summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
* AD GPO: Fix incorrect return of EACCESStephen Gallagher2014-10-021-2/+2
| | | | | | | | | | | | In the access providers, we expect to receive ERR_ACCESS_DENIED when access is denied, but we were returning EACCES here. The effect was the same, except that it presented ultimately as a system error instead of a proper denial. Related: https://fedorahosted.org/sssd/ticket/2437 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: add support for new extdom plugin versionSumit Bose2014-09-301-87/+802
| | | | | | | | | | | | | | | | | | | Initially the extdom plugin was only used to translate SIDs of AD user and groups to names or POSIX IDs. On IPA clients group memberships were resolved with the help of the PAC in the Kerberos ticket which required that the user has logged in at least once. Home directory and the login shell were auto generated. The new version of the extdom plugin can return the complete list of group memberships of a user and the list of all members of a group. Additionally the gecos field, home directory and login shell are returned together with an optional list of key-value pairs for arbitrary data which is written unmodified to the cache. Fixes https://fedorahosted.org/sssd/ticket/2159 and https://fedorahosted.org/sssd/ticket/2041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Do not require a dereference control to be retuned in a replyJakub Hrozek2014-09-291-1/+6
| | | | | | | | | When we attempt to request attributes that are not present in the dereferenced links, some serves might not send the dereference control back at all. Be permissive and treat the search as if it didn't find anything. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: Add domains= option to pam_sssDaniel Gollub2014-09-291-0/+1
| | | | | | | | | | | | | | Design document: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Fixes: https://fedorahosted.org/sssd/ticket/1021 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Sven-Thorsten Dietrich <sven@brocade.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: Add a missing break statement to the GPO codeJakub Hrozek2014-09-291-1/+2
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* AD GPO: Fix incorrect sAMAccountName selectionStephen Gallagher2014-09-291-2/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix debug messages - trailing '.'Pavel Reichl2014-09-294-4/+4
| | | | | | Fix debug messages where '\n' was wrongly followed by '.'. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Use GC for group lookups in server modeJakub Hrozek2014-09-251-5/+9
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2412 Even though AD trusts often work with POSIX attributes which are normally not replicated to GC, our group lookups are smart since commit 008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using the LDAP connection and only use the GC connection to look up the members. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Do not clobber return value when multiple controls are returnedJakub Hrozek2014-09-161-3/+4
| | | | | | | | We loop over the array of returned controls and set 'ret' based on the control value. In case multiple controls were returned, the 'ret' variable might be clobbered with result of a string-to-int conversion. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Use the alternative objectclass in group maps.Michal Zidek2014-09-157-29/+117
| | | | | | | | | Use the alternative group objectclass in queries. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add alternative objectClass to group attribute mapsMichal Zidek2014-09-154-1/+7
| | | | | | | | | | | | | In IPA we sometimes need to use posixGroup and sometimes groupOfNames objectclass to query the groups. This patch adds the possibility to specify alternative objectclass in group maps. By default it is only set for IPA. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Always free talloc_reqJakub Hrozek2014-09-101-2/+1
| | | | | | | | On failure, the subreq wasn't freed, which was not a big deal given the parent request would free the subreq anyway, but it's better to follow the usual pattern. Reviewed-by: Simo Sorce <simo@redhat.com>
* LDAP: Check return valueJakub Hrozek2014-09-081-0/+6
| | | | | | Reported by Coverity Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD-GPO: delete stale GPOsYassir Elley2014-09-081-0/+36
| | | | | | https://fedorahosted.org/sssd/ticket/2431 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Skip dereferenced entries that we are not permitted to readJakub Hrozek2014-09-082-4/+11
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2421 In case we dereference an entry, for which we have /some/ permissions for reading, but we only request attributes that we can't access, the dereference control only returns the DN. This is also the case with the current version of 389DS for cases where no entries at all are readable. In this case, the server should not return the DN at all, though. This DS bug was tracked as https://fedorahosted.org/389/ticket/47885 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD: process non-posix nested groups using tokenGroupsPavel Reichl2014-09-081-8/+1
| | | | | | | | | | When initgr is performed for AD supporting tokenGroups, do not skip non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD: process non-posix nested groups w/o tokenGroupsPavel Reichl2014-09-081-5/+1
| | | | | | | | | | When initgr is performed for AD not supporting tokenGroups, do not filter out groups without gid attribute or with gid equal to zero. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: process non-posix nested groupsPavel Reichl2014-09-082-2/+2
| | | | | | | | | | Do not expect objectClass to be posixGroup but rather more general groupofnames. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD-GPO: processing changes for gpo_map_* optionsYassir Elley2014-09-085-23/+460
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD-GPO: config changes for gpo_map_* optionsYassir Elley2014-09-082-0/+17
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Don't reuse a single tevent callback for multiple requestsJakub Hrozek2014-09-051-27/+53
| | | | | | | | | | | | | | | | | | | | Several requests (deref, ASQ and SD) were using the same tevent callback. This worked fine for quite some time, because the callback only used the tevent_req variables. However, a recent patch changed the shared sdap_get_generic_done so that it also longer uses the 'state' variable. At that point, all requsts that re-used the sdap_get_generic_done request started failing becaus the type of the state variable was different. This patch makes sure the callbacks only manipulate their own data types. Moreover, sdap_get_generic_ext_done() was renamed because it's not really a tevent callback. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSS_CACHE: Allow sss_cache tool to flush SSH hosts cacheWilliam B2014-09-051-2/+2
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2358 Signed-off-by: Jan Cholasta <jcholast@redhat.com> Reviewed-by: Jan Cholasta <jcholast@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* AD: Ignore all errors if gpo is in permissive mode.Lukas Slebodnik2014-09-021-1/+18
| | | | | | | | | | | | | | | This patch prevents problems with user authentication if gpo is misconfigurated. [ad_gpo_target_dn_retrieval_done] (0x0040): No DN retrieved for policy target. [sdap_id_op_destroy] (0x4000): releasing operation connection [ad_gpo_access_done] (0x0040): GPO-based access control failed. [be_pam_handler_callback] (0x0100): Backend returned: (3, 4, No such file or directory) [Internal Error (System error)] [be_pam_handler_callback] (0x0100): Sending result [4][sssdad.com] [be_pam_handler_callback] (0x0100): Sent result [4][sssdad.com] Reviewed-by: Yassir Elley <yelley@redhat.com>
* LDAP: Ignore returned referrals if referral support is disabledJakub Hrozek2014-09-021-8/+18
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Set umask before calling mkstempJakub Hrozek2014-09-021-0/+3
| | | | | | | | | Even though we only call mkstemp to generate a random filename, it's a good practice to set and re-set umask before and after calling mkstemp. Silences a warning from Coverity static analyzer. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM, NSS: allow UPN login namesSumit Bose2014-09-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | With this patch the NSS and PAM responders can handle user principal names besides the fully qualified user names. User principal names are build from a user name and a domain suffix separated by an '@' sign. But the domain suffix does not necessarily has to be the same as the configured domain name in sssd.conf of the dynamically discovered DNS domain name of a domain. The typical use case is an Active Directory forest with lots of different domains. To not force the users to remember the name of the individual domain they belong to the AD administrator can set a common domain suffix for all users from all domains in the forest. This is typically the domain name used for emails to make it even more easy to the users to remember it. Since SSSD splits name and domain part at the '@' sign and the common domain suffix might not be resolvable by DNS or the given user is not a member of that domain (e.g. in the case where the forest root is used as common domain suffix) SSSD might fail to look up the user. With this patch the NSS and PAM responder will do an extra lookup for a UPN if the domain part of the given name is not known or the user was not found and the login name contained the '@' sign. Resolves https://fedorahosted.org/sssd/ticket/1749
* PAM: extract checks from parsing routinesSumit Bose2014-09-012-0/+2
| | | | | | | | | This patch saves the original name given at a login prompt and send to the PAM responder in the logon_name member of the pam_data struct for later use. Additionally it separates the parsing of the data send by the PAM client and the checks of this data.
* LDAP: If extra_value is 'U' do a UPN searchSumit Bose2014-09-014-4/+25
| | | | | | | | | | | Besides the name the responders always send an extra string attribute to the backends which is so far mostly empty. Since the only difference in the processing of a request for a user name or a user principal name is a different search attribute in the LDAP provider this extra value can be used to indicate the type of the name. Providers which do not support UPN lookup can just ignore this attribute. Related to https://fedorahosted.org/sssd/ticket/1749
* LDAP: Enable tokenGroups with Windows Server 2003Jakub Hrozek2014-09-011-2/+2
| | | | | | | | | | | | According to Microsoft documentation, the tokenGroups attribute is available since Windows 2000: http://msdn.microsoft.com/en-us/library/cc220937.aspx We were not able to test against Windows 2000, though, as we don't have that OS around, so this patch only changes the compatibility level to 2003. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Fall back to functional level of Windows Server 2003Jakub Hrozek2014-09-011-1/+2
| | | | | | | | | The newest functional level we branch for is currently DS_BEHAVIOR_WIN2003. Therefore (and also because extended support for Windows server 2003 ends in 2015) we can safely set the functional level to 2003 if the attribute is present but not a known value. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Add Windows Server 2012 R2 functional levelJakub Hrozek2014-09-012-1/+3
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2418 According to http://msdn.microsoft.com/en-us/library/cc223272.aspx a Windows Server 2012 R2 has a functional level set to '6'. We need to support that value in order for tokenGroups to be functional. For more information on the functional levels, please refer to: http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels%28v=ws.10%29.aspx Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Set default value of ldap_user_ssh_public_key to "sshPublicKey"Jan Cholasta2014-09-011-2/+2
| | | | | | https://fedorahosted.org/sssd/ticket/1560 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: account lockout to restrict access via ssh keyPavel Reichl2014-08-273-0/+568
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Be able to configure sssd to honor openldap account lock to restrict access via ssh key. Introduce new ldap_access_order value ('lock') for enabling/disabling this feature. Account is considered locked if pwdAccountLockedTime attribut has value of 000001010000Z. ------------------------------------------------------------------------ Quotation from man slapo-ppolicy: pwdAccountLockedTime This attribute contains the time that the user's account was locked. If the account has been locked, the password may no longer be used to authenticate the user to the directory. If pwdAccountLockedTime is set to 000001010000Z, the user's account has been permanently locked and may only be unlocked by an administrator. Note that account locking only takes effect when the pwdLockout password policy attribute is set to "TRUE". ------------------------------------------------------------------------ Also set default value for sdap_pwdlockout_dn to cn=ppolicy,ou=policies,${search_base} Resolves: https://fedorahosted.org/sssd/ticket/2364 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: new option - DN to ppolicy on LDAPPavel Reichl2014-08-274-0/+4
| | | | | | | | | | To check value of pwdLockout attribute on LDAP server, DN of ppolicy must be set. Resolves: https://fedorahosted.org/sssd/ticket/2364 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: refactor AC offline checksPavel Reichl2014-08-271-9/+12
| | | | | | Prepare code for other access control checks. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Fix using of uninitialized variableLukas Slebodnik2014-08-261-2/+5
| | | | | | | | | | | | | | | | | | | | | | When group was posix and id mapping was enabled then variable gid was used uninitialized. Valgrind error: Conditional jump or move depends on uninitialised value(s) at 0x13F1A1D7: sdap_nested_group_hash_group (sdap_async_nested_groups.c:279) by 0x13F1DAA1: sdap_nested_group_send (sdap_async_nested_groups.c:718) by 0x13F1998D: sdap_get_groups_process (sdap_async_groups.c:1847) by 0x13F0F9CE: sdap_get_generic_ext_done (sdap_async.c:1467) by 0x13F0EE9F: sdap_process_result (sdap_async.c:357) by 0x54ABFBE: tevent_common_loop_timer_delay (in /usr/lib64/libtevent.so.0.9.20) by 0x54ACFC9: ??? (in /usr/lib64/libtevent.so.0.9.20) by 0x54AB6B6: ??? (in /usr/lib64/libtevent.so.0.9.20) by 0x54A7F2C: _tevent_loop_once (in /usr/lib64/libtevent.so.0.9.20) by 0x54A80CA: tevent_common_loop_wait (in /usr/lib64/libtevent.so.0.9.20) by 0x54AB656: ??? (in /usr/lib64/libtevent.so.0.9.20) by 0x5283872: server_loop (server.c:587) Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: Update groups for user just once.Lukas Slebodnik2014-08-261-20/+77
| | | | | | | | | | | | | | | | | | | | | | | | | | The function sdap_ad_tokengroups_update_members finds the differences between list of groups from sysdb and list of groups from LDAP (input argument). For each new group, connections are created between user and group. The other connections are removed. The problem was that in some cases function sdap_ad_tokengroups_update_members was called twice (sdap_ad_tokengroups_initgr_posix_tg_done and sdap_ad_tokengroups_initgr_posix_sids_done). The first call created connection between user and groups resolved from tokengroups and the second call update groups from missing SIDs, but previously created connections were removed. The worst case was when there weren't any missing groups. This behaviour caused missing groups in some cases (for users in child ad domain) This patch join array of groups obtained from token group and array of groups obtained from missing SIDs. The function sdap_ad_tokengroups_update_members is called just once with single array. Resolves: https://fedorahosted.org/sssd/ticket/2407 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Use different talloc_context for array of namesLukas Slebodnik2014-08-261-1/+1
| | | | | | It will be easier to steal whole array to another talloc context Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Immediately finish request for empty arrayLukas Slebodnik2014-08-261-1/+1
| | | | | | | | If array of sids is empty we needn't try to resolve them and we can immediately finish request in function sdap_ad_resolve_sids_send This patch is just a small optimisation. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Use randomized ccname for storing credentialsJakub Hrozek2014-08-261-5/+39
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2410 If two ldap_child processes attempt to prime the ccache at the same time for the same domain, the ldap_child might fail with: [ldap_child_get_tgt_sync] (0x0040): Failed to init ccache: Internal credentials cache error [main] (0x0020): ldap_child_get_tgt_sync failed. To avoid the race-condition, the ldap_child process now creates the ccache randomized and before returning to the caller, renames the randomized ccache to a permanent one. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Use tmp_ctx in ldap_child for temporary dataJakub Hrozek2014-08-261-7/+15
| | | | | | | Using a global memory context for short-lived private data might lead to memory growth. Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Don't add a user member twice when adding a primary groupJakub Hrozek2014-08-261-5/+33
| | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2406 In the AD case, deployments sometimes add groups as parents of the primary GID group. These groups are then returned during initgroups in the tokenGroups attribute and member/memberof links are established between the user and the group. However, any update of these groups would remove the links, so a sequence of calls: id -G user; id user; id -G user would return different group memberships. Our code errored out in the rare case when the user was *also* an LDAP member of his primary group. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Split out linking primary group members into a separate functionJakub Hrozek2014-08-261-7/+16
| | | | | | | The function sdap_fill_memberships did several tasks. It's more readable to split linking the primary members into a separate function. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Do not shortcut on ret != EOK during password expiry checkJakub Hrozek2014-08-221-15/+0
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2323 The functions that check for password expiration can return non-zero return codes not only on internal failure, but also to indicate that the password was expired. The code would in this case shortcut in the error handler instead of making its way to the switch-case code below that translates the SSSD error codes into PAM error codes. We don't lose the error reporting, because any internal error would translate into PAM_SYSTEM_ERROR anyway. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: free subrequest in sdap_dyndns_update_addrs_doneLukas Slebodnik2014-08-221-0/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* dyndns: Fix talloc hierarchy of "struct sss_iface_addr"Lukas Slebodnik2014-08-221-0/+9
| | | | | | | | | | | | | | | Structure "struct sdap_dyndns_update_state" has two linked lists of structures "struct sss_iface_addr": addresses, dns_addrlist In *_recv functions, linked list was talloc stealed to structure sss_iface_addr, but just 1st member was moved to "state" talloc context. Other member of link list were freed with removing subrequest, which caused use after free problem. Resolves: https://fedorahosted.org/sssd/ticket/2405 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Revert "IPA: try to resolve nested groups as poxix group"Jakub Hrozek2014-08-191-201/+5
| | | | This reverts commit 08145755f66e83c304e11228c2b610a09576dd81.
* Revert "IPA: process non-posix nested groups"Jakub Hrozek2014-08-191-72/+3
| | | | This reverts commit 5197ac634572a2e0f8c7cacad68d5e5336064744.
* Revert "IPA: new attribute map for non-posix groups"Jakub Hrozek2014-08-196-46/+5
| | | | This reverts commit 4c560e7b98e7ab71d22be24d2fbc468396cb634f.
* IPA: try to resolve nested groups as poxix groupPavel Reichl2014-08-191-5/+201
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-16 22:13:26 +0000