summaryrefslogtreecommitdiffstats
path: root/src/providers/ipa/ipa_subdomains_id.c
Commit message (Collapse)AuthorAgeFilesLines
* IPA: search for overrides during initgroups in sever modeSumit Bose2015-05-061-0/+69
| | | | | | | | | | | After the group memberships of a user from a trusted domain are read it must be checked if there are overrides for the discovered groups to be able to return the right gid or name to the caller. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 2263c6dd1242c92253240f4998c86a04b6a0ca3a)
* IPA: do initgroups if extdom exop supports itSumit Bose2015-05-061-7/+17
| | | | | | | | | | | | | | | Newer versions of the extdom plugin return the full list of group-memberships during a user lookup request. With these version there is no need to reject a initgroups request for sub/trusted-domain users anymore. This is e.g. useful for callers which call getgrouplist() directly without calling getpwnam() before. Additionally it helps if for some reasons the lifetime of the user entry and the lifetime of the initgroups data is different. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit e87badc0f6fb20a443cf12bde9582ecbc2aef727)
* IPA: allow initgroups by SID for AD usersSumit Bose2015-04-291-0/+13
| | | | | | | | | | | | If a user from a trusted AD domain is search with the help of an override name the SID from the override anchor is used to search the user in AD. Currently the initgroups request only allows searches by name. With this patch a SID can be used as well. Resolves https://fedorahosted.org/sssd/ticket/2632 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit f70a1adbfc30b9acc302027439fb8157e0c6ea2a)
* AD: use GC for SID requests as wellSumit Bose2015-01-301-0/+1
| | | | | | | | | | If a universal group is looked up by SID the cross-domain members must be resolved with the help of the Global Catalog. Related to https://fedorahosted.org/sssd/ticket/2514 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 561ed2fd03bab04cfdddbc09c4b48563c9d9b87e)
* IPA: resolve IPA group-memberships for AD usersSumit Bose2015-01-261-2/+42
| | | | | | | | | | | | | | | | So far only for initgroups requests the IPA group memberships where resolved for AD users and due to 6fac5e5f0c54a0f92872ce1450606cfcb577a920 those memberships are not overridden by other request. But it turned out that the originalMemberOf attributes related to the IPA group memberships can be overridden by user lookups. Since the originalMemberOf attribute is important in the HBAC evaluation this patch makes sure that the originalMemberOf attribute is not removed but updated during user lookups. Related to https://fedorahosted.org/sssd/ticket/2560 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 63748c69a2c6785d949c82f94749704e0408e5a7)
* IPA: resolve ghost members if a non-default view is appliedSumit Bose2015-01-131-0/+1
| | | | | | | Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 765d9075bb1e10ae0f09b6c2701bfd50aeb423d4)
* IPA: check overrrides for IPA users as wellSumit Bose2014-11-201-2/+14
| | | | | | | | | Currently overrides were only available for sub-domains, e.g. trusted AD domains. With this patch overrides can be used for IPA users as well. Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: make get_object_from_cache() publicSumit Bose2014-11-201-4/+5
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Rename user_dom into obj_domJakub Hrozek2014-10-301-12/+12
| | | | | | | | There was a variable in the IPA subdomain code named user_dom, however, it was used in code that processes both users and groups, which was confusing. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: Don't fail the request when BE doesn't find the objectJakub Hrozek2014-10-301-4/+6
| | | | | | | | The IPA subdomain code treated ENOENT as a fatal error, which resulted in a loud error message and the whole request being aborted. This patch ignores ENOENT. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* ipa: fix issues with older servers not supporting viewsSumit Bose2014-10-221-1/+3
| | | | | | | | | Older FreeIPA servers which do not know about the ipaAssignedIDView attribute will return an error during the LDAP dereference request because SSSD marks LDAP extensions as critical. In this case we keep the view name empty and skip override lookups. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* views: search overrides for user and group requestsSumit Bose2014-10-161-37/+352
| | | | | | | | | | | | | | | | | | | | | | | | | If the name or the POSIX ID of a user or a group is overridden the search request for those objects have to check the overide objects first before looking up the original objects. This patch adds a new request for the IPA sub-domain users which checks the overrides first if - SSSD is running in ipa-server-mode and a name or a POSIX ID is searched, since we do not override the SIDs we can skip the search in the override tree here - if the responder indicates it has not found the corresponding object in the cache and the input might be an override name or ID and not the original one of an object. If an override object was found the SID is extracted from the anchor attribute and the original object is search by its SID. If no override object was found the original object is search with the original input and finally it is checked if an override object exits for the found object. Relates to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* views: get overrides during user and group lookupsSumit Bose2014-10-161-43/+215
| | | | | | | | | | | | | | With this patch the IPA provider will check if overrides exists for the given view during the lookup of users and groups from trusted domains. In ipa-server-mode the default view is automatically applied and written to the cache. On IPA clients which use the extdom plugin for user and group lookups the override data is saved separately and the original object and the override data are linked with DN attributes for faster reference. Related to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: make IPA ID context available to extdom client codeSumit Bose2014-10-161-2/+5
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Use GC for group lookups in server modeJakub Hrozek2014-09-251-5/+9
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2412 Even though AD trusts often work with POSIX attributes which are normally not replicated to GC, our group lookups are smart since commit 008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using the LDAP connection and only use the GC connection to look up the members. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: handle searches by SID in apply_subdomain_homedirJakub Hrozek2014-08-191-4/+9
| | | | | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2391 apply_subdomain_homedir() didn't handle the situation where an entity that doesn't match was requested from the cache. For user and group lookups this wasn't a problem because the negative match was caught sooner. But SID lookups can match either user or group. When a group SID was requested, the preceding LDAP request matched the SID and stored the group in the cache. Then apply_subdomain_homedir() only tried to search user by SID, didn't find the entry and accessed a NULL pointer. A simple reproducer is: $ python >>> import pysss_nss_idmap >>> pysss_nss_idmap.getnamebysid(group_sid) The group_sid can be anything, including Domain Users (XXX-513) Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: rename find_subdomain_by_namePavel Reichl2014-07-221-5/+5
| | | | | | | | | The function was named "find_subdomain" yet it could find both main domain and subdomain. sed 's/find_subdomain_by_name/find_domain_by_name/' -i `find . -name "*.[ch]"` Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: Add option to expand homedir template formatLukas Slebodnik2014-06-021-0/+1
| | | | | | | | | LDAP server can contain template for home directory instead of plain string. This patch adds new expand option "%H", which will be replaced with value from configuration option homedir_substring (from sssd.conf) Resolves: https://fedorahosted.org/sssd/ticket/1853
* NSS: Refactor expand_homedir_templateLukas Slebodnik2014-06-021-9/+14
| | | | | | | | Function expand_homedir_template had lot of parameters. After adding new expand option, all function call should be rewritten, (usually argument NULL will be added) This patch wraps all necessary arguments to structure.
* ipa subdomains provider: make sure search by SID works for homedirAlexander Bokovoy2014-05-211-5/+15
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Use GC for AD initgroup requestsSumit Bose2014-03-101-6/+15
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ipa-server-mode: use lower-case user name for home dirSumit Bose2014-03-031-1/+10
| | | | | | | | | | | In older IPA server versions where the AD users where looked up by winbind the user name component of the home directory path was always lower case. This still holds for IPA clients as well. To avoid regression this patch makes the user name component lower case as well. Fixes https://fedorahosted.org/sssd/ticket/2263 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Don't fail if apply_subdomain_homedir returns ENOENTJakub Hrozek2014-02-201-1/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: Don't call tevent_req_post outside _sendJakub Hrozek2014-02-201-1/+0
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-31/+31
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* LDAP: Detect the presence of POSIX attributesJakub Hrozek2014-02-121-1/+1
| | | | | | | | | | | | | | | | | | | When the schema is set to AD and ID mapping is not used, there is a one-time check ran when searching for users to detect the presence of POSIX attributes in LDAP. If this check fails, the search fails as if no entry was found and returns a special error code. The sdap_server_opts structure is filled every time a client connects to a server so the posix check boolean is reset to false again on connecting to the server. It might be better to move the check to where the rootDSE is retrieved, but the check depends on several features that are not known to the code that retrieves the rootDSE (or the connection code for example) such as what the attribute mappings are or the authentication method that should be used. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD: support for subdomain_homedirPavel Reichl2014-02-051-0/+190
| | | | | | | Homedir is defaultly set accordingly to subdomain_homedir for users from AD. Resolves: https://fedorahosted.org/sssd/ticket/2169
* ipa-server-mode: add IPA group memberships to AD usersSumit Bose2013-08-281-8/+65
| | | | | | | | | | | | | | | | When IPA trusts an AD domain the AD user or groups can be placed into IPA groups e.g. to put AD users under the control of HBAC. Since IPA group can only have members from the IPA directory tree and the AD users and groups are not stored there a special IPA object called external group was introduced. SIDs of users and groups can be added to the external group and since the external groups are in the IPA directory tree they can be member of IPA groups. To speed things up and to remove some load from the IPA servers SSSD reads all external groups and stores them in memory for some time before rereading the data. Enhances https://fedorahosted.org/sssd/ticket/1962
* Fix possible dereference of a NULL pointer.Lukas Slebodnik2013-07-231-1/+1
| | | | | | We check if function ipa_get_ad_id_ctx returns NULL, but function ipa_get_ad_id_ctx could never return NULL. This issue was found by scan-build.
* IPA: Look up AD users directly if IPA server mode is onJakub Hrozek2013-06-281-0/+126
| | | | | | | | https://fedorahosted.org/sssd/ticket/1962 If the ipa_server_mode is selected IPA subdomain user and group lookups are not done with the help of the extdom plugin but directly against AD using the AD ID code.
* Replace new_subdomain() with find_subdomain_by_name()Sumit Bose2013-06-281-5/+3
| | | | | | new_subdomain() will create a new domain object and should not be used anymore in the priovder code directly. Instead a reference to the domain from the common domain object should be used.
* LDAP: sdap_id_ctx might contain several connectionsJakub Hrozek2013-06-071-1/+1
| | | | | | | | | | | | | | | | | | | With some LDAP server implementations, one server might provide different "views" of the identites on different ports. One example is the Active Directory Global catalog. The provider would contact different view depending on which operation it is performing and against which SSSD domain. At the same time, these views run on the same server, which means the same server options, enumeration, cleanup or Kerberos service should be used. So instead of using several different failover ports or several instances of sdap_id_ctx, this patch introduces a new "struct sdap_id_conn_ctx" that contains the connection cache to the particular view and an instance of "struct sdap_options" that contains the URI. No functional changes are present in this patch, currently all providers use a single connection. Multiple connections will be used later in the upcoming patches.
* Add SID related lookups to IPA subdomainsSumit Bose2013-05-031-0/+11
| | | | | This patch add the functionality to handle lookup by SIDs and lookups for SIDs to the subdomain branch of the IPA ID provider.
* Use struct to hold different types of request parametersSumit Bose2013-05-021-7/+18
| | | | | | | Currently the POSIX ID or the user name are passed in different parameters to some calls. The method will get cumbersome and error-prone if new parameters like, e.g. the SID, are added. This patch adds a union to hold the different kind of parameters.
* Remove unused attribute listSumit Bose2013-05-021-10/+1
|
* Add realm info to sss_domain_infoSimo Sorce2013-02-101-2/+3
|
* Use an entry type mask macro to filter entry typesSimo Sorce2012-12-041-1/+1
| | | | | Avoids hardcoding magic numbers everywhere and self documents why a mask is being applied.
* Fix ipa_subdomain_id names and tevent_req styleSimo Sorce2012-12-041-44/+29
|
* Clarify debug message about initgroups and subdomainsSumit Bose2012-11-081-0/+7
| | | | | | | | | | | | | | | | The initgroups request is not handled by the IPA provider for subdomain users on purpose because the group membership information is not available on the IPA server but will be directly written to the cache when the PAC of the user is processed. The old generic debug message "Invalid sub-domain request type" might be misleading. This patch adds a specific message for the initgroups case "Initgroups requests are not handled by the IPA provider but are resolved by the responder directly from the cache." and increase the debug level so that typically this message is not shown anymore because it is expected behaviour. Fixes https://fedorahosted.org/sssd/ticket/1610
* Allow extdom exop to return flat domain name as wellSumit Bose2012-10-121-1/+3
| | | | | | | | There are case where the extdom extended operation will return the flat or NetBIOS name of a domain instead of the DNS domain name. If this name is available for the current domain we accept it as well. Related to https://fedorahosted.org/sssd/ticket/1561
* Add support for filtering atributesJan Zeleny2012-05-311-2/+4
| | | | | This patch adds support for filtering attributes when constructing attribute list from a map for LDAP query.
* LDAP: Add attr_count return value to build_attrs_from_map()Stephen Gallagher2012-05-101-2/+2
| | | | | | | This is necessary because in several places in the code, we are appending to the attrs returned from this value, and if we relied on the map size macro, we would be appending after the NULL terminator if one or more attributes were defined as NULL.
* Add ID operations in subdomainsJan Zeleny2012-04-241-0/+240
generated by cgit (git 2.34.1) at 2024-06-13 05:26:17 +0000