Bug 967030

Summary:	realmd permit --all should remove simple_allow_users from sssd.conf
Product:	Red Hat Enterprise Linux 7	Reporter:	Patrik Kis <pkis>
Component:	realmd	Assignee:	Stef Walter <stefw>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Patrik Kis <pkis>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.0	CC:	dspurek
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	realmd-0.14.2-1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	965760	Environment:
Last Closed:	2014-06-13 09:18:57 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	965760
Bug Blocks:

Description Patrik Kis 2013-05-24 14:34:42 UTC

+++ This bug was initially created as a clone of Bug #965760 +++

Description of problem:
realmd can be fooled by combination of permit user and permit -all

Version-Release number of selected component (if applicable):
realmd-0.14.1-1.fc19

How reproducible:
always

Steps to Reproduce:

[root@pkis ~]# realm list
ad.baseos.qe
  type: kerberos
  realm-name: AD.BASEOS.QE
  domain-name: ad.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: %U.qe
  login-policy: allow-realm-logins
[root@pkis ~]# cat /etc/sssd/sssd.conf 

[sssd]
domains = ad.baseos.qe
config_file_version = 2
services = nss, pam

[nss]
default_shell = /bin/bash

[domain/ad.baseos.qe]
ad_domain = ad.baseos.qe
krb5_realm = AD.BASEOS.QE
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
access_provider = ad
[root@pkis ~]# 
[root@pkis ~]# 
[root@pkis ~]# realm -v permit Amy.qe
 * /usr/bin/systemctl restart sssd.service
 * Successfully changed permitted logins for realm
[root@pkis ~]# cat /etc/sssd/sssd.conf 

[sssd]
domains = ad.baseos.qe
config_file_version = 2
services = nss, pam

[nss]
default_shell = /bin/bash

[domain/ad.baseos.qe]
ad_domain = ad.baseos.qe
krb5_realm = AD.BASEOS.QE
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
access_provider = simple
simple_allow_users = amy
[root@pkis ~]# 
[root@pkis ~]# realm -v permit --all
 * /usr/bin/systemctl restart sssd.service
 * Successfully changed permitted logins for realm
[root@pkis ~]# cat /etc/sssd/sssd.conf 

[sssd]
domains = ad.baseos.qe
config_file_version = 2
services = nss, pam

[nss]
default_shell = /bin/bash

[domain/ad.baseos.qe]
ad_domain = ad.baseos.qe
krb5_realm = AD.BASEOS.QE
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
access_provider = ad
simple_allow_users = amy
[root@pkis ~]# realm list
ad.baseos.qe
  type: kerberos
  realm-name: AD.BASEOS.QE
  domain-name: ad.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: %U.qe
  login-policy: allow-realm-logins
[root@pkis ~]# 
[root@pkis ~]# realm -v permit Bender.qe
 * /usr/bin/systemctl restart sssd.service
 * Successfully changed permitted logins for realm
[root@pkis ~]# realm list
ad.baseos.qe
  type: kerberos
  realm-name: AD.BASEOS.QE
  domain-name: ad.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: %U.qe
  login-policy: allow-permitted-logins
  permitted-logins: amy.qe, bender.qe
  permitted-groups: 
[root@pkis ~]# cat /etc/sssd/sssd.conf 

[sssd]
domains = ad.baseos.qe
config_file_version = 2
services = nss, pam

[nss]
default_shell = /bin/bash

[domain/ad.baseos.qe]
ad_domain = ad.baseos.qe
krb5_realm = AD.BASEOS.QE
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%d/%u
access_provider = simple
simple_allow_users = amy, bender
[root@pkis ~]# 

Actual result:
Here one would expect that only Bender is allowed.

Expected result:
Last permit should allow only Bender.

--- Additional comment from Stef Walter on 2013-05-24 06:53:03 EDT ---

Patch available upstream.

Comment 1 Patrik Kis 2013-08-13 14:03:32 UTC

Verified with the following manual test:

OLD: realmd-0.13.3-2.el7

# realm list
security.baseos.qe
  type: kerberos
  realm-name: SECURITY.BASEOS.QE
  domain-name: security.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: SECURITY\%U
  login-policy: allow-realm-logins
# grep -e access_provider -e simple_allow_users /etc/sssd/sssd.conf 
access_provider = ad
# 
# realm permit SECURITY\\amy
# realm list
security.baseos.qe
  type: kerberos
  realm-name: SECURITY.BASEOS.QE
  domain-name: security.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: SECURITY\%U
  login-policy: allow-permitted-logins
  permitted-logins: SECURITY\amy
# grep -e access_provider -e simple_allow_users /etc/sssd/sssd.conf 
access_provider = simple
simple_allow_users = amy
# 
# realm permit --all
# realm list
security.baseos.qe
  type: kerberos
  realm-name: SECURITY.BASEOS.QE
  domain-name: security.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: SECURITY\%U
  login-policy: allow-realm-logins
# grep -e access_provider -e simple_allow_users /etc/sssd/sssd.conf 
access_provider = ad
simple_allow_users = amy
# 
# realm permit SECURITY\\bender
# realm list
security.baseos.qe
  type: kerberos
  realm-name: SECURITY.BASEOS.QE
  domain-name: security.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: SECURITY\%U
  login-policy: allow-permitted-logins
  permitted-logins: SECURITY\amy, SECURITY\bender
# grep -e access_provider -e simple_allow_users /etc/sssd/sssd.conf 
access_provider = simple
simple_allow_users = amy, bender
# 


NEW: realmd-0.14.2-2.el7

# realm list
security.baseos.qe
  type: kerberos
  realm-name: SECURITY.BASEOS.QE
  domain-name: security.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: %U.qe
  login-policy: allow-realm-logins
# grep -e access_provider -e simple_allow_users /etc/sssd/sssd.conf 
access_provider = ad
# 
# realm permit amy.qe
# realm list
security.baseos.qe
  type: kerberos
  realm-name: SECURITY.BASEOS.QE
  domain-name: security.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: %U.qe
  login-policy: allow-permitted-logins
  permitted-logins: amy.qe
  permitted-groups: 
# grep -e access_provider -e simple_allow_users /etc/sssd/sssd.conf 
access_provider = simple
simple_allow_users = amy
# 
# realm permit --all
# realm list
security.baseos.qe
  type: kerberos
  realm-name: SECURITY.BASEOS.QE
  domain-name: security.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: %U.qe
  login-policy: allow-realm-logins
# grep -e access_provider -e simple_allow_users /etc/sssd/sssd.conf 
access_provider = ad
# 
(reverse-i-search)`p': realm -v join --client-software=sssd --membershi^Csoftware=samba security.baseos.qe
# 
# realm permit bender.qe
# realm list
security.baseos.qe
  type: kerberos
  realm-name: SECURITY.BASEOS.QE
  domain-name: security.baseos.qe
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: %U.qe
  login-policy: allow-permitted-logins
  permitted-logins: bender.qe
  permitted-groups: 
# grep -e access_provider -e simple_allow_users /etc/sssd/sssd.conf 
access_provider = simple
simple_allow_users = bender
#

Comment 2 Ludek Smid 2014-06-13 09:18:57 UTC

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.