summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* IFP: Add GetUserAttrs callJakub Hrozek2014-05-136-0/+597
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds a DBus method that allows the caller to retrieve attributes of a user. The synopsis of the call is as follows: <method name="GetUserAttr"> <arg type="s" name="user" direction="in"/> <arg type="as" name="attr" direction="in"/> <arg type="a{sv}" name="values" direction="out"/> </method> The return value is an array (one attribute per array member) of dictionaries. The key of the dictionary is the attribute name, the value is a variant containing the attribute values as strings. If an attribute does not exist or is not permitted to be read, no error is returned. If the users does not exist, the method returns an error. In future patches this function will be marked as obsolete in favor of object-oriented approach. ifp_user_get_attr_unpack_msg is a separate function to allow extending it in a later patch. The function to check the cache validity duplicates quite a bit of code with the NSS responder. The refactoring would be nice to get done along with #843. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* IFP: Initialize negative cache timeoutJakub Hrozek2014-05-132-0/+17
| | | | | | | | | | | | | | In order to avoid hitting the back end with repetitive requests, the InfoPipe responder needs a negative cache, too. This patch follows the convention set by other responders, where the negative cache timeouts are read from the [nss] section. This is not ideal, however, and ticket #2318 tracks moving the configuration to the [ifp] section primarily. The timeout is also a separate parameter in the NSS context. We should consider moving it to the negcache context instead (#2317). Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* IFP: use a list of allowed_uids for authenticationJakub Hrozek2014-05-139-6/+159
| | | | | | | | Similar to the PAC responder, the InfoPipe uses a list of UIDs that are allowed to communicate with the IFP responder. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* IFP: Add utility functionsJakub Hrozek2014-05-134-1/+381
| | | | | | | | | | | | | Adds a number of utility functions, most importanly ifp_req_create(). The ifp_req is a structure that will be passed along with the ifp request and would provide easy access to both the sbus_request data and per-responder data, like the ifp_ctx. Also includes a utility function to split a path prefix from a full path and add a ldb_element into a dictionary. These will be reused later. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Refactor sbus_message_handler to retrieve caller IDJakub Hrozek2014-05-131-55/+111
| | | | | | | | | | | | | | | | sbus_message_handler() is refactored so that it only verifies the message matches any of the interfaces SSSD listens on in order to be able to return either of HANDLED or NOT_YET_HANDLED. If the interface is one of those the SSSD should handle, the caller ID is first resolved using sbus_get_sender_id_send and only then passed on to the appropriate special handler. If the sernder ID can't be retrieved, the message is dropped with an error. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Add an async request to retrieve the caller IDJakub Hrozek2014-05-138-0/+515
| | | | | | | | | | | | | | | | | Adds an async request sbus_get_sender_id_{send,recv} that allows retrieval of UID based on "sender" as returned by dbus_message_get_sender(). The UID is an int64_t to be able to use "-1" to as a fallback value for uknown or error cases. The unit test is added as a standalone one, not part of the sbus_tests because the request, and by extension the unit test relies on being connected to the system bus, which is very unlikely to work in a build system. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Add SBUS_CONN_TYPE_SYSBUSJakub Hrozek2014-05-133-4/+7
| | | | | | | | | We need to retrieve caller IDs for each call from the system bus. This commit adds a new SBUS connection type that identifies system bus connection. The connection is used in the IFP provider. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Split out dbus_conn_sendJakub Hrozek2014-05-132-22/+45
| | | | | | | | | | Split dbus_conn_send out of sbus_conn_send to be able to call DBus messages without having a full sbus connection. This function is available to the sbus code only, consumers of sbus (responders and providers) should use sbus_conn_send. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Add a convenience function sbus_error_newJakub Hrozek2014-05-133-0/+75
| | | | | | | | | Adds a convenience function that constructs a DBusError on top of a talloc context and as such can be used to mark an sbus request as failed without having to create a DBusError instance by the caller. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: Fix error handling conditionJakub Hrozek2014-05-131-1/+2
| | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* SBUS: several trivial style fixesJakub Hrozek2014-05-133-6/+9
| | | | | | | | | | In SSSD we tend to use {} brackets around single-line blocks, too to make sure we don't forget to add them should the block become larger. We also don't add a space between function name and the opening "(". Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Stef Walter <stefw@redhat.com>
* LDAP: Check the LDAP handle before using itJakub Hrozek2014-05-121-0/+13
| | | | | | | | | | As the connection code is async-driven, the LDAP handle might be invalidated before SSSD attempts to use it. Similar to commit 5fe6ca5e339fd345119752e996c14edf8db57660, this patch adds a NULL check for the LDAP handle and aborts the request instead of crashing. Resolves: https://fedorahosted.org/sssd/ticket/2305
* ipa_selinux: Put SELinux map order related variables into structureMichal Zidek2014-05-121-31/+37
| | | | | | | | | | | Small change to make the code more readable. The relation between order, order_array and order_count is more obvious when they are grouped in structure. resolves: https://fedorahosted.org/sssd/ticket/2304 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MONITOR: Fix start up with empty standard inputLukas Slebodnik2014-05-121-0/+3
| | | | | | | | | | | | The monitor process does not read data from standard input in. We can close file descriptor from stdin. [sssd] [server_stdin_handler] (0x0020): sssd: EOF on stdin - terminating Resolves: https://fedorahosted.org/sssd/ticket/2312 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Use constant instead of value for stdin.Lukas Slebodnik2014-05-121-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TEST: Link ipa_ldap_opt test with openldap libsLukas Slebodnik2014-05-061-0/+1
| | | | | | | | | | | | | | | | | | | | The test ipa_ldap_opt has undefined symbols from libldap and liblber, but it was not directly linked with openldap libraries. sh-4.2$ nm --undefined-only .libs/ipa_ldap_opt-tests | grep -E "ldap|ber" U ber_free U ldap_err2string It causes linker failure on systems with disabled link_all_deplibs (debian) /usr/bin/ld: src/providers/ldap/ipa_ldap_opt_tests-sdap.o: undefined reference to symbol 'ber_free' /usr/bin/ld: note: 'ber_free' is defined in DSO /lib64/liblber-2.4.so.2 so try adding it to the linker command line /lib64/liblber-2.4.so.2: could not read symbols: Invalid operation clang: error: linker command failed with exit code 1 (use -v to see invocation) Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Close memstream handle in introspect destructorJakub Hrozek2014-05-061-0/+4
| | | | | | | There was a resource leak in the introspection code. This patch fixes the leak. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SPEC: Remove duplicate sssd_ifp.Lukas Slebodnik2014-05-021-1/+0
| | | | | | | | | | | | | | | | | | | | The file sssd_ifp was installed by two subpackages: sssd-common and sssd-dbus I din't have instaled file org.freedesktop.sssd.infopipe.conf, because it is in package sssd-dbus. Missing conf file caused problem with starting the ifp service. [sssd] [monitor_service_init] (0x0400): Initializing D-BUS Service [sssd] [mt_svc_exit_handler] (0x0040): Child [ifp] exited with code [3] [sssd] [mt_svc_exit_handler] (0x0010): Process [ifp], definitely stopped! [sssd[ifp]] [sysbus_init] (0x0040): DBus error message: Connection ":1.522" is not allowed to own the service "org.freedesktop.sssd.infopipe" due to security policies in the configuration file [sssd[ifp]] [ifp_process_init] (0x0020): Failed to connect to the system message bus [sssd[ifp]] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Make LDAP extra attributes available to IPA and ADSumit Bose2014-05-027-48/+61
| | | | | | | https://fedorahosted.org/sssd/ticket/2073 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Make it possible to extend an attribute mapJakub Hrozek2014-05-0222-15/+383
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2073 This commit adds a new option ldap_user_extra_attrs that is unset by default. When set, the option contains a list of LDAP attributes the LDAP provider would download and store in addition to the usual set. The list can either contain LDAP attribute names only, or colon-separated tuples of LDAP attribute and SSSD cache attribute name. In case only LDAP attribute name is specified, the attribute is saved to the cache verbatim. Using a custom SSSD attribute name might be required by environments that configure several SSSD domains with different LDAP schemas. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Fix off-by-one bug in sdap_copy_optsJakub Hrozek2014-05-023-1/+62
| | | | | | | | The sdap_copy_opts function copied all the arguments except for the sentinel. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD Provider: bugfix use-after-freePavel Reichl2014-04-301-2/+7
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2322 Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD Provider: bug-fix uninitialized variablePavel Reichl2014-04-301-1/+2
| | | | | | ad_subdomains_refresh() always set value to output parameter 'changes' if EOK is returned. Reviewed-by: Sumit Bose <sbose@redhat.com>
* CRYPTO: Fix access to uninitialized dataLukas Slebodnik2014-04-282-4/+12
| | | | | | | | | | | | | | | | The size of output buffer(obufsize) was longer than initialised data. In calculation, uint32_t was used for length of the cryptotext, but uint16_t was written into buffer. The end of buffer was not initialised and it caused valgrind warning. Use of uninitialised value of size 8 at 0x37AE40F363: pl_base64_encode_buffer (nssb64e.c:180) by 0x37AE40F6ED: NSSBase64_EncodeItem_Util (nssb64e.c:482) by 0x37AE40F87A: BTOA_DataToAscii_Util (nssb64e.c:721) by 0x40208A: sss_base64_encode (nss_base64.c:47) by 0x403305: sss_password_encrypt (nss_obfuscate.c:358) Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* util: Fix 'wrong mode' debug messagePavel Reichl2014-04-281-2/+3
| | | | Reviewed-by: Simo Sorce <simo@redhat.com>
* Monitor: fix message wrong perm. mode on config filePavel Reichl2014-04-281-2/+2
| | | | | | | Change description of supported access modes. Add missing new line in message. Reviewed-by: Simo Sorce <simo@redhat.com>
* confdb: Change file checks for config fileSimo Sorce2014-04-281-3/+4
| | | | | | | | | | | | | | We only really care that the file is readable by the owner and not accessible by group or others. We do not really care whether the owner can write/execute the file or not, so we mask out those perms. Resolves: https://bugzilla.redhat.com/1089098 Resolves: https://fedorahosted.org/sssd/ticket/2321 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* util: Change file check fns to use a mode maskSimo Sorce2014-04-288-89/+60
| | | | | | | | | | | | | | | Instead of using a custom way to chck file type, use the system provided macros and a mode mask to decide when we want to check. Additionally a mask also allows us to selectively check permissions. Related: https://bugzilla.redhat.com/1089098 Resolves: https://fedorahosted.org/sssd/ticket/2321 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* mmap: Get errno when unlink failsMichal Zidek2014-04-251-0/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TEST: Some macros aren't defined in older version of check.Lukas Slebodnik2014-04-251-0/+15
| | | | | | | | | | | | | | | | | | | | | src/tests/sbus_codegen_tests-sbus_codegen_tests.o: In function `eject_handler': tests/sbus_codegen_tests.c:229: undefined reference to `ck_assert_uint_eq' tests/sbus_codegen_tests.c:235: undefined reference to `ck_assert_uint_eq' tests/sbus_codegen_tests.c:239: undefined reference to `ck_assert_uint_eq' src/tests/sbus_codegen_tests-sbus_codegen_tests.o: In function `test_marshal_basic_types': src/tests/sbus_codegen_tests.c:446: undefined reference to `ck_assert_uint_eq' src/tests/sbus_codegen_tests.c:449: undefined reference to `ck_assert_uint_eq' src/tests/sbus_codegen_tests-sbus_codegen_tests.o: src/tests/sbus_codegen_tests.c:451: more undefined references to `ck_assert_uint_eq' follow collect2: ld returned 1 exit status make[3]: *** [sbus_codegen_tests] Error 1 Macro ck_assert_uint_eq was added in check-0.9.10 Resolves: https://fedorahosted.org/sssd/ticket/2319 Reviewed-by: Michal Židek <mzidek@redhat.com>
* KRB5: Print a verbose error message on failure reading the keytabJakub Hrozek2014-04-231-0/+6
| | | | | | | | | | | | krb5_kt_resolve() returns 0 when a non-existent keytab is read, which means there was no FATAL-level DEBUG message printed to the user in case the keytab was missing completely and users had to enable more verbose debugging to diagnose failure to start up. This patch adds both the verbose DEBUG message as well as a syslog message. Reviewed-by: Michal Židek <mzidek@redhat.com>
* RESPONDERS: Add a new request sss_parse_inp_sendJakub Hrozek2014-04-228-1/+483
| | | | | | | | | The responders were copying code to parse input and on encountering an uknown domain, send the discover subdomain request. This patch adds a reusable request that can always be called in responders and in case the name can be parsed, just shortcut. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Split a separate common_mock_resp_dp moduleJakub Hrozek2014-04-223-71/+102
| | | | | | | | Splitting the module would allow responders that test the Data Provider requests to use the mock_rctx/mock_cctx functions without duplicate definitions. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Create a default sss_names_ctx in create_dom_test_ctxJakub Hrozek2014-04-222-0/+13
| | | | | | | | This would allow to call create_dom_test_ctx from tests that expect to be able to parse input with a regular expression just like a responder would do with an input from a client. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Remove unused 'force' parameter from the subdomain handlerJakub Hrozek2014-04-222-20/+6
| | | | | | | | | | | | | The force argument was unused and made the code more complex than required. Moreover, the force argument would have made the subdomain handler behave differently than other identity domains -- when the front end decides it's time to update the domains, the back end should just update them. Handling multiple concurrent requests from multiple responders (typically after startup) is handled at the generic back end level (see be_queue_request). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Fix a wrong DEBUG messageJakub Hrozek2014-04-221-2/+1
| | | | | | | Another function decides whether the responder is updating the subdomains or just returning an error code. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* build: List test extensionsNikolai Kondrashov2014-04-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | List test extensions with TEST_EXTENSIONS [1] in Makefile.am to allow applying separate LOG_COMPILER for binary and Python tests. This is needed to avoid running Python tests under Valgrind as that produces too many interpreter-specific errors which are hard to suppress reliably [2]. Thus a run like this would run only binary tests under Valgrind: make check PY_LOG_COMPILER=env LOG_COMPILER=valgrind Or more briefly: make check LOG_COMPILER=valgrind [1] http://www.gnu.org/software/automake/manual/automake.html#index-TEST_005fEXTENSIONS [2] http://svn.python.org/projects/python/trunk/Misc/README.valgrind Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus request: fix error initializationPavel Březina2014-04-191-2/+4
| | | | | | fixes: sssd_dbus_request.c:28:1: error: missing initializer [-Werror=missing-field-initializers] sssd_dbus_request.c:28:1: error: (near initialization for 'error_internal.dummy1') [-Werror=missing-field-initializers]
* sbus_tests: fix missing invoker in initializerPavel Březina2014-04-191-0/+2
|
* sbus_codegen_tests: Add test case type-safe handler argsStef Walter2014-04-195-5/+568
| | | | | | This adds a big test case for invoking a handler with all supported basic arguments, and constructing a reply with the same. Lots of tedious code, but worth it to make sure things work well.
* sbus: Add type-safe DBus method handlers and finish functionsStef Walter2014-04-1919-71/+544
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Type safe method handlers allow methods not to have to do tedious unwrapping and wrapping of DBus method call messages or replies. Arguments of the following DBus types are supported in type-safe method handlers. In addition arrays of these are supported. y: uint8_t b: bool (but no arrays, yet) n: int16_t q: uint16_t i: int32_t u: uint32_t x: int64_t t: uint64_t d: double s: char * (utf8 string) o: char * (object path) As an exception, arrays of booleans are not supported, but could be added later. Other more complex types could be added later if desired. If a method has other argument types, then it must be marked as having a raw handler (see below). Internally each method can have a type specific invoker function which unpacks the incoming arguments and invokes the method handler with the correct arguments. Each method also has a finish which accepts the type-safe out arguments (ie: return values) and builds the reply message. Like other request 'finish' functions, these free the request talloc context, and are to be used in place of sbus_request_finish() or friends. Raw method handlers parse their own method arguments, and prepare their own reply (ideally using sbus_request_finish() helpers). They can also do strange things like have variable arguments. To mark a DBus method as having a raw method handler use the following annotation: <annotation name="org.freedesktop.sssd.RawHandler" value="true"/> Raw methods do not have invokers or finish functions. I've left all of the internal peer to peer communication using raw method handlers. No code changes here.
* SBUS: Create an sbus_method_meta instance for IntrospectionJakub Hrozek2014-04-193-0/+12
| | | | | Also fixes a warning about uninitialized 'method' as the 'method' variable was unused and not set previously when introspecting.
* KRB5: Go offline in case of generic errorPavel Reichl2014-04-171-0/+1
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2313
* Minor fixes for sss_parse_name_for_domainsJakub Hrozek2014-04-171-6/+11
| | | | | | | | | | | | - use brackets after an if - use the right variable name (candidate_domain instead of candidate_name). - fix a typo in a debug message - only print a debug message about using a default domain when using a default domain - add a comment explaning when is a codepath executed Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Add a unit test for sss_parse_name_for_domainsJakub Hrozek2014-04-171-4/+199
| | | | | | | | The code of sss_parse_name_for_domains is really complex and hard to read. This patch adds a unit test to be able to see the function being used. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* ad_access_filter man page typoYassir Elley2014-04-171-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* build: Don't assume systemd implies journaldNikolai Kondrashov2014-04-171-1/+3
| | | | | | | | | | | | | Don't add --with-syslog=journald to extra_distcheck_flags if configured with systemd (--with-initscript=systemd). Add it if configured with journald (--with-syslog=journald) instead. This fixes distcheck target when configured with systemd, but without journald. Don't install journal.conf helping with enabling journald logging, unless configured with journald (--with-syslog=journald), as it would be useless and misleading. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB: do not check ccache directory for GIDPavel Reichl2014-04-171-7/+4
|
* ConfigAPI: Add two missing AD optionsJakub Hrozek2014-04-161-0/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* TEST: Add untested libraries into dlopen testLukas Slebodnik2014-04-161-0/+6
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-27 16:28:22 +0000