summaryrefslogtreecommitdiffstats
path: root/src/providers/ad/ad_subdomains.c
Commit message (Collapse)AuthorAgeFilesLines
* AD: Establish cross-domain memberships after enumeration finishesJakub Hrozek2014-01-291-11/+0
| | | | | | | | | | | | | | | | Because domain enumeration currently works for each domain separately, the code has to establish cross-domain memberships after all domains are enumerated. The code works as follows: 1) check if any *sub*domains were enumerated. If not, do nothing 2) if any of the groups saved had more original members than sysdb members, check if members of these groups can be linked now that all users and groups are saved using the orig_member attribute of the group matched against originalDN member of the user. Related: https://fedorahosted.org/sssd/ticket/2142
* LDAP: Pass a private context to enumeration ptask instead of hardcoded ↵Jakub Hrozek2014-01-291-3/+5
| | | | | | | | | | connection Previously, the sdap-domain enumeration request used a single connection context to download all the data. Now we'd like to use different connections to download different objects, so the ID context is passed in and the request itself decides which connection to use for the sdap-domain enumeration.
* AD: Store info on whether a subdomain is set to enumerateJakub Hrozek2014-01-291-5/+33
| | | | | | Depending on the state of the subdomain_enumerate variable, the newly created subdomain object is created with the right value of "enumerate" attribute in the sysdb.
* responder: Set forest attribute in AD domainsPavel Reichl2014-01-091-3/+6
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2160
* AD: Refresh subdomain data structures on startupJakub Hrozek2013-12-181-17/+32
| | | | | | | | | | Previously, if no changes were done to the list of subdomains, the SSSD didn't update its list of sdap_domain mappings for the new subdomain. This resulted in errors as no id_ctx was present for the subdomain during lookup. This patch moves the block of code performed during update to a function of its own and calls it during provider initialization as well.
* AD: use LDAP for group lookupsSumit Bose2013-12-131-1/+132
| | | | | | | | | | | | | | | | The group memberships cannot be reliable retrieved from the Global Catalog. By default the memberOf attribute is not replicated to the GC at all and the member attribute is copied from the local LDAP instance to the GC running on the same host, but is only replicated to other GC instances for groups with universal scope. Additionally the tokenGroups attribute contains invalid SIDs when used with the GC for users from a different domains than the GC belongs to. As a result the requests which tries to resolve group-memberships of a AD user have to go to a LDAP server from the domain of the user. Fixes https://fedorahosted.org/sssd/ticket/2161 and https://fedorahosted.org/sssd/ticket/2148 as a side-effect.
* SUBDOMAINS: Reuse cached results if DP is offlineJakub Hrozek2013-12-091-0/+7
| | | | | | | | | | If Data Provider was unable to refresh the subdomain list, the sss_domain_info->subdomains list was NULL. Which meant that no DP request matched any known domain and hence offline authentication was not working correctly. Resolves: https://fedorahosted.org/sssd/ticket/2168
* Initialize sid_str to NULL to avoid freeing random dataJakub Hrozek2013-11-081-1/+1
| | | | | If any function before failed, sss_idmap_free_sid() might have been called with random data.
* free idmapped SIDs correctlyPavel Březina2013-11-071-0/+2
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2133
* ad_subdom_store: check ID mapping of the domain not of the parentSumit Bose2013-10-291-2/+2
|
* ad: destroy ptasks when subdomain is removedPavel Březina2013-10-251-0/+3
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/1968
* dp: free sdap domain if subdomain is removedPavel Březina2013-10-251-0/+11
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/1968
* dp: make subdomains refresh interval configurablePavel Březina2013-10-251-4/+4
| | | | | | | | | | This patch makes the refresh of available subdomains configurable. New option: subdomain_refresh_interval (undocumented) Resolves: https://fedorahosted.org/sssd/ticket/1968
* sdap_idmap_domain_has_algorithmic_mapping: add domain name argumentSumit Bose2013-10-251-0/+1
| | | | | | | | | | | | | When libss_idmap was only used to algorithmically map a SID to a POSIX ID a domain SID was strictly necessary and the only information needed to find a domain. With the introduction of external mappings there are cases where a domain SID is not available. Currently we relied on the fact that external mapping was always used as a default if not specific information about the domain was found. The lead to extra CPU cycles and potentially confusing debug messages. Adding the domain name as a search parameter will avoid this.
* AD: talk to GC first even for local domain objectsJakub Hrozek2013-09-271-1/+7
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2070 Since we are recommending to configure the POSIX attributes so that they are replicated to the Global Catalog, we can start connecting to the GC by default even for local users. If the object is not matches in the GC, there is a possibility to fall back to LDAP.
* ipa_server_mode: write capaths to krb5 include fileSumit Bose2013-09-271-1/+1
| | | | | | | | | | | | If there are member domains in a trusted forest which are DNS-wise not proper children of the forest root the IPA KDC needs some help to determine the right authentication path. In general this should be done internally by the IPA KDC but this works requires more effort than letting sssd write the needed data to the include file for krb5.conf. If this functionality is available for the IPA KDC this patch might be removed from the sssd tree. Fixes https://fedorahosted.org/sssd/ticket/2093
* IPA: store forest name for forest member domainsSumit Bose2013-09-271-1/+1
| | | | | In order to fix https://fedorahosted.org/sssd/ticket/2093 the name of the forest must be known for a member domain of the forest.
* AD: Failure to get flat name is not fatalJakub Hrozek2013-09-221-3/+0
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2067 Some AD or AD-like servers do not contain the netlogon attribute in the master domain name. Instead of failing completely, we should just abort the master domain request and carry on. The only functionality we miss would be getting users by domain flat name.
* AD: async request to retrieve master domain infoJakub Hrozek2013-09-181-213/+22
| | | | Adds a reusable async request to download the master domain info.
* util: add sss_idmap_talloc[_free]Pavel Březina2013-09-171-11/+3
| | | | Remove code duplication.
* SYSDB: Store enumerate flag for subdomainJakub Hrozek2013-08-281-2/+2
|
* DB: remove unused realm parameter from sysdb_master_domain_add_infoJakub Hrozek2013-08-281-1/+1
| | | | The parameter was not used at all.
* AD: Move storing sdap_domain for subdomain to generic LDAP codeJakub Hrozek2013-06-281-65/+1
| | | | | | | | Makes creating the sdap_domain structure for a subdomain reusable outside AD subdomain code where it was created initially. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* Save mpg state for subdomainsSumit Bose2013-06-281-1/+3
| | | | | | The information of a subdomain will use magic private groups (mpg) or not will be stored together with other information about the domain in the cache.
* AD: Write out domain-realm mappingsJakub Hrozek2013-06-271-0/+7
| | | | | This patch reuses the code from IPA provider to make sure that domain-realm mappings are written even for AD sub domains.
* Use the correct talloc context when creating AD subdomainsJakub Hrozek2013-06-121-1/+1
| | | | | sdom was only ever guaranteed to be set when a new domain was being created. sditer is a valid pointer in both cases, so just use that.
* AD: Store trusted AD domains as subdomainsJakub Hrozek2013-06-071-2/+364
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/364 Looks up trusted domain objects in the LDAP and stores them as AD subdomains. Currently only trusted domains that run NT5 or newer from the same forest are looked up and stored.
* LDAP: new SDAP domain structureJakub Hrozek2013-06-071-1/+3
| | | | | | | | | | | Previously an sdap_id_ctx was always tied to one domain with a single set of search bases. But with the introduction of Global Catalog lookups, primary domain and subdomains might have different search bases. This patch introduces a new structure sdap_domain that contains an sssd domain or subdomain and a set of search bases. With this patch, there is only one sdap_domain that describes the primary domain.
* LDAP: sdap_id_ctx might contain several connectionsJakub Hrozek2013-06-071-1/+1
| | | | | | | | | | | | | | | | | | | With some LDAP server implementations, one server might provide different "views" of the identites on different ports. One example is the Active Directory Global catalog. The provider would contact different view depending on which operation it is performing and against which SSSD domain. At the same time, these views run on the same server, which means the same server options, enumeration, cleanup or Kerberos service should be used. So instead of using several different failover ports or several instances of sdap_id_ctx, this patch introduces a new "struct sdap_id_conn_ctx" that contains the connection cache to the particular view and an instance of "struct sdap_options" that contains the URI. No functional changes are present in this patch, currently all providers use a single connection. Multiple connections will be used later in the upcoming patches.
* Fix return code for AD subdomain requestSumit Bose2013-05-221-1/+3
|
* Fix segfault in AD Subdomains ModuleLukas Slebodnik2013-05-151-0/+2
| | | | | | In function ad_subdomains_get_netlogon_done: If variable "reply_count" is zero then variable "reply" will not be initialized. Therefore we should not continue.
* AD: read flat name and SID of the AD domainSumit Bose2013-05-071-0/+522
For various features either the flat/short/NetBIOS domain name or the domain SID is needed. Since the responders already try to do a subdomain lookup when and known domain name is encountered I added a subdomain lookup to the AD provider which currently only reads the SID from the base DN and the NetBIOS name from a reply of a LDAP ping. The results are written to the cache to have them available even if SSSD is started in offline mode. Looking up trusted domains can be added later. Since all the needed responder code is already available from the corresponding work for the IPA provider this patch fixes https://fedorahosted.org/sssd/ticket/1468
generated by cgit (git 2.34.1) at 2024-05-19 01:54:14 +0000