summaryrefslogtreecommitdiffstats
path: root/src/providers/ldap/sdap_async_initgroups.c
Commit message (Collapse)AuthorAgeFilesLines
* SDAP: Remove unnecessary argument from sdap_save_userLukas Slebodnik2015-05-251-1/+1
| | | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit dca741129d221558a4325479aefc617240f1ab08) (cherry picked from commit cd4e7846b8b1695956977e19a478198595946c4c)
* IPA: allow initgroups by UUID for FreeIPA usersSumit Bose2015-05-061-3/+11
| | | | | | | | | | | | | If a FreeIPA user is searched with the help of an override name the UUID from the override anchor is used to search the user. Currently the initgroups request only allows searches by SID or name. With this patch a UUID can be used as well. Related to https://fedorahosted.org/sssd/ticket/2642 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 0f9c28eb52d2b45c8a97f709308dc11377831b8c) (cherry picked from commit 3b00bcd8b6d53d33207005c4e7a631b6a241d300)
* IPA: allow initgroups by SID for AD usersSumit Bose2015-04-291-0/+2
| | | | | | | | | | | | If a user from a trusted AD domain is search with the help of an override name the SID from the override anchor is used to search the user in AD. Currently the initgroups request only allows searches by name. With this patch a SID can be used as well. Resolves https://fedorahosted.org/sssd/ticket/2632 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit f70a1adbfc30b9acc302027439fb8157e0c6ea2a)
* SDAP: Filter ad groups in initgroupsLukas Slebodnik2015-04-141-0/+12
| | | | | | | | | | | | Function sdap_add_incomplete_groups stored domain local groups from subdomain as POSIX group, which should not be done. Resolves: https://fedorahosted.org/sssd/ticket/2614 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit b9fbeb75e7a4f50f98d979a70a710f9221892483) (cherry picked from commit 49895bb18508a4f4b83b99d9875e99e17c81285b)
* sdap: properly handle binary objectGuid attributeSumit Bose2015-03-271-1/+6
| | | | | | | | | | | | | | | Although in the initial processing SSSD treats the binary value right at some point it mainly assumes that it is a string. Depending on the value this might end up with the correct binary value stored in the cache but in most cases there will be only a broken entry in the cache. This patch converts the binary value into a string representation which is described in [MS-DTYP] and stores the result in the cache. Resolves https://fedorahosted.org/sssd/ticket/2588 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit 4619742836ec22edf8f9d274d928bc896c5b0883)
* LDAP/AD: do not resolve group members during tokenGroups requestSumit Bose2015-03-201-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | During initgroups requests we try to avoid to resolve the complete member list of groups if possible, e.g. if there are no nested groups. The tokenGroups LDAP lookup return the complete list of memberships for a user hence it is not necessary lookup the other group member and un-roll nested groups. With this patch only the group entry is looked up and saved as incomplete group to the cache. This is achieved by adding a new boolean parameter no_members to groups_get_send() and sdap_get_groups_send(). The difference to config options like ldap_group_nesting_level = 0 or ignore_group_members is that if no_members is set to true groups which are missing in the cache are created a incomplete groups. As a result a request to lookup this group will trigger a new LDAP request to resolve the group completely. This way no information is ignored but the time needed to read all data is better distributed between different requests. https://fedorahosted.org/sssd/ticket/2601 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> (cherry picked from commit d81d8d3dc151ebc95cd0e3f3b14c1cdaa48980f1) (cherry picked from commit b8d9eca0d9469c1209161b31a0109d8e4ea2868c)
* Add missing new lines to debug messagesLukas Slebodnik2015-02-181-3/+3
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Add UUID when saving incomplete groupsJakub Hrozek2015-01-301-3/+13
| | | | | | | | Related to: https://fedorahosted.org/sssd/ticket/2571 Reviewed-by: Sumit Bose <sbose@redhat.com> (cherry picked from commit 108db0e3b9e06e530364ef8228634f5e3f6bd3b5)
* Use the alternative objectclass in group maps.Michal Zidek2014-09-151-11/+39
| | | | | | | | | Use the alternative group objectclass in queries. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: process non-posix nested groups w/o tokenGroupsPavel Reichl2014-09-081-5/+1
| | | | | | | | | | When initgr is performed for AD not supporting tokenGroups, do not filter out groups without gid attribute or with gid equal to zero. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: process non-posix nested groupsPavel Reichl2014-09-081-1/+1
| | | | | | | | | | Do not expect objectClass to be posixGroup but rather more general groupofnames. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: If extra_value is 'U' do a UPN searchSumit Bose2014-09-011-2/+9
| | | | | | | | | | | Besides the name the responders always send an extra string attribute to the backends which is so far mostly empty. Since the only difference in the processing of a request for a user name or a user principal name is a different search attribute in the LDAP provider this extra value can be used to indicate the type of the name. Providers which do not support UPN lookup can just ignore this attribute. Related to https://fedorahosted.org/sssd/ticket/1749
* LDAP: Enable tokenGroups with Windows Server 2003Jakub Hrozek2014-09-011-2/+2
| | | | | | | | | | | | According to Microsoft documentation, the tokenGroups attribute is available since Windows 2000: http://msdn.microsoft.com/en-us/library/cc220937.aspx We were not able to test against Windows 2000, though, as we don't have that OS around, so this patch only changes the compatibility level to 2003. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Revert "IPA: process non-posix nested groups"Jakub Hrozek2014-08-191-72/+3
| | | | This reverts commit 5197ac634572a2e0f8c7cacad68d5e5336064744.
* Revert "IPA: new attribute map for non-posix groups"Jakub Hrozek2014-08-191-9/+3
| | | | This reverts commit 4c560e7b98e7ab71d22be24d2fbc468396cb634f.
* IPA: process non-posix nested groupsPavel Reichl2014-08-191-3/+72
| | | | | | | | | | | | | | If an object can't be resolved as a posix group we then try to resolve it as a non-posix (without the gid attribute) nested group and store it as a group stub into the sysdb. The purpose is to be able to resolve nested posix groups which are members of non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: new attribute map for non-posix groupsPavel Reichl2014-08-191-3/+9
| | | | | | | | | Create new set of attributes to be used when processing non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* SDAP: fix use after free in async_initgroupsPavel Reichl2014-07-241-1/+0
| | | | | | | | Request is freed if creation of subrequest fails and ENOMEM is returned. This would lead to use after free as returned value is checked on caller's side and (already freed) request would be marked as erroneous. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: reduce code duplicity-rfc2307bis nested groupsPavel Reichl2014-07-231-41/+29
| | | | | | | Move copy&pasted code for iteration of nested groups into separate function. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SDAP: Add option to disable use of Token-GroupsPavel Reichl2014-06-021-2/+5
| | | | | | | | | | | Disabling use of Token-Groups is mandatory if expansion of nested groups is not desired (ldap_group_nesting_level = 0) for AD provider. Resolves: https://fedorahosted.org/sssd/ticket/2294 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: fix - find primary group by gidPavel Reichl2014-06-021-1/+0
| | | | | | | | | | Remove premature call of tevent_req_done() from sdap_get_initgr_done(). Request is correctly marked as done at sdap_get_initgr_pgid(). Resolves: https://fedorahosted.org/sssd/ticket/2334 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Make it possible to extend an attribute mapJakub Hrozek2014-05-021-2/+4
| | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2073 This commit adds a new option ldap_user_extra_attrs that is unset by default. When set, the option contains a list of LDAP attributes the LDAP provider would download and store in addition to the usual set. The list can either contain LDAP attribute names only, or colon-separated tuples of LDAP attribute and SSSD cache attribute name. In case only LDAP attribute name is specified, the attribute is saved to the cache verbatim. Using a custom SSSD attribute name might be required by environments that configure several SSSD domains with different LDAP schemas. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Update DEBUG* invocations to use new levelsNikolai Kondrashov2014-02-121-73/+100
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-121-164/+164
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* AD: cross-domain membership fixSumit Bose2013-12-191-3/+47
| | | | | | | | | | | | | | | | | | | A recent patch directed all call related to group membership lookups to the AD LDAP port to fix an issue related to missing group memberships in the Global Catalog. As a side-effect it broke cross-domain group-memberships because those cannot be resolved by the connection to the LDAP port. The patch tires to fix this by restoring the original behaviour in the top-level lookup calls in the AD provider and switching to the LDAP port only for the LDAP request which is expected to return the full group membership. Additionally this patch contains a related fix for the tokenGroups with Posix attributes patch. The original connection, typically a Global Catalog connection in the AD case is passed down the stack so that the group lookup after the tokenGroups request can run over the same connection.
* ad: use tokengroups even when id mapping is disabledPavel Březina2013-12-181-5/+5
| | | | https://fedorahosted.org/sssd/ticket/1568
* ad: refactor tokengroups initgroupsPavel Březina2013-12-181-8/+8
| | | | | sdap_get_ad_tokengroups_initgroups is split into more parts so it can be reused later.
* rfc2307bis_nested_groups_send: reuse search baseSumit Bose2013-12-091-2/+7
| | | | | If there are multiple members in the sdom list, always the search base of the first entry were used.
* Remove unused parameter from sdap_save_userLukas Slebodnik2013-11-271-3/+1
|
* SYSDB: Drop redundant sysdb_ctx parameter from sysdb.cMichal Zidek2013-11-151-2/+1
|
* SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 2)Michal Zidek2013-11-151-8/+6
|
* SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 1)Michal Zidek2013-11-151-3/+3
|
* SYSDB: Drop the sysdb_ctx parameter from the sysdb_search moduleMichal Zidek2013-11-151-8/+4
|
* sdap_idmap_domain_has_algorithmic_mapping: add domain name argumentSumit Bose2013-10-251-0/+4
| | | | | | | | | | | | | When libss_idmap was only used to algorithmically map a SID to a POSIX ID a domain SID was strictly necessary and the only information needed to find a domain. With the introduction of external mappings there are cases where a domain SID is not available. Currently we relied on the fact that external mapping was always used as a default if not specific information about the domain was found. The lead to extra CPU cycles and potentially confusing debug messages. Adding the domain name as a search parameter will avoid this.
* LDAP: Allow searching subdomain during RFC2307bis initgroupsJakub Hrozek2013-09-271-9/+11
| | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2070 Until now, the POSIX-compliant initgroups would only be able to search the parent domain. Since we want to allow using POSIX attributes from AD subdomains as well, we should allow searching a custom sdap_domain.
* LDAP: Require ID numbers when ID mapping is offJakub Hrozek2013-09-271-4/+55
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2070 When searching for users and groups without the use of ID mapping, make sure the UIDs and GIDs are included in the search. This will make the SSSD seemigly "miss" entries when searching in Global Catalog in the scenario where the POSIX attributes are not replicated to the GC.
* sysdb: get_sysdb_grouplist() can return either names or dnPavel Březina2013-09-261-16/+49
| | | | | | | | | We need to work with distinguish names when processing cross-domain membership, because groups and users may be stored in different sysdb tree. Resolves: https://fedorahosted.org/sssd/ticket/2066
* Fix formating of variables with type: size_tLukas Slebodnik2013-09-111-7/+10
|
* sysdb_add_incomplete_group: store SID string is availableSumit Bose2013-08-191-8/+17
| | | | | | During initgroups request we read the SID of a group from the server but do not save it to the cache. This patch fixes this and might help to avoid an additional lookup of the SID later.
* save_rfc2307bis_user_memberships: use fq names for subdomainsSumit Bose2013-08-191-0/+16
| | | | | For subdomains the group names must be expanded to fully qualified names to be able to find existing groups or properly add new ones.
* sdap_add_incomplete_groups: use fully qualified name if neededSumit Bose2013-08-191-4/+14
| | | | | For subdomains the group names must be expanded to fully qualified names to be able to find existing groups or properly add new ones.
* sdap_get_initgr_done: use the right SID to get a GIDSumit Bose2013-08-191-1/+2
|
* Fix memory context for a state memberSumit Bose2013-08-071-1/+1
| | | | | | primary_name was allocated on a temporary memory context but as it is a member of the state struct it should belong to the memory context of the state.
* LDAP: Use domain-specific name where appropriateJakub Hrozek2013-07-241-27/+24
| | | | | | | | | The subdomain users user FQDN in their name attribute. However, handling of whether to use FQDN in the LDAP code was not really good. This patch introduces a utility function and converts code that was relying on user/group names matching to this utility function. This is a temporary fix until we can refactor the sysdb API in #2011.
* Replace SDAP_ID_MAPPING checks with sdap_idmap_domain_has_algorithmic_mappingSumit Bose2013-06-281-7/+13
| | | | | | | | | | Currently the decision if external or algorithmic mapping should be used in the LDAP or AD provider was based on the value of the ldap_id_mapping config option. Since now all information about ID mapping is handled by libsss_idmap the check for this options can be replace with a call which checks the state via libss_idmap. https://fedorahosted.org/sssd/ticket/1961
* LDAP: return sdap search return code to IDJakub Hrozek2013-06-071-2/+2
| | | | | | | | By default, the LDAP searches delete the entry from cache if it wasn't found during a search. But if a search wants to try both Global Catalog and LDAP, for example, it might be beneficial to have an option to only delete the entry from cache after the last operation fails to prevent unnecessary memberof operations for example.
* LDAP: new SDAP domain structureJakub Hrozek2013-06-071-8/+10
| | | | | | | | | | | Previously an sdap_id_ctx was always tied to one domain with a single set of search bases. But with the introduction of Global Catalog lookups, primary domain and subdomains might have different search bases. This patch introduces a new structure sdap_domain that contains an sssd domain or subdomain and a set of search bases. With this patch, there is only one sdap_domain that describes the primary domain.
* LDAP: Pass in a connection to ID functionsJakub Hrozek2013-06-071-1/+4
| | | | | | | Instead of using the default connection from the sdap_id_ctx, allow the caller to specify which connection shall be used for this particular request. Again, no functional change is present in this patch, just another parameter is added.
* LDAP: If deref search fails, try again without derefJan Cholasta2013-03-211-1/+11
| | | | https://fedorahosted.org/sssd/ticket/1660
* ldap: Fallback option for rfc2307 schemaSimo Sorce2013-03-201-2/+15
| | | | | | | | | | | Add option to fallback to fetch local users if rfc2307is being used. This is useful for cases where people added local users as LDAP members and rely on these group memberships to be maintained on the local host. Disabled by default as it violates identity domain separation. Ticket: https://fedorahosted.org/sssd/ticket/1020
generated by cgit (git 2.34.1) at 2024-06-02 13:16:41 +0000