Merge ~sergiodj/ubuntu/+source/sssd:bug1934997-auth-error-gpo-jammy into ubuntu/+source/sssd:ubuntu/jammy-devel

[Sergio Durigan Junior]

This MP fixes the problem reported at bug #1934997 on Jammy.

When samba is used as a Domain Controller for an Active Directory realm, it correctly creates GPOs (Group Policy Objects) that list the proper Security Protocol Extension GUID. The problem is that there is no SecEdit/GptTmpl.inf file present in the sysvol.

According to Microsoft's "Group Policy: Security Protocol Extension" document, when such file doesn't exist the GPO client (sssd, in this case) should treat this as an error and stop processing. Quoting the document:

1. Perform an SMB File Open on the file specified by <gpo path>\Machine\Microsoft\Windows
NT\SecEdit\GptTmpl.inf (where <gpo path> is the GPO path in the GPO). If an error is
encountered while opening the file, an error MUST be indicated to the Group Policy system (as
specified in [MS-GPOL] section 2.2.7) on the client machine and processing MUST be stopped.

This is exactly what sssd has been doing in Jammy. The problem is that this causes user authentication to fail, which is not something we want. Apparently even Windows GPO clients don't honour the specification and just continue with the authentication if they can't find the file aforementioned.

Long story short, upstream sssd decided to follow the "de facto" standard and be more lenient when SecEdit/GptTmpl.inf is missing. This allows the user authentication to succeed, which is what users who have just setup a samba AD DC + sssd as its client would expect.

Testing this requires a little bit of effort; there are detailed instructions in the bug. There is a PPA with the proposed change here:

https://launchpad.net/~sergiodj/+archive/ubuntu/sssd-bugfix/+packages

autopkgtests are still running; I will post their results later.

It's worth mentioning that this bug is still affecting Kinetic, but it should be fixed with the new sssd merge that's up for review. This also means that the changes proposed here won't be uploaded until the Kinetic merge lands.

[Sergio Durigan Junior (sergiodj)]

Results from https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-sergiodj-sssd-bugfix/?format=plain:
  sssd @ amd64:
    18.06.22 06:51:24 Log 🗒️ ✅ Triggers: ['sssd/2.6.3-1ubuntu3.1~ppa1']
  sssd @ arm64:
    18.06.22 05:17:23 Log 🗒️ ✅ Triggers: ['sssd/2.6.3-1ubuntu3.1~ppa1']
  sssd @ armhf:
    18.06.22 05:28:07 Log 🗒️ ✅ Triggers: ['sssd/2.6.3-1ubuntu3.1~ppa1']
  sssd @ ppc64el:
    18.06.22 05:13:09 Log 🗒️ ✅ Triggers: ['sssd/2.6.3-1ubuntu3.1~ppa1']
  sssd @ s390x:
    18.06.22 05:18:24 Log 🗒️ ✅ Triggers: ['sssd/2.6.3-1ubuntu3.1~ppa1']

autopkgtest is OK.

[Andreas Hasenack (ahasenack)]

Grabbing this one

[Andreas Hasenack (ahasenack)]

https://github.com/SSSD/sssd/pull/6039/commits/f5b2d4c25eff1472772ee52edbacff4d4506e422 hints that an older commit in that PR was dropped because of a new PR that landed, that being https://github.com/SSSD/sssd/pull/6039

Do you think we need the second patch? It's to fix a different issue ("SSSD cant parse GPO if AD server have Russain language"), but I was a bit worried about some of the decisions made in the first PR being conditional on this other PR having landed.

review: Needs Information

[Sergio Durigan Junior (sergiodj)]

On Monday, June 20 2022, Andreas Hasenack wrote:

> https://github.com/SSSD/sssd/pull/6039/commits/f5b2d4c25eff1472772ee52edbacff4d4506e422
> hints that an older commit in that PR was dropped because of a new PR
> that landed, that being https://github.com/SSSD/sssd/pull/6039

I think that maybe you meant to link
https://github.com/SSSD/sssd/pull/6051#issuecomment-1064342858 here.

> Do you think we need the second patch? It's to fix a different issue
> ("SSSD cant parse GPO if AD server have Russain language"), but I was
> a bit worried about some of the decisions made in the first PR being
> conditional on this other PR having landed.

Hm, that's a good question (and good catch). Thanks for bringing this
up.

I looked at the patch from PR 6039, and it's not entirely trivial. I do
agree with you, though: the fact that a commit was removed from PR 6051
because PR 6039 was accepted makes the two patches conditional on each
other.

I think the correct thing to do here would be to create another bug and
perform the two SRUs in the same upload. Unless you think it's OK to
add this second patch as part of the fix for bug 1934997.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Andreas Hasenack (ahasenack)]

I'm thinking about the testing for the second case. We will need a gpo file with some non-ascii characters in it. It will have to be a second test case, doesn't matter if we have it in a separate bug or not. Maybe a second bug is best indeed.

[Sergio Durigan Junior (sergiodj)]

On Monday, June 20 2022, Andreas Hasenack wrote:

> I'm thinking about the testing for the second case. We will need a gpo
> file with some non-ascii characters in it. It will have to be a second
> test case, doesn't matter if we have it in a separate bug or
> not. Maybe a second bug is best indeed.

Yes, that's why I thought about a second bug: we will need a second test
case.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Andreas Hasenack (ahasenack)]

Ok, so this worked, but we need to simplify the setup a bit, and streamline it.

On the server, we just need "samba" and "winbind", then provision as advertised. Drop systemd-resolved from both the server and client, and get the client to use samba as its dns.

On the samba server, the provisioning tool adds a dns forwarder to smb.conf, but it points at 127.0.0.53. Change that to whatever is the "real" upstream dns, i.e., on a libvirt network, it will be the IP ending in .1.

With the above setup, on the client all we need to give to the realm tool is the domain (test.lan), it should find the IP of the samba server on its own. If it doesn't, that's a sign the setup has something wrong.

Also for testing, we should be mindful of client-side caching. This drove us nuts while troubleshooting. The hammer approach is "sssctl cache-remove -o -p -s"

And the test case for the second bug (about invalid non-ascii characters in GPT.INI) can be triggered via "echo -n -e "\ndisplayName=crásher\n" | iconv -f UTF-8 -t CP850 >> GPT.INI

(the first \n might not be needed, ymmv)

[Sergio Durigan Junior (sergiodj)]

FWIW, this MP has been updated to also address bug #1979350.

[Andreas Hasenack (ahasenack)]

+1

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: sergiodj, ahasenack
Uploaders: sergiodj, ahasenack
MP auto-approved

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Wednesday, June 22 2022, Andreas Hasenack wrote:

> +1

Thanks, Andreas.

I am working on backporting the fix to bug #1979453 and include it in
this MP as well. Just a heads up that you will have to review an extra
fix here.

Thanks,

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Sergio Durigan Junior (sergiodj)]

Pasting here the "Impact" section of the new bug this MP is fixing.

sssd users who try to invoke the "sssctl analyze" command on Ubuntu Jammy will experience the following error:

/usr/bin/env: ‘python’: No such file or directory

This happens because "sssctl analyze" will call /usr/libexec/sssd/sss_analyze, which uses "#!/usr/bin/env python" as its shebang. This is incorrect, as it should be using "python3" instead.

When this bug is fixed, another one pops up:

Traceback (most recent call last):
  File "/usr/libexec/sssd/sss_analyze", line 3, in <module>
    from sssd import sss_analyze
ModuleNotFoundError: No module named 'sssd'

This bug is happening because sssd-tools currently installs its Python files inside /usr/lib/python3.10/site-packages/sssd/, but the right path to install these files is /usr/lib/python3/dist-packages/sssd.

[Andreas Hasenack (ahasenack)]

There are other python files, apparently only used in some test, that have the incorrect shebang line for the ubuntu case. I took a quick look and they seem fine, as they are all called with a shell wrapper for python2 (if enabled) and python3.

+1

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Wednesday, June 22 2022, Andreas Hasenack wrote:

> Review: Approve
>
> There are other python files, apparently only used in some test, that
> have the incorrect shebang line for the ubuntu case. I took a quick
> look and they seem fine, as they are all called with a shell wrapper
> for python2 (if enabled) and python3.
>
> +1

Thanks, Andreas.

I'm waiting for sssd 2.7.2-3 to be consumed by Launchpad, which should
happen tonight or tomorrow morning. Then, I will merge it and get it
into Kinetic before I upload these changes to Jammy.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Sergio Durigan Junior (sergiodj)]

On Wednesday, June 22 2022, Sergio Durigan Junior wrote:

> On Wednesday, June 22 2022, Andreas Hasenack wrote:
>
>> Review: Approve
>>
>> There are other python files, apparently only used in some test, that
>> have the incorrect shebang line for the ubuntu case. I took a quick
>> look and they seem fine, as they are all called with a shell wrapper
>> for python2 (if enabled) and python3.
>>
>> +1
>
> Thanks, Andreas.
>
> I'm waiting for sssd 2.7.2-3 to be consumed by Launchpad, which should
> happen tonight or tomorrow morning. Then, I will merge it and get it
> into Kinetic before I upload these changes to Jammy.

sssd-2.7.2-3ubuntu1 has been uploaded a few hours ago.

Uploaded:

$ dput sssd_2.6.3-1ubuntu3.1_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/sssd/sssd_2.6.3-1ubuntu3.1_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/sssd/sssd_2.6.3-1ubuntu3.1.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading sssd_2.6.3-1ubuntu3.1.dsc: done.
  Uploading sssd_2.6.3-1ubuntu3.1.debian.tar.xz: done.
  Uploading sssd_2.6.3-1ubuntu3.1_source.buildinfo: done.
  Uploading sssd_2.6.3-1ubuntu3.1_source.changes: done.
Successfully uploaded packages.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

diff --git a/debian/changelog b/debian/changelog
index 4a92b68..055bfbf 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,21 @@
+sssd (2.6.3-1ubuntu3.1) jammy; urgency=medium
+
+  * d/p/lp1934997-authentication-fails-gpo-non-existent.patch:
+    Fix authentication failure when GPO is enabled and
+    SecEdit/GptTmpl.inf is missing (LP: #1934997).
+  * d/p/lp1979350-GPO-ignore-non-ascii-symbols-in-GPT.INI.patch:
+    Ignore non-ASCII characters in GPT.INI.  (LP: #1979350)
+  * Fix "sssctl analyze" (LP: #1979453)
+    [ Timo Aaltonen ]
+    - d/{python3-libipa-hbac.install,python3-sss.install,
+      sssd-tools.install,rules}: Fix Python installation directory
+      path.
+    [ Sergio Durigan Junior ]
+    - d/p/lp1979453-fix-shebang-on-sss_analyze.patch: Fix shebang on
+      sss_analyze.
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 22 Jun 2022 12:31:22 -0400
+
 sssd (2.6.3-1ubuntu3) jammy; urgency=medium
 
   * No-change rebuild with new samba 4.15.5
diff --git a/debian/patches/lp1934997-authentication-fails-gpo-non-existent.patch b/debian/patches/lp1934997-authentication-fails-gpo-non-existent.patch
new file mode 100644
index 0000000..5c2ce4a
--- /dev/null
+++ b/debian/patches/lp1934997-authentication-fails-gpo-non-existent.patch
@@ -0,0 +1,169 @@
+From: Alexey Sheplyakov <[e-mail]>
+Date: Thu, 2 Aug 2018 16:16:44 +0000
+Subject: ad: gpo: ignore GPO if SecEdit/GptTmpl.inf is missing
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+This makes it possible to use sssd's group policy based access control with
+samba4 domain controllers `out of the box`. The problem is caused by
+
+1) group policy based control denies access (to all users) if
+   `${GPO_GUID}/Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf`
+   file is missing.
+2) The `Default Domain Policy` and the `Default Domain Controller Policy`
+   GPOs created by samba4 list the Security Protocol Extension CSE GUID
+   {827D319E-6EAC-11D2-A4EA-00C04F79F83A} in their `gPCMachineExtensionNames`,
+   however there are no .../SecEdit/GptTmpl.inf files in the sysvol.
+
+According to the section 3.2.5 of [MS-GPSM] current sssd's behavior is
+correct. However Windows GPO client (at least the one in Windows 2008 r2)
+just skips such broken GPOs. This patch makes sssd behave in the same way,
+and makes setting up samba4 based AD domain less painful.
+
+Reviewed-by: Alexey Tikhonov <[e-mail]>
+Reviewed-by: Pavel Březina <[e-mail]>
+
+Origin: upstream, https://github.com/SSSD/sssd/commit/81d67a592315740d13e48b9a29e29baa8cc35638
+Bug: https://github.com/SSSD/sssd/issues/5716
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1934997
+Bug-Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1839805
+Applied-Upstream: 2.7.0
+---
+ Makefile.am                     |  1 +
+ src/providers/ad/ad_gpo.c       |  2 +-
+ src/providers/ad/ad_gpo_child.c | 63 +++++++++++++++++++++++++++++++++++++----
+ 3 files changed, 59 insertions(+), 7 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index a82c332..8affc58 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -4589,6 +4589,7 @@ gpo_child_SOURCES = \
+     src/util/atomic_io.c \
+     src/util/util.c \
+     src/util/util_ext.c \
++    src/util/util_errors.c \
+     src/util/signal.c \
+     src/util/sss_chain_id.c
+ gpo_child_CFLAGS = \
+diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
+index fa8727d..4b7bbf1 100644
+--- a/src/providers/ad/ad_gpo.c
++++ b/src/providers/ad/ad_gpo.c
+@@ -2766,7 +2766,7 @@ ad_gpo_cse_done(struct tevent_req *subreq)
+      */
+     ret = ad_gpo_store_policy_settings(state->host_domain,
+                                        cse_filtered_gpo->policy_filename);
+-    if (ret != EOK) {
++    if (ret != EOK && ret != ENOENT) {
+         DEBUG(SSSDBG_OP_FAILURE,
+               "ad_gpo_store_policy_settings failed: [%d](%s)\n",
+               ret, sss_strerror(ret));
+diff --git a/src/providers/ad/ad_gpo_child.c b/src/providers/ad/ad_gpo_child.c
+index f9e9cb0..4c676d6 100644
+--- a/src/providers/ad/ad_gpo_child.c
++++ b/src/providers/ad/ad_gpo_child.c
+@@ -387,6 +387,38 @@ static errno_t gpo_cache_store_file(const char *smb_path,
+     return ret;
+ }
+ 
++static errno_t
++gpo_cache_remove_file(const char *smb_path,
++                      const char *smb_cse_suffix)
++{
++    errno_t ret = EOK;
++    char *filename = NULL;
++
++    filename = talloc_asprintf(NULL, GPO_CACHE_PATH"%s%s", smb_path,
++                                                           smb_cse_suffix);
++    if (filename == NULL) {
++        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n");
++        ret = ENOMEM;
++        goto done;
++    }
++
++    ret = unlink(filename);
++    if (ret != 0) {
++        if (errno != ENOENT) {
++            ret = errno;
++            DEBUG(SSSDBG_CRIT_FAILURE, "failed to unlink %s [%d]: %s\n",
++                                       filename, ret, sss_strerror(ret));
++            goto done;
++        }
++    }
++
++    ret = EOK;
++
++done:
++    talloc_free(filename);
++    return ret;
++}
++
+ static errno_t
+ parse_ini_file_with_libini(struct ini_cfgobj *ini_config,
+                            int *_gpt_version)
+@@ -528,7 +560,8 @@ copy_smb_file_to_gpo_cache(SMBCCTX *smbc_ctx,
+                            const char *smb_server,
+                            const char *smb_share,
+                            const char *smb_path,
+-                           const char *smb_cse_suffix)
++                           const char *smb_cse_suffix,
++                           bool optional)
+ {
+     char *smb_uri = NULL;
+     char *gpt_main_folder = NULL;
+@@ -588,8 +621,25 @@ copy_smb_file_to_gpo_cache(SMBCCTX *smbc_ctx,
+ 
+         if (file == NULL) {
+             ret = errno;
+-            DEBUG(SSSDBG_CRIT_FAILURE, "smbc_getFunctionOpen failed [%d][%s]\n",
+-                  ret, strerror(ret));
++            if (optional && ret == ENOENT) {
++                DEBUG(SSSDBG_TRACE_FUNC,
++                      "%s does not exist in sysvol, purging cached copy\n",
++                      smb_uri);
++                /* It looks like Windows clients treat missing GPO files as
++                 * empty. To make sure we do not use old and now invalid
++                 * content an potentially exising old file will be removed. */
++                ret = gpo_cache_remove_file(smb_path, smb_cse_suffix);
++                if (ret != EOK && ret != ENOENT) {
++                    DEBUG(SSSDBG_CRIT_FAILURE,
++                          "failed to purge stale cached %s\n", smb_uri);
++                    goto done;
++                }
++                ret = EOK;
++            } else {
++                DEBUG(SSSDBG_CRIT_FAILURE,
++                      "smbc_getFunctionOpen failed [%d][%s]\n",
++                      ret, strerror(ret));
++            }
+             goto done;
+         }
+     }
+@@ -683,7 +733,7 @@ perform_smb_operations(int cached_gpt_version,
+ 
+     /* download ini file */
+     ret = copy_smb_file_to_gpo_cache(smbc_ctx, smb_server, smb_share, smb_path,
+-                                     GPT_INI);
++                                     GPT_INI, false);
+     if (ret != EOK) {
+         DEBUG(SSSDBG_CRIT_FAILURE,
+               "copy_smb_file_to_gpo_cache failed [%d][%s]\n",
+@@ -703,13 +753,14 @@ perform_smb_operations(int cached_gpt_version,
+     if (sysvol_gpt_version > cached_gpt_version) {
+         /* download policy file */
+         ret = copy_smb_file_to_gpo_cache(smbc_ctx, smb_server, smb_share,
+-                                         smb_path, smb_cse_suffix);
+-        if (ret != EOK) {
++                                         smb_path, smb_cse_suffix, true);
++        if (ret != EOK && ret != ENOENT) {
+             DEBUG(SSSDBG_CRIT_FAILURE,
+                   "copy_smb_file_to_gpo_cache failed [%d][%s]\n",
+                   ret, strerror(ret));
+             goto done;
+         }
++        ret = EOK;
+     }
+ 
+     *_sysvol_gpt_version = sysvol_gpt_version;
diff --git a/debian/patches/lp1979350-GPO-ignore-non-ascii-symbols-in-GPT.INI.patch b/debian/patches/lp1979350-GPO-ignore-non-ascii-symbols-in-GPT.INI.patch
new file mode 100644
index 0000000..1b503e8
--- /dev/null
+++ b/debian/patches/lp1979350-GPO-ignore-non-ascii-symbols-in-GPT.INI.patch
@@ -0,0 +1,152 @@
+From: Alexey Tikhonov <[e-mail]>
+Date: Mon, 7 Mar 2022 22:53:24 +0100
+Subject: GPO: ignore non-ascii symbols in values in GPT.INI
+
+Windows uses ANSI (extended-ASCII) to encode the GPT.INI file.
+See https://lists.samba.org/archive/cifs-protocol/2019-March/003228.html
+for details.
+
+There is no trivial way to figure out actual code page used. But from
+practical point of view, it seems the only key whose value might be
+non-ascii is "DisplayName", and SSSD doesn't use it anyway.
+
+This patch replaces non-ascii symbols in values of GPT.INI with '?'
+character to make content compatible with libini_config parser.
+
+Resolves: https://github.com/SSSD/sssd/issues/4138
+
+Reviewed-by: Iker Pedrosa <[e-mail]>
+Reviewed-by: Sumit Bose <[e-mail]>
+
+Origin: upstream, https://github.com/SSSD/sssd/commit/d241b55291419753ce3e961a1b201d62f7851513
+Bug: https://github.com/SSSD/sssd/issues/4138
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1979350
+Applied-Upstream: 2.7.0
+---
+ src/providers/ad/ad_gpo_child.c | 90 ++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 88 insertions(+), 2 deletions(-)
+
+diff --git a/src/providers/ad/ad_gpo_child.c b/src/providers/ad/ad_gpo_child.c
+index 4c676d6..98bc747 100644
+--- a/src/providers/ad/ad_gpo_child.c
++++ b/src/providers/ad/ad_gpo_child.c
+@@ -269,6 +269,48 @@ done:
+     return ret;
+ }
+ 
++static errno_t gpo_sanitize_buffer_content(uint8_t *buf, int buflen)
++{
++    int i;
++    int line_start = 0;
++    int equal_pos = 0;
++
++    if (!buf) {
++        return EINVAL;
++    }
++
++    for (i = 0; i < buflen; ++i) {
++        if (buf[i] == '\n') {
++            line_start = i + 1;
++            continue;
++        }
++        if (buf[i] == '=') {
++            equal_pos = i;
++            continue;
++        }
++        if (isascii(buf[i])) {
++            continue;
++        }
++
++        /* non-ascii */
++        if (equal_pos <= line_start) { /* key */
++            DEBUG(SSSDBG_OP_FAILURE,
++                  "Key or section starting at position %d ('%.*s...') contains"
++                  " non-ascii symbol. File is unusable!\n",
++                  line_start, i - line_start, buf + line_start);
++            return EINVAL;
++        }
++
++        buf[i] = '?';
++        DEBUG(SSSDBG_IMPORTANT_INFO,
++              "Value for key '%.*s' contains non-ascii symbol."
++              " Replacing with '?'\n",
++              equal_pos - line_start, buf + line_start);
++    }
++
++    return EOK;
++}
++
+ /*
+  * This function stores the input buf to a local file, whose file path
+  * is constructed by concatenating:
+@@ -472,6 +514,9 @@ ad_gpo_parse_ini_file(const char *smb_path,
+     int ret;
+     int gpt_version = -1;
+     TALLOC_CTX *tmp_ctx = NULL;
++    struct stat st;
++    int fd = -1;
++    uint8_t *buf = NULL;
+ 
+     tmp_ctx = talloc_new(NULL);
+     if (tmp_ctx == NULL) {
+@@ -496,10 +541,50 @@ ad_gpo_parse_ini_file(const char *smb_path,
+         goto done;
+     }
+ 
+-    ret = ini_config_file_open(ini_filename, 0, &file_ctx);
++    fd = open(ini_filename, O_RDONLY);
++    if (fd == -1) {
++        ret = errno;
++        DEBUG(SSSDBG_CRIT_FAILURE,
++              "open() failed [%d][%s]\n", ret, strerror(ret));
++        ret = EIO;
++        goto done;
++    }
++    ret = fstat(fd, &st);
++    if (ret != 0) {
++        ret = errno;
++        DEBUG(SSSDBG_CRIT_FAILURE,
++              "stat() failed [%d][%s]\n", ret, strerror(ret));
++        ret = EIO;
++        goto done;
++    }
++    buf = talloc_size(tmp_ctx, st.st_size);
++    if (buf == NULL) {
++        ret = ENOMEM;
++        goto done;
++    }
++    if (sss_atomic_read_s(fd, buf, st.st_size) != st.st_size) {
++        ret = EIO;
++        DEBUG(SSSDBG_CRIT_FAILURE,
++              "sss_atomic_read_s() failed\n");
++        goto done;
++    }
++
++    /* Windows uses ANSI (extended-ASCII) to encode the GPT.INI file.
++     * Practically this might mean any code page, including uncompatible
++     * with UTF. Since the only value read by SSSD from GPT.INI is
++     * 'Version=...', just get rid of any non-ascii characters to make
++     * content compatible with lib_iniconfig.
++     */
++    ret = gpo_sanitize_buffer_content(buf, st.st_size);
++    if (ret != EOK) {
++        DEBUG(SSSDBG_CRIT_FAILURE, "gpo_sanitize_buffer_content() failed\n");
++        goto done;
++    }
++
++    ret = ini_config_file_from_mem(buf, st.st_size, &file_ctx);
+     if (ret != 0) {
+         DEBUG(SSSDBG_CRIT_FAILURE,
+-              "ini_config_file_open failed [%d][%s]\n", ret, strerror(ret));
++              "ini_config_file_from_mem() failed [%d][%s]\n", ret, strerror(ret));
+         goto done;
+     }
+ 
+@@ -547,6 +632,7 @@ ad_gpo_parse_ini_file(const char *smb_path,
+ 
+     ini_config_file_destroy(file_ctx);
+     ini_config_destroy(ini_config);
++    if (fd != -1) close(fd);
+     talloc_free(tmp_ctx);
+     return ret;
+ }
diff --git a/debian/patches/lp1979453-fix-shebang-on-sss_analyze.patch b/debian/patches/lp1979453-fix-shebang-on-sss_analyze.patch
new file mode 100644
index 0000000..9eadaf2
--- /dev/null
+++ b/debian/patches/lp1979453-fix-shebang-on-sss_analyze.patch
@@ -0,0 +1,22 @@
+From: Sergio Durigan Junior <[e-mail]>
+Date: Wed, 22 Jun 2022 10:56:45 -0400
+Subject: Fix shebang on sss_analyze
+
+s/python/python3/
+
+Forwarded: not-needed
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1979453
+---
+ src/tools/analyzer/sss_analyze | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/tools/analyzer/sss_analyze b/src/tools/analyzer/sss_analyze
+index 3f1beaf..6d4b5b3 100755
+--- a/src/tools/analyzer/sss_analyze
++++ b/src/tools/analyzer/sss_analyze
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python
++#!/usr/bin/env python3
+ 
+ from sssd import sss_analyze
+ 
diff --git a/debian/patches/series b/debian/patches/series
index d83fab8..a400929 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,5 @@
 fix-whitespace-test.diff
 default-to-socket-activated-services.diff
+lp1934997-authentication-fails-gpo-non-existent.patch
+lp1979350-GPO-ignore-non-ascii-symbols-in-GPT.INI.patch
+lp1979453-fix-shebang-on-sss_analyze.patch
diff --git a/debian/python3-libipa-hbac.install b/debian/python3-libipa-hbac.install
index 7d3cf99..923e03d 100644
--- a/debian/python3-libipa-hbac.install
+++ b/debian/python3-libipa-hbac.install
@@ -1 +1 @@
-usr/lib/python3*/site-packages/pyhbac.so
+usr/lib/python3/dist-packages/pyhbac.so
diff --git a/debian/python3-libsss-nss-idmap.install b/debian/python3-libsss-nss-idmap.install
index b2339ca..a7667d1 100644
--- a/debian/python3-libsss-nss-idmap.install
+++ b/debian/python3-libsss-nss-idmap.install
@@ -1 +1 @@
-usr/lib/python3*/site-packages/pysss_nss_idmap.so
+usr/lib/python3/dist-packages/pysss_nss_idmap.so
diff --git a/debian/python3-sss.install b/debian/python3-sss.install
index f9b99df..1f75e8c 100644
--- a/debian/python3-sss.install
+++ b/debian/python3-sss.install
@@ -1,3 +1,3 @@
-usr/lib/python3*/dist-packages/SSSDConfig/*.py
-usr/lib/python3*/site-packages/pysss.so
-usr/lib/python3*/site-packages/pysss_murmur.so
+usr/lib/python3/dist-packages/SSSDConfig/*.py
+usr/lib/python3/dist-packages/pysss.so
+usr/lib/python3/dist-packages/pysss_murmur.so
diff --git a/debian/rules b/debian/rules
index c2251b3..dc7004b 100755
--- a/debian/rules
+++ b/debian/rules
@@ -12,6 +12,8 @@ CFLAGS = $(shell dpkg-buildflags --get CFLAGS)
 CFLAGS += -I/usr/include/samba-4.0
 
 export CK_DEFAULT_TIMEOUT=30
+export am_cv_python_pythondir=/usr/lib/python3/dist-packages
+export am_cv_python_pyexecdir=/usr/lib/python3/dist-packages
 
 DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
 
diff --git a/debian/sssd-tools.install b/debian/sssd-tools.install
index e2e2601..d6baf09 100644
--- a/debian/sssd-tools.install
+++ b/debian/sssd-tools.install
@@ -4,7 +4,7 @@ usr/sbin/sss_obfuscate
 usr/sbin/sss_override
 usr/sbin/sss_seed
 usr/sbin/sssctl
-usr/lib/python3*/site-packages/sssd/
+usr/lib/python3/dist-packages/sssd/
 usr/libexec/sssd/sss_analyze
 usr/share/man/man8/sss_cache.8*
 usr/share/man/man8/sss_debuglevel.8*