summaryrefslogtreecommitdiffstats
path: root/doc
Commit message (Collapse)AuthorAgeFilesLines
* slapi-nis: delay sending responses from compat tree after map searchAlexander Bokovoy2015-11-131-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When slapi-nis plugin responds on a search query, it holds read lock for the internal structure called 'map cache'. The map cache lock can also be taken for write when modification would be required like responding to DELETE, ADD, or MODIFY operations. As result of the lock semantics, write lock owner is blocked until all read lock owners release their locks. This is generally not a problem but when readers sent out LDAP query results, they call into SLAPI function that might take long time to send out the data due to external reasons (network latencies, clients being blocked, etc) and all this time map cache is locked for write operations. When Kerberos KDC issues a TGT, it needs to modify few Kerberos-related attributes in the principal's LDAP entry. These updates are generating MOD operations visible by slapi-nis plugin which triggers re-scan of map cache to potentially replace the affected entries. To perform potential replacement, slapi-nis has to take a write lock and be blocked by outstanding readers. Therefore, it is possible to encounter a situation where an LDAP client uses SASL GSSAPI authentication and existing Kerberos ticket did expire in a course of outstanding search request. According to LDAPv3 protocol specification, an LDAP client must perform re-negotiation before reading any outstanding PDUs. It would ask Kerberos KDC for a new (or renewed) TGT, that would cause MOD updates for the primary tree which is tracked for changes by slapi-nis. These changes would be blocked by a slapi-nis reader as the client cannot finish reading outstanding PDUs yet. To solve this problem, we avoid sending LDAP entries while keeping map cache lock. Instead, we generate a linked list of copies of entries which will be sent out. To allow sharing of entries between multiple parallel queries, we hash the entry and reference the cached entry in the linked list with increased reference count. Once entry is actually sent, its reference count decreased and on reaching zero it is removed from the hash. o solve this problem, we avoid sending LDAP entries while keeping map cache lock. Instead, we generate a linked list of copies of entries which will be sent out. To allow sharing of entries between multiple parallel queries, we hash the entry and reference the cached entry in the linked list with increased reference count. Once entry is actually sent, its reference count decreased and on reaching zero it is removed from the hash. The entry in the hash table might become outdated. This is detected by comparing both modifyTimestamp and entryUSN values of the entry to be sent and entry in the hash table. If new version of the entry is different, hash table's entry reference is replaced with a new copy. The old entry is not removed because it is still referenced by some outstanding query processing. Thus, the hash table always references the most recent version of an entry but there might be multiple copies in possesion of the linked lists from the separate parallel queries. An entry sharing via hash table can be disabled by setting slapi-entry-cache: 0 in the definition, cn=Schema Compatibility,cn=plugins,cn=config Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1273587
* schema-compat: use libnss_sss.so.2 explicitly to resolve trusted domain ↵Alexander Bokovoy2015-03-261-4/+10
| | | | | | | | | | | | users via NSS When Schema Compatibility plugin is configured to enumerate users and groups from Active Directory domains trusted by FreeIPA, use nss_sss module directly instead of following nsswitch.conf configuration. The issue with nsswitch.conf configuration is in the fact that for each request all modules in NSS chain are processed while only one of them is responsible for users from trusted Active Directory domains, namely, nss_sss.
* Add support for FreeIPA ID viewsAlexander Bokovoy2014-10-101-0/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FreeIPA ID views allow to override POSIX attributes for certain users and groups. A support is added to allow using specific ID view when serving compatibility tree. Each user or group entry which has an override in the view is amended with the overridden values from the view before served out to the LDAP client. A view to use is specified as a part of base DN: cn=<view>,cn=views,cn=compat,$SUFFIX where cn=compat,$SUFFIX is the original compatibility tree base DN. Each entry, when served through the view, gets new DN rewritten to specify the view. Additionally, if override in the view changes uid (for users) or cn (for groups) attribute, the entry's RDN is changed accordingly. For groups memberUid attribute is modified as well in case there is an override in the view that changes uid value of that member. FreeIPA ID views support overrides for users of trusted Active Directory domains. In case of a trusted AD domain's user or group is returned via compatibility tree, view overrides are applied in two stages: 1. SSSD applies default view for AD users 2. slapi-nis applies explicitly specified (host-specific) view on top of the entry returned by SSSD Thus, slapi-nis does not need to apply default view for AD users and if there are no host-specific views in use, there is no need to specify a view in the base DN, making overhead of a default view for AD users lower.
* Add ignore-subtree and restrict-subtree settingsNalin Dahyabhai2013-09-192-16/+34
| | | | | | | | | | | | | | Add {nis,schema-compat}-ignore-subtree (subtrees under which we ignore contents and updates )and {nis,schema-compat}-restrict-subtree (subtrees out of which we ignore contents and updates, if set) settings, and default the former to "cn=tasks,cn=config". This should avoid cases where we're looking through the ldbm backend for entries which have a dangling reference to a newly-added task (which, because it's in the DSE, means we acquire an ldbm lock after acquiring our internal lock) while also updating a compat entry after its source entry is modified (for example, by the memberOf plugin, which results in us attempting to acquire our lock while the ldbm lock is already held).
* sch-ipa.txt: add documentation about trusted domains support for FreeIPAAlexander Bokovoy2013-08-071-0/+48
|
* Add %sort() and %dribble_merge()Nalin Dahyabhai2013-05-231-0/+9
| | | | | | | Add %sort(), which binary-sorts a single list of values, and %dribble_merge(), which takes a quoted length, a separator, and some expressions and produces a list of lists of values using the separator, where no list is larger than the length.
* notes on what changes when we switch to betxnsNalin Dahyabhai2012-10-161-0/+18
|
* add shadow, passwd.adjuct, base64-encode nis-disallowed-charsNalin Dahyabhai2012-08-231-0/+2
| | | | | | | * add a definition for shadow.byname * add a definition for passwd.adjunct.byname * make passwd.byname/passwd.byuid hide userPassword if objectClass==shadowAccount * base64-encode nis-disallowed-chars when we are printing defaults
* - treat the padding values used by %link() into expressions instead ofNalin Dahyabhai2012-03-301-5/+5
| | | | as literals
* - add a "default" functionNalin Dahyabhai2012-03-281-0/+23
|
* - add multiple-result capable versions of match/regmatch/regsubNalin Dahyabhai2012-01-241-0/+35
|
* - add regsubi/regmatchi, which are like the originals but case-insensitiveNalin Dahyabhai2012-01-041-0/+14
|
* - bump to 0.20slapi-nis-0.20Nalin Dahyabhai2010-11-231-1/+33
|
* - handle a group with no explicitly-named container by treating theNalin Dahyabhai2010-11-221-1/+2
| | | | entries as direct subordinates of the group entry
* - notes on deref_rfNalin Dahyabhai2010-11-221-0/+88
|
* - yeah, we *really* need to be able to search on this attributeNalin Dahyabhai2010-11-191-4/+8
|
* - symlinkNalin Dahyabhai2010-09-271-0/+1
|
* - add a minimum uid and gid setting for screening users and groupsNalin Dahyabhai2010-01-271-0/+8
|
* - add the basics of a --files optionNalin Dahyabhai2010-01-271-3/+20
|
* - if the userPassword isn't a valid crypted value, drop itNalin Dahyabhai2009-09-011-0/+8
| | | | | - set the flags on a newly-created ipa user to require preauth and a new password
* - include the devel docs in the binary packageNalin Dahyabhai2009-06-181-2/+5
|
* - try to cut down on the number of places that a given formattingNalin Dahyabhai2009-06-173-88/+40
| | | | function is being documented
* - add a note about known map typesNalin Dahyabhai2009-06-172-0/+31
|
* - note that NIS is a postop plugin, not objectNalin Dahyabhai2009-06-172-16/+22
| | | | - note that the defaults at the bottom of getting-started actually work
* - move some documentation files aroundNalin Dahyabhai2009-06-1711-7/+7
|
* - list map names in non-nickname formNalin Dahyabhai2009-06-171-12/+27
| | | | | - explicitly mention all of the maps that a ypserv-based server would try to provide
* - comment why we bother with this scriptNalin Dahyabhai2009-06-171-0/+3
|
* - remove a typo wordNalin Dahyabhai2009-06-171-2/+2
|
* - note that the "filter" we expect in configuration is an LDAP searchNalin Dahyabhai2009-06-171-5/+11
| | | | | filter, and refer to format-specifiers.txt when describing settings which are given as format specifiers (Dmitri Pal)
* - make sure that %referred() and %deref() don't return empty stringsNalin Dahyabhai2009-05-071-1/+2
|
* - formatting/markup fixesNalin Dahyabhai2009-04-291-8/+8
|
* - formatting/markup fixesNalin Dahyabhai2009-04-291-19/+25
| | | | | - note that the purpose of grouping is so that we can save some work when figuring out where to search for referrants
* - formatting/markup fixesNalin Dahyabhai2009-04-292-12/+13
|
* - formatting/markup tweaksNalin Dahyabhai2009-04-291-28/+28
|
* - fix a couple of markup/formatting mistakesNalin Dahyabhai2009-04-291-9/+9
|
* - add UPG examplesNalin Dahyabhai2009-03-042-0/+13
|
* - add an example user-private-group setNalin Dahyabhai2009-03-041-1/+14
|
* - note that ifeq compares values using the server's matching rulesNalin Dahyabhai2009-03-041-1/+2
|
* - Remove the note about logging, as I think the right things are loggedNalin Dahyabhai2009-03-041-3/+0
| | | | as fatal now.
* - take a stab at documenting %ifeq()Nalin Dahyabhai2009-02-111-0/+21
|
* - whoops, that's an object plugin nowNalin Dahyabhai2008-12-032-2/+2
|
* - point out that attributes which are used to hold DNs should be indexedNalin Dahyabhai2008-12-031-0/+12
|
* - try to rework referred_r's description againNalin Dahyabhai2008-12-021-6/+6
|
* - add more on recursive dereferencingNalin Dahyabhai2008-12-021-9/+50
|
* - clean up (and clean up documentation for) matching functionsNalin Dahyabhai2008-12-021-24/+30
|
* - go more in-depth with some of the functionsNalin Dahyabhai2008-12-021-208/+311
|
* - update the todo list a bitNalin Dahyabhai2008-11-171-1/+4
|
* - more generic stuff before we dive into functionsNalin Dahyabhai2008-11-131-8/+30
|
* - split out docs on format specifiers, since it's shared anywayNalin Dahyabhai2008-11-133-435/+251
|
* - add a note about "%link"Nalin Dahyabhai2008-11-042-0/+28
|
generated by cgit (git 2.34.1) at 2025-08-28 16:44:54 +0000