summaryrefslogtreecommitdiffstats
path: root/src/providers/ldap/sdap_async.c
Commit message (Collapse)AuthorAgeFilesLines
* Add missing new lines to debug messagesLukas Slebodnik2015-02-181-1/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sdap_print_server: use getpeername() to get server addressSumit Bose2014-10-271-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add sdap_deref_search_with_filter_send()Sumit Bose2014-10-161-5/+71
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Do not require a dereference control to be retuned in a replyJakub Hrozek2014-09-291-1/+6
| | | | | | | | | When we attempt to request attributes that are not present in the dereferenced links, some serves might not send the dereference control back at all. Be permissive and treat the search as if it didn't find anything. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Skip dereferenced entries that we are not permitted to readJakub Hrozek2014-09-081-1/+7
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2421 In case we dereference an entry, for which we have /some/ permissions for reading, but we only request attributes that we can't access, the dereference control only returns the DN. This is also the case with the current version of 389DS for cases where no entries at all are readable. In this case, the server should not return the DN at all, though. This DS bug was tracked as https://fedorahosted.org/389/ticket/47885 Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Don't reuse a single tevent callback for multiple requestsJakub Hrozek2014-09-051-27/+53
| | | | | | | | | | | | | | | | | | | | Several requests (deref, ASQ and SD) were using the same tevent callback. This worked fine for quite some time, because the callback only used the tevent_req variables. However, a recent patch changed the shared sdap_get_generic_done so that it also longer uses the 'state' variable. At that point, all requsts that re-used the sdap_get_generic_done request started failing becaus the type of the state variable was different. This patch makes sure the callbacks only manipulate their own data types. Moreover, sdap_get_generic_ext_done() was renamed because it's not really a tevent callback. Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Ignore returned referrals if referral support is disabledJakub Hrozek2014-09-021-8/+18
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Revert "SDAP: Deref needn't be treated as critical"Lukas Slebodnik2014-08-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit fc8d98c9f0bb26de7be732c3e542b85c8abdba53. The reason why the control was marked critical is that we expect to get it back on reply, or it should fail. We should rather leave the criticality bit and handle the error (by downgrading to not use deref controls) if the server fails. In other words, we should not workaround bugs in any LDAP server. If server claim it support deref control, it should work with critical flag. sh-4.2$ ldapsearch -LLL -h 172.17.0.9 -x -b "" -s base supportedControl dn: supportedControl: 1.3.6.1.4.1.4203.666.5.16 supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.3344810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 sh-4.2$ grep "1.3.6.1.4.1.4203.666.5.16" /usr/include/ldap.h #define LDAP_CONTROL_X_DEREF "1.3.6.1.4.1.4203.666.5.16" sh-4.2$ ldapsearch -x -LLL -h 172.17.0.9 -b 'dc=example,dc=com' \ -E '!deref=member:cn,uid' \ cn=ref_grp1 cn,uid Critical extension is unavailable (12) Additional information: critical control unavailable in context Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Deref needn't be treated as criticalLukas Slebodnik2014-08-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The command line utility ldapsearch does not set option LDAP_CONTROL_X_DEREF as critical. sssd performes similar ldap search as following command: sh-4.2$ ldapsearch -x -LLL -h 172.17.0.7 \ -b 'cn=ref_grp1,ou=qagroup,dc=example,dc=com' -E '!deref=member:objectClass,cn,userPassword,gidNumber,member,modifyTimestamp,modifyTimestamp,uid' \ objectClass,cn,userPassword,gidNumber,member,modifyTimestamp,modifyTimestamp,uid Critical extension is unavailable (12) Additional information: critical control unavailable in context The most important is "exclamation mark" before extensions. It indicates criticality. This caused problem when openldap server was older openldap-2.4.23-34.el6. Dereference is performed successfully if extension is not critical: -E 'deref=member:objectClass ... Resolves: https://fedorahosted.org/sssd/ticket/2383 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Dump LDAP server IP address with a high DEBUG levelJakub Hrozek2014-08-051-0/+36
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Print referrals for debugging purposesJakub Hrozek2014-08-051-1/+10
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: remove duplicated codePavel Reichl2014-07-221-44/+3
| | | | | | | | | | | Body of functions sdap_x_deref_search_done(), sdap_asq_search_done(), sdap_sd_search_done and sdap_get_generic_done() are the same. Remove code duplication by calling sdap_get_generic_done() from sdap_x_deref_search_done(), sdap_sd_search_done and from sdap_asq_search_done() instead of having two more duplicate implementations. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Remove unused output parameter _dn from sdap_parse_entryJakub Hrozek2014-07-081-3/+3
| | | | | | | No caller directly accessed this parameter. Moreover, it seemed useless since the same data is available as SYSDB_ORIGINAL_DN in the attributes. Reviewed-by: Michal Židek <mzidek@redhat.com>
* Implemented LDAP component of GPO-based access controlYassir Elley2014-05-131-0/+180
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: move non async functions from sdap_async.c to sdap_utils.cPavel Březina2014-02-181-118/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Update DEBUG* invocations to use new levelsNikolai Kondrashov2014-02-121-67/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-141/+141
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* LDAP: Detect the presence of POSIX attributesJakub Hrozek2014-02-121-0/+200
| | | | | | | | | | | | | | | | | | | When the schema is set to AD and ID mapping is not used, there is a one-time check ran when searching for users to detect the presence of POSIX attributes in LDAP. If this check fails, the search fails as if no entry was found and returns a special error code. The sdap_server_opts structure is filled every time a client connects to a server so the posix check boolean is reset to false again on connecting to the server. It might be better to move the check to where the rootDSE is retrieved, but the check depends on several features that are not known to the code that retrieves the rootDSE (or the connection code for example) such as what the attribute mappings are or the authentication method that should be used. Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Add a new error code for malformed access control filterJakub Hrozek2014-01-091-6/+6
| | | | | | | https://fedorahosted.org/sssd/ticket/2164 The patch adds a new error code and special cases the new code so that access is denied and a nicer log message is shown.
* Use sysdb_attrs_add_lc_name_alias to add case-insensitive aliasSumit Bose2013-12-191-5/+16
|
* sdap_get_generic_ext_send: check if we a re still connectedSumit Bose2013-10-221-0/+7
| | | | | | | | | | | | | | At the beginning of a LDAP request we check if we are connecte and have a valid sdap handle. But for some requests more than one LDAP operation, typically a search, is needed. Due to the asynchronous handling of LDAP request it might be possible that a second request might detect a server error and close the connection while the first request just finished one LDAP search and wants to start a new LDAP search. This patch tries to make sure that there is a valid sdap handle before sending a LDAP search to the server. Fixes https://fedorahosted.org/sssd/ticket/2126
* Fix formating of variables with ber_ typeLukas Slebodnik2013-09-111-1/+1
|
* print hint about password complexity when new password is rejectedPavel Březina2013-07-171-0/+8
| | | | https://fedorahosted.org/sssd/ticket/1827
* LDAP: store FQDNs for trusted users and groupsJakub Hrozek2013-06-071-3/+10
| | | | | | Because the NSS responder expects the name attribute to contain FQDN, we must save the name as FQDN in the LDAP provider if the domain we save to is a subdomain.
* Prevent segfault while processing ASQ requestLukas Slebodnik2013-05-301-0/+6
| | | | https://fedorahosted.org/sssd/ticket/1950
* Adding option to disable retrieving large AD groups.Lukas Slebodnik2013-05-231-2/+13
| | | | | | | | | This commit adds new option ldap_disable_range_retrieval with default value FALSE. If this option is enabled, large groups(>1500) will not be retrieved and behaviour will be similar like was before commit ae8d047122c "LDAP: Handle very large Active Directory groups" https://fedorahosted.org/sssd/ticket/1823
* Fixing critical format string issues.Lukas Slebodnik2013-05-201-1/+2
| | | | | | --missing arguments. --format '%s', but argument is integer. --wrong format string, examle: '%\n'
* LDAP: If deref search fails, try again without derefJan Cholasta2013-03-211-1/+20
| | | | https://fedorahosted.org/sssd/ticket/1660
* Use common error facility instead of sdap_resultSimo Sorce2013-03-191-26/+22
| | | | | | | | | Simplifies and consolidates error reporting for ldap authentication paths. Adds 3 new error codes: ERR_CHPASS_DENIED - Used when password constraints deny password changes ERR_ACCOUNT_EXPIRED - Account is expired ERR_PASSWORD_EXPIRED - Password is expired
* sysdb: try dealing with binary-content attributesJan Engelhardt2013-02-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1818 I have here a LDAP user entry which has this attribute loginAllowedTimeMap:: AAAAAAAAAP///38AAP///38AAP///38AAP///38AAP///38AAAAAAAAA In the function sysdb_attrs_add_string(), called from sdap_attrs_add_ldap_attr(), strlen() is called on this blob, which is the wrong thing to do. The result of strlen is then used to populate the .v_length member of a struct ldb_val - and this will set it to zero in this case. (There is also the problem that there may not be a '\0' at all in the blob.) Subsequently, .v_length being 0 makes ldb_modify(), called from sysdb_set_entry_attr(), return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX. End result is that users do not get stored in the sysdb, and programs like `id` or `getent ...` show incomplete information. The bug was encountered with sssd-1.8.5. sssd-1.5.11 seemed to behave fine, but that may not mean that is the absolute lower boundary of introduction of the problem.
* Change pam data auth tokens.Simo Sorce2013-01-101-2/+2
| | | | Use the new authtok abstraction and interfaces throught the code.
* AD: Detect domain controller compatibility versionStephen Gallagher2012-09-241-0/+1
|
* Fixed wrong number in shadowLastChangeJan Zeleny2012-07-161-1/+2
| | | | | The attribute is supposed to contain number of days since the epoch, not the number of seconds.
* LDAP: Auto-detect support for the ldap match ruleStephen Gallagher2012-06-131-1/+95
| | | | | | | | This patch extends the RootDSE lookup so that we will perform a second request to test whether the match rule syntax can be used. If both groups and initgroups are disabled in the configuration, this lookup request can be skipped.
* Ghost members - removed sdap_check_aliases()Jan Zeleny2012-05-311-108/+0
| | | | | | | This function is no longer necessary because we don't have fake user entries any more. The original purpose of this function was to check if there are fake user entries for particular user and, if yes, to update its membership.
* Warn to syslog when dereference requests failAriel Barria2012-05-221-2/+2
|
* LDAP: Handle very large Active Directory groupsStephen Gallagher2012-05-101-2/+25
| | | | | | | | | | | | | Active Directory 2008R2 allows only 1500 group members to be retrieved in a single lookup. However, when we hit such a situation, we can take advantage of the ASQ lookups, which are not similarly limited. With this patch, we will add any members found by ASQ that were not found by the initial lookup so we will end with a complete group listing. https://fedorahosted.org/sssd/ticket/783
* Special-case LDAP_SIZELIMIT_EXCEEDEDJakub Hrozek2012-05-071-4/+9
| | | | | | | | | | | | Previous version of the SSSD did not abort the async LDAP search operation on errors. In cases where the request ended in progress, such as when the paging was very strictly limited, the old versions at least returned partial data. This patch special-cases the LDAP_SIZELIMIT_EXCEEDED error to avoid a user-visible regression. https://fedorahosted.org/sssd/ticket/1322
* Read sysdb attribute name, not LDAP attribute map nameJakub Hrozek2012-05-031-2/+2
| | | | https://fedorahosted.org/sssd/ticket/1320
* sdap_check_aliases must not error when detects the same userJakub Hrozek2012-04-201-13/+31
| | | | https://fedorahosted.org/sssd/ticket/1307
* Prevent printing NULL from DEBUG messagesJakub Hrozek2012-04-181-2/+4
|
* LDAP: Add better error logging when ldap_result() failsStephen Gallagher2012-03-211-1/+3
|
* LDAP: Only use paging control on requests for multiple entriesStephen Gallagher2012-02-241-5/+40
| | | | | | | | | | The paging control can cause issues on servers that put limits on how many paging controls can be active at one time (on some servers, it is limited to one per connection). We need to reduce our usage so that we only activate the paging control when making a request that may return an arbitrary number of results. https://fedorahosted.org/sssd/ticket/1202 phase one
* End request if ldap_parse_result failsJakub Hrozek2012-02-211-0/+3
|
* Update shadowLastChanged attribute during LDAP password changeJan Zeleny2012-02-061-0/+132
| | | | https://fedorahosted.org/sssd/ticket/1019
* LDAP: Add option to disable paging controlStephen Gallagher2012-01-181-2/+6
| | | | Fixes https://fedorahosted.org/sssd/ticket/967
* Use the case sensitivity flag in the LDAP providerJakub Hrozek2011-12-161-4/+5
|
* Refactor saving sdap entitiesJakub Hrozek2011-12-161-0/+80
| | | | | There was too much code duplication between sdap_save_{user,group,netgroup}. This patch removes the most egregious ones.
* Cleanup: Remove unused parametersJakub Hrozek2011-11-221-1/+2
|
* Prevent printing NULL in several places of LDAP providerJakub Hrozek2011-11-181-2/+4
|
generated by cgit (git 2.34.1) at 2024-06-01 12:18:42 +0000