summaryrefslogtreecommitdiffstats
path: root/src/providers/ldap/sdap_async_groups.c
Commit message (Collapse)AuthorAgeFilesLines
* Replace SDAP_ID_MAPPING checks with sdap_idmap_domain_has_algorithmic_mappingSumit Bose2013-06-281-1/+3
| | | | | | | | | | Currently the decision if external or algorithmic mapping should be used in the LDAP or AD provider was based on the value of the ldap_id_mapping config option. Since now all information about ID mapping is handled by libsss_idmap the check for this options can be replace with a call which checks the state via libss_idmap. https://fedorahosted.org/sssd/ticket/1961
* LDAP: store FQDNs for trusted users and groupsJakub Hrozek2013-06-071-2/+10
| | | | | | Because the NSS responder expects the name attribute to contain FQDN, we must save the name as FQDN in the LDAP provider if the domain we save to is a subdomain.
* LDAP: new SDAP domain structureJakub Hrozek2013-06-071-8/+8
| | | | | | | | | | | Previously an sdap_id_ctx was always tied to one domain with a single set of search bases. But with the introduction of Global Catalog lookups, primary domain and subdomains might have different search bases. This patch introduces a new structure sdap_domain that contains an sssd domain or subdomain and a set of search bases. With this patch, there is only one sdap_domain that describes the primary domain.
* Fixing critical format string issues.Lukas Slebodnik2013-05-201-1/+2
| | | | | | --missing arguments. --format '%s', but argument is integer. --wrong format string, examle: '%\n'
* LDAP: always store SID if availableSumit Bose2013-05-021-21/+28
| | | | | | | Currently the string representation of a SID is only stored in the cache for debugging purpose if SID based ID-mapping is used. This patch unconditionally stores the SID if available to allow SID-to-name mappings from the cache.
* LDAP: do not invalidate pointer with realloc while processing ghost usersJakub Hrozek2013-04-191-3/+13
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1799 One peculiarity of the sysdb_attrs_get_el interface is that if the attribute does not exist, then the attrs array is reallocated and the element is created. But in case other pointers are already pointing into the array, the realloc might invalidate them. Such case was in the sdap_process_ghost_members function where if the group had no members, the "gh" pointer requested earlier might have been invalidated by the realloc in order to create the member element.
* refactor nested group processing: replace old codePavel Březina2013-04-021-1721/+5
| | | | https://fedorahosted.org/sssd/ticket/1784
* LDAP: If deref search fails, try again without derefJan Cholasta2013-03-211-2/+12
| | | | https://fedorahosted.org/sssd/ticket/1660
* Fix initialization of multiple variablesOndrej Kos2013-03-131-1/+1
|
* sdap_fill_memberships: continue if a member is not foud in sysdbPavel Březina2013-02-271-3/+7
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1755 sdap_find_entry_by_origDN() may return ENOENT in these non-error scenarios: If a member is out of scope of configured nesting level, sssd produces few noise lines indicating failure. The worse case is when a member is outside of configured search bases. In this case we save the group with incomplete membership,
* nested groups: fix group lookup hangs if member dn is incorrectPavel Březina2013-01-281-0/+24
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1783 When dn in member attribute is invalid (e.g. rdn instead of dn) or it is outside of configured search bases, we might hit a situation when tevent_req is marked as done before any callback could be attached on it.
* Add domain argument to sysdb_search_groups()Simo Sorce2013-01-151-1/+2
|
* Add domain arg to sysdb_search_users()Simo Sorce2013-01-151-7/+9
|
* Add domain argument to sysdb_store_group()Simo Sorce2013-01-151-3/+5
| | | | Also remove sysdb_store_domgroup()
* Add domain argument to sysdb_set_user_attr()Simo Sorce2013-01-151-3/+7
|
* Add domain to sysdb_search_user_by_name()Simo Sorce2013-01-151-1/+1
| | | | Also remove unused sysdb_search_domuser_by_name()
* Make sysdb_domain_dn() require a domain.Simo Sorce2013-01-151-1/+1
|
* AD: Add user as a direct member of his primary groupJakub Hrozek2013-01-091-8/+109
| | | | | | | | | | | | In the AD case, deployments sometimes add groups as parents of the primary GID group. These groups are then returned during initgroups in the tokenGroups attribute and member/memberof links are established between the user and the group. However, any update of these groups would remove the links, so a sequence of calls: id -G user; id user; id -G user would return different group memberships. The downside of this approach is that the user is returned as a group member during getgrgid call as well.
* AD: replace GID/UID, do not add another oneJakub Hrozek2013-01-091-5/+3
| | | | | | | The code would call sysdb_attrs_add_uint32 which added another UID or GID to the ID=0 we already downloaded from LDAP (0 is the default value) when ID-mapping an entry. This led to funky behaviour later on when we wanted to process the ID.
* Indentation fixJakub Hrozek2012-12-041-5/+2
|
* idmap: Silence DEBUG messages when dealing with built-in SIDs.Michal Zidek2012-11-281-27/+34
| | | | | | | | When converting built-in SID to unix GID/UID a confusing debug message about the failed conversion was printed. This patch special cases these built-in objects. https://fedorahosted.org/sssd/ticket/1593
* LDAP: Only convert direct parents' ghost attribute to memberJakub Hrozek2012-11-201-3/+21
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1612 This patch changes the handling of ghost attributes when saving the actual user entry. Instead of always linking all groups that contained the ghost attribute with the new user entry, the original member attributes are now saved in the group object and the user entry is only linked with its direct parents. As the member attribute is compared against the originalDN of the user, if either the originalDN or the originalMember attributes are missing, the user object is linked with all the groups as a fallback. The original member attributes are only saved if the LDAP schema supports nesting.
* LDAP: Refactor saving ghost usersJakub Hrozek2012-11-191-88/+99
|
* LDAP: use the correct memory contextJakub Hrozek2012-11-191-1/+1
| | | | | The element being reallocated is part of the "group_attrs" array, not attrs.
* LDAP: Fix saving empty groupsJakub Hrozek2012-11-191-2/+4
| | | | | | | | https://fedorahosted.org/sssd/ticket/1647 A logic bug in the LDAP provider causes an attempt to allocate a zero-length array for group members while processing an empty group. The allocation would return NULL and saving the empty group would fail.
* LDAP: Allocate the temporary context on NULL, not memctxJakub Hrozek2012-11-191-1/+1
| | | | | | Allocating temporary context on NULL helps vind memory leaks with valgrind and avoid growing memory over time by allocating on a long-lived context.
* fix -O3 variable may be uninitialized warningsPavel Březina2012-11-161-4/+4
|
* Add ignore_group_members option.Paul B. Henson2012-11-151-1/+5
| | | | https://fedorahosted.org/sssd/ticket/1376
* LDAP: Better debug logging when saving groupsStephen Gallagher2012-11-011-11/+75
|
* LDAP: Fix off-by-one error when saving ghost usersJakub Hrozek2012-11-011-1/+1
| | | | | | | | The ldb_val's length parameter should not include the terminating NULL. This was causing funky behaviour as the users were saved as binary attributes. https://fedorahosted.org/sssd/ticket/1614
* Create ghost users when a user DN is encountered in IPAJakub Hrozek2012-10-121-37/+276
| | | | | | | The IPA has a defined directory tree structure that allows us to guess the username from a DN without having to look up the DN in LDAP. https://fedorahosted.org/sssd/ticket/1319
* SYSDB: Remove unnecessary domain parameter from several sysdb callsJakub Hrozek2012-09-241-1/+1
| | | | | The domain can be read from the sysdb object. Removing the domain string makes the API more self-contained.
* Unify usage of sysdb transactionsMichal Zidek2012-08-231-5/+22
| | | | | | Removing bad examples of usage of sysdb_transaction_start/commit/end functions and making it more consistent (all files except of src/db/sysdb_*.c).
* Fix incorrect error-checkStephen Gallagher2012-07-091-1/+1
| | | | Coverity #12770
* Fix possible segfault in sdap_save_group()Jan Zeleny2012-06-201-2/+11
|
* Fixed debug message in sdap_save_group()Jan Zeleny2012-06-151-1/+1
|
* Fix an issue in ghost usersJan Zeleny2012-06-131-75/+47
| | | | | | | | | | | | | | | | | There was an issue with ghost members in nested groups. Consider a scenario with two groups A and B, B being member of A and having some ghost members. In such case SSSD stored both groups, then added membership between them and then added ghost members to the group B. The problem was that adding ghost members to group B didn't propagate these ghost members to group A. This functionality could have been solved by memberof plugin but the logic is far more complicated that changes this patch introduces. The change is simple: add ghost members at the same time as the group is created, even if groups are supposed to be stored in two passes. That way ghost members will be present at the time A -> B membership is created and they will be propagated as expected.
* LDAP: Auto-detect support for the ldap match ruleStephen Gallagher2012-06-131-0/+1
| | | | | | | | This patch extends the RootDSE lookup so that we will perform a second request to test whether the match rule syntax can be used. If both groups and initgroups are disabled in the configuration, this lookup request can be skipped.
* LDAP: Add support for AD chain matching extension in group lookupsStephen Gallagher2012-06-131-9/+153
|
* LDAP: Remove redundant checkStephen Gallagher2012-06-121-11/+0
| | | | | The same block appeared earlier in the function and neither variable could have changed values since.
* Add support for filtering atributesJan Zeleny2012-05-311-5/+5
| | | | | This patch adds support for filtering attributes when constructing attribute list from a map for LDAP query.
* Ghost members - support in LDAP providerJan Zeleny2012-05-311-186/+286
| | | | | | | | | | | | | | | | | | | | The original approach was to store name and original DN in an object in sysdb. When later referenced as member of a group, it was retrieved by its original DN and the correct information about its sysdb DN was stored in the group object which referenced it. The new approach doesn't use fake user objects, therefore this information has to be reached differently when constructing group memberships. The approach is to store all users to a hash table where original DN is used as the key and username as value. When constructing group memberships, the name is retrieved from this hash table instead of sysdb. This hash table is constructed when retrieving user objects from LDAP server - if the user is not present in sysdb, it is automatically stored in the hash table. Another situation is for rfc2307. Because there is no nesting there, we can construct the SYSDB_GHOST attribute directly and therefore don't need a hash table of ghost users.
* LDAP nested groups: Do not process callback with _post deep in the nested ↵Jakub Hrozek2012-05-221-12/+10
| | | | | | structure https://fedorahosted.org/sssd/ticket/1343
* Use the sysdb attribute name, not LDAP attribute nameJakub Hrozek2012-05-161-1/+1
|
* LDAP: Handle very large Active Directory groupsStephen Gallagher2012-05-101-17/+37
| | | | | | | | | | | | | Active Directory 2008R2 allows only 1500 group members to be retrieved in a single lookup. However, when we hit such a situation, we can take advantage of the ASQ lookups, which are not similarly limited. With this patch, we will add any members found by ASQ that were not found by the initial lookup so we will end with a complete group listing. https://fedorahosted.org/sssd/ticket/783
* LDAP: Add attr_count return value to build_attrs_from_map()Stephen Gallagher2012-05-101-6/+8
| | | | | | | This is necessary because in several places in the code, we are appending to the attrs returned from this value, and if we relied on the map size macro, we would be appending after the NULL terminator if one or more attributes were defined as NULL.
* LDAP: Add helper function to map IDsStephen Gallagher2012-05-031-46/+2
| | | | | This function will also auto-create a new ID map if the domain has not been seen previously.
* LDAP: Do not remove uidNumber and gidNumber attributes when saving id-mapped ↵Stephen Gallagher2012-05-031-0/+5
| | | | entries
* LDAP: Add helper routine to convert LDAP blob to SID stringStephen Gallagher2012-05-031-20/+4
|
* LDAP: Allow looking up ID-mapped groups by nameStephen Gallagher2012-05-031-18/+105
|
generated by cgit (git 2.34.1) at 2024-06-16 13:39:20 +0000