March 2005 - Darwin-dev - lists.apple.com

Re: OpenDirectory, DirectoryServices, OpenLDAP architecture questions
by Michael Bartosh (local Account) 15 Mar '05

15 Mar '05

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Mar 15, 2005, at 9:25 PM, Michael Torrie wrote: One of my goals is to somehow get a pam module created for linux to interface with OpenDirectory. LDAP is adequate for many things, but talking to the SASL repository would be even better. Why not just use pam_krb5. The KDC is synchronized with Password Server. Or pam_ldap, assuming it supports SASL CRAM-MD5 binds (not sure). Not that pam_passwordserver wouldn't be cool. __ Michael Bartosh Essential Mac OS X Server Administration O'Reilly, forthcoming http://www.pantherserver.org/buy _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… I typically use nss_ldap and pam_krb5 when integrating linux or Solaris with Open Directory. This email sent to site_archiver(a)lists.apple.com

1 0

Re: OpenDirectory, DirectoryServices, OpenLDAP architecture questions
by Michael Torrie 15 Mar '05

15 Mar '05

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Tue, 2005-03-15 at 16:18 -0800, Jason Townsend wrote: > Hopefully I can help explain things some... despite our best efforts > on documentation it seems there are always some questions left > unanswered. I'm assuming you have seen the Open Directory API (also > known as the Directory Services API) documentation already? > > http://developer.apple.com/documentation/Networking/Conceptual/ > Open_Directory/ Thanks so much for this reply. It helps greatly. I have browsed the documentation on the api before, but needed to understand a bit more of the 10,000 foot view. A couple more questions are at the bottom of this e-mail. > DirectoryService is a daemon which provides various directory data to > the rest of the operating system from a variety of sources. These are > provided by plug-ins which use a common API. Current plug-ins include > LDAPv3, NetInfo, BSD flat files and NIS, and others. Essentially DirectoryService acts like a combination of pam and the name-switching service on linux? > > NetInfo is a directory system which originated with NeXT and is most > commonly used for the local directory information on every Mac OS X > system. It also supports serving information over the network. Maybe > the source of the confusion for item (1) in your list is that the > "netinfo" project available through Darwin provides not only the > NetInfo daemons and tools, but also lookupd. I actually mean to say "lookupd" in the list instead of netinfo. > > lookupd services many of the POSIX style APIs for looking up > information on users, groups, mounts, hosts, services, etc. For > example: getpwnam(), getpwuid(), getaddrinfo(), gethostbyname() and > so on. There is a plug-in to lookupd called DSAgent which calls the > Directory Services API and provides information from the > DirectoryService daemon to clients of lookupd. I have observed that on occasion when the ldap server goes weird, things slowly start to not work. Eventually, if left long enough, even DirectoryService freezes. If I kill it, it won't restart, but just freezes immediately. At this point, any application that makes any libc call that goes to lookupd or any DirectoryService call blocks indefinitely. This almost seems like a deadlock. IE the DirectoryService system cannot respond because LDAP is not responding (still accepting connections but blocks indefinitely). And at this point I cannot get lookupd or DirectoryService to restart because they both need to do some call that depends on LDAP. So it is kind of circular. The only way I can break the cycle is if I kill lookupd, DirectoryService, PasswordService, and slapd (whatever is still running) all simultaneously. Only then does the whole system unstick so that I can get slapd and all the other parts of OpenDirectory running again. In this case PasswordService won't start automatically so I have to start it manually. > > For the following discussion, I'm describing how things work for a > typical user in an Open Directory LDAP server. > > When authenticating as a Password Server based user in LDAP, there > are two plug-ins involved inside DirectoryService. There's the LDAPv3 > plug-in, which looks up the user record and looks for > AuthenticationAuthority and Password attributes. In this case there > is an authentication authority present which indicates a tag of > ApplePasswordServer as the first value. Since this is a Password > Server user, the PasswordServer plug-in is called with information > from the AuthenticationAuthority data to perform the authentication. > If the cleartext password was passed in by the client of the > Directory Services API, the plug-ins can use the best authentication > method available to verify the password. This is as I figured. <snip> > As described above, LDAPv3 is used in addition to the Password Server > protocol. The Password Server protocol is based on SASL for any > challenge response authentications, and there are some additional > commands specific to it. Currently there is no documentation but the > Password Server plug-in source is available from the > DSPasswordServerPlugin project. Password Server uses either port 3659 > or 106. 3659 is the preferred port for current implementations. > > For more on SASL, check out CMU's list of RFCs here: > > http://asg.web.cmu.edu/sasl/sasl-ietf-docs.html So essentially all an opendirectory client (say an iMac) uses is straight LDAP and SASL protocol? How are things like authenticating to change a password handled (the auth flag thing you were talking about)? One of my goals is to somehow get a pam module created for linux to interface with OpenDirectory. LDAP is adequate for many things, but talking to the SASL repository would be even better. Thanks. Michael > > -Jason > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-dev/torriem%40chem.byu.edu > > This email sent to torriem(a)chem.byu.edu -- Michael Torrie <torriem(a)chem.byu.edu> _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: OpenDirectory, DirectoryServices, OpenLDAP architecture questions
by Jason Townsend 15 Mar '05

15 Mar '05

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com From: Michael L Torrie <torriem(a)chem.byu.edu> I was referred to this list by Apple's tech support. I'm seeking to better understand how the parts of OpenDirectory all fit together. So here's my current understanding of how OpenDirectory is working: My questions so far are these: 1. Are my understandings so far correct? You're partially correct. For more on SASL, check out CMU's list of RFCs here: http://asg.web.cmu.edu/sasl/sasl-ietf-docs.html -Jason _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Hopefully I can help explain things some... despite our best efforts on documentation it seems there are always some questions left unanswered. I'm assuming you have seen the Open Directory API (also known as the Directory Services API) documentation already? http://developer.apple.com/documentation/Networking/Conceptual/ Open_Directory/ 1. netinfo provides a bridge between libc posix api calls (getpwnam, etc) and the OpenDirectory API provided by DirectoryService 2. DirectoryService communicates with OpenLDAP to get name switching information (uid-uidNumber mappings, user information, etc) and directly with PasswordService to do authentication. DirectoryService will not do an actual LDAP bind to authenticate a user in this case because the user is an OpenDirectory user and thus has information in the Password server. 3. OpenLDAP talks to PasswordService whenever asked to perform a SASL bind via standard LDAP protocol. This only occurs if the user in question is an OpenDirectory user. If not, and the user has a normal userPassword field, the bind is performed against that. DirectoryService is a daemon which provides various directory data to the rest of the operating system from a variety of sources. These are provided by plug-ins which use a common API. Current plug-ins include LDAPv3, NetInfo, BSD flat files and NIS, and others. NetInfo is a directory system which originated with NeXT and is most commonly used for the local directory information on every Mac OS X system. It also supports serving information over the network. Maybe the source of the confusion for item (1) in your list is that the "netinfo" project available through Darwin provides not only the NetInfo daemons and tools, but also lookupd. lookupd services many of the POSIX style APIs for looking up information on users, groups, mounts, hosts, services, etc. For example: getpwnam(), getpwuid(), getaddrinfo(), gethostbyname() and so on. There is a plug-in to lookupd called DSAgent which calls the Directory Services API and provides information from the DirectoryService daemon to clients of lookupd. For the following discussion, I'm describing how things work for a typical user in an Open Directory LDAP server. When authenticating as a Password Server based user in LDAP, there are two plug-ins involved inside DirectoryService. There's the LDAPv3 plug-in, which looks up the user record and looks for AuthenticationAuthority and Password attributes. In this case there is an authentication authority present which indicates a tag of ApplePasswordServer as the first value. Since this is a Password Server user, the PasswordServer plug-in is called with information from the AuthenticationAuthority data to perform the authentication. If the cleartext password was passed in by the client of the Directory Services API, the plug-ins can use the best authentication method available to verify the password. One extra wrinkle to this is the "authOnly" flag which is passed to dsDoDirNodeAuth(). This indicates whether the authentication is purely a password verification (in which case authOnly is true), or it is also intended to change the access to the node reference based on that authentication (in which case authOnly is false). The first case would apply to a mail server checking the password for example. The second case would apply to an administrative tool authenticating to make changes, such as dscl or Workgroup Manager. In the authOnly false case, there is a second authentication that must be performed to change access to the LDAP server. This is done using a SASL bind if possible. So in the case we're talking about, the second auth will be a CRAM-MD5 authentication through LDAP. On the backend, the password hashes are not stored in the LDAP server's database, so it must perform a "pass through" authentication to the Password Server. This is done in the case of a cleartext bind or a CRAM-MD5 SASL bind. 2. What protocols do remote OpenDirectory clients use to communicate with the server? If authentication is done using PasswordServer, is this done over a tcp/ip port other than ldap? Where are these protocols documented? As described above, LDAPv3 is used in addition to the Password Server protocol. The Password Server protocol is based on SASL for any challenge response authentications, and there are some additional commands specific to it. Currently there is no documentation but the Password Server plug-in source is available from the DSPasswordServerPlugin project. Password Server uses either port 3659 or 106. 3659 is the preferred port for current implementations. This email sent to site_archiver(a)lists.apple.com

1 0

Re: New and only webbrowser session does not play quicktime file
by mbast＠o2w.nl 15 Mar '05

15 Mar '05

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Mutt/1.5.6+20040907i On Tue, Mar 15, 2005 at 03:18:27PM +0100, Lars Sonchocky-Helldorf wrote: > mbast(a)o2w.nl (Michael Bastiaansen) wrote on 15.03.2005 14:39:38: > > > to continue this nice little conversation with myself ;-) > > Maybe you'd get some answers if you were asking your questions on the > streaming-server-dev or streaming-server-users list instead of here, the > Darwin (Operation System) Developers List. Despite common belief just > "Darwin" is not an streaming server, the "Darwin Streaming Server" is ( > See also: http://developer.apple.com/darwin/projects/darwin/faq.html , > http://developer.apple.com/darwin/projects/streaming/ ). Find the > appropiate lists here: > > http://www.lists.apple.com/mailman/listinfo Hmm .. I did look at http://www.lists.apple.com/mailman/listinfo but overlooked the word _not_ in: Darwin-dev Technical discussion list for general Darwin software development. This does not include Carbon, Cocoa, or Darwin Streaming Server. My mistake, thx for letting me know. -- Michael Bastiaansen _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: New and only webbrowser session does not play quicktime file
by Lars Sonchocky-Helldorf 15 Mar '05

15 Mar '05

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com mbast(a)o2w.nl (Michael Bastiaansen) wrote on 15.03.2005 14:39:38: > to continue this nice little conversation with myself ;-) Maybe you'd get some answers if you were asking your questions on the streaming-server-dev or streaming-server-users list instead of here, the Darwin (Operation System) Developers List. Despite common belief just "Darwin" is not an streaming server, the "Darwin Streaming Server" is ( See also: http://developer.apple.com/darwin/projects/darwin/faq.html , http://developer.apple.com/darwin/projects/streaming/ ). Find the appropiate lists here: http://www.lists.apple.com/mailman/listinfo Note to the list mom: I already proposed that there should be a - maybe boldface - note in http://lists.apple.com/mailman/listinfo/darwin-dev or the welcome message that those darwin lists don't cover streaming server topics. It's too often that people get caught in this trap. regards, Lars _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: New and only webbrowser session does not play quicktime file
by mbast＠o2w.nl 15 Mar '05

15 Mar '05

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Mutt/1.5.6+20040907i to continue this nice little conversation with myself ;-) On Mon, Mar 14, 2005 at 01:23:28PM +0100, mbast(a)o2w.nl wrote: > > Does anyone ever seen the following problem or does anyone have a solution > to the following problem? > > I am trying to stream quicktime movies with the Darwin Streaming Server. > The Streaming server is installed on a Windows 2003 Server. I got the > server working but I am experiencing a strange problem. I played with the "max_retransmit_delay" setting in the streamingserver.xml config file and I worked around the problem. I used a lower value and it is acceptable for now. More on "max_retransmit_delay": from: http://developer.apple.com/documentation/QuickTime/QTSS/Concepts/chapter_2_… qtssPrefsMaxRetransDelayInMsec For Reliable UDP, the maximum interval in milliseconds between when a retransmit is supposed to be sent and when it is actually sent. Lower values result in smoother but slower server performance. By default, the value of this attribute is 500. Of course it is only a work around for the problem. The problem is that if there are no browsers started only a new browser would not begin playing the movie. Instead of playing the movie I got the quicktime logo (not the broken one) for 500 seconds. After these 500 seconds the movie gets retransmited. So lowering the 500 seconds is only a work around. -- Michael Bastiaansen _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

OpenDirectory, DirectoryServices, OpenLDAP architecture questions
by Michael L Torrie 14 Mar '05

14 Mar '05

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com I was referred to this list by Apple's tech support. I'm seeking to better understand how the parts of OpenDirectory all fit together. I'm experiencing massive problems with my two OpenDirectory services and I need to better understand how things work so I can track these problems down. As near as I can tell the problems are all originating in OpenLDAP and its interaction with PasswordService (the password server). So here's my current understanding of how OpenDirectory is working: 1. netinfo provides a bridge between libc posix api calls (getpwnam, etc) and the OpenDirectory API provided by DirectoryService 2. DirectoryService communicates with OpenLDAP to get name switching information (uid-uidNumber mappings, user information, etc) and directly with PasswordService to do authentication. DirectoryService will not do an actual LDAP bind to authenticate a user in this case because the user is an OpenDirectory user and thus has information in the Password server. 3. OpenLDAP talks to PasswordService whenever asked to perform a SASL bind via standard LDAP protocol. This only occurs if the user in question is an OpenDirectory user. If not, and the user has a normal userPassword field, the bind is performed against that. My questions so far are these: 1. Are my understandings so far correct? 2. What protocols do remote OpenDirectory clients use to communicate with the server? If authentication is done using PasswordServer, is this done over a tcp/ip port other than ldap? Where are these protocols documented? I have many more questions, but I'll wait to ask them until I have a better understanding of how things work. thank you very much. Michael -- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: CFMessagePortSendRequest seems to ignore sendTimeout
by David Niemeijer 14 Mar '05

14 Mar '05

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com david. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… At 23:55 +0100 13/3/05, Stéphane Sudre wrote: I had a look at the CFMessagePortSendRequest source code and the time-out is used for the mach_msg call. So the time-out does not apply to the whole CFMessagePortSendRequest code and there does not seem to be any atomic restrictions in the code which would prevent other processes to take CPU time during the execution of this method till the call to mach_msg. Not sure it would explain the situation. It might explain it at least partly, but I now have timings of up to 9 ticks without getting a timeout error. That means that CFMessagePortSendRequest can apparently take as long as 0.15 seconds and not time-out even though I have requested it to time-out at 0.02 seconds. That is a duration 7.5 times longer than the time-out I set and defintily not what I would expect. Could it be that the timeout values should not be specified as a double in seconds, but as something else? I have just counted 115 times (in 45 minutes of operation on a 17" PB) a duration exceeding at least 0.067 sec (which is 4 times the time-out of 0.02). So it does not appear that rare (I think about 10% of the communication is exceeding my set time-out value). It also means that each of these times CFMessagePortSendRequest is blocking my thread way too long. I did not expect the overhead of this call to be so large and it would seem to me this might be some kind of bug. This email sent to site_archiver(a)lists.apple.com

1 0

New and only webbrowser session does not play quicktime file
by mbast＠o2w.nl 14 Mar '05

14 Mar '05

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Importance: Normal User-agent: SquirrelMail/1.4.4 Hello, First of all I am not certain that this is the correct list for my problem. If not please let me know. Does anyone ever seen the following problem or does anyone have a solution to the following problem? I am trying to stream quicktime movies with the Darwin Streaming Server. The Streaming server is installed on a Windows 2003 Server. I got the server working but I am experiencing a strange problem. I use the following code in a webpage to connect to the streaming server: <OBJECT CLASSID="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" WIDTH="160"HEIGHT="144" CODEBASE="http://www.apple.com/qtactivex/qtplugin.cab"> <PARAM name="SRC" VALUE="http://streamingserver.domeinnaam.ext/test.mov"> <PARAM name="AUTOPLAY" VALUE="true"> <PARAM name="CONTROLLER" VALUE="false"> <EMBED SRC="sample.mov" WIDTH="160" HEIGHT="144" AUTOPLAY="true" CONTROLLER="false" PLUGINSPAGE="http://www.apple.com/quicktime/download/"> </EMBED> </OBJECT> When I open the webpage which contains this code in a web browser (no other web browser sessions are open at that moment) the movie starts to play. I close down this web browser session an I open a new web browser session to this page. After I repeat this a few times (2 or 3 times) the movie does not start playing. When this occurs I can open a second web browser session to this page and the movie in that session will work. Every following new and only web browser session will not work. Restarting Darwin Streaming Server solves the problem, but again after 2 or 3 times trying the problem is back. To investigate this I have installed on different versions of windows and on linux: If I install Darwin streaming server version: 5.0.1 on windows 2003 server the problem exists. If I install Darwin streaming server version: 5.0.1 on windows 2000 server the problem also exists. If I install Darwin streaming server version: 5.0.1 on Linux (debian) the problem still exists. If I install Darwin streaming server version: 5.0 on Linux (debian) the problem still exists. Is there anyone out there who could help me? Thanks, -- Michael Bastiaansen _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Leaking Mach Ports?
by Dirk Musfeldt 14 Mar '05

14 Mar '05

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Microsoft-Entourage/11.1.0.040913 Matt, using pthread_mach_thread_np() instead of mach_thread_self() indeed solved the problem. Thank you for that hint! >> I seem to recall that you have to call mach_port_deallocate() for any >> port returned from mach_thread_self()...Are you doing that? > > No one should be using mach_thread_self(), unless you are creating raw > mach threads. Use pthread_mach_thread_np() instead. This does not > require a mach_port_deallocate(). > > I believe the port leak being seen here is normal, as a thread port > remains after the thread is detached, to be cleaned up by the next > pthread_create() or pthread_exit() that is called. > > matt. > > Regards Dirk _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0