summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
* AD: Handle cases where no GPOs applyStephen Gallagher2015-07-261-3/+43
| | | | | | | | | | | | | | | | | It is possible to have a machine where none of the GPOs associated with it include access-control rules. Currently, this results in a denial-by-system-error. We need to treat this case as allowing the user (see the test cases in https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration We also need to delete the result object from the cache to ensure that offline operation will also grant access. Resolves: https://fedorahosted.org/sssd/ticket/2713 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* DYNDNS: support for dualstackPavel Reichl2015-07-243-39/+124
| | | | | | | | | | | | When dyndns_iface option was not used, address of connection to LDAP was used. This patch proposes following change: * Interface containing address of connection is found. * All A and AAAA addresses of this interface are collected. * Collected addresses are sent during DDNS update. * Function sss_iface_addr_add() is removed. Resolves: https://fedorahosted.org/sssd/ticket/2558
* DYNDNS: special value '*' for dyndns_iface optionPavel Reichl2015-07-241-4/+16
| | | | | Option dyndns_iface has now special value '*' which implies that IPs from add interfaces should be sent during DDNS update.
* DYNDNS: support mult. interfaces for dyndns_iface optPavel Reichl2015-07-243-8/+74
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2549
* DYNDNS: sss_iface_addr_list_get return ENOENTPavel Reichl2015-07-242-3/+16
| | | | | | | If none of eligible interfaces matches ifname then ENOENT is returned. Resolves: https://fedorahosted.org/sssd/ticket/2549
* Fix minor typosYuri Chornoivan2015-07-232-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Use the right domain for case-sensitive flagJakub Hrozek2015-07-221-1/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Update few debug messagesLukas Slebodnik2015-07-171-2/+3
| | | | | | | | | It reduces a noise caused by canonicalization of non-existing user. Resolves: https://fedorahosted.org/sssd/ticket/2678 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* KRB5: Return right data provider error codeLukas Slebodnik2015-07-151-1/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2719 Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Add the wildcard_limit optionJakub Hrozek2015-07-156-2/+18
| | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Adds a new wildcard_limit option that is set by default to 1000 (one page). This option limits the number of entries that can by default be returned by a wildcard search. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Add sdap_lookup_type enumJakub Hrozek2015-07-156-33/+73
| | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Change the boolan parameter of sdap_get_users_send and sdap_get_groups_send to a tri-state that controls whether we expect only a single entry (ie don't use the paging control), multiple entries with a search limit (wildcard request) or multiple entries with no limit (enumeration). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Use sdap_get_and_parse_generic_/_recvJakub Hrozek2015-07-152-8/+8
| | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Using the new request sdap_get_and_parse_generic_send is a separate commit so that we can audit where the function is used during a code review. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Add sdap_get_and_parse_generic_sendJakub Hrozek2015-07-152-35/+136
| | | | | | | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 So far we had a simple sdap_get_generic_send() request that uses the right defaults around the low-level sdap_get_generic_ext_send() request and calls the parser. This patch adds also sdap_get_and_parse_generic_send() that exposes all options that sdap_get_generic_ext_send() offers but also calls the parser. In this patch the function is not used at all. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Fetch users and groups using wildcardsJakub Hrozek2015-07-152-2/+51
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Adds handler for the BE_FILTER_WILDCARD in the LDAP provider. So far it's the same code as if enumeration was used, so there are no limits. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Add DP_WILDCARD and SSS_DP_WILDCARD_USER/SSS_DP_WILDCARD_GROUPJakub Hrozek2015-07-152-0/+9
| | | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Extends the Data Provider interface and the responder<->Data provider interface with wildcard lookups. The patch uses a new "wildcard" prefix rather than reusing the existing user/group prefixes. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5: Add and use krb5_auth_queue_send to queue requests by defaultJakub Hrozek2015-07-066-54/+205
| | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2701 Previously, only the krb5 provides used to queue requests, which resulted in concurrent authentication requests stepping on one another. This patch queues requests by default. Reviewed-by: Sumit Bose <sbose@redhat.com>
* views: Add is_default_view helper functionMichal Židek2015-07-024-20/+10
| | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2641 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* GPO: Fix incorrect strerror on GPO access denialStephen Gallagher2015-06-231-8/+8
| | | | | | | | | | We're attempting to use strerror() to print the result from ad_gpo_access_check(), but that function returns an extended SSSD errno Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Remove user from cache for missing user in LDAPLukas Slebodnik2015-06-191-21/+26
| | | | | | | | | | | | Function sysdb_get_real_name overrode reurned code LDAP and thus user was not removed from cache after removing it from LDAP. This patch also do not try to set initgroups flag if user does not exist. It reduce some error message. Resolves: https://fedorahosted.org/sssd/ticket/2681 Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP/IPA: add user lookup by certificateSumit Bose2015-06-194-7/+73
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: add ldap_user_certificate optionSumit Bose2015-06-194-0/+6
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BUILD: Store keytabs in /var/lib/sss/keytabsJakub Hrozek2015-06-161-1/+1
| | | | | | Make sure the directory is only accessible to the sssd user Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Consolidate SDAP_SASL_REALM/SDAP_KRB5_REALM behaviourJakub Hrozek2015-06-143-8/+16
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Do not set keytab through environment variableJakub Hrozek2015-06-141-10/+0
| | | | | | | | | | Otherwise each connection would clobber the environment variable with its own. This is a temporary workaround until SSSD's ldap_child is able to store ccaches in a collection. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Utility function for setting up one-way trust contextJakub Hrozek2015-06-141-4/+67
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Add ad_create_1way_trust_optionsJakub Hrozek2015-06-142-6/+79
| | | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 For one-way trusts we can assume that AD domain is the same as the Kerberis realm. On the other hand, SASL realm and keytab path are specified, unlike two-way trusts that use the system keytab. Includes a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Do not set AD_KRB5_REALM twiceJakub Hrozek2015-06-141-8/+0
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Both the AD common code and ipa_ad_ctx_new() used set AD_KRB5_REALM. As verified by unit tests, we don't need to set the parameter twice. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA/AD: Set up AD domain in ad_create_2way_trust_optionsJakub Hrozek2015-06-144-20/+18
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Removed code duplication. Amends unit test to make sure we don't regress. Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Split off ad_create_default_optionsJakub Hrozek2015-06-142-3/+17
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Make the function reusable and add a simple unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Rename ad_create_default_options to ad_create_2way_trust_optionsJakub Hrozek2015-06-144-9/+9
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Better reflects what's going on in the function. Also adds a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Rename ad_set_ad_id_options to ad_set_sdap_optionsJakub Hrozek2015-06-141-6/+6
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 The function sets SDAP related options based on the AD ID context options. The name should reflect what the function does. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Fetch keytab for 1way trustsJakub Hrozek2015-06-142-21/+409
| | | | | | | | | Uses the ipa-getkeytab call to retrieve keytabs for one-way trust relationships. https://fedorahosted.org/sssd/ticket/2636 Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Make constructing an IPA server mode context asyncJakub Hrozek2015-06-143-30/+249
| | | | | | | Refactoring in preparation for requesting the keytab in future patches. Currently it's a fake async that just marks the request as done. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Read forest name for trusted forest roots as wellJakub Hrozek2015-06-141-0/+15
| | | | | | | | | This will reduce special-casing when establishing forest roots as all domains will contain the forest name. Additionally, AD subdomains already contain the forest name. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Include ipaNTTrustDirection in the attribute set for trusted domainsJakub Hrozek2015-06-143-21/+140
| | | | | | | | | | | Allows to distinguish the trust directions for trusted domains. For domains where we don't know the direction in server mode, we assume two-way trusts. Member domains do not have the direction, but rather the forest root direction is used. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Split two functions to new module ipa_subdomains_utils.cJakub Hrozek2015-06-143-42/+111
| | | | | | | | | These functions will be later reused by the subdomains_server.c module. Splitting them into a separate subdomains_utils.c module will make sure there are no cyclic dependencies and the functions are testable in isolation. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Move server-mode functions to a separate moduleJakub Hrozek2015-06-144-317/+357
| | | | | | | | There is already quite a few functions that are server-mode specific and there will be even more with one-way trusts. Split the server-mode specific functions into a separate module. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Also update master domain when initializing subdom handlerJakub Hrozek2015-06-141-0/+9
| | | | | | | Updating master domain record from sysdb will ensure the flat name of the master domain record is up-to-date. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Fold ipa_subdom_enumerates into ipa_subdom_storeJakub Hrozek2015-06-141-15/+10
| | | | | | Reduced code duplication Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Check master domain record before subdomain recordsJakub Hrozek2015-06-141-14/+28
| | | | | | | | | | | | | | | | | | | | For one-way trusts we need to know the flat name of the IPA domain when we process subdomains, hence we need to swap the processing order and read the master domain record sooner. Previsouly the order was: - ranges - subdomains - if on client, views - master Now the order is: - ranges - master - subdomains - if on client, views Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Add ipa_subdomains_handler_get_{start,cont} wrappersJakub Hrozek2015-06-141-13/+34
| | | | | | | | | | Previously it was error-prone to move code around, because the functions that started next subdomain request were scattered together with moving to next base or assigning next base. This patch creates a wrappers for better readability. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add realm to sysdb_master_domain_add_infoJakub Hrozek2015-06-143-2/+30
| | | | | | | | | | Adding realm to both master domain and subdomain will make it easier to set and select forest roots. Even master domains can be forest members, it's preferable to avoid special-casing as much as possible. Includes a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Store trust direction for subdomainsJakub Hrozek2015-06-142-2/+2
| | | | | | | | | | | | We need to store the subdomain trust direction in order to recover the structure after SSSD restart. The trust direction is a plain uint32_t to avoid leaking the knowledge about AD trust directions to sysdb while at the same time making it easy to compare values between sysdb and LDAP and avoid translating the values. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: Log failure from sysdb_handle_original_uuidLukas Slebodnik2015-06-141-0/+6
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: Don't override homedir with subdomain_homedirPavel Reichl2015-06-141-7/+23
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2583 Reviewed-by: Michal Židek <mzidek@redhat.com>
* subdomains: Inherit cleanup period and tokengroup settings from parent domainJakub Hrozek2015-06-054-0/+70
| | | | | | | | | | | Allows the administrator to extend the functionality of ldap_purge_cache_timeout, ldap_user_principal and ldap_use_tokengroups to the subdomains. This is a less intrusive way of achieving: https://fedorahosted.org/sssd/ticket/2627 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: Add sdap_copy_map_entryJakub Hrozek2015-06-052-0/+21
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* DP: Add a function to inherit DP options, if setJakub Hrozek2015-06-052-0/+62
| | | | | | | | | | | Related to: https://fedorahosted.org/sssd/ticket/2644 Adds a utility function that checks if a DP option is present in the subdomain_inherit list. If it is, then the option is set from source to destination dp_option array. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* krb: remove duplicit decl. of write_krb5info_filePavel Reichl2015-06-051-3/+0
| | | | | | function write_krb5info_file() was declared twice in krb5_common.h Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* dyndns: ipa_dyndns.h missed declaration of used dataPavel Reichl2015-06-051-0/+4
| | | | | | ipa_dyndns.h was depended on header files included before it. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-22 12:29:34 +0000