| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
| |
|
| |
|
|
|
|
|
|
| |
Also allows us to remove sysdb_subdom_get<pw/gr>nam() wrappers and restore
fqnames proper value in subdomains, by testing for a parent domain being
present or not.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Storing ranges for multiple domains under any specific domain is
somewhat aritrary and unnecessary.
Put ranges under cn=ranges,cn=sysdb, without involving any specific
domain subtree.
This allows us to avoid using sysdb->domain in ranges functions.
Also storing other subdomains data under the parent domain tree felt
wrong, all other domain specific data is under their own subtree.
Moving this data in its own place seems a better solution.
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
We are deprecating sysdb->domain so kill the function that gives access to
this member as we should stop relying on it being available (or correct).
|
|
|
|
|
| |
Bring it out of sysdb, which will slowly remove internal dependencies on
domains and instead will always require them to be passed by callers.
|
|
|
|
|
|
|
|
|
|
|
|
| |
Change the way sysdbs are initialized. Make callers responsible for providing
the list of domains.
Remove the returned array of sysdb contexts, it was used only by sss_cache
and not really necessary there either as that tool can easily iterate the
domains.
Make sysdb ctx children of their respective domains.
Neither sysdb context nor domains are ever freed until a program is done so
there shouldn't be any memory hierarchy issue. As plus we simplify the code by
removing a destructor and a setter function.
|
|
|
|
|
|
|
| |
This commit is the first of a complex work of untangling domain and sysdb.
It turns out the idea of keeping a reference to the domain within the sysdb was
a poor one so we need to split the domain out and change all functions that
needs one to get it explicitly from their callers.
|
|
|
|
| |
Also fixes https://fedorahosted.org/sssd/ticket/1754
|
|
|
|
| |
https://fedorahosted.org/sssd/ticket/1760
|
|
|
|
|
|
| |
sss_authtok_get_password() already returns length without terminating
zero. This broke authentication over LDAP because we removed the
last password character.
|
|
|
|
| |
Use the new authtok abstraction and interfaces throught the code.
|
|
|
|
|
|
| |
These functions allow handling of auth tokens in a completely opaque way,
with clear semantics and accessor fucntions that guarantee consistency,
proper access to data and error conditions.
|
|
|
|
|
| |
This is useful for wiping passwords, as it prevents the compiler from
optimizing out a memset to zero before a free()
|
|
|
|
|
| |
Make it clear to the API users that we can not take arbitrary auth tokens.
We can only take a password for now so simplify and clarify the interface.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This set of functions had a few important issues:
1. the base_dn was always NULL, as the base array was never actually used
to construct any DN. This means each function searched the whole database
multiple times.
It would try to remove SYSDB_USN from all database entries 3 times.
Then it would try to find non updated entries another 3 times and delete
them, arguably find empty results the last 2 times.
2. Remove use of sysdb_private.h, that header is *PRIVATE* which means it
should not be used anywhere but within sysdb. Do this by using existing
functions instead of using ldb calls directly. This is important to keep
sysdb as conistent and self-contained as possible.
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
In the AD case, deployments sometimes add groups as parents of the
primary GID group. These groups are then returned during initgroups
in the tokenGroups attribute and member/memberof links are established
between the user and the group. However, any update of these groups
would remove the links, so a sequence of calls: id -G user; id user; id
-G user would return different group memberships.
The downside of this approach is that the user is returned as a group
member during getgrgid call as well.
|
|
|
|
|
|
|
| |
The code would call sysdb_attrs_add_uint32 which added another UID or GID
to the ID=0 we already downloaded from LDAP (0 is the default value) when
ID-mapping an entry. This led to funky behaviour later on when we wanted
to process the ID.
|
|
|
|
|
|
|
| |
This reverts commit d698499602461b98fd56f2d550f80c6cb25f12a9.
And adds the correct fix.
Also makes the function static,as it is used nowehere else.
|
|
|
|
|
| |
Besides adding the missing default this patch suppresses a compiler
warning about ret being uninitialized.
|
| |
|
|
|
|
|
|
|
|
|
| |
Using a vtable like this has various drawacks, including the fact prototypes
are not checked by the compiler so the code could silently break and still
compile fine (in fact I found this out changing one of the prototypes).
A switch statement is also better because it catches if the enum changed and
won't risk allowing to access the table out of bounds.
|
|
|
|
| |
It is not a map, but a default context. The name should reflect that.
|
|
|
|
|
| |
Changes the ipa_get_selinux{send,recv} request so that it only delivers
data and moves processing to the IPA selinux handler.
|
| |
|
| |
|
|
|
|
|
|
| |
Instead of using a single array of gid-domain_pointer pairs, Simo
suggested to use a gid array for each domain an store it with a pointer
to the domain.
|
|
|
|
|
|
| |
If some of the Posix attributes of an user existing in the cache differ
from the data given in the current PAC the old user entry is drop and a
new one is created with the data from the PAC.
|
| |
|
|
|
|
|
|
|
| |
To avoid duplicated entries in the group list all gids are added to a
hash table first.
Fixes: https://fedorahosted.org/sssd/ticket/1672
|
|
|
|
|
|
|
|
| |
Currently only the LDB error code indicating that an entry already
exists is translated to EEXIST. To make debugging easier and return a
better indication of the reason for an error in the logs this patch
translates the LDB error code for an already existing attribute or value
to EEXIST as well.
|
|
|
|
|
|
|
| |
Read the group membership of the remote domain the user belongs to from
the PAC and add them to the cache.
Fixes: https://fedorahosted.org/sssd/ticket/1666
|
|
|
|
|
|
|
| |
Groups from subdomains will not have an attribute holding the original
DN because in general it will not be available. This attribute is only
used by IPA HABC to improve performance and remote groups cannot be used
for access control.
|
|
|
|
|
|
|
|
|
|
| |
Currently users from subdomains can only be members of groups from the
configured domain and to access those groups a pointer to the domain
struct of the configured domain is used. This patch sets the dom_grp
member of struct pac_grp to point to the domain struct of the configured
for groups from this domain. This is a first step to allow group
membership for groups from subdomains as well. For those groups a
pointer to the related subdomain structure will be saved.
|
|
|
|
|
|
|
| |
Currently some user specific data from the PAC is only read when the
user is not already in the cache. Since some of this information is
needed later on, e.g. the domain SID the user belongs to, with this
patch the data is read always from the PAC.
|
|
|
|
|
|
|
| |
Currently only the flat name of the configured domain is updated if it
is not already set. This patch updates the domain ID as well. This is
typically the case when trust support is enabled on the server side
while sssd is running.
|
|
|
|
|
| |
To avoid a conversion on the caller side a new call is added to
libsss_idmap which converts a Samba dom_sid structure to a Posix ID.
|
|
|
|
|
|
|
| |
Currently domains can only be searched by name in the global domain
list. To make it easier to find the domain for a given SID
find_domain_by_id() which returns a pointer to the domain or subdomain
entry in the global domain list if a matching id was found.
|
|
|
|
|
| |
To be able to handle groupmemberships from other domains more data than
just the gid must be kept for groups given in the PAC.
|