summaryrefslogtreecommitdiffstats
path: root/src/providers/ldap/sdap.c
Commit message (Collapse)AuthorAgeFilesLines
* SDAP: Suppress warning maybe-uninitializedLukas Slebodnik2014-10-091-7/+9
| | | | | | | | | | | | | | | | | | There is a warning with some version of gcc (4.9.1, 4.4.7). In my opinion, variable "a" should be initialized every time if "maps" is not NULL. src/providers/ldap/sdap.c: In function 'sdap_parse_entry': src/providers/ldap/sdap.c:481:56: warning: 'a' may be used uninitialized in this function [-Wmaybe-uninitialized] for (ai = a; ai < attrs_num; ai++) { ^ src/providers/ldap/sdap.c:307:9: note: 'a' was declared here int a, i, ret, ai; ^ CCLD libsss_ldap_common.la Reviewed-by: Simo Sorce <simo@redhat.com>
* Use the alternative objectclass in group maps.Michal Zidek2014-09-151-4/+36
| | | | | | | | | Use the alternative group objectclass in queries. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Skip dereferenced entries that we are not permitted to readJakub Hrozek2014-09-081-3/+4
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2421 In case we dereference an entry, for which we have /some/ permissions for reading, but we only request attributes that we can't access, the dereference control only returns the DN. This is also the case with the current version of 389DS for cases where no entries at all are readable. In this case, the server should not return the DN at all, though. This DS bug was tracked as https://fedorahosted.org/389/ticket/47885 Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Fall back to functional level of Windows Server 2003Jakub Hrozek2014-09-011-1/+2
| | | | | | | | | The newest functional level we branch for is currently DS_BEHAVIOR_WIN2003. Therefore (and also because extended support for Windows server 2003 ends in 2015) we can safely set the functional level to 2003 if the attribute is present but not a known value. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Add Windows Server 2012 R2 functional levelJakub Hrozek2014-09-011-0/+1
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2418 According to http://msdn.microsoft.com/en-us/library/cc223272.aspx a Windows Server 2012 R2 has a functional level set to '6'. We need to support that value in order for tokenGroups to be functional. For more information on the functional levels, please refer to: http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels%28v=ws.10%29.aspx Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Free bervals on failure in sdap_parse_entryJakub Hrozek2014-07-081-2/+10
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* SDAP: Remove unused function sdap_get_msg_dnJakub Hrozek2014-07-081-31/+0
| | | | | | | This function was not used since 2009. Unused and untested function would just rot, better to remove it completely. Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Remove unused output parameter _dn from sdap_parse_entryJakub Hrozek2014-07-081-12/+2
| | | | | | | No caller directly accessed this parameter. Moreover, it seemed useless since the same data is available as SYSDB_ORIGINAL_DN in the attributes. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SDAP: Fix DEBUG message priorities in sdap_parse_entryJakub Hrozek2014-07-081-13/+13
| | | | | | | | | While I was changing the sdap_parse_entry function, I also realized that some of the DEBUG messages were converted to the #defines, but their level was still not accurate. This patch fixes the DEBUG levels and indentation around them. Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Try all attributes when saving an entryJakub Hrozek2014-07-081-3/+24
| | | | | | | | | | | | | The same LDAP attribute might be used several times for the same user or group attribute. For instance, some servers have a global "ID" number that should be used for both UID and GID. However, our sdap_parse_entry() function only copied the LDAP attribute to the first matching sysdb attribute. This patch adds a second nested loop that checks if any of the other LDAP attributes are eligible. Reviewed-by: Michal Židek <mzidek@redhat.com>
* Make LDAP extra attributes available to IPA and ADSumit Bose2014-05-021-0/+39
| | | | | | | https://fedorahosted.org/sssd/ticket/2073 Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Make it possible to extend an attribute mapJakub Hrozek2014-05-021-0/+116
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2073 This commit adds a new option ldap_user_extra_attrs that is unset by default. When set, the option contains a list of LDAP attributes the LDAP provider would download and store in addition to the usual set. The list can either contain LDAP attribute names only, or colon-separated tuples of LDAP attribute and SSSD cache attribute name. In case only LDAP attribute name is specified, the attribute is saved to the cache verbatim. Using a custom SSSD attribute name might be required by environments that configure several SSSD domains with different LDAP schemas. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Fix off-by-one bug in sdap_copy_optsJakub Hrozek2014-05-021-1/+4
| | | | | | | | The sdap_copy_opts function copied all the arguments except for the sentinel. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Update DEBUG* invocations to use new levelsNikolai Kondrashov2014-02-121-46/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-90/+90
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* LDAP: Fix typo and use the right attribute mapJakub Hrozek2014-01-081-1/+1
| | | | | | | | https://fedorahosted.org/sssd/ticket/2191 There was a copy-n-paste bug in the code that resulted in using a wrong attribute map. This could lead to the primary name not being selected correctly.
* LDAP: Use primary cn to search netgroupLukas Slebodnik2013-09-201-0/+11
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2075
* LDAP: Use domain-specific name where appropriateJakub Hrozek2013-07-241-0/+51
| | | | | | | | | The subdomain users user FQDN in their name attribute. However, handling of whether to use FQDN in the LDAP code was not really good. This patch introduces a utility function and converts code that was relying on user/group names matching to this utility function. This is a temporary fix until we can refactor the sysdb API in #2011.
* LDAP: Add utility function sdap_copy_mapJakub Hrozek2013-06-281-0/+40
| | | | | | | | | The AD subdomains will only use default options values. This patch introduces a new utility function sdap_copy_map() that copies the default options map. Subtask of: https://fedorahosted.org/sssd/ticket/1962
* LDAP: new SDAP domain structureJakub Hrozek2013-06-071-28/+30
| | | | | | | | | | | Previously an sdap_id_ctx was always tied to one domain with a single set of search bases. But with the introduction of Global Catalog lookups, primary domain and subdomains might have different search bases. This patch introduces a new structure sdap_domain that contains an sssd domain or subdomain and a set of search bases. With this patch, there is only one sdap_domain that describes the primary domain.
* Adding option to disable retrieving large AD groups.Lukas Slebodnik2013-05-231-8/+18
| | | | | | | | | This commit adds new option ldap_disable_range_retrieval with default value FALSE. If this option is enabled, large groups(>1500) will not be retrieved and behaviour will be similar like was before commit ae8d047122c "LDAP: Handle very large Active Directory groups" https://fedorahosted.org/sssd/ticket/1823
* Removing unused functions.Lukas Slebodnik2013-05-231-28/+0
| | | | This patch remove unused functions sdap_parse_user and sdap_parse_group
* LDAP: Always fail if a map can't be foundJakub Hrozek2013-04-091-4/+2
|
* sysdb: try dealing with binary-content attributesJan Engelhardt2013-02-261-5/+3
| | | | | | | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1818 I have here a LDAP user entry which has this attribute loginAllowedTimeMap:: AAAAAAAAAP///38AAP///38AAP///38AAP///38AAP///38AAAAAAAAA In the function sysdb_attrs_add_string(), called from sdap_attrs_add_ldap_attr(), strlen() is called on this blob, which is the wrong thing to do. The result of strlen is then used to populate the .v_length member of a struct ldb_val - and this will set it to zero in this case. (There is also the problem that there may not be a '\0' at all in the blob.) Subsequently, .v_length being 0 makes ldb_modify(), called from sysdb_set_entry_attr(), return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX. End result is that users do not get stored in the sysdb, and programs like `id` or `getent ...` show incomplete information. The bug was encountered with sssd-1.8.5. sssd-1.5.11 seemed to behave fine, but that may not mean that is the absolute lower boundary of introduction of the problem.
* AD: replace GID/UID, do not add another oneJakub Hrozek2013-01-091-0/+31
| | | | | | | The code would call sysdb_attrs_add_uint32 which added another UID or GID to the ID=0 we already downloaded from LDAP (0 is the default value) when ID-mapping an entry. This led to funky behaviour later on when we wanted to process the ID.
* LDAP: Check validity of naming_contextJakub Hrozek2012-10-151-1/+1
| | | | | | | https://fedorahosted.org/sssd/ticket/1581 If the namingContext attribute had no values or multiple values, then our code would dereference a NULL pointer.
* LDAP: Handle empty namingContexts values safelyStephen Gallagher2012-09-261-0/+8
| | | | | | | | Certain LDAP servers can return an empty string as the value of namingContexts. We need to treat these as NULL so that we can fail gracefully. https://fedorahosted.org/sssd/ticket/1542
* AD: Detect domain controller compatibility versionStephen Gallagher2012-09-241-0/+30
|
* SSSD fails to store users if any of the requested attribute is empty.Michal Zidek2012-09-201-0/+6
| | | | https://fedorahosted.org/sssd/ticket/1440
* Fix segfault when sudo is not configured.Simo Sorce2012-06-301-1/+2
| | | | | Sudo support is optional, when it is not configured sudorules_map is not initialized and dereferencing it will cause a segmentation fault.
* ldap provider: add sudo usn valuePavel Březina2012-06-291-0/+5
|
* LDAP: Auto-detect support for the ldap match ruleStephen Gallagher2012-06-131-2/+5
| | | | | | | | This patch extends the RootDSE lookup so that we will perform a second request to test whether the match rule syntax can be used. If both groups and initgroups are disabled in the configuration, this lookup request can be skipped.
* Add support for filtering atributesJan Zeleny2012-05-311-1/+19
| | | | | This patch adds support for filtering attributes when constructing attribute list from a map for LDAP query.
* Fixed two minor memory leaksJan Zeleny2012-05-141-1/+4
|
* LDAP: Handle very large Active Directory groupsStephen Gallagher2012-05-101-26/+46
| | | | | | | | | | | | | Active Directory 2008R2 allows only 1500 group members to be retrieved in a single lookup. However, when we hit such a situation, we can take advantage of the ASQ lookups, which are not similarly limited. With this patch, we will add any members found by ASQ that were not found by the initial lookup so we will end with a complete group listing. https://fedorahosted.org/sssd/ticket/783
* LDAP: Add attr_count return value to build_attrs_from_map()Stephen Gallagher2012-05-101-5/+26
| | | | | | | This is necessary because in several places in the code, we are appending to the attrs returned from this value, and if we relied on the map size macro, we would be appending after the NULL terminator if one or more attributes were defined as NULL.
* Prevent printing NULL from DEBUG messagesJakub Hrozek2012-04-181-4/+9
|
* Add missing breaks to switch statementsStephen Gallagher2012-02-131-0/+1
| | | | Coverity #12525 and #12524
* LDAP: Add support for SSH user public keysJan Cholasta2012-02-071-2/+18
|
* AUTOFS: LDAP providerJakub Hrozek2012-02-051-1/+12
|
* LDAP: Do not fail if RootDSE check cannot determine search basesStephen Gallagher2012-02-041-1/+6
| | | | https://fedorahosted.org/sssd/ticket/1152
* LDAP: Add enumeration support for servicesStephen Gallagher2012-01-311-0/+5
|
* LDAP: Add support for service lookups (non-enum)Stephen Gallagher2012-01-311-0/+11
|
* LDAP: Improve debugging for sdap_parse_derefStephen Gallagher2012-01-231-4/+7
| | | | | | Move the debug statement identifying the DN to an earlier line, so if we get a reply with no attributes, we know which entry is at fault.
* SUDO Integration - LDAP configuration optionsPavel Březina2011-12-161-1/+13
|
* Modified sdap_parse_search_base()Jan Zeleny2011-11-231-1/+1
|
* Cleanup: Remove unused parametersJakub Hrozek2011-11-221-2/+0
|
* LDAP: Add parser for multiple search basesStephen Gallagher2011-11-021-26/+83
|
* sss_ldap_err2string() - ldap_err2string() to sss_ldap_err2string()Pavel Březina2011-09-061-14/+14
| | | | https://fedorahosted.org/sssd/ticket/986
* OpenLDAP dereference searchesJakub Hrozek2011-05-201-0/+159
| | | | | | | | This dereference method is supported at least by OpenLDAP and 389DS/RHDS For more details, see: http://tools.ietf.org/html/draft-masarati-ldap-deref-00
generated by cgit (git 2.34.1) at 2024-05-28 10:18:35 +0000