 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: nss_ldap should support AD-style groups 1.2. Name of Document Author/Supplier: Author: Nicolas Williams 1.3 Date of This Document: 30 May, 2009 4. Technical Description See the case directory for more detail 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From sacadmin Sat May 30 02:00:22 2009 Received: from binky.Central.Sun.COM (binky.Central.Sun.COM [129.153.128.104]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n4U90L9X026953; Sat, 30 May 2009 02:00:22 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n4U8oTdP016426; Sat, 30 May 2009 03:50:29 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n4U8oOpx016425; Sat, 30 May 2009 03:50:24 -0500 (CDT) X-Authentication-Warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f Date: Sat, 30 May 2009 03:50:24 -0500 From: Nicolas Williams To: Nicolas Williams Cc: PSARC-record@sac.sfbay.sun.com, Erwin Aitenbichler Subject: nss_ldap should support AD-style groups [PSARC/2009/328 FastTrack timeout 06/05/2009] Message-ID: <20090530085024.GT29258@Sun.COM> References: <200905300822.n4U8MIWo026431@sac.sfbay.sun.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200905300822.n4U8MIWo026431@sac.sfbay.sun.com> User-Agent: Mutt/1.5.7i Status: RO Content-Length: 2067 I'm submitting this fasttrack on behalf of Erwin Aitenbichler, an OpenSolaris contributor. The release binding is micro/patch (with no intention to backport). This case introduces new behavior in nss_ldap(5) that rises to the level of an interface; this behavior will be Committed. BACKGROUND Microsoft's Active Directory (AD) can be used as Solaris name service repository through nss_ldap(5) by using Windows Identity Management for Unix (IDMU) or Service For Unix (SFU) and configuring schema mapping on the Solaris native LDAP clients. This is true on Solaris 10, Solaris Nevada, and OpenSolaris. PROBLEM AD supports richer group (as in Unix group) semantics than Unix. For example, it supports nested groups. But nss_ldap(5) does not support these semantics. Specifically, nss_ldap(5) uses the RFC2307bis+ memberUid attribute of group objects to construct a list of all users in a group. Whereas AD uses a different attribute, 'member', containing not UIDs but the DNs of members' directory objects (which may be users and groups alike). Also, each group object has a 'memberof' attribute listing the groups that the group is a member of. PROPOSAL nss_ldap(5)'s getbynam/getbygid entry points will use the 'member' attribute if the memberUid attribute is not present or has an empty value for the given group, but the member attribute is present and has a non-empty value. And nss_ldap(5) will expand the list of members recursively by searching the directory for each listed member and looking up any member group's members. nss_ldap(5)'s getbymember entry point will find the user's DN and then will query all groups a user is member of using this DN. For each group, the memberof attribute will be chased recursively to obtain the full list of groups that the user is a member of directly or indirectly. In both cases loops in group membership will be detected to prevent infinite looping. No additional configuration is needed to enable this feature. From gww@sac.sfbay.sun.com Wed Jun 3 11:08:18 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n53I8I6X016347 for ; Wed, 3 Jun 2009 11:08:18 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n53I8H5P019184 for <@sunmail2sca.sfbay.sun.com:psarc-ext@sun.com>; Wed, 3 Jun 2009 11:08:18 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KKO0070FD1U6000@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 03 Jun 2009 11:08:18 -0700 (PDT) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KKO00MUSD1T09B0@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 03 Jun 2009 11:08:17 -0700 (PDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n53I8Cal029749; Wed, 03 Jun 2009 11:08:12 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n53I8Ave016343; Wed, 03 Jun 2009 11:08:10 -0700 (PDT) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n53I84Pw016342; Wed, 03 Jun 2009 11:08:04 -0700 (PDT) Date: Wed, 03 Jun 2009 11:08:04 -0700 (PDT) From: Gary Winiger Subject: nss_ldap should support AD-style groups [PSARC/2009/328 FastTrack timeout 06/10/2009] To: Nicolas.Williams@sun.com, psarc-ext@sun.com Cc: erwin@informatik.tu-darmstadt.de Message-id: <200906031808.n53I84Pw016342@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 2225 This case was never published to psarc-ext. I'm doing so on behalf of Nico (the I below) and extending the timer for a week from publication. Gary.. ====== I'm submitting this fasttrack on behalf of Erwin Aitenbichler, an OpenSolaris contributor. The release binding is micro/patch (with no intention to backport). This case introduces new behavior in nss_ldap(5) that rises to the level of an interface; this behavior will be Committed. BACKGROUND Microsoft's Active Directory (AD) can be used as Solaris name service repository through nss_ldap(5) by using Windows Identity Management for Unix (IDMU) or Service For Unix (SFU) and configuring schema mapping on the Solaris native LDAP clients. This is true on Solaris 10, Solaris Nevada, and OpenSolaris. PROBLEM AD supports richer group (as in Unix group) semantics than Unix. For example, it supports nested groups. But nss_ldap(5) does not support these semantics. Specifically, nss_ldap(5) uses the RFC2307bis+ memberUid attribute of group objects to construct a list of all users in a group. Whereas AD uses a different attribute, 'member', containing not UIDs but the DNs of members' directory objects (which may be users and groups alike). Also, each group object has a 'memberof' attribute listing the groups that the group is a member of. PROPOSAL nss_ldap(5)'s getbynam/getbygid entry points will use the 'member' attribute if the memberUid attribute is not present or has an empty value for the given group, but the member attribute is present and has a non-empty value. And nss_ldap(5) will expand the list of members recursively by searching the directory for each listed member and looking up any member group's members. nss_ldap(5)'s getbymember entry point will find the user's DN and then will query all groups a user is member of using this DN. For each group, the memberof attribute will be chased recursively to obtain the full list of groups that the user is a member of directly or indirectly. In both cases loops in group membership will be detected to prevent infinite looping. No additional configuration is needed to enable this feature. From gdamore@sun.com Wed Jun 3 12:06:26 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n53J6P5Q009641 for ; Wed, 3 Jun 2009 12:06:26 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n53J6OID001167 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 4 Jun 2009 03:06:25 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KKO00A01FQOJL00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 03 Jun 2009 12:06:24 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KKO00AAHFQJDB00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 03 Jun 2009 12:06:23 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n53J6IXb019902 for ; Wed, 03 Jun 2009 12:06:18 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KKO00K00FMAD800@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 03 Jun 2009 12:06:18 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KKO00IY1FQ96EF0@fe-sfbay-09.sun.com>; Wed, 03 Jun 2009 12:06:10 -0700 (PDT) Date: Wed, 03 Jun 2009 12:06:09 -0700 From: "Garrett D'Amore" Subject: Re: nss_ldap should support AD-style groups [PSARC/2009/328 FastTrack timeout 06/10/2009] In-reply-to: <200906031808.n53I84Pw016342@sac.sfbay.sun.com> Sender: Garrett.Damore@sun.com To: Gary Winiger Cc: Nicolas.Williams@sun.com, PSARC-ext@sun.com, erwin@informatik.tu-darmstadt.de Message-id: <4A26C9A1.2050204@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200906031808.n53I84Pw016342@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 2883 This case *looks* fairly obvious. I can't think of any situation where the new behavior would be undesirable relative to the old behavior. It seems, though, that this is possibly too useful not to backport. Having a disagreement here between Solaris 10 and OpenSolaris authentication seems potentially problematic. Hence, if this change is approved, I'd actually recommend backporting it as well. So +1 from me. Hopefully Gary is also reviewing this and making sure that neither Nico nor I are missing anything. - Garrett Gary Winiger wrote: > This case was never published to psarc-ext. I'm doing so on behalf > of Nico (the I below) and extending the timer for a week from publication. > > Gary.. > ====== > I'm submitting this fasttrack on behalf of Erwin Aitenbichler, an > OpenSolaris contributor. The release binding is micro/patch (with no > intention to backport). This case introduces new behavior in > nss_ldap(5) that rises to the level of an interface; this behavior will > be Committed. > > BACKGROUND > > Microsoft's Active Directory (AD) can be used as Solaris name service > repository through nss_ldap(5) by using Windows Identity Management > for Unix (IDMU) or Service For Unix (SFU) and configuring schema > mapping on the Solaris native LDAP clients. This is true on Solaris > 10, Solaris Nevada, and OpenSolaris. > > PROBLEM > > AD supports richer group (as in Unix group) semantics than Unix. For > example, it supports nested groups. But nss_ldap(5) does not support > these semantics. > > Specifically, nss_ldap(5) uses the RFC2307bis+ memberUid attribute of > group objects to construct a list of all users in a group. Whereas > AD uses a different attribute, 'member', containing not UIDs but the > DNs of members' directory objects (which may be users and groups > alike). Also, each group object has a 'memberof' attribute listing the > groups that the group is a member of. > > PROPOSAL > > nss_ldap(5)'s getbynam/getbygid entry points will use the 'member' > attribute if the memberUid attribute is not present or has an empty > value for the given group, but the member attribute is present and > has a non-empty value. And nss_ldap(5) will expand the list of > members recursively by searching the directory for each listed member > and looking up any member group's members. > > nss_ldap(5)'s getbymember entry point will find the user's DN and > then will query all groups a user is member of using this DN. For > each group, the memberof attribute will be chased recursively to > obtain the full list of groups that the user is a member of directly > or indirectly. > > In both cases loops in group membership will be detected to prevent > infinite looping. > > No additional configuration is needed to enable this feature. > > From gww@sac.sfbay.sun.com Thu Jun 4 10:13:06 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n54HD6XM000644 for ; Thu, 4 Jun 2009 10:13:06 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n54HD2q4024017; Thu, 4 Jun 2009 10:13:05 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KKQ0000J55SPM00@nwk-avmta-2.sfbay.sun.com>; Thu, 04 Jun 2009 10:13:04 -0700 (PDT) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KKQ00L8Y55OSH40@nwk-avmta-2.sfbay.sun.com>; Thu, 04 Jun 2009 10:13:00 -0700 (PDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n54HCr6C042094; Thu, 04 Jun 2009 10:12:53 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n54HCqFM000641; Thu, 04 Jun 2009 10:12:52 -0700 (PDT) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n54HCk5K000640; Thu, 04 Jun 2009 10:12:46 -0700 (PDT) Date: Thu, 04 Jun 2009 10:12:46 -0700 (PDT) From: Gary Winiger Subject: Re: nss_ldap should support AD-style groups [PSARC/2009/328 FastTrack timeout 06/10/2009] To: gdamore@sun.com Cc: Nicolas.Williams@sun.com, PSARC-ext@sun.com, erwin@informatik.tu-darmstadt.de Message-id: <200906041712.n54HCk5K000640@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 133 > So +1 from me. Hopefully Gary is also reviewing this and making sure > that neither Nico nor I are missing anything. +1 Gary.. From gdamore@sun.com Tue Jun 30 11:19:30 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n5UIJTfk005962 for ; Tue, 30 Jun 2009 11:19:30 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n5UIJ9HE000624 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 1 Jul 2009 02:19:28 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KM200H11DKEND00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 30 Jun 2009 11:19:26 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KM200FHGDKEVFA0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 30 Jun 2009 11:19:26 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n5UIJQau018588 for ; Tue, 30 Jun 2009 11:19:26 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KM200E00DIGH700@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 30 Jun 2009 11:19:26 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KM2001EWDK77L40@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 30 Jun 2009 11:19:19 -0700 (PDT) Date: Tue, 30 Jun 2009 11:19:19 -0700 From: "Garrett D'Amore" Subject: PSARC 2009/328 nss_ldap should support AD-style groups Sender: Garrett.Damore@sun.com To: PSARC-ext Message-id: <4A4A5727.5000603@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 170 This case was approved a while back at PSARC ... I know we ran the litany on it (I think not for the first time) last week. I've updated the IAM file. - Garrett