summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
* SDAP: refactor AC offline checksPavel Reichl2014-08-271-9/+12
| | | | | | Prepare code for other access control checks. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Fix using of uninitialized variableLukas Slebodnik2014-08-261-2/+5
| | | | | | | | | | | | | | | | | | | | | | When group was posix and id mapping was enabled then variable gid was used uninitialized. Valgrind error: Conditional jump or move depends on uninitialised value(s) at 0x13F1A1D7: sdap_nested_group_hash_group (sdap_async_nested_groups.c:279) by 0x13F1DAA1: sdap_nested_group_send (sdap_async_nested_groups.c:718) by 0x13F1998D: sdap_get_groups_process (sdap_async_groups.c:1847) by 0x13F0F9CE: sdap_get_generic_ext_done (sdap_async.c:1467) by 0x13F0EE9F: sdap_process_result (sdap_async.c:357) by 0x54ABFBE: tevent_common_loop_timer_delay (in /usr/lib64/libtevent.so.0.9.20) by 0x54ACFC9: ??? (in /usr/lib64/libtevent.so.0.9.20) by 0x54AB6B6: ??? (in /usr/lib64/libtevent.so.0.9.20) by 0x54A7F2C: _tevent_loop_once (in /usr/lib64/libtevent.so.0.9.20) by 0x54A80CA: tevent_common_loop_wait (in /usr/lib64/libtevent.so.0.9.20) by 0x54AB656: ??? (in /usr/lib64/libtevent.so.0.9.20) by 0x5283872: server_loop (server.c:587) Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: Update groups for user just once.Lukas Slebodnik2014-08-261-20/+77
| | | | | | | | | | | | | | | | | | | | | | | | | | The function sdap_ad_tokengroups_update_members finds the differences between list of groups from sysdb and list of groups from LDAP (input argument). For each new group, connections are created between user and group. The other connections are removed. The problem was that in some cases function sdap_ad_tokengroups_update_members was called twice (sdap_ad_tokengroups_initgr_posix_tg_done and sdap_ad_tokengroups_initgr_posix_sids_done). The first call created connection between user and groups resolved from tokengroups and the second call update groups from missing SIDs, but previously created connections were removed. The worst case was when there weren't any missing groups. This behaviour caused missing groups in some cases (for users in child ad domain) This patch join array of groups obtained from token group and array of groups obtained from missing SIDs. The function sdap_ad_tokengroups_update_members is called just once with single array. Resolves: https://fedorahosted.org/sssd/ticket/2407 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Use different talloc_context for array of namesLukas Slebodnik2014-08-261-1/+1
| | | | | | It will be easier to steal whole array to another talloc context Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Immediately finish request for empty arrayLukas Slebodnik2014-08-261-1/+1
| | | | | | | | If array of sids is empty we needn't try to resolve them and we can immediately finish request in function sdap_ad_resolve_sids_send This patch is just a small optimisation. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Use randomized ccname for storing credentialsJakub Hrozek2014-08-261-5/+39
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2410 If two ldap_child processes attempt to prime the ccache at the same time for the same domain, the ldap_child might fail with: [ldap_child_get_tgt_sync] (0x0040): Failed to init ccache: Internal credentials cache error [main] (0x0020): ldap_child_get_tgt_sync failed. To avoid the race-condition, the ldap_child process now creates the ccache randomized and before returning to the caller, renames the randomized ccache to a permanent one. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Use tmp_ctx in ldap_child for temporary dataJakub Hrozek2014-08-261-7/+15
| | | | | | | Using a global memory context for short-lived private data might lead to memory growth. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Don't add a user member twice when adding a primary groupJakub Hrozek2014-08-261-5/+33
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2406 In the AD case, deployments sometimes add groups as parents of the primary GID group. These groups are then returned during initgroups in the tokenGroups attribute and member/memberof links are established between the user and the group. However, any update of these groups would remove the links, so a sequence of calls: id -G user; id user; id -G user would return different group memberships. Our code errored out in the rare case when the user was *also* an LDAP member of his primary group. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Split out linking primary group members into a separate functionJakub Hrozek2014-08-261-7/+16
| | | | | | | The function sdap_fill_memberships did several tasks. It's more readable to split linking the primary members into a separate function. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Do not shortcut on ret != EOK during password expiry checkJakub Hrozek2014-08-221-15/+0
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2323 The functions that check for password expiration can return non-zero return codes not only on internal failure, but also to indicate that the password was expired. The code would in this case shortcut in the error handler instead of making its way to the switch-case code below that translates the SSSD error codes into PAM error codes. We don't lose the error reporting, because any internal error would translate into PAM_SYSTEM_ERROR anyway. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: free subrequest in sdap_dyndns_update_addrs_doneLukas Slebodnik2014-08-221-0/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* dyndns: Fix talloc hierarchy of "struct sss_iface_addr"Lukas Slebodnik2014-08-221-0/+9
| | | | | | | | | | | | | | | Structure "struct sdap_dyndns_update_state" has two linked lists of structures "struct sss_iface_addr": addresses, dns_addrlist In *_recv functions, linked list was talloc stealed to structure sss_iface_addr, but just 1st member was moved to "state" talloc context. Other member of link list were freed with removing subrequest, which caused use after free problem. Resolves: https://fedorahosted.org/sssd/ticket/2405 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Revert "IPA: try to resolve nested groups as poxix group"Jakub Hrozek2014-08-191-201/+5
| | | | This reverts commit 08145755f66e83c304e11228c2b610a09576dd81.
* Revert "IPA: process non-posix nested groups"Jakub Hrozek2014-08-191-72/+3
| | | | This reverts commit 5197ac634572a2e0f8c7cacad68d5e5336064744.
* Revert "IPA: new attribute map for non-posix groups"Jakub Hrozek2014-08-196-46/+5
| | | | This reverts commit 4c560e7b98e7ab71d22be24d2fbc468396cb634f.
* IPA: try to resolve nested groups as poxix groupPavel Reichl2014-08-191-5/+201
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: process non-posix nested groupsPavel Reichl2014-08-191-3/+72
| | | | | | | | | | | | | | If an object can't be resolved as a posix group we then try to resolve it as a non-posix (without the gid attribute) nested group and store it as a group stub into the sysdb. The purpose is to be able to resolve nested posix groups which are members of non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: new attribute map for non-posix groupsPavel Reichl2014-08-196-5/+46
| | | | | | | | | Create new set of attributes to be used when processing non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* Revert "SDAP: Deref needn't be treated as critical"Lukas Slebodnik2014-08-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit fc8d98c9f0bb26de7be732c3e542b85c8abdba53. The reason why the control was marked critical is that we expect to get it back on reply, or it should fail. We should rather leave the criticality bit and handle the error (by downgrading to not use deref controls) if the server fails. In other words, we should not workaround bugs in any LDAP server. If server claim it support deref control, it should work with critical flag. sh-4.2$ ldapsearch -LLL -h 172.17.0.9 -x -b "" -s base supportedControl dn: supportedControl: 1.3.6.1.4.1.4203.666.5.16 supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.3344810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 sh-4.2$ grep "1.3.6.1.4.1.4203.666.5.16" /usr/include/ldap.h #define LDAP_CONTROL_X_DEREF "1.3.6.1.4.1.4203.666.5.16" sh-4.2$ ldapsearch -x -LLL -h 172.17.0.9 -b 'dc=example,dc=com' \ -E '!deref=member:cn,uid' \ cn=ref_grp1 cn,uid Critical extension is unavailable (12) Additional information: critical control unavailable in context Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: handle searches by SID in apply_subdomain_homedirJakub Hrozek2014-08-191-4/+9
| | | | | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2391 apply_subdomain_homedir() didn't handle the situation where an entity that doesn't match was requested from the cache. For user and group lookups this wasn't a problem because the negative match was caught sooner. But SID lookups can match either user or group. When a group SID was requested, the preceding LDAP request matched the SID and stored the group in the cache. Then apply_subdomain_homedir() only tried to search user by SID, didn't find the entry and accessed a NULL pointer. A simple reproducer is: $ python >>> import pysss_nss_idmap >>> pysss_nss_idmap.getnamebysid(group_sid) The group_sid can be anything, including Domain Users (XXX-513) Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sudo: work with correct D-Bus iteratorPavel Březina2014-08-191-3/+4
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* be_get_account_info change level of debug messageMichal Zidek2014-08-191-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: don't log error on access deniedPavel Reichl2014-08-171-1/+6
| | | | | | Don't log error if access is denied in function sdap_access_done(). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: refactor sdap_access_filter_donePavel Reichl2014-08-171-18/+37
| | | | | | | | | | | | As preparation for ticket #2364 move code from sdap_access_filter_done() into sdap_access_done() to make its reuse possible and thus avoid code duplication. Rename check_next_rule() to sdap_access_check_next_rule(). Update definition order of tevent-using functions by time of execution. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: nitpicks in sdap_access_filter_get_access_donePavel Reichl2014-08-171-7/+5
| | | | | | Fixed typo and replaced duplicated string by macro definition. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: refactor sdap_access_filter_sendPavel Reichl2014-08-171-16/+30
| | | | | | | | | As preparation for ticket #2364 separate code for parsing user basedn to a new function sdap_get_basedn_user_entry(). We actually do not need to call strdup on basedn, instead we can just point to address in user_entry as it's allocated on parent memory context. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: split sdap_access_filter_get_access_donePavel Reichl2014-08-171-20/+39
| | | | | | | As a preparation for ticket #2364 separate code for storing user bool values into sysdb to a new function sdap_save_user_cache_bool(). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BE: Handle SIGUSR2Jakub Hrozek2014-08-131-0/+20
| | | | | | | | | It was possible to send SIGUSR1 and to both sssd and sssd_be processes, but only possible to send SIGUSR2 to sssd. This patches fixes the dichotomy by making the sssd_be process handle SIGUSR2 as well. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Dan Lavu <dlavu@redhat.com>
* AD-GPO: ad_gpo changes for offline gpo supportYassir Elley2014-08-131-23/+149
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP SUDO: sudo provider doesn't fetch 'EntryUSN'Michal Šrubař2014-08-111-0/+1
| | | | | | | | | | The EntryUSN is not fetched by the sudo LDAP provider when it downloads the rules because sudorule_map is missing this attribute. We forgot to add the SDAP_AT_SUDO_RUNAS into sdap_sudorule_attrs when we added support for sudoRunAs. Related to: https://fedorahosted.org/sssd/ticket/2212
* SDAP: Deref needn't be treated as criticalLukas Slebodnik2014-08-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The command line utility ldapsearch does not set option LDAP_CONTROL_X_DEREF as critical. sssd performes similar ldap search as following command: sh-4.2$ ldapsearch -x -LLL -h 172.17.0.7 \ -b 'cn=ref_grp1,ou=qagroup,dc=example,dc=com' -E '!deref=member:objectClass,cn,userPassword,gidNumber,member,modifyTimestamp,modifyTimestamp,uid' \ objectClass,cn,userPassword,gidNumber,member,modifyTimestamp,modifyTimestamp,uid Critical extension is unavailable (12) Additional information: critical control unavailable in context The most important is "exclamation mark" before extensions. It indicates criticality. This caused problem when openldap server was older openldap-2.4.23-34.el6. Dereference is performed successfully if extension is not critical: -E 'deref=member:objectClass ... Resolves: https://fedorahosted.org/sssd/ticket/2383 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ad initgroups: continue if resolved SID is still missingPavel Březina2014-08-091-6/+13
| | | | | | https://fedorahosted.org/sssd/ticket/2389 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Avoid undefined ret valueJakub Hrozek2014-08-061-1/+1
| | | | | | | | | | If the LDAP schema was set to a different value than AD and ID mapping was enabled, the value of ret was not defined. Make sure we define ret for the condition below with the default for ID mapping which is 'no GID' Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Dump LDAP server IP address with a high DEBUG levelJakub Hrozek2014-08-051-0/+36
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Print referrals for debugging purposesJakub Hrozek2014-08-051-1/+10
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AD-GPO: add ad_gpo_cache_timeout optionYassir Elley2014-07-315-97/+191
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* failover: set port status to not working if previous srv lookup failedPavel Březina2014-07-311-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The meta server status consists of two parts: A) port status - managed by failover mechanism B) SRV lookup status - managed by SRV resolver Both parts are resetted to "neutral" after some time, having B timeout greater than A timeout. We were hitting the following issue: 1. SRV lookup fails (DNS is not reachable), this will set A to "not working and B to "resolve error". Then the next server is tried but fails as well. 2. If SSSD tries to go back online the failover will set A to "neutral" and it will try to resolve SRV again. But B status is still set to "resolve error" since we haven't reached the timeout yet and SRV resolution fails immediately. But the next server is not tried since the port status (A) remains "neutral". This patch sets the port status to "not working" making the failover to continue with the next server as expected. https://fedorahosted.org/sssd/ticket/2390 Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Exit offline mode only if server is available.Michal Zidek2014-07-312-17/+52
| | | | | | | | | | | | | | | | | | | | | This patch adds periodic check to test if backend can exit offline mode and only marks backend as not offline if server for the service is available. Prior to this patch we marked backend as not offline if the offline_timeout was reached without checking for the server availability and when the next request failed again we switched back to the offline mode. This caused significant slowdowns in some edge cases. Fixes: https://fedorahosted.org/sssd/ticket/2355 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* ptask: Add backoff feature to the ptask api.Michal Zidek2014-07-315-3/+37
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* ptask: Allow adding random_offset to scheduled execution timeMichal Zidek2014-07-315-5/+22
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* AD-GPO: only download policy files if gpo version changesYassir Elley2014-07-302-197/+560
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sudo: replace asterisk with escape sequence in host filterPavel Březina2014-07-291-1/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2377 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* case_sensitivity = preservingMichal Zidek2014-07-292-4/+28
| | | | | | | | | | | If case_sensitivity is set to 'preserving', getXXnam returns name attribute in the same format as stored in LDAP. Fixes: https://fedorahosted.org/sssd/ticket/2367 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* AD: Increment som_index when advancing to the next GPOJakub Hrozek2014-07-291-0/+2
| | | | | | | When the GPO processing tried to advance to the next GPO on encountering an error, the som_index was not incremented, causing an infinite loop. Reviewed-by: Yassir Elley <yelley@redhat.com>
* AD: Check return value of ad_gpo_evaluate_daclJakub Hrozek2014-07-291-2/+7
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Remove unused option ldap_user_uuidLukas Slebodnik2014-07-254-7/+0
| | | | | | | | | | | | | | | | | | | | | | There is problem with OpenLDAP server and dereferencing of attributes that is not in the schema of the server? sh-4.2$ ldapsearch -x -LLL -h openldap.server.test -b 'dc=example,dc=com' \ -E 'deref=member:uid,dummy_attr' cn=ref_grp Protocol error (2) Additional information: Dereference control: attribute decoding error sh-4.2$ echo $? 2 The attribute nsUniqueID is a 389-only, non-standard attribute. It is an operational attribute that is not in the rfc2307bis nor inetOrgPerson nor posixAccount schema. It was a default value of option ldap_user_uuid, but it was not use anywhere. Resolves: https://fedorahosted.org/sssd/ticket/2383 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Remove unused option ldap_group_uuidLukas Slebodnik2014-07-254-7/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Remove unused option ldap_netgroup_uuidLukas Slebodnik2014-07-253-5/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sudo: use dbus array for rules refreshPavel Březina2014-07-241-8/+14
| | | | | | | | | | D-Bus only supports 255 signatures which caused a segmentation fault when sudo responder tried to refresh more rules at once. Resolves: https://fedorahosted.org/sssd/ticket/2387 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: fix use after free in async_initgroupsPavel Reichl2014-07-241-1/+0
| | | | | | | | Request is freed if creation of subrequest fails and ENOMEM is returned. This would lead to use after free as returned value is checked on caller's side and (already freed) request would be marked as erroneous. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-22 00:53:21 +0000