summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
* LDAP: Change defaults for ldap_user/group_objectsidMichal Zidek2014-10-161-4/+4
| | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2361 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* UTIL: Always write capathsJakub Hrozek2014-10-162-4/+2
| | | | | | | | | We used to only generate the [capaths] section on the IPA server itself, when running in a trusted setup. But we also found out that the capaths are often required to make SSO fully work, so it's better to always generate them. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* views: search overrides for user and group requestsSumit Bose2014-10-166-101/+602
| | | | | | | | | | | | | | | | | | | | | | | | | If the name or the POSIX ID of a user or a group is overridden the search request for those objects have to check the overide objects first before looking up the original objects. This patch adds a new request for the IPA sub-domain users which checks the overrides first if - SSSD is running in ipa-server-mode and a name or a POSIX ID is searched, since we do not override the SIDs we can skip the search in the override tree here - if the responder indicates it has not found the corresponding object in the cache and the input might be an override name or ID and not the original one of an object. If an override object was found the SID is extracted from the anchor attribute and the original object is search by its SID. If no override object was found the original object is search with the original input and finally it is checked if an override object exits for the found object. Relates to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* views: get overrides during user and group lookupsSumit Bose2014-10-163-102/+522
| | | | | | | | | | | | | | With this patch the IPA provider will check if overrides exists for the given view during the lookup of users and groups from trusted domains. In ipa-server-mode the default view is automatically applied and written to the cache. On IPA clients which use the extdom plugin for user and group lookups the override data is saved separately and the original object and the override data are linked with DN attributes for faster reference. Related to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* views: add ipa_get_ad_override_send()Sumit Bose2014-10-162-0/+262
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: add view support and get view nameSumit Bose2014-10-166-28/+328
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2375 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: make IPA ID context available to extdom client codeSumit Bose2014-10-164-5/+16
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Add sdap_deref_search_with_filter_send()Sumit Bose2014-10-162-5/+88
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* nss: add SSS_NSS_GETORIGBYNAME requestSumit Bose2014-10-141-2/+0
| | | | | | | | | | | | | | | This patch adds a new request to the nss responder which follows the same flow as a SSS_NSSGETSIDBYNAME request but returns more data than just the SID. The data is returned as pairs of \0-terminated strings where the first string is the sysdb attribute name and the second the corresponding value. The main use case is on the FreeIPA server to make additional user and group data available to the extdom plugin which then send this data to SSSD running on FreeIPA clients. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* add_v1_group_data: fix for empty members listSumit Bose2014-10-141-16/+25
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* GPO: Do not use output argument if function failedLukas Slebodnik2014-10-131-4/+4
| | | | | | | | | deny_size and allow_size were initialized in function parse_policy_setting_value (output argument). If function parse_policy_setting_value fails then output arguments will not initialized and will be used uninitialized in debug macro. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* GPO: Fail if we cannot retrieve gpo from cache.Lukas Slebodnik2014-10-131-0/+6
| | | | | | The variable value could be used uninitialized. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* GPO: fail if there is problem with storing gpo into sysdbLukas Slebodnik2014-10-131-0/+14
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: check that connection is open before bindPavel Reichl2014-10-121-10/+103
| | | | | | | | | | | | | | | | Tivoli server does not return an empty response when being asked for the rootDSE data but an error. In this case the rootDSE lookup in SSSD will terminate the connection to the server and return a error. But since errors except timeouts are ignored SSSD will try to continue with the bind, but since the connection is already terminated this will fail as well. And this will terminate the whole operation. Make sure the connection is open before performing bind operation. Resolves: https://fedorahosted.org/sssd/ticket/2435 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: move deciding of tls usage into new functionPavel Reichl2014-10-121-20/+37
| | | | | | | Separate code for deciding tls usage from sdap_cli_connect_send() to new function decide_tls_usage(). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Fix error handling after talloc_ber_flattenLukas Slebodnik2014-10-121-2/+1
| | | | | | | The function talloc_ber_flatten can return EFAULT, ENOMEM, EOK. But it was tested for -1. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: test return value of sysdb_search_servicesLukas Slebodnik2014-10-121-0/+6
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Fix warning Value stored to is never readLukas Slebodnik2014-10-121-1/+0
| | | | | | | | | | If function sdap_idmap_sid_to_unix return error code ENOTSUP then error message will be printed: "Skipping buit-in object" Processing of sids will continue an variable ret will be overridden with return code from function sdap_idmap_sid_to_unix, therefore storing EOK to variable is useless. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Move become_user outside krb5 treeJakub Hrozek2014-10-102-207/+0
| | | | | | | | In order for several other SSSD processes to run as a non-root user, we need to move the functions to become another user to a shared space in our source tree. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: Suppress warning maybe-uninitializedLukas Slebodnik2014-10-091-7/+9
| | | | | | | | | | | | | | | | | | There is a warning with some version of gcc (4.9.1, 4.4.7). In my opinion, variable "a" should be initialized every time if "maps" is not NULL. src/providers/ldap/sdap.c: In function 'sdap_parse_entry': src/providers/ldap/sdap.c:481:56: warning: 'a' may be used uninitialized in this function [-Wmaybe-uninitialized] for (ai = a; ai < attrs_num; ai++) { ^ src/providers/ldap/sdap.c:307:9: note: 'a' was declared here int a, i, ret, ai; ^ CCLD libsss_ldap_common.la Reviewed-by: Simo Sorce <simo@redhat.com>
* UTIL: Do not depend on monitor codeJakub Hrozek2014-10-091-1/+1
| | | | | | | Just moves code around. There should be a way to use the server.c module without linking the monitor code. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* DP: Print a type as hexadecimal number in debug message.Lukas Slebodnik2014-10-091-1/+1
| | | | | | | | | | | | | | | | | | | | All request from nss responder, start in domain log with debug message in function be_get_account_info e.g. [be_get_account_info] (0x0100): Got request for [4099][1][name=user1] [be_get_account_info] (0x0100): Got request for [4098][1][name=group1] [be_get_account_info] (0x0100): Got request for [4097][1][name=user1] The 1st number is type, which is defined as hexadecimal nuber in header file src/providers/data_provider.h #define BE_REQ_USER 0x0001 #define BE_REQ_GROUP 0x0002 #define BE_REQ_INITGROUPS 0x0003 ... This patch changes formatting from decimal representation to hexadecimal; so you needn't convert it in head while analysing log files. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* GPO: remove unused talloc contextsLukas Slebodnik2014-10-031-11/+8
| | | | | | | Talloc context was not used in functions ad_gpo_parse_gpo_child_response ad_gpo_process_cse_recv, ad_gpo_store_policy_settings. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* GPO: Use argument ndg_flags instead of constantLukas Slebodnik2014-10-031-6/+6
| | | | | | | | | | | | Some internal gpo functions [1] were called just once and with constant NDR_SCALARS as 2nd argument(ndr_flags), but 2nd argument was not used in these functions[1]. They used constant NDR_SCALARS. [1] ndr_pull_security_ace_flags, ndr_pull_security_ace_type, ndr_pull_security_ace_object_flags, ndr_pull_security_acl_revision, ndr_pull_security_descriptor_revision, ndr_pull_security_descriptor_type Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* AD-GPO resolve conflicting policy settings correctlyYassir Elley2014-10-021-499/+412
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2437 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* AD GPO: Fix incorrect return of EACCESStephen Gallagher2014-10-021-2/+2
| | | | | | | | | | | | In the access providers, we expect to receive ERR_ACCESS_DENIED when access is denied, but we were returning EACCES here. The effect was the same, except that it presented ultimately as a system error instead of a proper denial. Related: https://fedorahosted.org/sssd/ticket/2437 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: add support for new extdom plugin versionSumit Bose2014-09-301-87/+802
| | | | | | | | | | | | | | | | | | | Initially the extdom plugin was only used to translate SIDs of AD user and groups to names or POSIX IDs. On IPA clients group memberships were resolved with the help of the PAC in the Kerberos ticket which required that the user has logged in at least once. Home directory and the login shell were auto generated. The new version of the extdom plugin can return the complete list of group memberships of a user and the list of all members of a group. Additionally the gecos field, home directory and login shell are returned together with an optional list of key-value pairs for arbitrary data which is written unmodified to the cache. Fixes https://fedorahosted.org/sssd/ticket/2159 and https://fedorahosted.org/sssd/ticket/2041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Do not require a dereference control to be retuned in a replyJakub Hrozek2014-09-291-1/+6
| | | | | | | | | When we attempt to request attributes that are not present in the dereferenced links, some serves might not send the dereference control back at all. Be permissive and treat the search as if it didn't find anything. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: Add domains= option to pam_sssDaniel Gollub2014-09-291-0/+1
| | | | | | | | | | | | | | Design document: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Fixes: https://fedorahosted.org/sssd/ticket/1021 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Sven-Thorsten Dietrich <sven@brocade.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: Add a missing break statement to the GPO codeJakub Hrozek2014-09-291-1/+2
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* AD GPO: Fix incorrect sAMAccountName selectionStephen Gallagher2014-09-291-2/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix debug messages - trailing '.'Pavel Reichl2014-09-294-4/+4
| | | | | | Fix debug messages where '\n' was wrongly followed by '.'. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Use GC for group lookups in server modeJakub Hrozek2014-09-251-5/+9
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2412 Even though AD trusts often work with POSIX attributes which are normally not replicated to GC, our group lookups are smart since commit 008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using the LDAP connection and only use the GC connection to look up the members. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Do not clobber return value when multiple controls are returnedJakub Hrozek2014-09-161-3/+4
| | | | | | | | We loop over the array of returned controls and set 'ret' based on the control value. In case multiple controls were returned, the 'ret' variable might be clobbered with result of a string-to-int conversion. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Use the alternative objectclass in group maps.Michal Zidek2014-09-157-29/+117
| | | | | | | | | Use the alternative group objectclass in queries. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add alternative objectClass to group attribute mapsMichal Zidek2014-09-154-1/+7
| | | | | | | | | | | | | In IPA we sometimes need to use posixGroup and sometimes groupOfNames objectclass to query the groups. This patch adds the possibility to specify alternative objectclass in group maps. By default it is only set for IPA. Fixes: https://fedorahosted.org/sssd/ticket/2436 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Always free talloc_reqJakub Hrozek2014-09-101-2/+1
| | | | | | | | On failure, the subreq wasn't freed, which was not a big deal given the parent request would free the subreq anyway, but it's better to follow the usual pattern. Reviewed-by: Simo Sorce <simo@redhat.com>
* LDAP: Check return valueJakub Hrozek2014-09-081-0/+6
| | | | | | Reported by Coverity Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD-GPO: delete stale GPOsYassir Elley2014-09-081-0/+36
| | | | | | https://fedorahosted.org/sssd/ticket/2431 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Skip dereferenced entries that we are not permitted to readJakub Hrozek2014-09-082-4/+11
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2421 In case we dereference an entry, for which we have /some/ permissions for reading, but we only request attributes that we can't access, the dereference control only returns the DN. This is also the case with the current version of 389DS for cases where no entries at all are readable. In this case, the server should not return the DN at all, though. This DS bug was tracked as https://fedorahosted.org/389/ticket/47885 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD: process non-posix nested groups using tokenGroupsPavel Reichl2014-09-081-8/+1
| | | | | | | | | | When initgr is performed for AD supporting tokenGroups, do not skip non-posix groups. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD: process non-posix nested groups w/o tokenGroupsPavel Reichl2014-09-081-5/+1
| | | | | | | | | | When initgr is performed for AD not supporting tokenGroups, do not filter out groups without gid attribute or with gid equal to zero. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: process non-posix nested groupsPavel Reichl2014-09-082-2/+2
| | | | | | | | | | Do not expect objectClass to be posixGroup but rather more general groupofnames. Resolves: https://fedorahosted.org/sssd/ticket/2343 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD-GPO: processing changes for gpo_map_* optionsYassir Elley2014-09-085-23/+460
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD-GPO: config changes for gpo_map_* optionsYassir Elley2014-09-082-0/+17
| | | | | Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Don't reuse a single tevent callback for multiple requestsJakub Hrozek2014-09-051-27/+53
| | | | | | | | | | | | | | | | | | | | Several requests (deref, ASQ and SD) were using the same tevent callback. This worked fine for quite some time, because the callback only used the tevent_req variables. However, a recent patch changed the shared sdap_get_generic_done so that it also longer uses the 'state' variable. At that point, all requsts that re-used the sdap_get_generic_done request started failing becaus the type of the state variable was different. This patch makes sure the callbacks only manipulate their own data types. Moreover, sdap_get_generic_ext_done() was renamed because it's not really a tevent callback. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSS_CACHE: Allow sss_cache tool to flush SSH hosts cacheWilliam B2014-09-051-2/+2
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2358 Signed-off-by: Jan Cholasta <jcholast@redhat.com> Reviewed-by: Jan Cholasta <jcholast@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* AD: Ignore all errors if gpo is in permissive mode.Lukas Slebodnik2014-09-021-1/+18
| | | | | | | | | | | | | | | This patch prevents problems with user authentication if gpo is misconfigurated. [ad_gpo_target_dn_retrieval_done] (0x0040): No DN retrieved for policy target. [sdap_id_op_destroy] (0x4000): releasing operation connection [ad_gpo_access_done] (0x0040): GPO-based access control failed. [be_pam_handler_callback] (0x0100): Backend returned: (3, 4, No such file or directory) [Internal Error (System error)] [be_pam_handler_callback] (0x0100): Sending result [4][sssdad.com] [be_pam_handler_callback] (0x0100): Sent result [4][sssdad.com] Reviewed-by: Yassir Elley <yelley@redhat.com>
* LDAP: Ignore returned referrals if referral support is disabledJakub Hrozek2014-09-021-8/+18
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Set umask before calling mkstempJakub Hrozek2014-09-021-0/+3
| | | | | | | | | Even though we only call mkstemp to generate a random filename, it's a good practice to set and re-set umask before and after calling mkstemp. Silences a warning from Coverity static analyzer. Reviewed-by: Sumit Bose <sbose@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-10 06:40:52 +0000