summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--src/providers/ad/ad_access.c4
-rw-r--r--src/providers/ipa/ipa_access.c13
-rw-r--r--src/providers/ldap/ldap_access.c11
-rw-r--r--src/providers/ldap/sdap_access.c40
-rw-r--r--src/providers/ldap/sdap_access.h2
5 files changed, 44 insertions, 26 deletions
diff --git a/src/providers/ad/ad_access.c b/src/providers/ad/ad_access.c
index 746017dc5..cf6412f22 100644
--- a/src/providers/ad/ad_access.c
+++ b/src/providers/ad/ad_access.c
@@ -56,7 +56,9 @@ ad_access_handler(struct be_req *breq)
/* Verify that the account is not locked */
req = sdap_access_send(breq, be_ctx->ev, be_ctx, domain,
- access_ctx->sdap_access_ctx, pd);
+ access_ctx->sdap_access_ctx,
+ access_ctx->sdap_access_ctx->id_ctx->conn,
+ pd);
if (!req) {
be_req_terminate(breq, DP_ERR_FATAL, PAM_SYSTEM_ERR, NULL);
return;
diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c
index 58539f4c6..704419484 100644
--- a/src/providers/ipa/ipa_access.c
+++ b/src/providers/ipa/ipa_access.c
@@ -78,6 +78,7 @@ void ipa_access_handler(struct be_req *be_req)
struct pam_data *pd;
struct ipa_access_ctx *ipa_access_ctx;
struct tevent_req *req;
+ struct sss_domain_info *dom;
struct be_ctx *be_ctx = be_req_get_be_ctx(be_req);
pd = talloc_get_type(be_req_get_data(be_req), struct pam_data);
@@ -85,13 +86,21 @@ void ipa_access_handler(struct be_req *be_req)
ipa_access_ctx = talloc_get_type(be_ctx->bet_info[BET_ACCESS].pvt_bet_data,
struct ipa_access_ctx);
+ dom = be_ctx->domain;
+ if (strcasecmp(pd->domain, be_ctx->domain->name) != 0) {
+ /* Subdomain request, verify subdomain */
+ dom = find_subdomain_by_name(be_ctx->domain, pd->domain, true);
+ }
+
/* First, verify that this account isn't locked.
* We need to do this in case the auth phase was
* skipped (such as during GSSAPI single-sign-on
* or SSH public key exchange.
*/
- req = sdap_access_send(be_req, be_ctx->ev, be_ctx, be_ctx->domain,
- ipa_access_ctx->sdap_access_ctx, pd);
+ req = sdap_access_send(be_req, be_ctx->ev, be_ctx, dom,
+ ipa_access_ctx->sdap_access_ctx,
+ ipa_access_ctx->sdap_access_ctx->id_ctx->conn,
+ pd);
if (!req) {
be_req_terminate(be_req, DP_ERR_FATAL, PAM_SYSTEM_ERR, NULL);
return;
diff --git a/src/providers/ldap/ldap_access.c b/src/providers/ldap/ldap_access.c
index bb5c37f44..b3920b7ac 100644
--- a/src/providers/ldap/ldap_access.c
+++ b/src/providers/ldap/ldap_access.c
@@ -49,6 +49,7 @@ void sdap_pam_access_handler(struct be_req *breq)
struct pam_data *pd;
struct tevent_req *req;
struct sdap_access_ctx *access_ctx;
+ struct sss_domain_info *dom;
pd = talloc_get_type(be_req_get_data(breq), struct pam_data);
@@ -56,8 +57,16 @@ void sdap_pam_access_handler(struct be_req *breq)
talloc_get_type(be_ctx->bet_info[BET_ACCESS].pvt_bet_data,
struct sdap_access_ctx);
+ dom = be_ctx->domain;
+ if (strcasecmp(pd->domain, be_ctx->domain->name) != 0) {
+ /* Subdomain request, verify subdomain */
+ dom = find_subdomain_by_name(be_ctx->domain, pd->domain, true);
+ }
+
req = sdap_access_send(breq, be_ctx->ev, be_ctx,
- be_ctx->domain, access_ctx, pd);
+ dom, access_ctx,
+ access_ctx->id_ctx->conn,
+ pd);
if (req == NULL) {
DEBUG(SSSDBG_CRIT_FAILURE, ("Unable to start sdap_access request\n"));
sdap_access_reply(breq, PAM_SYSTEM_ERR);
diff --git a/src/providers/ldap/sdap_access.c b/src/providers/ldap/sdap_access.c
index 9d1315fab..267a2b863 100644
--- a/src/providers/ldap/sdap_access.c
+++ b/src/providers/ldap/sdap_access.c
@@ -45,6 +45,7 @@ static struct tevent_req *sdap_access_filter_send(TALLOC_CTX *mem_ctx,
struct be_ctx *be_ctx,
struct sss_domain_info *domain,
struct sdap_access_ctx *access_ctx,
+ struct sdap_id_conn_ctx *conn,
const char *username,
struct ldb_message *user_entry);
static errno_t sdap_access_filter_recv(struct tevent_req *req);
@@ -62,6 +63,7 @@ struct sdap_access_req_ctx {
struct pam_data *pd;
struct tevent_context *ev;
struct sdap_access_ctx *access_ctx;
+ struct sdap_id_conn_ctx *conn;
struct be_ctx *be_ctx;
struct sss_domain_info *domain;
struct ldb_message *user_entry;
@@ -78,6 +80,7 @@ sdap_access_send(TALLOC_CTX *mem_ctx,
struct be_ctx *be_ctx,
struct sss_domain_info *domain,
struct sdap_access_ctx *access_ctx,
+ struct sdap_id_conn_ctx *conn,
struct pam_data *pd)
{
errno_t ret;
@@ -85,7 +88,6 @@ sdap_access_send(TALLOC_CTX *mem_ctx,
struct tevent_req *req;
struct ldb_result *res;
const char *attrs[] = { "*", NULL };
- struct sss_domain_info *user_dom;
req = tevent_req_create(mem_ctx, &state, struct sdap_access_req_ctx);
if (req == NULL) {
@@ -98,6 +100,7 @@ sdap_access_send(TALLOC_CTX *mem_ctx,
state->pd = pd;
state->ev = ev;
state->access_ctx = access_ctx;
+ state->conn = conn;
state->current_rule = 0;
DEBUG(6, ("Performing access check for user [%s]\n", pd->user));
@@ -108,20 +111,9 @@ sdap_access_send(TALLOC_CTX *mem_ctx,
goto done;
}
- /* Get original user DN, take care of subdomain users as well */
- if (strcasecmp(pd->domain, be_ctx->domain->name) != 0) {
- user_dom = find_subdomain_by_name(be_ctx->domain, pd->domain, true);
- if (user_dom == NULL) {
- DEBUG(SSSDBG_OP_FAILURE, ("find_subdomain_by_name failed.\n"));
- ret = ENOMEM;
- goto done;
- }
- ret = sysdb_get_user_attr(state, user_dom->sysdb, user_dom,
- pd->user, attrs, &res);
- } else {
- ret = sysdb_get_user_attr(state, domain->sysdb, domain,
- pd->user, attrs, &res);
- }
+ /* Get original user DN, domain already points to the right (sub)domain */
+ ret = sysdb_get_user_attr(state, domain->sysdb, domain,
+ pd->user, attrs, &res);
if (ret != EOK) {
if (ret == ENOENT) {
/* If we can't find the user, return access denied */
@@ -177,6 +169,7 @@ static errno_t check_next_rule(struct sdap_access_req_ctx *state,
subreq = sdap_access_filter_send(state, state->ev, state->be_ctx,
state->domain,
state->access_ctx,
+ state->conn,
state->pd->user,
state->user_entry);
if (subreq == NULL) {
@@ -624,7 +617,8 @@ struct sdap_access_filter_req_ctx {
const char *filter;
struct tevent_context *ev;
struct sdap_access_ctx *access_ctx;
- struct sdap_id_ctx *sdap_ctx;
+ struct sdap_options *opts;
+ struct sdap_id_conn_ctx *conn;
struct sdap_id_op *sdap_op;
struct sysdb_handle *handle;
struct sss_domain_info *domain;
@@ -641,6 +635,7 @@ static struct tevent_req *sdap_access_filter_send(TALLOC_CTX *mem_ctx,
struct be_ctx *be_ctx,
struct sss_domain_info *domain,
struct sdap_access_ctx *access_ctx,
+ struct sdap_id_conn_ctx *conn,
const char *username,
struct ldb_message *user_entry)
{
@@ -664,7 +659,8 @@ static struct tevent_req *sdap_access_filter_send(TALLOC_CTX *mem_ctx,
state->filter = NULL;
state->username = username;
- state->sdap_ctx = access_ctx->id_ctx;
+ state->opts = access_ctx->id_ctx->opts;
+ state->conn = conn;
state->ev = ev;
state->access_ctx = access_ctx;
state->domain = domain;
@@ -707,9 +703,9 @@ static struct tevent_req *sdap_access_filter_send(TALLOC_CTX *mem_ctx,
state->filter = talloc_asprintf(
state,
"(&(%s=%s)(objectclass=%s)%s)",
- state->sdap_ctx->opts->user_map[SDAP_AT_USER_NAME].name,
+ state->opts->user_map[SDAP_AT_USER_NAME].name,
clean_username,
- state->sdap_ctx->opts->user_map[SDAP_OC_USER].name,
+ state->opts->user_map[SDAP_OC_USER].name,
state->access_ctx->filter);
if (state->filter == NULL) {
DEBUG(0, ("Could not construct access filter\n"));
@@ -721,7 +717,7 @@ static struct tevent_req *sdap_access_filter_send(TALLOC_CTX *mem_ctx,
DEBUG(6, ("Checking filter against LDAP\n"));
state->sdap_op = sdap_id_op_create(state,
- state->sdap_ctx->conn->conn_cache);
+ state->conn->conn_cache);
if (!state->sdap_op) {
DEBUG(2, ("sdap_id_op_create failed\n"));
ret = ENOMEM;
@@ -805,13 +801,13 @@ static void sdap_access_filter_connect_done(struct tevent_req *subreq)
*/
subreq = sdap_get_generic_send(state,
state->ev,
- state->sdap_ctx->opts,
+ state->opts,
sdap_id_op_handle(state->sdap_op),
state->basedn,
LDAP_SCOPE_BASE,
state->filter, NULL,
NULL, 0,
- dp_opt_get_int(state->sdap_ctx->opts->basic,
+ dp_opt_get_int(state->opts->basic,
SDAP_SEARCH_TIMEOUT),
false);
if (subreq == NULL) {
diff --git a/src/providers/ldap/sdap_access.h b/src/providers/ldap/sdap_access.h
index cda078688..30097e21f 100644
--- a/src/providers/ldap/sdap_access.h
+++ b/src/providers/ldap/sdap_access.h
@@ -26,6 +26,7 @@
#define SDAP_ACCESS_H_
#include "providers/dp_backend.h"
+#include "providers/ldap/ldap_common.h"
#define SYSDB_LDAP_ACCESS_FILTER "ldap_access_filter_allow"
@@ -62,6 +63,7 @@ sdap_access_send(TALLOC_CTX *mem_ctx,
struct be_ctx *be_ctx,
struct sss_domain_info *domain,
struct sdap_access_ctx *access_ctx,
+ struct sdap_id_conn_ctx *conn,
struct pam_data *pd);
errno_t sdap_access_recv(struct tevent_req *req);