summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* LDAP: Add the wildcard_limit optionJakub Hrozek2015-07-156-2/+18
| | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Adds a new wildcard_limit option that is set by default to 1000 (one page). This option limits the number of entries that can by default be returned by a wildcard search. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Add sdap_lookup_type enumJakub Hrozek2015-07-156-33/+73
| | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Change the boolan parameter of sdap_get_users_send and sdap_get_groups_send to a tri-state that controls whether we expect only a single entry (ie don't use the paging control), multiple entries with a search limit (wildcard request) or multiple entries with no limit (enumeration). Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Use sdap_get_and_parse_generic_/_recvJakub Hrozek2015-07-152-8/+8
| | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Using the new request sdap_get_and_parse_generic_send is a separate commit so that we can audit where the function is used during a code review. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Add sdap_get_and_parse_generic_sendJakub Hrozek2015-07-152-35/+136
| | | | | | | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 So far we had a simple sdap_get_generic_send() request that uses the right defaults around the low-level sdap_get_generic_ext_send() request and calls the parser. This patch adds also sdap_get_and_parse_generic_send() that exposes all options that sdap_get_generic_ext_send() offers but also calls the parser. In this patch the function is not used at all. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Fetch users and groups using wildcardsJakub Hrozek2015-07-152-2/+51
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Adds handler for the BE_FILTER_WILDCARD in the LDAP provider. So far it's the same code as if enumeration was used, so there are no limits. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Add DP_WILDCARD and SSS_DP_WILDCARD_USER/SSS_DP_WILDCARD_GROUPJakub Hrozek2015-07-152-0/+9
| | | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Extends the Data Provider interface and the responder<->Data provider interface with wildcard lookups. The patch uses a new "wildcard" prefix rather than reusing the existing user/group prefixes. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5: Add and use krb5_auth_queue_send to queue requests by defaultJakub Hrozek2015-07-066-54/+205
| | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2701 Previously, only the krb5 provides used to queue requests, which resulted in concurrent authentication requests stepping on one another. This patch queues requests by default. Reviewed-by: Sumit Bose <sbose@redhat.com>
* views: Add is_default_view helper functionMichal Židek2015-07-024-20/+10
| | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2641 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* GPO: Fix incorrect strerror on GPO access denialStephen Gallagher2015-06-231-8/+8
| | | | | | | | | | We're attempting to use strerror() to print the result from ad_gpo_access_check(), but that function returns an extended SSSD errno Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Remove user from cache for missing user in LDAPLukas Slebodnik2015-06-191-21/+26
| | | | | | | | | | | | Function sysdb_get_real_name overrode reurned code LDAP and thus user was not removed from cache after removing it from LDAP. This patch also do not try to set initgroups flag if user does not exist. It reduce some error message. Resolves: https://fedorahosted.org/sssd/ticket/2681 Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP/IPA: add user lookup by certificateSumit Bose2015-06-194-7/+73
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: add ldap_user_certificate optionSumit Bose2015-06-194-0/+6
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BUILD: Store keytabs in /var/lib/sss/keytabsJakub Hrozek2015-06-161-1/+1
| | | | | | Make sure the directory is only accessible to the sssd user Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Consolidate SDAP_SASL_REALM/SDAP_KRB5_REALM behaviourJakub Hrozek2015-06-143-8/+16
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* LDAP: Do not set keytab through environment variableJakub Hrozek2015-06-141-10/+0
| | | | | | | | | | Otherwise each connection would clobber the environment variable with its own. This is a temporary workaround until SSSD's ldap_child is able to store ccaches in a collection. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Utility function for setting up one-way trust contextJakub Hrozek2015-06-141-4/+67
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Add ad_create_1way_trust_optionsJakub Hrozek2015-06-142-6/+79
| | | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 For one-way trusts we can assume that AD domain is the same as the Kerberis realm. On the other hand, SASL realm and keytab path are specified, unlike two-way trusts that use the system keytab. Includes a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Do not set AD_KRB5_REALM twiceJakub Hrozek2015-06-141-8/+0
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Both the AD common code and ipa_ad_ctx_new() used set AD_KRB5_REALM. As verified by unit tests, we don't need to set the parameter twice. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA/AD: Set up AD domain in ad_create_2way_trust_optionsJakub Hrozek2015-06-144-20/+18
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Removed code duplication. Amends unit test to make sure we don't regress. Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Split off ad_create_default_optionsJakub Hrozek2015-06-142-3/+17
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Make the function reusable and add a simple unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Rename ad_create_default_options to ad_create_2way_trust_optionsJakub Hrozek2015-06-144-9/+9
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Better reflects what's going on in the function. Also adds a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Rename ad_set_ad_id_options to ad_set_sdap_optionsJakub Hrozek2015-06-141-6/+6
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 The function sets SDAP related options based on the AD ID context options. The name should reflect what the function does. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Fetch keytab for 1way trustsJakub Hrozek2015-06-142-21/+409
| | | | | | | | | Uses the ipa-getkeytab call to retrieve keytabs for one-way trust relationships. https://fedorahosted.org/sssd/ticket/2636 Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Make constructing an IPA server mode context asyncJakub Hrozek2015-06-143-30/+249
| | | | | | | Refactoring in preparation for requesting the keytab in future patches. Currently it's a fake async that just marks the request as done. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Read forest name for trusted forest roots as wellJakub Hrozek2015-06-141-0/+15
| | | | | | | | | This will reduce special-casing when establishing forest roots as all domains will contain the forest name. Additionally, AD subdomains already contain the forest name. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Include ipaNTTrustDirection in the attribute set for trusted domainsJakub Hrozek2015-06-143-21/+140
| | | | | | | | | | | Allows to distinguish the trust directions for trusted domains. For domains where we don't know the direction in server mode, we assume two-way trusts. Member domains do not have the direction, but rather the forest root direction is used. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Split two functions to new module ipa_subdomains_utils.cJakub Hrozek2015-06-143-42/+111
| | | | | | | | | These functions will be later reused by the subdomains_server.c module. Splitting them into a separate subdomains_utils.c module will make sure there are no cyclic dependencies and the functions are testable in isolation. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Move server-mode functions to a separate moduleJakub Hrozek2015-06-144-317/+357
| | | | | | | | There is already quite a few functions that are server-mode specific and there will be even more with one-way trusts. Split the server-mode specific functions into a separate module. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Also update master domain when initializing subdom handlerJakub Hrozek2015-06-141-0/+9
| | | | | | | Updating master domain record from sysdb will ensure the flat name of the master domain record is up-to-date. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Fold ipa_subdom_enumerates into ipa_subdom_storeJakub Hrozek2015-06-141-15/+10
| | | | | | Reduced code duplication Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Check master domain record before subdomain recordsJakub Hrozek2015-06-141-14/+28
| | | | | | | | | | | | | | | | | | | | For one-way trusts we need to know the flat name of the IPA domain when we process subdomains, hence we need to swap the processing order and read the master domain record sooner. Previsouly the order was: - ranges - subdomains - if on client, views - master Now the order is: - ranges - master - subdomains - if on client, views Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Add ipa_subdomains_handler_get_{start,cont} wrappersJakub Hrozek2015-06-141-13/+34
| | | | | | | | | | Previously it was error-prone to move code around, because the functions that started next subdomain request were scattered together with moving to next base or assigning next base. This patch creates a wrappers for better readability. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add realm to sysdb_master_domain_add_infoJakub Hrozek2015-06-143-2/+30
| | | | | | | | | | Adding realm to both master domain and subdomain will make it easier to set and select forest roots. Even master domains can be forest members, it's preferable to avoid special-casing as much as possible. Includes a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Store trust direction for subdomainsJakub Hrozek2015-06-142-2/+2
| | | | | | | | | | | | We need to store the subdomain trust direction in order to recover the structure after SSSD restart. The trust direction is a plain uint32_t to avoid leaking the knowledge about AD trust directions to sysdb while at the same time making it easy to compare values between sysdb and LDAP and avoid translating the values. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: Log failure from sysdb_handle_original_uuidLukas Slebodnik2015-06-141-0/+6
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: Don't override homedir with subdomain_homedirPavel Reichl2015-06-141-7/+23
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2583 Reviewed-by: Michal Židek <mzidek@redhat.com>
* subdomains: Inherit cleanup period and tokengroup settings from parent domainJakub Hrozek2015-06-054-0/+70
| | | | | | | | | | | Allows the administrator to extend the functionality of ldap_purge_cache_timeout, ldap_user_principal and ldap_use_tokengroups to the subdomains. This is a less intrusive way of achieving: https://fedorahosted.org/sssd/ticket/2627 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: Add sdap_copy_map_entryJakub Hrozek2015-06-052-0/+21
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* DP: Add a function to inherit DP options, if setJakub Hrozek2015-06-052-0/+62
| | | | | | | | | | | Related to: https://fedorahosted.org/sssd/ticket/2644 Adds a utility function that checks if a DP option is present in the subdomain_inherit list. If it is, then the option is set from source to destination dp_option array. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* krb: remove duplicit decl. of write_krb5info_filePavel Reichl2015-06-051-3/+0
| | | | | | function write_krb5info_file() was declared twice in krb5_common.h Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* dyndns: ipa_dyndns.h missed declaration of used dataPavel Reichl2015-06-051-0/+4
| | | | | | ipa_dyndns.h was depended on header files included before it. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* dyndns: don't pass zone directive to nsupdatePavel Reichl2015-06-041-1/+9
| | | | | | | | | | | | | | | | | | | | | | Don't pass zone directive to nsupdate for the first pass. The information about zone should be generated by nsupdate which has auto-detection logic for zone value. The previous version code sometime worked but it broke when client domain was not the same as FreeIPA domain. Log without patch applied: [ipa_dyndns_update_send] (0x0400): Performing update [ipa_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [5]: Input/output error [ipa_dyndns_nsupdate_done] (0x0040): Updating DNS entry failed [5]: Input/output error Log after patch applied: [ipa_dyndns_update_send] (0x0400): Performing update [ipa_dyndns_nsupdate_done] (0x0040): DNS update finished Resolves: https://fedorahosted.org/sssd/ticket/2540 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* dyndns: remove dupl declaration of ipa_dyndns_updatePavel Reichl2015-06-021-3/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap: use proper sysdb name in groups_by_user_done()Sumit Bose2015-06-011-3/+12
| | | | | | | | | | | | | | | | In a recent change set_initgroups_expire_attribute() was added to groups_by_user_done() to make sure that the initgroups timeout is only added to the user object until all groups added to the cache. This change (and the original code in groups_by_user_done() as well) didn't took sub-domain users into account where the name in sysdb might different form the original request and the domain is not the configured domain. This patch tries to ensure that the right name and domain are used. https://fedorahosted.org/sssd/ticket/2663 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: Check return value before using output argumentsLukas Slebodnik2015-06-011-6/+8
| | | | | | | | | | | | | | | | | | | ==18139== Conditional jump or move depends on uninitialised value(s) ==18139== at 0x14400F1B: generic_ext_search_handler.isra.3 (sdap_async.c:1626) ==18139== by 0x879D7E3: tevent_common_loop_immediate (tevent_immediate.c:135) ==18139== by 0x87A20CD: epoll_event_loop_once (tevent_epoll.c:907) ==18139== by 0x87A07D6: std_event_loop_once (tevent_standard.c:114) ==18139== by 0x879CFBC: _tevent_loop_once (tevent.c:530) ==18139== by 0x879D15A: tevent_common_loop_wait (tevent.c:634) ==18139== by 0x87A0776: std_event_loop_wait (tevent_standard.c:140) ==18139== by 0x5293862: server_loop (server.c:668) ==18139== by 0x10EA41: main (data_provider_be.c:2909 Related tickets: https://fedorahosted.org/sssd/ticket/2645 https://fedorahosted.org/sssd/ticket/2662 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Skip enumeration requests in IPA and AD providers as wellJakub Hrozek2015-06-014-29/+32
| | | | | | | | | | | | | | Checking the enum request in the underlying LDAP provider to skip it might be too late as the richer IPA or AD providers depend on having a useful result when the sdap request finishes. Move the enumeration check earlier instead and allow directly in the IPA or AD handler. Related: https://fedorahosted.org/sssd/ticket/2659 Reviewed-by: Sumit Bose <sbose@redhat.com>
* DP: Set extra_value to NULL for enum requestsJakub Hrozek2015-06-011-1/+2
| | | | | | | | | | | | Some providers, notably IPA, rely on extra_value to be either a useful value or NULL. In enumeration, however, extra_value was random. Set the extra_value pointer explicitly to NULL to make it clear that it's not used for enumeration and also use talloc_zero as future-proof. Resolves: https://fedorahosted.org/sssd/ticket/2659 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PROXY: Do not register signal with SA_SIGINFOLukas Slebodnik2015-05-311-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Argument "siginfo_t *siginfo" (void *__siginfo) was not used in signal handlers pc_init_sig_handler, proxy_child_sig_handler. siginfo is mostly used for additional information for about signal and precesses (@see man 2 sigaction) and we store needed information in custom context (private_data); It's tevent style. Why backend crashed: proxy_child_init_send creates request; forks a process and register handler for signal SIGCHLD. Talloc parent of tevent_signal is previously created request. If proxy_child fails (return code is not 0) then SIGCHLD is received handler pc_init_sig_handler is called. However pc_init_sig_handler can call tevent_req_error for request which calls request callback and released request. tevent_signal_destructor was called as a part of releasing tevent_signal. The destructor cleared siginfo in ring buffer for first time. Then tevent tried to clear the same siginfo in ring buffer for the secont time after returning from signal hander (pc_init_sig_handler). But it was already cleared and it caused dereference of NULL pointer. Resolves: https://fedorahosted.org/sssd/ticket/2654 Reviewed-by: Michal Židek <mzidek@redhat.com>
* PROXY: proxy_child should work in non-root modeLukas Slebodnik2015-05-311-1/+1
| | | | | | | | | | | | | | | | | | | According to design page[1], proxy_child should run with root privileges in non-root mode however proxy_child did not have setuid bit. After setting setuid bit proxy_child will be executed with extra privileges. The effective user ID will be 0 but effective group ID will be still the same as egid of sssd_be. Therefore gid of private pipe for proxy_child should be the same. Otherwise proxy_child will fail due to wrong permissions of unix pipe (sbus_client_init -> check_file) [1] https://fedorahosted.org/sssd/wiki/DesignDocs/NotRootSSSD Resolves: https://fedorahosted.org/sssd/ticket/2655 Reviewed-by: Michal Židek <mzidek@redhat.com>
* Download complete groups if ignore_group_members is set with tokengroupsJakub Hrozek2015-05-311-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2644 When tokenGroups are enabled, we save groups using their SID as the RDN attribute during initgroups() and later, if the groups is requested and saved again with the full name, remove the original and save the new group entry. Saving the new group entry would break if ignore_group_members is also set, because the new group entry would lack the "member" attribute, so the member/memberof links between the new group and the user entry wouldn't be established again. This patch changes the initgroups processing so that the full group object is fetched when initgroups is enabled but together with ignore_group_members. This solution imposes some performance impact, because instead of one search for tokenGroups we also need to resolve the groups. The more systematic solution would be to get rid of removing the group entry as described in https://fedorahosted.org/sssd/ticket/2656 To reproduce the bug, set: ignore_group_members = True with a backend that uses: id_provider = ad Then run: $ id aduser@ad_domain.com $ id aduser@ad_domain.com Reviewed-by: Sumit Bose <sbose@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-29 01:04:11 +0000