summaryrefslogtreecommitdiffstats
path: root/src/providers/data_provider.h
Commit message (Collapse)AuthorAgeFilesLines
* DATA_PROVIDER: BE_REQ as string in log messagePetr Cech2015-09-141-16/+1
| | | | | | | | | | | | | | | | | Add be_req2str() for translation BE_REQ to string. So we will have || Got request for [0x1001][FAST BE_REQ_USER][1][name=celestian] instead of || Got request for [0x1001][1][name=celestian] Function be_req2str() is used in data provider and in responder too. So this patch create new header file data_provider_req.h which delivers function be_req2str() and definitions of BE_REQ_*. Resolves: https://fedorahosted.org/sssd/ticket/2708 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* DP: Add DP_WILDCARD and SSS_DP_WILDCARD_USER/SSS_DP_WILDCARD_GROUPJakub Hrozek2015-07-151-0/+4
| | | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Extends the Data Provider interface and the responder<->Data provider interface with wildcard lookups. The patch uses a new "wildcard" prefix rather than reusing the existing user/group prefixes. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP/IPA: add user lookup by certificateSumit Bose2015-06-191-1/+5
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Add a function to inherit DP options, if setJakub Hrozek2015-06-051-0/+5
| | | | | | | | | | | Related to: https://fedorahosted.org/sssd/ticket/2644 Adds a utility function that checks if a DP option is present in the subdomain_inherit list. If it is, then the option is set from source to destination dp_option array. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: allow initgroups by UUID for FreeIPA usersSumit Bose2015-05-061-1/+0
| | | | | | | | | | | If a FreeIPA user is searched with the help of an override name the UUID from the override anchor is used to search the user. Currently the initgroups request only allows searches by SID or name. With this patch a UUID can be used as well. Related to https://fedorahosted.org/sssd/ticket/2642 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: allow initgroups by SID for AD usersSumit Bose2015-04-291-0/+1
| | | | | | | | | | | If a user from a trusted AD domain is search with the help of an override name the SID from the override anchor is used to search the user in AD. Currently the initgroups request only allows searches by name. With this patch a SID can be used as well. Resolves https://fedorahosted.org/sssd/ticket/2632 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: add support for lookups by UUIDSumit Bose2014-11-201-0/+2
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* views: search overrides for user and group requestsSumit Bose2014-10-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | If the name or the POSIX ID of a user or a group is overridden the search request for those objects have to check the overide objects first before looking up the original objects. This patch adds a new request for the IPA sub-domain users which checks the overrides first if - SSSD is running in ipa-server-mode and a name or a POSIX ID is searched, since we do not override the SIDs we can skip the search in the override tree here - if the responder indicates it has not found the corresponding object in the cache and the input might be an override name or ID and not the original one of an object. If an override object was found the SID is extracted from the anchor attribute and the original object is search by its SID. If no override object was found the original object is search with the original input and finally it is checked if an override object exits for the found object. Relates to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* PAM: Add domains= option to pam_sssDaniel Gollub2014-09-291-0/+1
| | | | | | | | | | | | | | Design document: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Fixes: https://fedorahosted.org/sssd/ticket/1021 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Sven-Thorsten Dietrich <sven@brocade.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM, NSS: allow UPN login namesSumit Bose2014-09-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | With this patch the NSS and PAM responders can handle user principal names besides the fully qualified user names. User principal names are build from a user name and a domain suffix separated by an '@' sign. But the domain suffix does not necessarily has to be the same as the configured domain name in sssd.conf of the dynamically discovered DNS domain name of a domain. The typical use case is an Active Directory forest with lots of different domains. To not force the users to remember the name of the individual domain they belong to the AD administrator can set a common domain suffix for all users from all domains in the forest. This is typically the domain name used for emails to make it even more easy to the users to remember it. Since SSSD splits name and domain part at the '@' sign and the common domain suffix might not be resolvable by DNS or the given user is not a member of that domain (e.g. in the case where the forest root is used as common domain suffix) SSSD might fail to look up the user. With this patch the NSS and PAM responder will do an extra lookup for a UPN if the domain part of the given name is not known or the user was not found and the login name contained the '@' sign. Resolves https://fedorahosted.org/sssd/ticket/1749
* PAM: extract checks from parsing routinesSumit Bose2014-09-011-0/+1
| | | | | | | | | This patch saves the original name given at a login prompt and send to the PAM responder in the logon_name member of the pam_data struct for later use. Additionally it separates the parsing of the data send by the PAM client and the checks of this data.
* LDAP: If extra_value is 'U' do a UPN searchSumit Bose2014-09-011-0/+2
| | | | | | | | | | | Besides the name the responders always send an extra string attribute to the backends which is so far mostly empty. Since the only difference in the processing of a request for a user name or a user principal name is a different search attribute in the LDAP provider this extra value can be used to indicate the type of the name. Providers which do not support UPN lookup can just ignore this attribute. Related to https://fedorahosted.org/sssd/ticket/1749
* DP: Provide separate dp_copy_defaults functionJakub Hrozek2014-02-261-0/+5
| | | | | | https://fedorahosted.org/sssd/ticket/2257 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sbus: Use constants to make dbus callsStef Walter2014-02-241-17/+0
| | | | | | | | | | | This allows us to remove duplicated information, and have the compiler check that when an method name is changed or removed the callers are updated. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* sbus: Rework sbus to use interface metadata and vtablesStef Walter2014-02-241-0/+1
| | | | | | | | | | | | | | | | | | | | Previous commits added support for interface metadata and handler vtables. This commit ports sbus_dbus_connection to use them. Port the internal uses of dbus to use the new scheme in a very minimal way. Further cleanup is possible here. This commit provides basic definitions of the internal dbus interfaces. The interfaces aren't fully defined, as the handlers will continue to unpack manually, and often overload DBus methods with different arguments (which is rather unorthodox, but not the end of the world). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* nss: Stop using one DBus interface with totally different methodsStef Walter2014-02-241-0/+1
| | | | | | | | | | | | | | | This is an incorrect use of DBus, where we use a single interface name with completely different sets of methods. Easily fixed. Once the vtable stuff is in use then this would be automatically detected and fail to build. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Remove DEBUG macro support for old debug levelsNikolai Kondrashov2014-02-121-1/+1
| | | | | | | | | | | | | | Remove support for specifying old debug levels to the DEBUG macro: * remove debug_get_level function which was used for conversion, * remove debug_get_level tests, * remove mentions of old/new levels from DEBUG and DEBUG_IS_SET macro descriptions, * rename "newlevel" argument of debug_fn to just "level". Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Include external headers with #include <foo.h>Jakub Hrozek2013-10-221-4/+5
| | | | | | I find it more readable to include headers from outside the sssd tree with <foo.h>, not "foo.h". The latter should be used for in-tree headers only.
* Add two new request types to the data-provider interfaceSumit Bose2013-05-021-0/+2
| | | | | | | The patch adds two new request types for SID related requests. The first one is used if a SID is given and the corresponding object should be found. The second one can be used if the SID for an object is requested but it is not clear if the object is a user or a group.
* Add secid filter to responder-dp protocolSumit Bose2013-05-021-0/+6
| | | | | This patch add a new filter type to the data-provider interface which can be used for SID-based lookups.
* Init failover with be_res optionsJakub Hrozek2013-04-031-0/+12
|
* Making the authtok structure really opaque.Lukas Slebodnik2013-04-021-2/+2
| | | | | | | | | | | | | | | | | | | | Definition of structure sss_auth_token was removed from header file authtok.h and there left only declaration of this structure. Therefore only way how to use this structure is to use accessory function from same header file. To creating new empty authotok can only be used newly created function sss_authtok_new(). TALLOC context was removed from copy and setter functions, because pointer to stuct sss_auth_token is used as a memory context. All declaration of struct sss_auth_token variables was replaced with pointer to this structure and related changes was made in source code. Function copy_pam_data can copy from argument src which was dynamically allocated with function create_pam_data() or zero initialized struct pam_data allocated on stack. https://fedorahosted.org/sssd/ticket/1830
* Reusing create_pam_data() on the other places.Lukas Slebodnik2013-04-021-0/+12
| | | | | | Function create_pam_data() should be only one way how to create new struct pam_data, because it also initialize destructor to created object.
* Change pam data auth tokens.Simo Sorce2013-01-101-6/+3
| | | | Use the new authtok abstraction and interfaces throught the code.
* Hook for mmap cache update on initgroup callsSimo Sorce2012-12-051-0/+1
| | | | | This set of functions enumerate the user's groups and invalidate them all if the list does not matches what we get from the caller.
* Hook to perform a mmap cache update from sssd_nssSimo Sorce2012-12-051-0/+6
| | | | | This set of functions enumerate each user/group from all domains and invalidate any mmap cache record that matches.
* Use an entry type mask macro to filter entry typesSimo Sorce2012-12-041-0/+1
| | | | | Avoids hardcoding magic numbers everywhere and self documents why a mask is being applied.
* krb5_child: send back the client principalSumit Bose2012-10-261-0/+1
| | | | | | | | | | | | | In general Kerberos is case sensitive but the KDC of Active Directory typically handles request case in-sensitive. In the case where we guess a user principal by combining the user name and the realm and are not sure about the cases of the letters used in the user name we might get a valid ticket from the AD KDC but are not able to access it with the Kerberos client library because we assume a wrong case. The client principal in the returned credentials will always have the right cases. To be able to update the cache user principal name the krb5_child will return the principal for further processing.
* sudo: clean upPavel Březina2012-06-291-5/+2
|
* sudo ldap provider: add support for on demand refresh of specific rulesPavel Březina2012-06-291-0/+1
|
* sudo ldap provider: add support for on demand full refreshPavel Březina2012-06-291-0/+1
|
* data provider: added subdomainsSumit Bose2012-04-241-2/+0
|
* Responder part of the subdomain retrieval workJan Zeleny2012-04-241-0/+1
|
* Add terminator for dp_optionStephen Gallagher2012-03-281-0/+2
|
* DP: Add host info handlerJan Cholasta2012-02-071-1/+3
|
* AUTOFS: responderJakub Hrozek2012-02-051-0/+1
|
* AUTOFS: Data Provider requestJakub Hrozek2012-02-051-0/+1
|
* SUDO Integration - prepare data provider for new responder commandsPavel Březina2012-01-271-7/+9
| | | | https://fedorahosted.org/sssd/ticket/1143
* SUDO: Provide a sudo DP request based on the internal_reqJakub Hrozek2012-01-271-0/+1
|
* DP: Add support for services in dp requestsStephen Gallagher2012-01-271-0/+1
|
* SUDO integration - data provider backend handlerPavel Březina2011-12-161-0/+1
|
* Multiline macro cleanupJakub Hrozek2011-09-281-1/+1
| | | | | | | | | | This is mostly a cosmetic patch. The purpose of wrapping a multi-line macro in a do { } while(0) is to make the macro usable as a regular statement, not a compound statement. When the while(0) is terminated with a semicolon, the do { } while(0); block becomes a compound statement again.
* New DEBUG facility - conversionPavel Březina2011-08-251-1/+1
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/925 Conversion of the old debug_level format to the new one. (only where it was necessary) Removed: SSS_DEFAULT_DEBUG_LEVEL (completely replaced with SSSDBG_DEFAULT)
* Remove unused constants from data_provider.hJakub Hrozek2011-05-061-11/+0
|
* Remove unused be_check_online() SBUS callJan Zeleny2011-03-081-1/+0
|
* Add support for server-side pam response messagesSumit Bose2010-12-031-0/+8
|
* Add a special filter type to handle enumerationsSumit Bose2010-12-021-0/+1
|
* Introduce pam_verbosity config optionSumit Bose2010-11-151-0/+1
| | | | | | | | | | | Currently we display all PAM messages generated by sssd to the user. But only some of them are important and others are just some useful information. This patch introduces a new option to the PAM responder which controls what kind of messages are displayed. As an example the 'Authenticated with cached credentials' message is used. This message is only displayed if pam_verbosity=1 or if there is an expire date.
* Add netgroup support to the NSS responderStephen Gallagher2010-10-131-0/+1
|
* Copy pam data from DBus messageSumit Bose2010-05-271-2/+2
| | | | | | | | Instead of just using references to the pam data inside of the DBus message the data is copied. New the DBus message can be freed at any time and the pam data is part of the memory hierarchy. Additionally it is possible to overwrite the authentication tokens in the DBus message, because it is not used elsewhere.
generated by cgit (git 2.34.1) at 2024-06-07 07:30:40 +0000