summaryrefslogtreecommitdiffstats
path: root/src/providers/ldap
Commit message (Collapse)AuthorAgeFilesLines
* LDAP: sdap_id_ctx might contain several connectionsJakub Hrozek2013-06-0713-73/+142
| | | | | | | | | | | | | | | | | | | With some LDAP server implementations, one server might provide different "views" of the identites on different ports. One example is the Active Directory Global catalog. The provider would contact different view depending on which operation it is performing and against which SSSD domain. At the same time, these views run on the same server, which means the same server options, enumeration, cleanup or Kerberos service should be used. So instead of using several different failover ports or several instances of sdap_id_ctx, this patch introduces a new "struct sdap_id_conn_ctx" that contains the connection cache to the particular view and an instance of "struct sdap_options" that contains the URI. No functional changes are present in this patch, currently all providers use a single connection. Multiple connections will be used later in the upcoming patches.
* Do not obfuscate calls with booleansJakub Hrozek2013-06-071-10/+29
| | | | | | Instead of using boolean variables to denote whether the call is adding a primary or a secondary server, use a function wrapper that tells what it's doing by its name.
* Intermittent fix for get_user_and_group_users_doneSumit Bose2013-06-061-3/+0
| | | | | | | | | | | users_get_recv() never returns ENOENT. In general it should return EOK in the case no matching user was found. But since I forget to handle a SID based filter properly in sdap_get_users_process() an error is returned in this case which makes get_user_and_group_users_done() work as expected with this patch. There is an upcoming enhancement to users_get_recv() which I'm planning to use for a full fix.
* Prevent segfault while processing ASQ requestLukas Slebodnik2013-05-301-0/+6
| | | | https://fedorahosted.org/sssd/ticket/1950
* Remove unneeded commentJakub Hrozek2013-05-281-1/+0
|
* Fail with misconfigured id-mapping rangesOndrej Kos2013-05-271-1/+2
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/1930 On misconfigured id-mapping range variables, the provider should not start. We were internally correctly setting error code for failure, but interruption of startup was not performed. Also raised the debug level of message for this misconfiguration.
* Add SID related requests to the LDAP providerSumit Bose2013-05-271-5/+230
| | | | | | | | | | | The patch adds support for BE_REQ_BY_SECID and BE_REQ_USER_AND_GROUP to the LDAP provider. Since the AD and the IPA provider use the same code they support those request now as well. Besides allowing that users and groups can be searched by the SID as well the new request allows to search users and groups in one run, i.e. if there is not user matching the search criteria groups are searched as well.
* Handle SID strings in sdap_attrs_get_sid_str() as wellSumit Bose2013-05-271-9/+20
| | | | | | | This patch add a basic check if the SID returned by the LDAP server is in a string representation. If not it is assumed that a binary SID was returned by the LDAP server which is converted into a string representation which is returned to the caller.
* Adding option to disable retrieving large AD groups.Lukas Slebodnik2013-05-236-13/+49
| | | | | | | | | This commit adds new option ldap_disable_range_retrieval with default value FALSE. If this option is enabled, large groups(>1500) will not be retrieved and behaviour will be similar like was before commit ae8d047122c "LDAP: Handle very large Active Directory groups" https://fedorahosted.org/sssd/ticket/1823
* Removing unused functions.Lukas Slebodnik2013-05-232-36/+0
| | | | This patch remove unused functions sdap_parse_user and sdap_parse_group
* Remove unneeded parameter of setup_child and namespace itJakub Hrozek2013-05-203-3/+3
| | | | | setup_child() was accepting a parameter it didn't use. Also the function name was too generic, so I added a sdap prefix.
* Fixing critical format string issues.Lukas Slebodnik2013-05-205-6/+10
| | | | | | --missing arguments. --format '%s', but argument is integer. --wrong format string, examle: '%\n'
* Re-add a useful DEBUG messageJakub Hrozek2013-05-131-0/+2
| | | | | | | In commit 46222e5191473f9a46aec581273eb2eef22e23be we removed a very similar DEBUG message while moving the whole piece of code to the idmap library. But it turned out that the DEBUG message was useful while testing the functionality, so this patch adds it back.
* LDAP: Always initialize idmap objectJakub Hrozek2013-05-131-5/+3
| | | | | | | | https://fedorahosted.org/sssd/ticket/1922 Since we always store the SID now, we need to always initialize the ID mapping object in LDAP provider as well. Some users might want to configure the LDAP provider with ID mapping, not the AD provider itself.
* Split out the common code from timed DNS updatesJakub Hrozek2013-05-032-0/+121
|
* dyndns: new option dyndns_authJakub Hrozek2013-05-032-2/+8
| | | | | | This options is mostly provided for future expansion. Currently it is undocumented and both IPA and AD dynamic DNS updates default to GSS-TSIG. Allowed values are GSS-TSIG and none.
* dyndns: new option dyndns_force_tcpJakub Hrozek2013-05-031-2/+6
| | | | | | | https://fedorahosted.org/sssd/ticket/1831 Adds a new option that can be used to force nsupdate to only use TCP to communicate with the DNS server.
* dyndns: New option dyndns_update_ptrJakub Hrozek2013-05-032-36/+160
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1832 While some servers, such as FreeIPA allow the PTR record to be synchronized when the forward record is updated, other servers, including Active Directory, require that the PTR record is synchronized manually. This patch adds a new option, dyndns_update_ptr that automatically generates appropriate DNS update message for updating the reverse zone. This option is off by default in the IPA provider. Also renames be_nsupdate_create_msg to be_nsupdate_create_fwd_msg
* Refactor dynamic DNS updatesJakub Hrozek2013-05-032-0/+545
| | | | | | | | | | | | Provides two new layers instead of the previous IPA specific layer: 1) dp_dyndns.c -- a very generic dyndns layer on the DP level. Its purpose it to make it possible for any back end to use dynamic DNS updates. 2) sdap_dyndns.c -- a wrapper around dp_dyndns.c that utilizes some LDAP-specific features like autodetecting the address from the LDAP connection. Also converts the dyndns code to new specific error codes.
* Add secid filter to responder-dp protocolSumit Bose2013-05-021-0/+6
| | | | | This patch add a new filter type to the data-provider interface which can be used for SID-based lookups.
* LDAP: always store SID if availableSumit Bose2013-05-022-33/+58
| | | | | | | Currently the string representation of a SID is only stored in the cache for debugging purpose if SID based ID-mapping is used. This patch unconditionally stores the SID if available to allow SID-to-name mappings from the cache.
* sdap: add sdap_connect_host requestPavel Březina2013-05-022-0/+201
| | | | | Create connection to specified LDAP server without using any failover stuff.
* Display the last grace warning, tooJakub Hrozek2013-05-022-3/+3
| | | | | | | Due to a comparison error, the last warning when an LDAP password was in its grace period was never displayed. https://fedorahosted.org/sssd/ticket/1890
* libsss_idmap: function to calculate rangeMichal Zidek2013-04-292-115/+54
| | | | | | | | Calculation of range for domains is moved from sdap_idmap code to sss_idmap code. Some refactoring have been done to allow this move. https://fedorahosted.org/sssd/ticket/1844
* LDAP: do not invalidate pointer with realloc while processing ghost usersJakub Hrozek2013-04-191-3/+13
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1799 One peculiarity of the sysdb_attrs_get_el interface is that if the attribute does not exist, then the attrs array is reallocated and the element is created. But in case other pointers are already pointing into the array, the realloc might invalidate them. Such case was in the sdap_process_ghost_members function where if the group had no members, the "gh" pointer requested earlier might have been invalidated by the realloc in order to create the member element.
* DNS sites support - use SRV DNS lookup plugin in all providersPavel Březina2013-04-101-0/+9
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1032 We set a plugin during an initialization of ID provider, which is an authoritative provider for a plugin choice. The plugin is set only once. When other provider is initalized (e.g. id = IPA, sudo = LDAP), we do not overwrite the plugin. Since sssm_*_id_init() is called from all module constructors, this patch relies on the fact, that ID provider is initialized before all other providers.
* LDAP: Always fail if a map can't be foundJakub Hrozek2013-04-091-4/+2
|
* LDAP: Fix value initialization warningsLukas Slebodnik2013-04-042-2/+2
|
* Centralize resolv_init, remove resolv context listJakub Hrozek2013-04-031-16/+2
|
* Init failover with be_res optionsJakub Hrozek2013-04-031-24/+5
|
* Making the authtok structure really opaque.Lukas Slebodnik2013-04-022-9/+15
| | | | | | | | | | | | | | | | | | | | Definition of structure sss_auth_token was removed from header file authtok.h and there left only declaration of this structure. Therefore only way how to use this structure is to use accessory function from same header file. To creating new empty authotok can only be used newly created function sss_authtok_new(). TALLOC context was removed from copy and setter functions, because pointer to stuct sss_auth_token is used as a memory context. All declaration of struct sss_auth_token variables was replaced with pointer to this structure and related changes was made in source code. Function copy_pam_data can copy from argument src which was dynamically allocated with function create_pam_data() or zero initialized struct pam_data allocated on stack. https://fedorahosted.org/sssd/ticket/1830
* refactor nested group processing: replace old codePavel Březina2013-04-022-1721/+21
| | | | https://fedorahosted.org/sssd/ticket/1784
* refactor nested group processing: add new codePavel Březina2013-04-021-0/+2229
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1784 1. initialization (main-req), returns members of input group 2. evaluate group members (group) 3. perform individual search (no-deref) or dereference attribute (deref) 4a. no-deref 1. perform a lookup depending on the type of the member object 2. all direct members are evaluated first 3. then we step down in nesting level and evaluate nested groups 4b. deref 1. perform a dereference lookup on member attribute 2. all direct members are evaluated first 3. then we step down in nesting level and evaluate nested groups Tevent request flow: main-req | group |------------------------| no-deref deref | | |----|------|---------| | user group unknown recurse recurse / \ | | | ... | | | ... user group group group
* LDAP: Fix value initializationOndrej Kos2013-03-271-1/+1
|
* LDAP: If deref search fails, try again without derefJan Cholasta2013-03-214-4/+44
| | | | https://fedorahosted.org/sssd/ticket/1660
* ldap: Fallback option for rfc2307 schemaSimo Sorce2013-03-207-11/+191
| | | | | | | | | | | Add option to fallback to fetch local users if rfc2307is being used. This is useful for cases where people added local users as LDAP members and rely on these group memberships to be maintained on the local host. Disabled by default as it violates identity domain separation. Ticket: https://fedorahosted.org/sssd/ticket/1020
* Convert sdap_access to new error codesSimo Sorce2013-03-193-453/+186
| | | | Also simplify sdap_access_send to avoid completely fake _send() routines.
* Removing unused declaration of functions and variable.Lukas Slebodnik2013-03-191-10/+0
| | | | | | Variables dir_cc and file_cc are used in three modules: krb5_common.c, krb5_utils.c, krb5_child-test.c, therefore should be declared with extern in krb5_utils.h.
* Use common error facility instead of sdap_resultSimo Sorce2013-03-195-316/+202
| | | | | | | | | Simplifies and consolidates error reporting for ldap authentication paths. Adds 3 new error codes: ERR_CHPASS_DENIED - Used when password constraints deny password changes ERR_ACCOUNT_EXPIRED - Account is expired ERR_PASSWORD_EXPIRED - Password is expired
* Fix initialization of multiple variablesOndrej Kos2013-03-132-2/+2
|
* More generalized function open_debug_file_ex()Lukas Slebodnik2013-03-131-5/+1
| | | | | | | | Function open_debug_file_ex() set flag FD_CLOEXEC to opened file according to the value of third parameter. Removed duplicity of unsetting FD_CLOEXEC after calling function open_debug_file_ex()
* Fixed typo in debug message.Lukas Slebodnik2013-03-071-3/+5
| | | | | C compiler did not complain, because "index" is function defined in header file <string.h>
* Check the return value of sysdb_search_servicesJakub Hrozek2013-03-051-0/+6
|
* sdap_fill_memberships: continue if a member is not foud in sysdbPavel Březina2013-02-271-3/+7
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1755 sdap_find_entry_by_origDN() may return ENOENT in these non-error scenarios: If a member is out of scope of configured nesting level, sssd produces few noise lines indicating failure. The worse case is when a member is outside of configured search bases. In this case we save the group with incomplete membership,
* sysdb: try dealing with binary-content attributesJan Engelhardt2013-02-262-7/+5
| | | | | | | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1818 I have here a LDAP user entry which has this attribute loginAllowedTimeMap:: AAAAAAAAAP///38AAP///38AAP///38AAP///38AAP///38AAAAAAAAA In the function sysdb_attrs_add_string(), called from sdap_attrs_add_ldap_attr(), strlen() is called on this blob, which is the wrong thing to do. The result of strlen is then used to populate the .v_length member of a struct ldb_val - and this will set it to zero in this case. (There is also the problem that there may not be a '\0' at all in the blob.) Subsequently, .v_length being 0 makes ldb_modify(), called from sysdb_set_entry_attr(), return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX. End result is that users do not get stored in the sysdb, and programs like `id` or `getent ...` show incomplete information. The bug was encountered with sssd-1.8.5. sssd-1.5.11 seemed to behave fine, but that may not mean that is the absolute lower boundary of introduction of the problem.
* LDAP: Check for authtok validityJakub Hrozek2013-02-111-7/+9
| | | | | | | | | | The default authtok type in the LDAP provider (unlike the new IPA and AD providers) is "password". This oddity dates back to when password was the only supported authtok type in the SSSD, so configuration specifying only the password and bind DN was valid. We need to check the authtok validity as well before attempting to use it.
* Add realm info to sss_domain_infoSimo Sorce2013-02-101-1/+1
|
* nested groups: fix group lookup hangs if member dn is incorrectPavel Březina2013-01-281-0/+24
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1783 When dn in member attribute is invalid (e.g. rdn instead of dn) or it is outside of configured search bases, we might hit a situation when tevent_req is marked as done before any callback could be attached on it.
* Add be_req_get_data() helper funciton.Simo Sorce2013-01-215-8/+8
| | | | In preparation for making struct be_req opaque.
* Add be_req_get_be_ctx() helper.Simo Sorce2013-01-215-39/+43
| | | | In preparation for making be_req opaque
generated by cgit (git 2.34.1) at 2024-05-23 20:31:55 +0000