summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* IFP: Add a unit test for ifp_reply_objpathJakub Hrozek2014-05-221-0/+30
| | | | | Reviewed-by: Stef Walter <stefw@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Add a utility function to reply with an object pathPavel Březina2014-05-222-0/+48
| | | | | Reviewed-by: Stef Walter <stefw@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Add utility functions to escape and unescape object pathsJakub Hrozek2014-05-223-1/+240
| | | | | | | | | | | | D-Bus spec says: Each element must only contain the ASCII characters "[A-Z][a-z][0-9]_" This patch adds two utility functions to escape raw input into format suitable for DBus and conversely transform escaped paths back into raw paths. Reviewed-by: Stef Walter <stefw@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: Initialize user_map_cnt in server modeJakub Hrozek2014-05-221-0/+1
| | | | | | | | | | | user_map_cnt was initialized when all the traditional back ends are initialized. However, for the server mode, we simply copy the defaults and the count was left zeroed, which led to crashes. Down the road, we should consider tying the map and the attribute count together (see ticket #2336) Reviewed-by: Pavel Reichl <preichl@redhat.com>
* well known sids: Windows Server 2012 new asserted identity SIDsAlexander Bokovoy2014-05-211-0/+2
| | | | | | | | | | http://support.microsoft.com/kb/2830145 In Windows Server 2012, two new security principal SIDs are introduced to differentiate between proof of possession and Service-for-User-to-Self (S4U2Self) protocol transitions . Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa subdomains provider: make sure search by SID works for homedirAlexander Bokovoy2014-05-211-5/+15
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* resolv: Do not try to free addrinfo in case of errorLukas Slebodnik2014-05-201-1/+2
| | | | | | | | | | | We should call freeaddrinfo only in situation if getaddrinfo succeeds. It is not specified in RFC2553 the behaviour of calling freeaddrinfo with the NULL argument. It is more portable to do not rely on undocumented behaviour of glibc. http://www.ietf.org/rfc/rfc2553.txt [Page 28] Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Remove unused parameter from ifp_user_get_groups_replyLukas Slebodnik2014-05-201-4/+2
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Remove unused parameter from ifp_user_get_attr_handle_replyLukas Slebodnik2014-05-201-4/+4
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* CONFIGURE: Remove duplicate detection of pamLukas Slebodnik2014-05-181-6/+0
| | | | | | The same test is in file src/external/pam.m4 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CRYPTO: Use unprefixed version of function stpncpyLukas Slebodnik2014-05-182-4/+4
| | | | | | | | | | | | | | | | glibc contains two versions of finction stpncpy sh-4.2$ nm --dynamic --defined-only /lib64/libc.so.6 | grep stpncpy 0000003ce1c89b00 i stpncpy 0000003ce1c89b00 i __stpncpy 0000003ce1d040a0 T __stpncpy_chk We should use more portable version of stpncpy without prefix with underscores. The function __stpncpy was used in initial veersion e65c65fc710fa030bfb8319efc43fcdc9ce5a26f, which was based on http://people.redhat.com/drepper/SHA-crypt.txt Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: macro PAM_DATA_REPLACE isn't available in openpam.Lukas Slebodnik2014-05-181-0/+2
| | | | | | | This part was introduced in commit dba7903ba7fc04bc331004b0453938c116be3663 "PAM: close socket fd with pam_set_data" Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: Fix problem with missing declaration.Lukas Slebodnik2014-05-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | The functions strdup and strncmp are used in pam_test_client, but header file string.h was not included directly in this file. The header file string.h was indirectly included by the header file security/pam_client.h. src/sss_client/pam_test_client.c: In function 'main': src/sss_client/pam_test_client.c:45: error: implicit declaration of function 'strdup' src/sss_client/pam_test_client.c:45: warning: incompatible implicit declaration of built-in function 'strdup' src/sss_client/pam_test_client.c:49: warning: incompatible implicit declaration of built-in function 'strdup' src/sss_client/pam_test_client.c:52: warning: incompatible implicit declaration of built-in function 'strdup' src/sss_client/pam_test_client.c:64: error: implicit declaration of function 'strncmp' gmake[2]: *** [src/sss_client/pam_test_client.o] Error 1 sh-4.2$ nm --undefined-only ./pam_test_client | grep -E "strdup|strncmp" U __strdup@@GLIBC_2.2.5 U strncmp@@GLIBC_2.2.5 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SBUS: Fix warning declaration shadows a global declarationLukas Slebodnik2014-05-161-4/+4
| | | | | | | | | src/sbus/sssd_dbus_meta.c: In function 'sbus_meta_find_signal': src/sbus/sssd_dbus_meta.c:43: warning: declaration of 'signal' shadows a global declaration /usr/include/signal.h:101: warning: shadowed declaration is here Reviewed-by: Stef Walter <stefw@redhat.com>
* BUILD: Make samba4 libraries optionalLukas Slebodnik2014-05-165-5/+40
| | | | | | | | | | Samba 4 libraries are necessary for building {ad, ipa} provider, but samba4 needn't be available on older distributions. This patch add possibility to build SSSD without {ad, ipa} provider and thus without Samba 4 libraries. The script configure have new argument --with-samba with default value yes. Reviewed-by: Michal Židek <mzidek@redhat.com>
* TEST: Refactor test_ioLukas Slebodnik2014-05-161-48/+115
| | | | | | | Tests should not create resources. It is purpose of setup functions. Patch fixes also fd leaks from mkstemp. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Add a GetGroupsList methodJakub Hrozek2014-05-147-14/+226
| | | | | | | | | | | | | This patch adds a new method on the bus with the following synopsis: <method name="GetUserGroups"> <arg name="user" type="s" direction="in" /> <arg name="values" type="as" direction="out"/> </method> Its purpose is to return names of groups the user is a member of as a list of strings. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: return SYSDB_NAME from sysdb_initgroupsJakub Hrozek2014-05-142-0/+6
| | | | | | | | For the GetGroupsList function it would be handy to get the user names as well with a single sysdb_initgroups() call. This patch adds SYSDB_NAME to the default attribute list. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TEST: Remove unused variablePavel Reichl2014-05-141-3/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SPEC: Add libsss_ad_common.so to the package sssd-adLukas Slebodnik2014-05-141-0/+1
| | | | | | | | RPM build errors: error: Installed (but unpackaged) file(s) found: /usr/lib64/sssd/libsss_ad_common.so Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_config: build only when IFP is allowedPavel Březina2014-05-142-5/+11
| | | | | | since the IFP responder is currently the only planned consumer. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_config: unit testsPavel Březina2014-05-142-0/+903
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_config: buildPavel Březina2014-05-146-0/+50
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_config: the codePavel Březina2014-05-142-0/+580
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SBUS: Allow registering paths with fallbackJakub Hrozek2014-05-131-4/+76
| | | | | | | | | | | | Some interfaces we support, such as domain might not be bound to a single path, but rather anything under a path 'directory'. This patch allows the SBUS to register a fallback path that would route any messages under a given anchor to a handler of an interface. The fallback interface is denoted with a trailing wildcard: /org/sssd/anchor/* Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Per-attribute ACL for usersJakub Hrozek2014-05-1310-3/+361
| | | | | | | | | | | Introduces a new option called user_attributes that allows to specify which user attributes are allowed to be queried from the IFP responder. By default only the default POSIX set is allowed, this option allows to either add other attributes (+attrname) or remove them from the default set (-attrname). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Implemented LDAP component of GPO-based access controlYassir Elley2014-05-1320-45/+2746
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Do not remove non-root domains when looking up root domainJakub Hrozek2014-05-131-3/+22
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2322 When the AD subdomains code looked up the root domain subsequently (after the domain list was already populated), the non-root domains might have been removed along with their respective tasks, because the root domain lookup only ever matched a single root domain. This could cause havoc especially during login when different lookups for different domains might be going on during user group refresh. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SBUS: remove unused variablesPavel Březina2014-05-131-4/+0
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IFP: Add GetUserAttrs callJakub Hrozek2014-05-136-0/+597
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds a DBus method that allows the caller to retrieve attributes of a user. The synopsis of the call is as follows: <method name="GetUserAttr"> <arg type="s" name="user" direction="in"/> <arg type="as" name="attr" direction="in"/> <arg type="a{sv}" name="values" direction="out"/> </method> The return value is an array (one attribute per array member) of dictionaries. The key of the dictionary is the attribute name, the value is a variant containing the attribute values as strings. If an attribute does not exist or is not permitted to be read, no error is returned. If the users does not exist, the method returns an error. In future patches this function will be marked as obsolete in favor of object-oriented approach. ifp_user_get_attr_unpack_msg is a separate function to allow extending it in a later patch. The function to check the cache validity duplicates quite a bit of code with the NSS responder. The refactoring would be nice to get done along with #843. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* IFP: Initialize negative cache timeoutJakub Hrozek2014-05-132-0/+17
| | | | | | | | | | | | | | In order to avoid hitting the back end with repetitive requests, the InfoPipe responder needs a negative cache, too. This patch follows the convention set by other responders, where the negative cache timeouts are read from the [nss] section. This is not ideal, however, and ticket #2318 tracks moving the configuration to the [ifp] section primarily. The timeout is also a separate parameter in the NSS context. We should consider moving it to the negcache context instead (#2317). Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* IFP: use a list of allowed_uids for authenticationJakub Hrozek2014-05-139-6/+159
| | | | | | | | Similar to the PAC responder, the InfoPipe uses a list of UIDs that are allowed to communicate with the IFP responder. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* IFP: Add utility functionsJakub Hrozek2014-05-134-1/+381
| | | | | | | | | | | | | Adds a number of utility functions, most importanly ifp_req_create(). The ifp_req is a structure that will be passed along with the ifp request and would provide easy access to both the sbus_request data and per-responder data, like the ifp_ctx. Also includes a utility function to split a path prefix from a full path and add a ldb_element into a dictionary. These will be reused later. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Refactor sbus_message_handler to retrieve caller IDJakub Hrozek2014-05-131-55/+111
| | | | | | | | | | | | | | | | sbus_message_handler() is refactored so that it only verifies the message matches any of the interfaces SSSD listens on in order to be able to return either of HANDLED or NOT_YET_HANDLED. If the interface is one of those the SSSD should handle, the caller ID is first resolved using sbus_get_sender_id_send and only then passed on to the appropriate special handler. If the sernder ID can't be retrieved, the message is dropped with an error. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Add an async request to retrieve the caller IDJakub Hrozek2014-05-138-0/+515
| | | | | | | | | | | | | | | | | Adds an async request sbus_get_sender_id_{send,recv} that allows retrieval of UID based on "sender" as returned by dbus_message_get_sender(). The UID is an int64_t to be able to use "-1" to as a fallback value for uknown or error cases. The unit test is added as a standalone one, not part of the sbus_tests because the request, and by extension the unit test relies on being connected to the system bus, which is very unlikely to work in a build system. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Add SBUS_CONN_TYPE_SYSBUSJakub Hrozek2014-05-133-4/+7
| | | | | | | | | We need to retrieve caller IDs for each call from the system bus. This commit adds a new SBUS connection type that identifies system bus connection. The connection is used in the IFP provider. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Split out dbus_conn_sendJakub Hrozek2014-05-132-22/+45
| | | | | | | | | | Split dbus_conn_send out of sbus_conn_send to be able to call DBus messages without having a full sbus connection. This function is available to the sbus code only, consumers of sbus (responders and providers) should use sbus_conn_send. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Add a convenience function sbus_error_newJakub Hrozek2014-05-133-0/+75
| | | | | | | | | Adds a convenience function that constructs a DBusError on top of a talloc context and as such can be used to mark an sbus request as failed without having to create a DBusError instance by the caller. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Fix error handling conditionJakub Hrozek2014-05-131-1/+2
| | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: several trivial style fixesJakub Hrozek2014-05-133-6/+9
| | | | | | | | | | In SSSD we tend to use {} brackets around single-line blocks, too to make sure we don't forget to add them should the block become larger. We also don't add a space between function name and the opening "(". Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* LDAP: Check the LDAP handle before using itJakub Hrozek2014-05-121-0/+13
| | | | | | | | | | As the connection code is async-driven, the LDAP handle might be invalidated before SSSD attempts to use it. Similar to commit 5fe6ca5e339fd345119752e996c14edf8db57660, this patch adds a NULL check for the LDAP handle and aborts the request instead of crashing. Resolves: https://fedorahosted.org/sssd/ticket/2305
* ipa_selinux: Put SELinux map order related variables into structureMichal Zidek2014-05-121-31/+37
| | | | | | | | | | | Small change to make the code more readable. The relation between order, order_array and order_count is more obvious when they are grouped in structure. resolves: https://fedorahosted.org/sssd/ticket/2304 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MONITOR: Fix start up with empty standard inputLukas Slebodnik2014-05-121-0/+3
| | | | | | | | | | | | The monitor process does not read data from standard input in. We can close file descriptor from stdin. [sssd] [server_stdin_handler] (0x0020): sssd: EOF on stdin - terminating Resolves: https://fedorahosted.org/sssd/ticket/2312 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Use constant instead of value for stdin.Lukas Slebodnik2014-05-121-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Link ipa_ldap_opt test with openldap libsLukas Slebodnik2014-05-061-0/+1
| | | | | | | | | | | | | | | | | | | | The test ipa_ldap_opt has undefined symbols from libldap and liblber, but it was not directly linked with openldap libraries. sh-4.2$ nm --undefined-only .libs/ipa_ldap_opt-tests | grep -E "ldap|ber" U ber_free U ldap_err2string It causes linker failure on systems with disabled link_all_deplibs (debian) /usr/bin/ld: src/providers/ldap/ipa_ldap_opt_tests-sdap.o: undefined reference to symbol 'ber_free' /usr/bin/ld: note: 'ber_free' is defined in DSO /lib64/liblber-2.4.so.2 so try adding it to the linker command line /lib64/liblber-2.4.so.2: could not read symbols: Invalid operation clang: error: linker command failed with exit code 1 (use -v to see invocation) Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Close memstream handle in introspect destructorJakub Hrozek2014-05-061-0/+4
| | | | | | | There was a resource leak in the introspection code. This patch fixes the leak. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SPEC: Remove duplicate sssd_ifp.Lukas Slebodnik2014-05-021-1/+0
| | | | | | | | | | | | | | | | | | | | The file sssd_ifp was installed by two subpackages: sssd-common and sssd-dbus I din't have instaled file org.freedesktop.sssd.infopipe.conf, because it is in package sssd-dbus. Missing conf file caused problem with starting the ifp service. [sssd] [monitor_service_init] (0x0400): Initializing D-BUS Service [sssd] [mt_svc_exit_handler] (0x0040): Child [ifp] exited with code [3] [sssd] [mt_svc_exit_handler] (0x0010): Process [ifp], definitely stopped! [sssd[ifp]] [sysbus_init] (0x0040): DBus error message: Connection ":1.522" is not allowed to own the service "org.freedesktop.sssd.infopipe" due to security policies in the configuration file [sssd[ifp]] [ifp_process_init] (0x0020): Failed to connect to the system message bus [sssd[ifp]] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Make LDAP extra attributes available to IPA and ADSumit Bose2014-05-027-48/+61
| | | | | | | https://fedorahosted.org/sssd/ticket/2073 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Make it possible to extend an attribute mapJakub Hrozek2014-05-0222-15/+383
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2073 This commit adds a new option ldap_user_extra_attrs that is unset by default. When set, the option contains a list of LDAP attributes the LDAP provider would download and store in addition to the usual set. The list can either contain LDAP attribute names only, or colon-separated tuples of LDAP attribute and SSSD cache attribute name. In case only LDAP attribute name is specified, the attribute is saved to the cache verbatim. Using a custom SSSD attribute name might be required by environments that configure several SSSD domains with different LDAP schemas. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Fix off-by-one bug in sdap_copy_optsJakub Hrozek2014-05-023-1/+62
| | | | | | | | The sdap_copy_opts function copied all the arguments except for the sentinel. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-24 16:04:08 +0000