summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* AD GPO: Change default to "enforcing"Stephen Gallagher2015-05-281-1/+2
| | | | | | | | | | | | | | | | | When a user enrolls a system against Active Directory, the expectation is that the client will honor the centrally-managed settings. In the past, we avoided changing the default (and left it in permissive mode, to warn admins that the security policy wasn't being honored) in order to avoid breaking existing Active Directory enrollments. However, sufficient time has likely passed for users to become accustomed to using GPOs to manage access-control for their systems. This patch changes the default to enforcing and adds a configure flag for distributions to use if they wish to provide a different default value. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD GPO: Support processing referralsStephen Gallagher2015-05-284-46/+446
| | | | | | | | | | | | For GPOs assigned to a site, it's possible that their definition actually exists in another domain. To retrieve this information, we need to follow the referral and perform a base search on another domain controller. Resolves: https://fedorahosted.org/sssd/ticket/2645 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Support returning referral informationStephen Gallagher2015-05-281-22/+112
| | | | | | | | | Some callers may be interested in the raw referral values returned from a lookup. This patch allows interested consumers to get these referrals back and process them if they wish. It does not implement a generic automatic following of referrals. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: new option krb5_map_userPavel Reichl2015-05-2810-15/+215
| | | | | | | | | | New option `krb5_map_user` providing mapping of ID provider names to Kerberos principals. Resolves: https://fedorahosted.org/sssd/ticket/2509 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Remove unnecessary argument from sdap_save_userLukas Slebodnik2015-05-224-6/+3
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Set initgroups expire attribute at the endLukas Slebodnik2015-05-222-9/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | Initgrups consisted of two main steps: 1. store user to cache 2. store all user groups to cache. Previously the attribute SYSDB_INITGR_EXPIRE was set in the first step. So in case of epmty cache and parallel initgroups request in responders there was a small period when SYSDB_INITGR_EXPIRE was valid but groups were not cached. Therefore sometime responder could return zero supplementary groups. This patch moves the setting of initgroups expire attribute from 1st step to the end of 2nd step. In case of parallel initgroups requests in responder there are two other ways how we could get correct results even thought there was a bug. a) Time between two request was too small. User was not stored in cache yet and 2nd request waited for response from DP. b) Time between two request was big enough. All users groups were successfully stored in cache and 2nd request returned correct results. Resolves: https://fedorahosted.org/sssd/ticket/2634 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Remove dead assignmentLukas Slebodnik2015-05-181-1/+0
| | | | | | | | | The variable ret was not read when function sysdb_has_enumerated returned ENOENT. Just boolean variable has_enumerated need to be changed. This dead assignment caused warning from clang static analyser Value stored to 'ret' is never read Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: warn about lockout option being deprecatedPavel Reichl2015-05-141-1/+8
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: remove field run_as_userPavel Reichl2015-05-142-15/+0
| | | | | | run_as_user is set set but never read. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: disable the cleanup task by defaultJakub Hrozek2015-05-124-3/+22
| | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2627 The cleanup task was designed to keep the cache size within certain limits. This is how it roughly works now: - find users who have never logged in by default. If account_cache_expiration is set, find users who loggged in later than account_cache_expiration - delete the matching set of users - find groups that have no members - delete the matching set of groups So unless account_cache_expiration is set to something sensible, only empty groups and expired users who never logged in are removed and that's quite a corner case. The above effectivelly walks the whole database, especially the groups step is quite slow with a huge database. The whole cleanup task also runs in a single sysdb transaction, which means all other transactions are blocked while the cleanup task crunches the database. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: do not fail if view name lookup failed on older versionsSumit Bose2015-05-121-1/+8
| | | | | | | | | | | | | | Depending on the version 389ds return a different error code if the search for the view name failed because our dereference attribute ipaAssignedIDView is not known. Newer version return LDAP_UNAVAILABLE_CRITICAL_EXTENSION(12) which is translated to EOPNOTSUPP and older versions return LDAP_PROTOCOL_ERROR(2) which is returned as EIO. In both cases we have to assume that the server is not view aware and keep the view name unset. Resolves https://fedorahosted.org/sssd/ticket/2650 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: use DN to update entrySumit Bose2015-05-111-1/+2
| | | | | | | | | | | | | | | sdap_nested_group_populate_users() has code to handle user name changes. It updates the SYSDB_NAME attribute. This attribute is also used in the RDN but changing the attribute in the object does not change the DN hence the DN still contains the old name. Currently sysdb_set_user_attr() was used to update the entry which creates the DN based on the give name. This will fail if the name is changed for a second time. Since the DN is already available in the search result it is more reliable to use it directly with sysdb_set_entry_attr(). Related to https://fedorahosted.org/sssd/ticket/2591 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: return after tevent_req_errorJakub Hrozek2015-05-111-0/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5: try delayed online authentication only for single factor authSumit Bose2015-05-081-0/+7
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5: save hash of the first authentication factor to the cacheSumit Bose2015-05-081-3/+23
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: create preauth indicator file at startupSumit Bose2015-05-081-0/+66
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5-child: add preauth and split 2fa token supportSumit Bose2015-05-083-21/+251
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Add pre-auth requestSumit Bose2015-05-084-0/+6
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: allow initgroups by UUID for FreeIPA usersSumit Bose2015-05-065-17/+34
| | | | | | | | | | | If a FreeIPA user is searched with the help of an override name the UUID from the override anchor is used to search the user. Currently the initgroups request only allows searches by SID or name. With this patch a UUID can be used as well. Related to https://fedorahosted.org/sssd/ticket/2642 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: do not add domain name unconditionallySumit Bose2015-05-061-0/+2
| | | | | | | | | | | Depending on the server-side configuration the extdom plugin can return short or fully qualified names for IPA objects. The client must handle the names according to its own configuration and not add the domain part of the fully-qualified name unconditionally. Resolves https://fedorahosted.org/sssd/ticket/2647 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: search for overrides during initgroups in sever modeSumit Bose2015-05-051-0/+69
| | | | | | | | | | After the group memberships of a user from a trusted domain are read it must be checked if there are overrides for the discovered groups to be able to return the right gid or name to the caller. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: enhance ipa_initgr_get_overrides_send()Sumit Bose2015-05-052-17/+56
| | | | | | | | | This patch makes ipa_initgr_get_overrides_send() public and add support to search overrides by UUID or by SID. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: update initgr expire timestamp conditionallySumit Bose2015-05-051-8/+11
| | | | | | | | | | | | | | | Newer versions of the extdom plugin return the full list of group-memberships during user lookups. As a result the lifetime of the group-membership data is updates in those cases. But if the user is not looked up directly but is resolved as a group member during a group lookup SSSD does not resolve all group-membership of the user to avoid deep recursion and eventually a complete enumeration of the user and group base. In this case the lifetime of the group-memberships should not be updated because it might be incomplete. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: do initgroups if extdom exop supports itSumit Bose2015-05-053-10/+21
| | | | | | | | | | | | | | Newer versions of the extdom plugin return the full list of group-memberships during a user lookup request. With these version there is no need to reject a initgroups request for sub/trusted-domain users anymore. This is e.g. useful for callers which call getgrouplist() directly without calling getpwnam() before. Additionally it helps if for some reasons the lifetime of the user entry and the lifetime of the initgroups data is different. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Fix id mapping with disabled subdomainsLukas Slebodnik2015-05-051-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If subdomains are disabled "subdomain_provider = none" then auto-discovery discovery of domain SID is disabled. It is possible to configure options ldap_idmap_default_domain{,_sid} and id mapping should work. However value of option ldap_idmap_default_domain_sid was not assigned to sss_domain_info for main domain. It was only used for initialisation of sdap_idmap_ctx. As a result of this bug posix attributes were used in ldap filter and id mapping worked just for users with posix attributes. [be_get_account_info] (0x0100): Got request for [0x1001][1][name=user] [be_req_set_domain] (0x0400): Changing request domain from [EXAMPLE.TEST] to [EXAMPLE.TEST] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)] [sdap_search_user_next_base] (0x0400): Searching for users with base [DC=EXAMPLE,DC=TEST] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=hdpadmin)(objectclass=user) (sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))] [DC=EXAMPLE,DC=TEST]. [sdap_search_user_process] (0x0400): Search for users, returned 0 results. [sdap_get_users_done] (0x0040): Failed to retrieve users Resolves: https://fedorahosted.org/sssd/ticket/2635 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* GPO: Do not ignore missing attrs for GPOsLukas Slebodnik2015-04-301-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | We don't want to skip over a GPO that might properly be denying users. [sssd[be[a.foo.com]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={2BA15B73-9524-419F-B4B7-185E1F0D3DCF},cn=policies,cn=system,DC=foo,DC=com] using SD [sssd[be[a.foo.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={2BA15B73-9524-419F-B4B7-185E1F0D3DCF},cn=policies,cn=system,DC=lzb,DC=hq]. [sssd[be[a.foo.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] [sssd[be[a.foo.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Referral(10), 0000202B: RefErr: DSID-0310063C, data 0, 1 access points ref 1: 'lzb.hq' [sssd[be[a.foo.com]]] [sdap_get_generic_op_finished] (0x1000): Ref: ldap://foo.com/cn=%7B2BA15B73-9524-419F-B4B7-185E1F0D3DCF%7D,cn=policies,cn=system,DC=foo,DC=com [sssd[be[a.foo.com]]] [ad_gpo_get_gpo_attrs_done] (0x0040): no attrs found for GPO; try next GPO. Resolves: https://fedorahosted.org/sssd/ticket/2629 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* IPA: fix segfault in ipa_s2n_exopAron Parsons2015-04-291-1/+1
| | | | | | | | can be triggered on demand by assigning a POSIX group with external members sudo privileges, then dropping the cache and doing a sudo -U <user> -l. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: allow initgroups by SID for AD usersSumit Bose2015-04-294-2/+29
| | | | | | | | | | | If a user from a trusted AD domain is search with the help of an override name the SID from the override anchor is used to search the user in AD. Currently the initgroups request only allows searches by name. With this patch a SID can be used as well. Resolves https://fedorahosted.org/sssd/ticket/2632 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* simple-access-provider: make user grp res more robustPavel Reichl2015-04-281-4/+22
| | | | | | | | | Not all user groups need to be resolved if group deny list is empty. Resolves: https://fedorahosted.org/sssd/ticket/2519 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: check ghosts in groups found by uuid as wellSumit Bose2015-04-271-9/+12
| | | | | | | | | | | | With views and overrides groups are not allowed to have ghost members anymore because the name of a member might be overridden. To achieve this ghost members are looked up and resolved later during group lookups. Currently this is only done for group lookups by name but should happen as well if the group is looked up by uuid. Resolves https://fedorahosted.org/sssd/ticket/2631 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: use sysdb_attrs_add_string_safe to add group memberSumit Bose2015-04-271-2/+3
| | | | | | | | The member list returned by the extdom plugin might contain some entries more than once. Although this is an issue on the server side to avoid ldb errors duplicates should be filtered out on the client as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: do not try to save override data for the default viewSumit Bose2015-04-271-5/+10
| | | | | | | | | | For the default view all override data is available in the cached user or group object. Even if separate override data is available it should not be written into the cache. Resolves https://fedorahosted.org/sssd/ticket/2630 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ad_opts: Use different default attribute for group nameLukas Slebodnik2015-04-171-1/+1
| | | | | | | | | | | | | | | | The MSFT docs [1,2] for LDAP attributes says: samAccountName is mandotory for 'user' and 'group' objectclasses via the 'Security-Principal' aux-class name is part of the 'top' class and *not* mandatory for 'user' or 'group'. [1] https://msdn.microsoft.com/en-us/library/ms679635%28v=vs.85%29.aspx [2] https://msdn.microsoft.com/en-us/library/ms678697%28v=vs.85%29.aspx Resolves: https://fedorahosted.org/sssd/ticket/2593 Reviewed-by: Sumit Bose <sbose@redhat.com>
* subdom: Remove unused function get_flat_name_from_subdomain_nameJakub Hrozek2015-04-162-24/+0
| | | | | | | The function was added in 70eaade10feedd7845e39170d0b7eebf3a030af1 and is unused since b8d703cf3aba81800cf1b8ccca64bb00ef0b30f7 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD GPO: Always look up GPOs from machine domainStephen Gallagher2015-04-151-21/+33
| | | | | | | | | | | | | | When dealing with users from a child domain, SSSD was attempting to use the subdomain for lookups. However, all GPOs applicable to this machine are stored in the primary domain (the domain the host directly joined). This patch has the GPO processing use the primary domain instead of the user domain. Resolves: https://fedorahosted.org/sssd/ticket/2606 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Always get domain-specific ID connectionStephen Gallagher2015-04-151-11/+7
| | | | | | | | | | | | | | | | ad_get_dom_ldap_conn() assumed that ad_ctx->ldap_ctx always points at the LDAP connection for the primary domain, however it turns out that this is not always the case. It's currently unclear why, but this connection can sometimes be pointing at a subdomain. Since the value of subdom_id_ctx->ldap_ctx always points to the correct domain (including the primary domain case), there's no benefit to trying to shortcut to the ad_ctx->ldap_ctx when performing this lookup. This patch also makes a minor tweak to the tests so that the primary domain passes the sdap_domain_get() check for validity (since it needs to have a private member assigned). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Clean up ad_access_gpoStephen Gallagher2015-04-151-7/+5
| | | | | | Align goto usage with conventions in the rest of the source. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* selinux: Only call semanage if the context actually changesJakub Hrozek2015-04-141-4/+31
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2624 Add a function to query the libsemanage database for a user context and only update the database if the context differes from the one set on the server. Adds talloc dependency to libsss_semanage. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SDAP: Filter ad groups in initgroupsLukas Slebodnik2015-04-141-0/+12
| | | | | | | | | | Function sdap_add_incomplete_groups stored domain local groups from subdomain as POSIX group, which should not be done. Resolves: https://fedorahosted.org/sssd/ticket/2614 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Extract filtering AD group to functionLukas Slebodnik2015-04-144-47/+99
| | | | | | Patch remove code duplication. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Do not set gid 0 twiceLukas Slebodnik2015-04-141-7/+0
| | | | | | | | | | | | | | | | | | | | | The gid o was added to sysdb attrs directly in sdap_save_group for 1st time and for second time in the function sdap_store_group_with_gid, which was called every time from function sdap_save_group [sysdb_set_entry_attr] (0x0080): ldb_modify failed: [Attribute or value exists](20)[attribute 'gidNumber': value #1 on 'name=domainlocalgroup1_dom2-493341@sssdad_tree.com,cn=groups,cn=sssdad_tree.com,cn=sysdb' provided more than once] [sysdb_set_entry_attr] (0x0040): Error: 17 (File exists) [sysdb_store_group] (0x1000): sysdb_set_group_attr failed. [sysdb_store_group] (0x0400): Error: 17 (File exists) [sdap_store_group_with_gid] (0x0040): Could not store group domainlocalgroup1_dom2-493341@sssdad_tree.com [sdap_save_group] (0x0080): Could not store group with GID: [File exists] [sdap_save_group] (0x0080): Failed to save group [domainlocalgroup1_dom2-493341@sssdad_tree.com]: [File exists] [sdap_save_groups] (0x0040): Failed to store group 0. Ignoring. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nsupdate: Append -d/-D to nsupdate with a high debug levelJakub Hrozek2015-04-141-1/+17
| | | | | | https://fedorahosted.org/sssd/ticket/897 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* dyndns: Log nsupdate stderr with a high debug levelJakub Hrozek2015-04-141-0/+12
| | | | | | https://fedorahosted.org/sssd/ticket/2224 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: Set sdap handle as explicitly connected in LDAP authJakub Hrozek2015-04-081-0/+12
| | | | | | | | | | | | | In case SSSD is set with id_provider=proxy and auth_provider=ldap, the LDAP provider is not used to retrieve the user info with the higher-level calls, but the lower-level connection establishment is used instead. In this case, we need to make sure to mark the connection as explicitly connected to be notified about results of looking up the DN. Resolves: https://fedorahosted.org/sssd/ticket/2620 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* enumeration: fix talloc contextPavel Březina2015-04-082-2/+2
| | | | | | | | | | | | | | If for some reason ptask fails (e.g. timeout), req is talloc freed but because subreq is attached to ectx which is permanent it is finished anyway. Then a crash occures when we are trying to access callback data. The same happens in sdap_dom_enum_ex_send. Resolves: https://fedorahosted.org/sssd/ticket/2611 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* KRB5: Unify prototype and definitionLukas Slebodnik2015-04-011-2/+3
| | | | | | | | | The prototype of function copy_keytab_into_memory does not match the definition. One of arguments differs in constant modifier. Patch also include header file to implementation module. If should avoid such problems in future. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* GPO: Check return value of ad_gpo_store_policy_settingsLukas Slebodnik2015-04-011-0/+6
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: fix a typo in debug messagePavel Reichl2015-03-261-1/+1
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Remove the ipa_hbac_treat_deny_as optionJakub Hrozek2015-03-248-79/+19
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2603 Since deny rules are no longer supported on the server, the client should no longer support them either. Remove the option. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Deprecate the ipa_hbac_treat_deny_as optionJakub Hrozek2015-03-241-0/+4
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2603 Deny rules have not been supported by the IPA server since 2.1. We should deprecate the ipa_hbac_treat_deny_as option. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-29 18:34:27 +0000